Examkin

Question

Difficulty: MediumVPC Network Security

A solutions architect is designing the network security for a three-tier application. Web servers are located in a public subnet, application servers are in private subnet A, and a database cluster is hosted in private subnet B. The database cluster only needs to receive incoming database queries from the application servers over TCP port 5432. All other network traffic to the database cluster must be blocked. Which configuration should the solutions architect implement to meet these requirements with the minimum administrative overhead?

  1. Associate a security group with the database cluster that allows inbound traffic on TCP port 5432 from the security group associated with the application servers.Answer
  2. B
    Associate a security group with the database cluster that allows inbound traffic on TCP port 5432 from the security group of the application servers, and configure an outbound security group rule to allow traffic back to the application servers on ephemeral TCP ports.
  3. C
    Configure a network ACL for private subnet B that allows inbound traffic on TCP port 5432 from the CIDR range of private subnet A, without adding any outbound rules.
  4. D
    Associate an AWS WAF web ACL with the database instances to inspect incoming traffic and block any request not originating from the application servers on TCP port 5432.

Answer

Associate a security group with the database cluster that allows inbound traffic on TCP port 5432 from the security group associated with the application servers.
Allowing inbound traffic on TCP port 5432 from the application server's security group is correct because security groups are stateful; return traffic is allowed automatically. Referencing the application security group directly provides dynamic, minimal administrative control.

Step-by-Step Solution

1
Analyze the stateful nature of Security Groups and stateless nature of Network ACLs.
Identify that Security Groups automatically track connections, making manual outbound rules for return traffic unnecessary, while Network ACLs require explicit rules for both directions.
This determines whether outbound rules for ephemeral port return traffic are needed.
2
Evaluate the administrative overhead of using CIDR ranges vs. security group references.
Referencing the application server's security group allows the configuration to dynamically scale without modifying rules when instances are added or replaced.
This meets the requirement of 'minimum administrative overhead' and provides least-privilege access control.
3
Verify if the correct AWS security tool is being proposed for the traffic type.
AWS WAF is inappropriate because database connection requests on port 5432 do not use the HTTP/HTTPS protocols that WAF filters.
This rules out using WAF for database port filtering.

Key Concept

Security groups are stateful and support referencing other security groups as traffic sources to enable least-privilege, dynamic network access control.
Rate this question

Topics

VPC Network Security

More questions from this topic