Exam AWS Certified Security - Specialty All Questions

View all questions & answers for the AWS Certified Security - Specialty exam

Exam AWS Certified Security - Specialty topic 1 question 128 discussion

Exam question from Amazon's AWS Certified Security - Specialty

Question #: 128
Topic #: 1

[All AWS Certified Security - Specialty Questions]

A Security Engineer for a large company is managing a data processing application used by 1,500 subsidiary companies. The parent and subsidiary companies all use AWS. The application uses TCP port 443 and runs on Amazon EC2 behind a Network Load Balancer (NLB). For compliance reasons, the application should only be accessible to the subsidiaries and should not be available on the public internet. To meet the compliance requirements for restricted access, the Engineer has received the public and private CIDR block ranges for each subsidiary.
What solution should the Engineer use to implement the appropriate access restrictions for the application?

A. Create a NACL to allow access on TCP port 443 from the 1,500 subsidiary CIDR block ranges. Associate the NACL to both the NLB and EC2 instances
B. Create an AWS security group to allow access on TCP port 443 from the 1,500 subsidiary CIDR block ranges. Associate the security group to the NLB. Create a second security group for EC2 instances with access on TCP port 443 from the NLB security group.
C. Create an AWS PrivateLink endpoint service in the parent company account attached to the NLB. Create an AWS security group for the instances to allow access on TCP port 443 from the AWS PrivateLink endpoint. Use AWS PrivateLink interface endpoints in the 1,500 subsidiary AWS accounts to connect to the data processing application.
D. Create an AWS security group to allow access on TCP port 443 from the 1,500 subsidiary CIDR block ranges. Associate the security group with EC2 instances.

Show Suggested Answer

Suggested Answer: C 🗳️

by RaySmith at March 21, 2020, 1:43 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

sapien45

Highly Voted 2 years, 10 months ago

Selected Answer: C

A picture is better than 1000 worlds https://www.fugue.co/hs-fs/hubfs/Cloud-Network-feature.png?noresize&width=672&height=380&name=Cloud-Network-feature.png

upvoted 8 times

...

sam_live

Highly Voted 3 years, 5 months ago

Answer C. the firms accessing the data are also using AWS, so create a privatelink to connect VPCs in different accounts. https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-privatelink.html

upvoted 6 times

...

Raphaello

Most Recent 1 year, 4 months ago

Selected Answer: C

Ideal scenario for PrivateLink service (VPC endpoint - Consumer/Provider) Correct answer is C.

upvoted 1 times

...

ati

2 years ago

I don't know much about PrivateLink but if I were a security engineer, creating NACL and Security Group to allow port 443 for 1500 Ip ranges would be a nightmare so option C is the most appropriate.

upvoted 3 times

...

ITGURU51

2 years, 2 months ago

The key requirement here: For compliance reasons, the application should only be accessible to the subsidiaries and should not be available on the public internet. Therefore, we need a private communication link and a security group to meet the business requirements.

upvoted 2 times

...

treeli

3 years, 1 month ago

NACL have limitations, far less than 1500, so the answer should be c

upvoted 2 times

...

TigerInTheCloud

3 years, 2 months ago

Selected Answer: C

After reading the question, I searched for endpoint service, which is only in D. The other answers, without the endpoint service, might be doable, but why should I care.

upvoted 3 times

...

AWS_Dude

3 years, 4 months ago

Technically B and C are correct but C is much better architecture so that is why it's the correct choice. Would be nice if the questions said "which is the BEST answer" since technically B works too it's just more manual work.

upvoted 1 times

AWS_Dude

3 years, 4 months ago

Actually NVM Each security group can have a maximum of 50 rules per: I think this can be adjusted but still can't have 1,500 cidrs in an SG or even multiple I don't think. Sorry! 50 inbound/outbound, IPv4/IPv6 rules

upvoted 1 times

...

VikramCh

3 years, 4 months ago

B may not be technically correct, because, there is a 60 rule limit on security group and cannot include 1500 IP ranges. https://docs.aws.amazon.com/vpc/latest/userguide/amazon-vpc-limits.html

upvoted 4 times

...