AWS Certified Solutions Architect Associate SAA-C03 Practice Question
A company has a web application architecture which consists of a load balancer accessible by internet users and web servers that are not publicly exposed. The architecture also includes a database server that contains sensitive information and needs to communicate with the web servers. Which approach should be taken to ensure that data is securely transferred from users to the web application and that the web application has a secure connection to the database server?
Activate a common managed DDoS protection service on the load balancer for encryption, and use directory services to manage database server access.
Use internet gateway and static IP addresses to ensure connection between internet users and the application is consistent and secure.
Set up secured connection protocol listeners for the load balancer and use instance-level security mechanisms to permit data flow only from the web servers to the database server.
Place the database server in a public subnet to enable public internet users to directly access the application database without requiring web server intervention.
The optimal solution is to configure the load balancer with listeners that support secured connection protocols to facilitate encrypted data exchange between the client and the web application. While AWS Shield provides DDoS protection, it does not encrypt web traffic. Security groups, on the other hand, provide stateful filtering of ingress/egress traffic at the instance level, allowing fine-grained access control from the web servers to the database server. The use of security groups rather than network access control lists (NACLs) is preferable here because they provide more granular control and are stateful. A VPN setup is not necessary in this scenario as it does not directly facilitate web traffic encryption between the client and the application.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What are secured connection protocol listeners in a load balancer?
Open an interactive chat with Bash
What is the difference between security groups and network access control lists (NACLs)?
Open an interactive chat with Bash
How does encryption ensure secure data transfer between a web application and its users?