A company is deploying a new application to a VPC on existing Amazon EC2 instances. The application has a presentation tier that uses an Auto Scaling group of EC2 instances. The application also has…

Question

Options

• AModify the RDS database security group to allow traffic from a CIDR range that includes IP
• BAssociate a new ACL with the private subnets. Deny all incoming traffic from IP addresses that
• CModify the RDS database security group to allow traffic from the security group that is associated
• DAssociate a new ACL with the private subnets. Deny all incoming traffic except for traffic from a

• A
  13% (5)
• B
  3% (1)
• C
  80% (32)
• D
  5% (2)

Explanation

Correct Approach: AWS Security Groups: Security groups operate at the instance level, making them the ideal tool for controlling access to specific resources such as an Amazon RDS database. By default, security groups deny all incoming traffic. You can allow access by explicitly specifying another security group. Associating an RDS database security group with the EC2 instances' security group ensures only the specified EC2 instances can access the RDS database. Incorrect Options Analysis: Option A: Using CIDR blocks for IP-based access is less secure and more difficult to manage. Additionally, Auto Scaling groups dynamically allocate IP addresses, making this approach Option B: Network ACLs (NACLs) operate at the subnet level and are stateless. While NACLs can deny or allow traffic, they are not suited to application-specific access control. Option D: Similar to Option B, using a NACL with CIDR ranges for EC2 IPs is difficult to manage and not application-specific.

No community discussion yet for this question.