Exam AWS Certified Security - Specialty topic 1 question 289 discussion

Exam question from Amazon's AWS Certified Security - Specialty

Question #: 289
Topic #: 1

[All AWS Certified Security - Specialty Questions]

A company needs to use HTTPS when connecting to its web applications to meet compliance requirements. These web applications run in Amazon VPC on
Amazon EC2 instances behind an Application Load Balancer (ALB). A security engineer wants to ensure that the load balancer will only accept connections over port 443, even if the ALB is mistakenly configured with an HTTP listener.
Which configuration steps should the security engineer take to accomplish this task?

A. Create a security group with a rule that denies inbound connections from 0.0.0.0/0 on port 80. Attach this security group to the ALB to overwrite more permissive rules from the ALB's default security group.
B. Create a network ACL that denies inbound connections from 0.0.0.0/0 on port 80. Associate the network ACL with the VPC's internet gateway.
C. Create a network ACL that allows outbound connections to the VPC IP range on port 443 only. Associate the network ACL with the VPC's internet gateway.
D. Create a security group with a single inbound rule that allows connections from 0.0.0.0/0 on port 443. Ensure this security group is the only one associated with the ALB.

Show Suggested Answer

Suggested Answer: D 🗳️

by babaseun at Dec. 29, 2021, 4:40 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

Radhaghosh

Highly Voted 3 years, 5 months ago

Answer D, Very Simple and Classical Use case

upvoted 7 times

...

Raphaello

Most Recent 1 year, 4 months ago

Selected Answer: D

Only allow HTTPS (443) in ALB's SG.

upvoted 1 times

...

Toptip

2 years, 1 month ago

Selected Answer: D

D only makes sense

upvoted 1 times

...

MungKey

2 years, 10 months ago

A - SG - can't have deny rules B - Not correct - NACL would deny for every instance with subnet, NACL is associated to subset not sure what is meant by associate NACL with VPC's IGW C - Not correct - Need inbound rule restrictions, NACL is associated to subset not sure what is meant by associate NACL with VPC's IGW D - SG allows all traffic on 443, this does the job Answer is D

upvoted 1 times

...