SCS-C02 Question 258
Select 3Your company is experiencing connectivity issues with a web application hosted in a private subnet of a VPC. The application is accessible through an Application Load Balancer (ALB) in a public subnet. Upon investigation, you notice that users are unable to access the application. Which of the following troubleshooting steps should you take to identify and resolve the network security issue?
- A
Verify that the security group attached to the Application Load Balancer allows inbound traffic on the required ports from the users' IP ranges.
- B
Check the Network ACLs (NACLs) associated with both the public and private subnets to ensure they allow the required traffic.
- C
Ensure that the route table associated with the private subnet has a route to an Internet Gateway.
- D
Verify that the security group attached to the EC2 instances in the private subnet allows inbound traffic from the Application Load Balancer's security group.
- E
Inspect the AWS WAF configuration attached to the Application Load Balancer to confirm that it is not blocking legitimate traffic.
Show answer and explanation
Correct answers: A, B, D
Explanation
Troubleshooting network security in AWS often involves checking multiple layers of security, including security groups, NACLs, and route tables. In this scenario, ensuring correct security group rules for the ALB and the EC2 instances, as well as verifying NACL rules, are critical steps. Route tables are not relevant because the private subnet does not need direct internet access for this setup, and AWS WAF is more related to application-layer filtering than network connectivity.
- A. Correct.
Correct: Security groups control inbound and outbound traffic at the instance or load balancer level. Ensuring the ALB's security group allows inbound traffic on the necessary ports is a key step in troubleshooting.
- B. Correct.
Correct: Network ACLs (NACLs) operate at the subnet level and can block traffic before it reaches the security group. Both inbound and outbound rules should be verified.
- C. Incorrect.
Incorrect: A private subnet does not require a route to an Internet Gateway unless the instances within it need to access the internet. However, this does not apply to troubleshooting connectivity between the ALB and the application.
- D. Correct.
Correct: The EC2 instances in the private subnet must allow inbound traffic from the security group of the ALB to process requests. This is a crucial configuration to verify.
- E. Incorrect.
Incorrect: AWS WAF is used for web application filtering, but it is not directly related to network connectivity issues. While it could block traffic in some scenarios, it is less likely to be the root cause in this specific case.