SCS-C02 Question 257
Single answerYour organization is hosting a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). Users report that they are unable to access the application. Upon investigation, you find that the security group attached to the ALB allows inbound traffic on port 80, but the EC2 instances' security group allows only outbound traffic. What change should you make to resolve this issue while adhering to least privilege principles?
- A
Modify the EC2 instances' security group to allow inbound traffic on port 80 from the ALB's security group.
- B
Attach the same security group to both the ALB and the EC2 instances.
- C
Modify the ALB's security group to allow all inbound traffic and ensure the EC2 instances allow outbound traffic.
- D
Enable a NAT gateway for the EC2 instances to allow outbound traffic to the ALB.
Show answer and explanation
Correct answer: A
Explanation
The issue lies in the security group configuration. To fix the problem, the EC2 instances' security group must explicitly allow inbound traffic from the ALB's security group on the required port. This approach adheres to the principle of least privilege by restricting access to the source of the traffic, which is the ALB in this case.
- A. Correct.
Correct: This solution ensures that the EC2 instances only accept traffic from the ALB, adhering to least privilege principles.
- B. Incorrect.
Incorrect: While this might work, it does not adhere to the principle of least privilege as it allows more access than necessary.
- C. Incorrect.
Incorrect: Allowing all inbound traffic to the ALB is overly permissive and violates security best practices.
- D. Incorrect.
Incorrect: A NAT gateway is not relevant to this scenario. The issue is with the security group rules, not outbound internet access.