SCS-C02 Question 498
Select 3Your organization has deployed a web application on AWS using Amazon EC2 instances behind an Application Load Balancer (ALB). The application is publicly accessible over the internet. As part of a security audit, you are tasked with reducing the attack surface of the application while maintaining functionality. Which combination of actions can you take to achieve this goal?
- A
Restrict access to the ALB by using security groups to allow only specific IP ranges.
- B
Configure the ALB to only accept HTTPS traffic and enforce SSL/TLS certificates.
- C
Enable Amazon GuardDuty to monitor and analyze security threats for the web application.
- D
Use AWS Web Application Firewall (WAF) to filter and block malicious requests.
- E
Deploy the application within a private subnet and remove the ALB.
Show answer and explanation
Correct answers: A, B, D
Explanation
Reducing the attack surface involves measures that limit the exposure of your application to potential threats while maintaining its required functionality. Using security groups to restrict access, enforcing HTTPS for secure communication, and deploying AWS WAF to block malicious traffic are all effective strategies for reducing the attack surface of a publicly accessible application. GuardDuty, while valuable for monitoring, does not actively reduce the attack surface, and deploying the application in a private subnet would break its public accessibility, which is not aligned with the requirements.
- A. Correct.
Restricting access to the ALB with security groups reduces the attack surface by limiting who can access the application. This is a direct way to reduce exposure to unauthorized users.
- B. Correct.
Configuring the ALB to only accept HTTPS traffic and enforce SSL/TLS certificates ensures secure communication, which eliminates vulnerabilities associated with unencrypted traffic.
- C. Incorrect.
While enabling Amazon GuardDuty is a good practice for threat detection, it does not directly reduce the attack surface. It is a monitoring service rather than a preventive measure.
- D. Correct.
Using AWS WAF to filter and block malicious requests helps to reduce the attack surface by preventing certain types of attacks, such as SQL injection or cross-site scripting, from reaching the application.
- E. Incorrect.
Deploying the application in a private subnet and removing the ALB would break functionality for a publicly accessible application. This is not a viable solution for reducing the attack surface while maintaining accessibility.