SCS-C02 Question 497
Select 2Your organization runs a web application on AWS using an Amazon EC2 instance behind an Application Load Balancer (ALB). The EC2 instance hosts both the web server and a database. To reduce the attack surface, which of the following actions should you take? (Choose TWO.)
- A
Move the database to a managed service like Amazon RDS and restrict its access to the EC2 instance.
- B
Enable ALB access logging and store the logs in an Amazon S3 bucket for monitoring.
- C
Ensure the EC2 instance security group allows inbound traffic only from the ALB security group.
- D
Configure the database to allow public access for easier troubleshooting.
- E
Use AWS WAF to filter malicious traffic at the Application Load Balancer.
Show answer and explanation
Correct answers: A, C
Explanation
Reducing attack surfaces involves minimizing potential points of entry for attackers. Moving the database to Amazon RDS isolates it from the web server layer and secures it within a managed service, while restricting the EC2 instance’s inbound access to only necessary sources (like the ALB security group) prevents unauthorized traffic. These steps directly reduce the attack surface. Other options, while useful, either do not address attack surface reduction or may inadvertently increase it.
- A. Correct.
Correct: Moving the database to a managed service like Amazon RDS offloads operational complexity, enhances security, and allows for better network isolation, reducing the attack surface.
- B. Incorrect.
Incorrect: While enabling ALB access logging is a good practice for monitoring, it does not directly reduce the attack surface of the application.
- C. Correct.
Correct: Restricting inbound traffic to the EC2 instance by allowing it only from the ALB security group minimizes exposure and reduces the attack surface by preventing unauthorized direct access to the instance.
- D. Incorrect.
Incorrect: Allowing public access to the database significantly increases the attack surface and is not a secure practice.
- E. Incorrect.
Incorrect: While AWS WAF helps protect against malicious traffic, it primarily enhances application security and does not directly reduce the attack surface by itself.