Examkin

Soru

Zorluk: OrtaVPC Network Security

A company has deployed two applications in separate VPCs within the same AWS Region and AWS account. VPC A uses the CIDR block 10.1.0.0/1610.1.0.0/16 and hosts a web application on Amazon EC2 instances. VPC B uses the CIDR block 10.2.0.0/1610.2.0.0/16 and hosts a PostgreSQL database on Amazon EC2 instances. The two VPCs are connected via a VPC peering connection, and route tables are correctly configured to route traffic between the subnets. The company's security policy requires that the PostgreSQL database in VPC B must only accept traffic from the specific EC2 instances hosting the web application in VPC A. Which configuration meets this requirement with the least administrative overhead?

  1. In the security group for the database instances in VPC B, add an inbound rule that allows TCP port 54325432 traffic and references the security group ID of the web application instances in VPC A as the source.Cevap
  2. B
    In the security group for the database instances in VPC B, add an inbound rule that allows TCP port 54325432 traffic and references the CIDR block of VPC A (10.1.0.0/1610.1.0.0/16) as the source.
  3. C
    In the Network ACL for the database subnet in VPC B, add an inbound rule that allows TCP port 54325432 traffic and references the security group ID of the web application instances in VPC A as the source.
  4. D
    In the security group for the database instances in VPC B, add an inbound rule that allows TCP port 54325432 traffic and references the public IP addresses of the web application instances in VPC A as the source.

Cevap

In the security group for the database instances in VPC B, add an inbound rule that allows TCP port 54325432 traffic and references the security group ID of the web application instances in VPC A as the source.
The correct configuration is to reference the security group ID of the web application instances in VPC A in the database's security group inbound rules. AWS allows security groups to reference other security groups across peered VPCs in the same region. This ensures that only the instances associated with the web application security group can access the PostgreSQL database, achieving least-privilege security without the need to maintain IP addresses manually.

Adım Adım Çözüm

1
Identify the communication channel between the two VPCs.
The VPCs are peered, meaning instances communicate using their private IP addresses.
This rules out any configurations that rely on public IP addresses.
2
Evaluate the security requirements against the capabilities of Security Groups and Network ACLs.
The requirement is to limit access to specific EC2 instances (least privilege). Security groups can be referenced across VPC peering connections as sources, whereas Network ACLs can only reference CIDR blocks.
This eliminates using Network ACLs for instance-level filtering and directs the solution to security groups.
3
Select the security group source that restricts traffic to only the web application instances rather than the entire subnet or VPC.
Referencing the web application's security group ID limits access strictly to those instances, while using the VPC A CIDR block (10.1.0.0/1610.1.0.0/16) would be too permissive.
This confirms the correct configuration option.

Anahtar Kavram

Security Group Referencing across VPC Peering
Bu soruyu puanla

Konular

VPC Network Security

Bu konudan daha fazla soru