Free Preparation Discussions
MENU
Amazon Exam SCS-C02 Topic 6 Question 27 Discussion
Topic #: 6
A company operates a web application that runs on Amazon EC2 instances. The application listens on port 80 and port 443. The company uses an Application Load Balancer (ALB) with AWS WAF to terminate SSL and to forward traffic to the application instances only on port 80.
The ALB is in public subnets that are associated with a network ACL that is named NACL1. The application instances are in dedicated private subnets that are associated with a network ACL that is named NACL2. An Amazon RDS for PostgreSQL DB instance that uses port 5432 is in a dedicated private subnet that is associated with a network ACL that is named NACL3. All the network ACLs currently allow all inbound and outbound traffic.
Which set of network ACL changes will increase the security of the application while ensuring functionality?
For increased security while ensuring functionality, adjusting NACL3 to allow inbound traffic on port 5432 from the CIDR blocks of the application instance subnets, and allowing outbound traffic on ephemeral ports (1024-65536) back to those subnets creates a secure path for database access. Removing default allow-all rules enhances security by implementing the principle of least privilege, ensuring that only necessary traffic is permitted.
Novella
2 months agoMaryann
2 months agoDean
28 days agoStephaine
1 months agoFelix
2 months agoTiera
2 months agoKatina
2 months agoTiera
2 months agoVivan
2 months agoTammara
1 months agoEvangelina
2 months agoJill
2 months agoEdgar
2 months agoBrianne
2 months agoTiera
3 months agoStaci
3 months agoKimbery
2 months agoEna
3 months agoFrederick
3 months ago