Examkin

Soru

Zorluk: KolayStrengthening Identity, Access, and Network Security

A company is reviewing the security posture of an existing web application hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The EC2 instances are currently residing in public subnets, and the ALB receives public HTTP/HTTPS traffic. The company wants to strengthen network security by restricting backend instance access and blocking common web exploits at the edge. Which two options should the solutions architect recommend to achieve this? (Select TWO.)

  1. Migrate the EC2 instances to private subnets, and configure their security groups to accept inbound traffic only from the Application Load Balancer's security group.Cevap
  2. Associate an AWS WAF Web ACL with the Application Load Balancer, configuring SQL injection mitigation rules prioritized at the beginning of the Web ACL evaluation order.Cevap
  3. C
    Deploy an AWS WAF Web ACL on the Application Load Balancer, placing specific SQL injection block rules after a default allow rule in the Web ACL evaluation order.
  4. D
    Configure cross-account access to log files in an S3 bucket by modifying the key policy of the default AWS-managed KMS key (aws/s3) in the source account.
  5. E
    Apply a Service Control Policy (SCP) to the member account containing the Application Load Balancer to grant administrative access to the security team without defining local IAM roles.

Cevap

Migrating the EC2 instances to private subnets and configuring their security groups to accept inbound traffic only from the Application Load Balancer's security group, and associating an AWS WAF Web ACL with the Application Load Balancer with SQL injection mitigation rules prioritized first.
The correct solution involves migrating backend instances to private subnets and locking down their security groups to only accept traffic from the ALB's security group, while utilizing AWS WAF on the ALB with properly prioritized block rules at the start of the evaluation order to block exploits before general rules apply.

Adım Adım Çözüm

1
Identify the current architecture weaknesses where EC2 instances are in public subnets and exposed directly to the internet.
Realize that backend instances must be isolated from the public internet.
Exposing backend instances directly to the internet increases the attack surface unnecessarily.
2
Isolate the backend servers by moving the EC2 instances to private subnets and modifying their security groups to allow inbound traffic only from the Application Load Balancer.
Backend instances are no longer directly addressable from the internet and only process traffic forwarded by the load balancer.
This establishes a layered network design where only the load balancer is public-facing.
3
Add edge security to the Application Load Balancer by associating a Web ACL with AWS WAF.
The load balancer is equipped with application-layer filtering.
AWS WAF can inspect HTTP/HTTPS headers and payloads to detect and block malicious web requests.
4
Configure rules inside the WAF Web ACL, ensuring specific block rules like SQL injection are placed at the beginning of the evaluation sequence.
Malicious requests are successfully filtered out before reaching the backend servers.
Proper rule evaluation order ensures that block rules are executed before generic allow rules, preventing bypass vulnerabilities.

Anahtar Kavram

Implementing defense-in-depth by separating subnet tiers and applying edge security with AWS WAF on the ALB.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Strengthening Identity, Access, and Network Security