Examkin

Soru

Zorluk: OrtaVPC Network Security

A company has deployed a multi-VPC architecture in a single AWS Region with two peered VPCs: VPC A (CIDR 10.1.0.0/1610.1.0.0/16) and VPC B (CIDR 10.2.0.0/1610.2.0.0/16). VPC A hosts a fleet of autoscaling web servers within a security group named `sg-web`. VPC B hosts an internal microservice on Amazon EC2 instances within a security group named `sg-api`. The web servers must securely communicate with the internal microservice using HTTPS (port 443443). The network design must ensure that only the web servers in VPC A can access the microservice in VPC B, minimizing administrative overhead as the web server fleet scales.

Which configuration meets these requirements?

  1. A
    Create a Network ACL rule for the microservice subnet in VPC B that allows inbound TCP port 443443 traffic from the web server security group (`sg-web`).
  2. Add an inbound rule to the internal microservice security group (`sg-api`) that allows TCP port 443443 traffic where the source is the web server security group (`sg-web`).Cevap
  3. C
    Add an inbound rule to the internal microservice security group (`sg-api`) that allows TCP port 443443 traffic where the source is the CIDR block of VPC A (10.1.0.0/1610.1.0.0/16).
  4. D
    Deploy AWS Shield Advanced in VPC B and configure an access control policy to restrict inbound port 443443 traffic to the public IP addresses of the web servers in VPC A.

Cevap

Add an inbound rule to the internal microservice security group (`sg-api`) that allows TCP port 443443 traffic where the source is the web server security group (`sg-web`).
The correct configuration is to add an inbound rule to the internal microservice security group that allows traffic on port 443443 from the web server security group. AWS allows security groups to reference other security groups in peered VPCs within the same Region. This ensures that only the instances associated with the web server security group can access the microservice, automatically adapting as the web server fleet scales and avoiding the need to manage individual IP addresses or allow the entire VPC A CIDR block.

Adım Adım Çözüm

1
Identify the communication path and required security controls between the peered VPCs.
VPC A and VPC B are peered, meaning private IP traffic can flow between them. Security groups are needed to control this traffic at the instance level.
Security groups act as firewalls at the instance level, which is ideal for restricting microservice access.
2
Determine the optimal source filter for the security group rule to satisfy least privilege and scalability.
Referencing the source security group (`sg-web`) allows traffic only from instances associated with that security group, dynamically adapting as instances scale.
Using CIDR blocks is too broad, and individual IP addresses require excessive administrative overhead when instances scale.
3
Add the security group reference rule to the destination security group (`sg-api`).
Only traffic from instances in `sg-web` on port 443443 is allowed inbound to `sg-api` across the peered VPCs.
AWS supports referencing security groups in peered VPCs within the same Region, establishing a secure and maintainable connection.

Anahtar Kavram

Security Group Referencing Across Peered VPCs
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

VPC Network Security

Bu konudan daha fazla soru