SCS-C02 Question 90
Select 2A company is running a web application that stores sensitive customer data in an Amazon RDS database. The application is hosted on Amazon EC2 instances within a VPC and uses a security group to control inbound and outbound traffic. During a recent security review, the company identified that unauthorized IP addresses were attempting to access the database directly. As a security specialist, what measures should you implement to ensure only the web application servers can access the database, while minimizing administrative overhead?
- A
Modify the RDS security group to only allow inbound traffic from the security group attached to the web application servers.
- B
Enable encryption at rest for the RDS database using an AWS-managed KMS key.
- C
Use a Network ACL (NACL) to block all IP ranges except those of the web application servers.
- D
Configure the web application servers to use IAM database authentication for connecting to the RDS database.
- E
Remove the public IP address of the RDS instance and ensure it is only accessible within the VPC.
Show answer and explanation
Correct answers: A, E
Explanation
To ensure the RDS database is securely accessed only by the web application servers, you should leverage security groups to allow inbound traffic only from the web application servers' security group (Option 1). This ensures that access is limited at a network level. Additionally, removing the public IP address of the RDS instance (Option 5) ensures that it is not exposed to the internet and is only accessible within the private network of the VPC. These measures together provide a robust and scalable solution to the identified security concern.
- A. Correct.
Correct. By configuring the RDS security group to allow inbound traffic only from the security group associated with the web application servers, you can ensure that only the web servers can establish a connection with the database. This is a scalable and secure solution.
- B. Incorrect.
Incorrect. While enabling encryption at rest is a good security practice, it does not address the issue of unauthorized access to the database.
- C. Incorrect.
Incorrect. While NACLs can provide additional security, they are stateless and require cumbersome management as you would need to maintain rules for both inbound and outbound traffic. Security groups are more manageable in this scenario.
- D. Incorrect.
Incorrect. IAM database authentication ensures secure authentication but does not restrict network-level access to the database.
- E. Correct.
Correct. By removing the public IP address of the RDS instance and ensuring it is only accessible within the VPC, you reduce the attack surface and prevent unauthorized access from outside the VPC.