SCS-C02 Question 66
Select 3An organization is running multiple applications in a single AWS account. To ensure secure resource isolation between applications, which of the following mechanisms should be implemented?
- A
Use separate VPCs for each application and configure appropriate security groups.
- B
Leverage AWS Organizations to create a separate account for each application.
- C
Use IAM resource-based policies to restrict access to resources for specific applications.
- D
Assign each application a unique EC2 instance profile to isolate permissions.
- E
Use AWS WAF to block traffic between different applications.
Show answer and explanation
Correct answers: A, B, C
Explanation
Resource isolation is crucial for securing applications in a multi-tenant environment. Best practices include using separate VPCs for network isolation, leveraging AWS Organizations for account-level isolation, and applying IAM resource-based policies to restrict access to specific resources. These mechanisms ensure that applications do not interfere with each other and maintain strict boundaries between their resources. Instance profiles and AWS WAF, while useful for specific use cases, do not directly contribute to resource isolation.
- A. Correct.
Using separate VPCs for each application ensures network-level isolation, preventing unintended communication between resources belonging to different applications. Security groups can be used to further control inbound and outbound traffic.
- B. Correct.
AWS Organizations allows you to create separate accounts for each application, providing a hard boundary for resources and permissions. This is one of the strongest resource isolation mechanisms in AWS.
- C. Correct.
IAM resource-based policies can be used to restrict access to resources, ensuring that only the intended application or service has access to its associated resources.
- D. Incorrect.
Assigning a unique EC2 instance profile to each application does not guarantee resource isolation. Instance profiles control permissions for the instance, but they do not isolate the underlying resources.
- E. Incorrect.
AWS WAF is primarily used for protecting web applications from common web exploits and does not provide resource isolation between applications.