Examkin

Soru

Zorluk: OrtaStrengthening Identity, Access, and Network Security

An enterprise has a multi-tier web application running on Amazon EC2 instances in a production VPC. The instances are placed in private subnets behind an internet-facing Application Load Balancer (ALB). An AWS WAF WebACL is associated with the ALB. The WebACL includes a custom IP match rule with an 'Allow' action to permit traffic from partner IP ranges, followed by AWS Managed Rules to block SQL injection (SQLi) attacks.

A recent security audit reveals two security issues:
1. The web application EC2 instances are receiving HTTP traffic directly from external sources, bypassing the ALB.
2. Malicious SQLi attacks originating from the partner IP ranges are successfully reaching the application.

Which combination of actions should a solutions architect take to resolve these security issues? (Select TWO.)

  1. Configure the security groups of the web tier EC2 instances to only allow inbound HTTP/HTTPS traffic from the security group of the ALB, and remove any rules allowing direct public inbound access.Cevap
  2. Adjust the rule evaluation order in the AWS WAF WebACL to position the SQL injection detection rules with a higher priority (lower numeric value) than the partner IP allow-list rule.Cevap
  3. C
    Attach a Service Control Policy (SCP) to the production account's Organizational Unit (OU) that denies direct internet access to the web tier EC2 instances, while allowing traffic from the ALB.
  4. D
    Configure the ALB to use an AWS-managed KMS key to decrypt and inspect inbound SSL/TLS payloads before routing them to the EC2 instances.
  5. E
    Consolidate all outbound traffic from the private subnets to route through a single NAT Gateway deployed in one Availability Zone to monitor traffic patterns.

Cevap

Configure the security groups of the web tier EC2 instances to only allow inbound HTTP/HTTPS traffic from the security group of the ALB, and adjust the rule evaluation order in the AWS WAF WebACL to position the SQL injection detection rules with a higher priority (lower numeric value) than the partner IP allow-list rule.
The correct solution involves restricting the network path at the security group level and fixing the AWS WAF evaluation order. Enforcing the EC2 security groups to only accept the ALB security group as a source blocks any direct external bypass traffic. Reordering the WebACL rules so that SQL injection detection occurs before the IP allow-list rule ensures that malicious requests from allowed IPs are inspected and blocked before being granted entry.

Adım Adım Çözüm

1
Update the security groups associated with the EC2 instances in the private subnets.
Inbound rules are changed to permit traffic exclusively from the source security group of the ALB.
This guarantees that no external network traffic can bypass the load balancer and its security controls to access the application instances directly.
2
Modify the priority of the rules within the AWS WAF WebACL.
The SQL injection mitigation rule is set with a priority lower than the IP match rule.
Because AWS WAF processes rules sequentially and stops evaluation upon matching an 'Allow' action, the blocking rule must be evaluated first to intercept and drop malicious payloads before they hit the allow-list rule.

Anahtar Kavram

Strengthening identity and network boundary security by enforcing security group integration and correcting AWS WAF rule evaluation order.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Strengthening Identity, Access, and Network Security