Q29 — AWS SAA-C03 Ch.13

Question 29 of 100 | ← Chapter 13

Q929. A company hosts a video streaming web application in a VPC.The company uses a Network Load Balancer (NLB) to handle TCP traffic for real-time data processing. There have been unauthorized attempts to access the application.The company wants to improve application security with minimal architectural change to prevent unauthorized attempts to access the application.Which solution will meet these requirements?

Correct Answer: B. Recreate the NLB with a security group to allow only trusted IP addresses.

Explanation

To meet the requirements of improving application security with minimal architectural change while preventing unauthorized attempts to access the video streaming web application hosted in a VPC and using a Network Load Balancer (NLB), the most suitable solution is:B. Recreate the NLB with a security group to allow only trusted IP addresses.Explanation:A. Implement a series of AWS WAF rules directly on the NLB to filter out unauthorized traffic: While AWS WAF can be used to filter web traffic at the edge, it is not directly supported on NLBs. WAF is primarily designed to protect Amazon CloudFront distributions, Amazon API Gateway REST APIs, and AWS AppSync GraphQL APIs. It cannot be directly attached to an NLB.B. Recreate the NLB with a security group to allow only trusted IP addresses: This option directly addresses the need to restrict access to the NLB by using a security group that only allows traffic from trusted IP addresses. This is a straightforward and effective way to prevent unauthorized access attempts with minimal architectural change.C. Deploy a second NLB in parallel with the existing NLB configured with a strict IP address allow list: While this would work, it introduces unnecessary complexity and cost by requiring a second NLB. Moreover, it doesn't represent a minimal architectural change as requested.D. Use AWS Shield Advanced to provide enhanced DDoS protection and prevent unauthorized access attempts: AWS Shield Advanced provides advanced DDoS protection, but it is not specifically designed to prevent unauthorized access attempts based on IP addresses or traffic patterns. It focuses on mitigating large-scale DDoS attacks. While it's a valuable service, it does not directly address the problem of unauthorized access attempts as described in the scenario.