Examkin

Question

Difficulty: MediumVPC Network Security

An application runs on Amazon EC2 instances within a private subnet (10.100.1.0/2410.100.1.0/24). The application must query an Amazon RDS PostgreSQL database located in a dedicated database subnet (10.100.2.0/2410.100.2.0/24). Additionally, the application must securely retrieve database credentials from AWS Secrets Manager without accessing the public internet. The solutions architect needs to configure network security controls to allow only the necessary traffic flows.

Which TWO configurations should the solutions architect implement to meet these requirements securely? (Select TWO.)

  1. Create an interface VPC endpoint for AWS Secrets Manager in the private subnet, and configure the RDS database security group to allow inbound traffic on port 54325432 from the security group of the EC2 instances.Answer
  2. Associate a security group with the Secrets Manager interface VPC endpoint that allows inbound TCP traffic on port 443443 from the security group of the EC2 instances.Answer
  3. C
    Configure the database subnet's network ACL to allow inbound traffic on port 54325432 from the security group of the EC2 instances.
  4. D
    Configure the private subnet's network ACL to allow outbound HTTPS traffic on port 443443 to the AWS Secrets Manager VPC endpoint, but do not configure any inbound rules on the network ACL since it automatically permits return traffic.
  5. E
    Deploy AWS WAF on the private subnet to inspect and filter all SQL query traffic from the EC2 instances to the Amazon RDS PostgreSQL database.

Answer

To securely allow this communication, the solutions architect must configure the RDS database security group to allow inbound traffic from the EC2 instances' security group on port 54325432, and configure a security group for the AWS Secrets Manager interface VPC endpoint that allows inbound HTTPS traffic on port 443443 from the EC2 instances' security group.
To establish secure, private connectivity, the solutions architect must configure the RDS database security group to allow inbound PostgreSQL traffic (port 54325432) directly from the EC2 instances' security group. For AWS Secrets Manager, an interface VPC endpoint must be created, and its associated security group must allow inbound HTTPS traffic (port 443443) from the EC2 instances' security group. These two settings ensure secure, least-privilege access.

Step-by-Step Solution

1
Configure the database security group rule.
The RDS database security group accepts traffic on port 54325432 from the EC2 security group.
Security groups are stateful and allow return traffic automatically, so only an inbound rule is required on the database side.
2
Deploy an interface VPC endpoint for Secrets Manager.
An elastic network interface (ENI) is created in the private subnet, mapping Secrets Manager traffic to private IP addresses.
Secrets Manager only supports interface endpoints (AWS PrivateLink), and this prevents traffic from traversing the internet.
3
Configure the VPC endpoint security group.
The interface endpoint allows inbound HTTPS traffic on port 443443 from the EC2 security group.
Interface endpoints are protected by security groups, which must explicitly permit traffic from the calling client instances.

Key Concept

VPC network security involves configuring stateful security groups and stateless network ACLs. Security groups operate at the instance level and support rules referencing other security groups. Network ACLs operate at the subnet level, are stateless, and only support IP CIDR ranges.
Estimated Time:2m 0s
Rate this question

Topics

VPC Network Security

More questions from this topic