A developer is hosting a web application on a single Amazon EC2 instance. The developer wa… — AWS Certified Solutions Architect - Associate

A developer is hosting a web application on a single Amazon EC2 instance. The developer wants to allow external users to access the application over HTTPS while blocking all other incoming traffic. To achieve this, which configuration should be applied to the security group associated with the EC2 instance?

Add an inbound rule allowing TCP port $443$ from source $0.0.0.0/0$ .Answer
B
Add both an inbound rule allowing TCP port $443$ from source $0.0.0.0/0$ and an outbound rule allowing ephemeral TCP ports to destination $0.0.0.0/0$ .
C
Add only an outbound rule allowing TCP port $443$ to destination $0.0.0.0/0$ .
D
Add a rule to the default AWS Shield protection to allow HTTPS traffic to the EC2 instance's IP address.

Answer

Add an inbound rule allowing TCP port

443

from source

0.0.0.0/0

The correct option is the one that recommends adding an inbound rule allowing TCP port

443

from source

0.0.0.0/0

. Since security groups are stateful firewalls, they automatically allow return traffic for established connections. Therefore, allowing inbound TCP port

443

is sufficient to enable external users to establish HTTPS connections and receive responses.

Step-by-Step Solution

Identify the resource security requirement.

The requirement is to allow external users to access an application hosted on an EC2 instance over HTTPS (TCP port

443

) while blocking all other traffic.

This establishes that we need to configure traffic rules at the host/instance level using security groups.

Determine the stateful behavior of the security group.

Security groups are stateful, meaning any allowed inbound traffic is automatically allowed to exit, and any allowed outbound traffic is automatically allowed to enter.

Understanding statefulness simplifies the rules needed, indicating that we do not need to configure corresponding outbound rules for return traffic.

Formulate the correct inbound rule.

Create an inbound rule allowing TCP port

443

from the internet (

0.0.0.0/0

) to the EC2 instance.

This allows external users to initiate HTTPS requests while the security group's default deny-all behavior blocks other unspecified ports.

Key Concept

Stateful behavior of AWS Security Groups

Estimated Time:45s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic