SAA-C03 practice question: Security groups and network ACLs (1 of 3)

Design Secure Architectures A free question from our original SAA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A retailer is launching a web application with the network design shown in the diagram. An internet-facing Application Load Balancer (ALB) in the public subnets forwards HTTPS requests to web servers in two Availability Zones. A security review of the first test deployment found that the launch template puts the web servers in the public subnets with public IPv4 addresses, and that their security group allows HTTPS from 0.0.0.0/0. The web servers must be reachable only through the ALB. Which TWO actions should a solutions architect take? (Choose two.)

Architecture diagram: users on the internet reach an Application Load Balancer in two public subnets, which forwards traffic to web servers in two private subnets, one in each of two Availability Zones.

Choose two answers.

A. Change the web servers' security group so that it allows inbound HTTPS only from the security group that is attached to the ALB.
B. Update the launch template to use the private subnets and to stop assigning public IPv4 addresses to the web servers.
C. Add a network ACL rule to the private subnets that allows inbound HTTPS only from the ALB's security group, and deny everything else.
D. Recreate the ALB with the internal scheme so that its nodes have only private IP addresses inside the VPC.
E. Keep HTTPS open to 0.0.0.0/0 on the web servers, and attach an AWS WAF web ACL to the ALB to filter requests.

Show the answer and explanation

Answers: A, B

A. Right: Correct. A security group rule can use another security group as its source, so only traffic sent by the load balancer's nodes is allowed in. Requests that try to reach the servers directly are dropped, whatever address they come from. Learn more: Security groups for your Application Load Balancer (opens in a new tab)
B. Right: Correct. Servers in private subnets with no public IP address have no route from the internet, which matches the diagram. The ALB reaches its targets on their private IP addresses, so nothing else needs to change. Learn more: How Elastic Load Balancing works (opens in a new tab)
C. Wrong: Network ACL rules match traffic by CIDR range, not by security group, so this rule cannot be written. A network ACL is also stateless, so return traffic would need its own rules. The security group reference belongs on the web servers' security group. Learn more: Network ACL rules (opens in a new tab)
D. Wrong: An internal load balancer can only route requests from clients that have access to the VPC. Customers on the internet could no longer reach the application at all. The ALB must stay internet-facing; it is the web servers that must be private. Learn more: How Elastic Load Balancing works (opens in a new tab)
E. Wrong: AWS WAF inspects only requests that pass through the resource it protects. Traffic sent straight to the servers' public addresses would skip the ALB and the web ACL entirely. The servers themselves must stop accepting direct traffic. Learn more: What are AWS WAF, AWS Shield Advanced, AWS Shield network security director and AWS Firewall Manager? (opens in a new tab)

Explanation

Use two layers. Placing the web servers in private subnets without public IP addresses removes any direct path from the internet, and allowing inbound HTTPS only from the ALB's security group means that even traffic from inside the VPC must come through the load balancer. Network ACLs cannot reference security groups, an internal ALB would cut off customers, and AWS WAF does not protect traffic that bypasses the ALB.

SAA-C03 practice question: Security groups and network ACLs (1 of 3)

Explanation

Study

Keep practising