ExamTopics Logo
Mail Us[email protected]
Menu
Amazon Discussions
exam questions

Exam AWS Certified Solutions Architect - Associate SAA-C02 All Questions

View all questions & answers for the AWS Certified Solutions Architect - Associate SAA-C02 exam
Go to Exam

Exam AWS Certified Solutions Architect - Associate SAA-C02 topic 1 question 470 discussion

Exam question from Amazon's AWS Certified Solutions Architect - Associate SAA-C02
Question #: 470
Topic #: 1
[All AWS Certified Solutions Architect - Associate SAA-C02 Questions]

A company operates a two-tier application for image processing. The application uses two Availability Zones, each with one public subnet and one private subnet.
An Application Load Balancer (ALB) for the web tier uses the public subnets. Amazon EC2 instances for the application tier use the private subnets.
Users report that the application is running more slowly than expected. A security audit of the web server log files shows that the application is receiving millions of illegitimate requests from a small number of IP addresses. A solutions architect needs to resolve the immediate performance problem while the company investigates a more permanent solution.
What should the solutions architect recommend to meet this requirement?

  • A. Modify the inbound security group for the web tier. Add a deny rule for the IP addresses that are consuming resources.
  • B. Modify the network ACL for the web tier subnets. Add an inbound deny rule for the IP addresses that are consuming resources.
  • C. Modify the inbound security group for the application tier. Add a deny rule for the IP addresses that are consuming resources.
  • D. Modify the network ACL for the application tier subnets. Add an inbound deny rule for the IP addresses that are consuming resources.
Show Suggested Answer Hide Answer
Suggested Answer: B 🗳️
by bigchange at Aug. 19, 2021, 7:59 p.m.
Disclaimers:
  • - ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
  • - Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
Jonfernz
Highly Voted 3 years, 8 months ago
Let's rule out any deny rule involving an SG. Because there's no such thing. Out go A & C. So why B over D? Simple - nip the problem in the bud. A robber is trying to steal something from your house --- take him down before he enters your house, not after he breaks in.
upvoted 70 times
wimalik
3 years, 7 months ago
Pretty awesome explanation!
upvoted 4 times
...
cJay722
3 years, 7 months ago
Private subnet will always see the traffic as coming from the ALB. So we can't actually use a NACL in private subnet anyway.
upvoted 14 times
Jonfernz
3 years, 7 months ago
I agree. But sometimes people remember things better when you conceptualise a scenario using such examples. =)
upvoted 9 times
...
naveenagurjara
2 years, 11 months ago
Good point
upvoted 1 times
...
...
gargaditya
3 years, 6 months ago
+additional note:NACL can contain both allow and deny statements and is applied at subnet level.
upvoted 2 times
...
gargaditya
3 years, 6 months ago
Amazing explanation, can someone help understand how traffic flows/how is it evaluated from end user thru to LB and to application EC2 (where would the NACL be evaluated actually)?
upvoted 2 times
...
...
ShehuUsman
Highly Voted 3 years, 8 months ago
Answer is B. Deny the request from the first entry at the public subnet, dont allow it to cross and get to the private subnet.
upvoted 19 times
...
queen101
Most Recent 2 years, 10 months ago
BBBBBBBBBBBBB
upvoted 1 times
...
awsas2022
2 years, 10 months ago
What is the correct option ?
upvoted 1 times
...
marklovesaws143
2 years, 10 months ago
Selected Answer: B
BBBBBBBBBBB
upvoted 1 times
...
slcheng
2 years, 11 months ago
Selected Answer: B
Agreed with B
upvoted 1 times
...
chael88
2 years, 12 months ago
Selected Answer: B
So you always want to block malicious traffic before it even reaches EC2 instances. Since security groups operate at the instance level, that eliminates A and C. Network ACL operates at the subnet level. So it's B
upvoted 1 times
...
Jeffdu
3 years, 3 months ago
Selected Answer: B
"The web tier's Application Load Balancer (ALB) makes use of public subnets"...thats the key subnets to deny ddos attack to via the NACL
upvoted 1 times
...
sylax
3 years, 3 months ago
Selected Answer: B
security group doesn't support deny rule, so that leaves the ACLs, the web tier is hosted in public subnet hence that's where the deny should be applied for inbound traffic.
upvoted 1 times
...
BlassArun
3 years, 5 months ago
Ans is B
upvoted 1 times
...
jj22222
3 years, 5 months ago
BBBBB - deny using NACL
upvoted 1 times
...
abobo
3 years, 6 months ago
Selected Answer: B
SG don't have deny rules D inappropriate coz traffic on apps goes out of ALB
upvoted 2 times
...
nutouch
3 years, 6 months ago
Selected Answer: B
No deny rule option in SG, so must be B or D. B makes more sense to kill the traffic at public subnet.
upvoted 2 times
...
AWSExplorer
3 years, 6 months ago
D) CORRECT -->Security groups are tied to an instance whereas Network ACLs are tied to the subnet. Network ACLs are applicable at the subnet level, so any instance in the subnet with an associated NACL will follow rules of NACL. That’s not the case with security groups, security groups has to be assigned explicitly to the instance. This means any instances the subnet group gets the rule applied. https://medium.com/awesome-cloud/aws-difference-between-security-groups-and-network-acls-adc632ea29ae Amazon EC2 instances for the application tier use the private subnets.
upvoted 4 times
...
Seb
3 years, 6 months ago
answer B, https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html
upvoted 2 times
...
Kenisworld666
3 years, 7 months ago
B https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Security.html#VPC_Security_Comparison
upvoted 2 times
...
yottabyte
3 years, 7 months ago
answer is B. you can deny an IP rule only in Network ACL and not in security group. You are trying to block an external IP coming into your network and attacking the public subnet which is the web application tier. To block an IP it is ACL not security group.
upvoted 3 times
...
Load full discussion...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel