AWS Certified Security Specialty · Free Practice Question Medium
Question 2
A web application is deployed on EC2 instances running under an Auto Scaling Group. The application needs to be accessible from an Application Load Balancer that provides HTTPS termination, and accesses a PostgreSQL database managed by RDS.
As an AWS Certified Security Specialist, how would you configure the security groups? (Select three)
-
A
The security group of the ALB should have an inbound rule from anywhere on port 443
-
B
The security group of the EC2 instances should have an inbound rule from the security group of the ALB on port 80
-
C
The security group of the ALB should have an inbound rule from anywhere on port 80
-
D
The security group of the EC2 instances should have an inbound rule from the security group of the RDS database on port 5432
-
E
The security group of RDS should have an inbound rule from the security group of the EC2 instances in the ASG on port 80
-
F
The security group of RDS should have an inbound rule from the security group of the EC2 instances in the ASG on port 5432
Reveal correct answers
Correct answers: A, B, F
Explanation
Correct options:
The security group of RDS should have an inbound rule from the security group of the EC2 instances in the ASG on port 5432
The security group of the EC2 instances should have an inbound rule from the security group of the ALB on port 80
The security group of the ALB should have an inbound rule from anywhere on port 443
A security group acts as a virtual firewall that controls the traffic for one or more instances. When you launch an instance, you can specify one or more security groups; otherwise, we use the default security group. You can add rules to each security group that allows traffic to or from its associated instances. You can modify the rules for a security group at any time; the new rules are automatically applied to all instances that are associated with the security group. When we decide whether to allow traffic to reach an instance, we evaluate all the rules from all the security groups that are associated with the instance. The following are the characteristics of security group rules: By default, security groups allow all outbound traffic. Security group rules are always permissive; you can't create rules that deny access. Security groups are stateful
PostgreSQL port = 5432 HTTP port = 80 HTTPS port = 443
The traffic follows this route : The client sends an HTTPS request to ALB on port 443. This is handled by the rule - The security group of the ALB should have an inbound rule from anywhere on port 443. The ALB then forwards the request to one of the EC2 instances. This is handled by the rule - The security group of the EC2 instances should have an inbound rule from the security group of the ALB on port 80. The EC2 instance further accesses the PostgreSQL database managed by RDS on port 5432. This is handled by the rule - The security group of RDS should have an inbound rule from the security group of the EC2 instances in the ASG on port 5432.
Incorrect options:
The security group of the ALB should have an inbound rule from anywhere on port 80 - The client sends an HTTPS request to ALB on port 443 and not on port 80, so this is incorrect.
The security group of the EC2 instances should have an inbound rule from the security group of the RDS database on port 5432 - The security group of the EC2 instances should have an inbound rule from the security group of the ALB and not from the security group of the RDS database, so this option is incorrect.
The security group of RDS should have an inbound rule from the security group of the EC2 instances in the ASG on port 80 - The EC2 instance further accesses the PostgreSQL database managed by RDS on port 5432 and not on port 80, so this option is incorrect.
Reference:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
