SCS-C02 Question 36
Select 2An organization is running a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team wants to ensure that requests to the web application are coming only from trusted IP ranges. Additionally, they need to log and analyze any denied requests for auditing purposes. How can the organization achieve this?
- A
Use AWS WAF with an IP set to allow only trusted IP ranges and associate it with the ALB.
- B
Use Security Groups on the ALB to allow traffic only from trusted IP ranges.
- C
Enable VPC Flow Logs to log all traffic and analyze denied requests.
- D
Use AWS WAF logging to capture details of denied requests and analyze them for auditing.
- E
Configure a Network ACL on the VPC subnets hosting the ALB to restrict traffic to trusted IP ranges.
Show answer and explanation
Correct answers: A, D
Explanation
To restrict access to the web application to trusted IP ranges, AWS WAF with an IP set is the best choice because it operates at the application layer and allows fine-grained control. Using AWS WAF logging provides detailed insights into denied requests, which is essential for auditing purposes. Security Groups and Network ACLs are more suitable for network-level controls but do not meet the requirements for logging and auditing denied requests.
- A. Correct.
Correct. AWS WAF can be used with an IP set to allow or block specific IP ranges. Associating it with the ALB ensures that only trusted traffic reaches the application.
- B. Incorrect.
Incorrect. Security Groups are used to control inbound and outbound traffic at the instance or resource level, but they do not provide detailed logging or auditing capabilities.
- C. Incorrect.
Incorrect. VPC Flow Logs capture network traffic at the subnet or interface level, but they do not provide the ability to filter or block traffic at the application layer.
- D. Correct.
Correct. AWS WAF logging can capture details of allowed and denied requests, providing visibility into blocked traffic for auditing purposes.
- E. Incorrect.
Incorrect. Network ACLs operate at the subnet level and can restrict traffic, but they lack the flexibility and detailed logging capabilities provided by AWS WAF.