Q29 — AWS SAA-C03 Ch.11

Question 29 of 100 | ← Chapter 11

Q729. A company is designing a new multi-tier web application that consists of the following components:?Web and application servers that run on Amazon EC2 instances as part of Auto Scaling groups ?An Amazon RDS DB instance for data storageA solutions architect needs to limit access to the application servers so that only the web servers can access them.Which solution will meet these requirements?

Correct Answer: D. Deploy an Application Load Balancer with a target group that contains the application servers' Auto Scaling group. Configure the security group to allow only the web servers to access the application servers.

Explanation

To meet the requirement of limiting access to the application servers so that only the web servers can access them in a multi-tier web application running on Amazon EC2 instances with Auto Scaling groups, the most suitable solution is:D. Deploy an Application Load Balancer with a target group that contains the application servers' Auto Scaling group. Configure the security group to allow only the web servers to access the application servers.Option D, deploying an Application Load Balancer (ALB) with a target group that contains the application servers' Auto Scaling group and configuring the security group to allow only the web servers to access the application servers, is the recommended solution to meet the requirements:- Application Load Balancer (ALB): An ALB provides layer 7 load balancing and allows you to distribute incoming traffic across multiple EC2 instances. It acts as a reverse proxy between clients and the application servers.By deploying an ALB and configuring a target group that includes the Auto Scaling group of the application servers, you can ensure that incoming traffic is evenly distributed among the instances. This simplifies the process of managing and scaling the application servers.To limit access to the application servers, you can configure the security group associated with the application servers to allow inbound traffic only from the ALB. This effectively restricts access to the application servers to only the web servers that are behind the ALB, ensuring that no direct access is allowed.Option A, deploying AWS PrivateLink in front of the application servers and configuring the network ACL to allow only the web servers to access the application servers, is not the most appropriate solution for this scenario. AWS PrivateLink is primarily used for securely accessing services over private networks, and it does not provide the necessary load balancing functionality or integration with Auto Scaling.Option B, deploying a VPC endpoint in front of the application servers and configuring the security group to allow only the web servers to access the application servers, is not the most suitable solution. VPC endpoints are typically used for enabling private connectivity to AWS services, but they do not provide load balancing capabilities or integration with Auto Scaling.Option C, deploying a Network Load Balancer (NLB) with a target group that contains the application servers' Auto Scaling group and configuring the network ACL to allow only the web servers to access the application servers, is not the optimal solution. While an NLB provides layer 4 load balancing, it does not have the built-in features for managing and distributing traffic at the application layer, like an ALB does.Therefore, the solution that best meets the requirements is D: Deploy an Application Load Balancer with a target group that contains the application servers' Auto Scaling group and configure the security group to allow only the web servers to access the application servers. This solution provides load balancing capabilities, simplifies management and scalability, and ensures that only the web servers can access the application servers.