AWS Certified Solutions Architect Associate · Free Practice Question Medium
Question 3
A company is deploying a publicly accessible web application. To accomplish this, the engineering team has designed the VPC with a public subnet and a private subnet. The application will be hosted on several Amazon EC2 instances in an Auto Scaling group. The team also wants Transport Layer Security (TLS) termination to be offloaded from the Amazon EC2 instances.
Which solution should a solutions architect implement to address these requirements in the most secure manner?
-
A
Set up a Network Load Balancer in the public subnet. Create an Auto Scaling group in the public subnet and associate it with the Network Load Balancer
-
B
Set up a Network Load Balancer in the private subnet. Create an Auto Scaling group in the public subnet and associate it with the Network Load Balancer
-
C
Set up a Network Load Balancer in the public subnet. Create an Auto Scaling group in the private subnet and associate it with the Network Load Balancer
-
D
Set up a Network Load Balancer in the private subnet. Create an Auto Scaling group in the private subnet and associate it with the Network Load Balancer
Reveal correct answer
Correct answer: C
Explanation
Correct option:
Set up a Network Load Balancer in the public subnet. Create an Auto Scaling group in the private subnet and associate it with the Network Load Balancer
A load balancer serves as the single point of contact for clients. The load balancer distributes incoming traffic across multiple targets, such as Amazon EC2 instances. This increases the availability of your application. You add one or more listeners to your load balancer.
With a Network Load Balancer, you can offload the decryption/encryption of Transport Layer Security (TLS) traffic from your application servers to the Network Load Balancer, which helps you optimize the performance of your backend application servers while keeping your workloads secure. Additionally, Network Load Balancers preserve the source IP of the clients to the back-end applications, while terminating Transport Layer Security (TLS) on the load balancer.
An Auto Scaling group contains a collection of Amazon EC2 instances that are treated as a logical grouping for the purposes of automatic scaling and management. An Auto Scaling group also enables you to use Amazon EC2 Auto Scaling features such as health check replacements and scaling policies. Both maintaining the number of instances in an Auto Scaling group and automatic scaling are the core functionality of the Amazon EC2 Auto Scaling service.
The NLB has to be accessible over the internet and hence has to be in a public subnet and will act as a single point-of-contact for all incoming traffic. NLB will forward the incoming traffic to the Amazon EC2 instances managed by the ASG in the private subnet.
Exam Alert:
You should note that the Application Load Balancer also supports Transport Layer Security (TLS) offloading. The Classic Load Balancer supports SSL offloading.
Incorrect options:
Set up a Network Load Balancer in the public subnet. Create an Auto Scaling group in the public subnet and associate it with the Network Load Balancer - The Auto Scaling group with its target EC2 instances should be in the private subnet to avoid access to EC2 instances over the public internet. Having EC2 instances in the public subnet would weaken the security posture of the application. Hence, this option is incorrect.
Set up a Network Load Balancer in the private subnet. Create an Auto Scaling group in the public subnet and associate it with the Network Load Balancer
Set up a Network Load Balancer in the private subnet. Create an Auto Scaling group in the private subnet and associate it with the Network Load Balancer
NLB should be in the public subnet as it represents the internet-facing component of the web tier. Therefore, both these options are incorrect.
Reference:
https://aws.amazon.com/blogs/aws/new-tls-termination-for-network-load-balancers/
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
