Q23 — AWS SAA-C03 Ch.12

Question 23 of 100 | ← Chapter 12

Q823. A company wants to deploy an internal web application on AWS. The web application must be accessible only from the company's office. The company needs to download security patches for the web application from the internet.The company has created a VPC and has configured an AWS Site-to-Site VPN connection to the company's office. A solutions architect must design a secure architecture for the web application.Which solution will meet these requirements?

Correct Answer: B. Deploy the web application on Amazon EC2 instances in private subnets behind an internal Application Load Balancer (ALB). Deploy NAT gateways in public subnets. Attach an internet gateway to the VPC.Set the inbound source of the ALB's security group to the company's office network CIDR block.

Explanation

The solution that will meet the requirements is option B: Deploy the web application on Amazon EC2 instances in private subnets behind an internal Application Load Balancer (ALB). Deploy NAT gateways in public subnets. Attach an internet gateway to the VPC. Set the inbound source of the ALB's security group to the company's office network CIDR block.By deploying the web application on Amazon EC2 instances in private subnets, you ensure that the instances are not directly accessible from the internet, providing an additional layer of security.Using an internal Application Load Balancer (ALB) in front of the EC2 instances allows you to distribute traffic and provide high availability for the web application. The ALB can be configured with a target group that includes the private subnet EC2 instances.NAT gateways are deployed in public subnets to provide internet access for resources in private subnets, such as the EC2 instances hosting the web application. This enables the EC2 instances to download security patches from the internet.Attaching an internet gateway to the VPC allows outbound internet access for resources within the VPC.Setting the inbound source of the ALB's security group to the company's office network CIDR block ensures that only traffic originating from the company's office network can reach the web application. This restricts access to the web application, making it accessible only from the company's office.Option A, deploying the web application on EC2 instances in public subnets behind a public ALB with an inbound security group source of 0.0.0.0/0, opens the application to the internet and does not meet the requirement of restricting access to the company's office.Option C, deploying the web application on EC2 instances in public subnets behind an internal ALB with outbound security group rules to the company's office network, does not provide the necessary level of security as the instances are publicly accessible.Option D, deploying the web application on EC2 instances in private subnets behind a public ALB with an outbound security group destination of 0.0.0.0/0, allows unrestricted outbound access from the web application instances, which is not a secure configuration.Therefore, option B is the most suitable solution as it provides a secure architecture where the web application is accessible only from the company's office while allowing the instances to download security patches from the internet.