A company is deploying a database instance in a private subnet. The database needs to receive traffic only from a web server running in a public subnet of the same VPC. Which of the following configurations are required to establish this network security boundary? (Select TWO.)
- Create a security group for the database instance with an inbound rule that allows the database port traffic from the security group of the web server.Answer
- Configure the private subnet's Network ACL with an inbound rule allowing database port traffic from the public subnet CIDR, and an outbound rule allowing ephemeral port traffic back to the public subnet CIDR.Answer
- CAttach an AWS WAF web ACL directly to the database instance to inspect and filter SQL queries at the network layer.
- DConfigure the database security group with an outbound rule allowing return traffic to the web server, because security groups are stateless.
- EConfigure a Network ACL at the database instance level to restrict inbound access to the database port.
Answer
The correct configurations are to create a security group for the database instance that allows inbound traffic from the web server's security group, and to configure the private subnet's Network ACL with both inbound traffic rules and outbound ephemeral port return rules.
The correct choices are the security group inbound rule configuration and the Network ACL rules configuration. Security groups operate at the instance level and are stateful, so configuring an inbound rule referencing the web server's security group allows the traffic and its return flow. Network ACLs operate at the subnet level and are stateless, requiring explicit rules for both inbound database traffic and outbound ephemeral port return traffic.
Step-by-Step Solution
Key Concept
VPC Network Security controls comparison (Security Groups vs. Network ACLs)