AWS Certified CloudOps Engineer Associate SOA-C03 Practice Question

An operations engineer is defining security for a newly deployed three-tier web application in a single VPC. The application tier EC2 instances reside in private subnets and receive traffic exclusively from an internal Application Load Balancer. The engineer must permit only the load balancer to initiate HTTPS connections to the instances, even when the load balancer scales. How should the security group for the application tier be configured?

Add an inbound rule that allows TCP 443 with the source set to the load balancer's subnet CIDR ranges.
Attach the load balancer's security group to the application EC2 instances instead of creating a separate security group.
Add an inbound rule that allows TCP 443 with the source set to the security group ID of the Application Load Balancer.
Create a network ACL for the private subnets that allows inbound TCP 443 from 0.0.0.0/0.

Report Issue

Answer Description

Referencing the load balancer's security group in the application tier security group provides least-privilege, stateful filtering that scales automatically. An inbound rule that allows TCP 443 from the ALB's security group ID admits traffic only from ENIs that belong to the load balancer, regardless of how many nodes AWS adds or removes. Using subnet CIDR blocks is broader and would also allow any other resource in those subnets. Attaching the ALB's security group to the instances breaks the tiered model and overrides intended instance rules. Network ACLs are stateless and the proposed rule is overly permissive, exposing the instances to the entire internet.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.