Q3 — AWS SAA-C03 Ch.15

Question 3 of 100 | ← Chapter 15

Q1103. A company is deploying a new SFTP service. The service consists of Amazon EC2 instances in an Auto Scaling group that spans two Availability Zones and a shared Amazon Elastic File System (Amazon EFS) file system. The service is behind a Network Load Balancer (NLB) that has a security group attached. A solutions architects needs to grant a list of IP address access to the new service.Which solution will meet this requirement?

• A. Edit the default network ACL to add an inbound rule for Port 22 and an outbound rule for Ports 32768- 61000 for the subnet that contains the NLB and the Auto Scaling group. Add a rule to deny all other traffic.
• B. Add an inbound rule to the NLB security group that allows TCP Port 22 traffic from the IP addresses.Add an inbound rule to the security group referenced by the Auto Scaling group that allows TCP Port 22 traffic from the NLB security group. ✓
• C. Add an inbound rule to the NLB security group that allows TCP Port 22 traffic from the IP addresses.Add an inbound rule to the security group referenced by the Auto Scaling group to allow all traffic from the NLB security group.
• D. Add an inbound rule to the NLB security group that allows TCP Port 22 from 0.0.0.0/0. Add an inbound rule to the security group referenced by the Auto Scaling group that allows TCP Port 22 traffic from the NLB security group.

Correct Answer: B. Add an inbound rule to the NLB security group that allows TCP Port 22 traffic from the IP addresses.Add an inbound rule to the security group referenced by the Auto Scaling group that allows TCP Port 22 traffic from the NLB security group.

Explanation

To grant a list of IP addresses access to the new SFTP service that consists of Amazon EC2 instances in an Auto Scaling group behind a Network Load Balancer (NLB), we need to consider how traffic flows and where security needs to be enforced.Let's evaluate each option:A. Edit the default network ACL to add an inbound rule for Port 22 and an outbound rule for Ports 32768- 61000 for the subnet that contains the NLB and the Auto Scaling group. Add a rule to deny all other traffic.Network ACLs (Access Control Lists) are stateless and operate at the subnet level. They are not typically used for controlling access to specific services like an NLB with backend instances. Moreover, Port 32768- 61000 are ephemeral ports used for outbound traffic, not relevant for inbound SFTP (Port 22). B. Add an inbound rule to the NLB security group that allows TCP Port 22 traffic from the IP addresses. Add an inbound rule to the security group referenced by the Auto Scaling group that allows TCP Port 22 traffic from the NLB security group.This option correctly sets up the security groups:The NLB security group allows SSH (Port 22) traffic from the specified IP addresses. The security group for the Auto Scaling group allows SSH (Port 22) traffic from the NLB security group, meaning only the NLB (which has already filtered traffic) can forward it to the EC2 instances. C. Add an inbound rule to the NLB security group that allows TCP Port 22 traffic from the IP addresses. Add an inbound rule to the security group referenced by the Auto Scaling group to allow all traffic from the NLB security group.This option is not secure because it allows "all traffic" from the NLB security group to the Auto Scaling group, not just Port 22. This could potentially expose other services running on the instances to unauthorized access.D. Add an inbound rule to the NLB security group that allows TCP Port 22 from 0.0.0.0/0. Add an inbound rule to the security group referenced by the Auto Scaling group that allows TCP Port 22 traffic from the NLB security group.This option allows SSH access to the NLB from any IP address, which is a security risk. The second part, allowing Port 22 from the NLB security group to the Auto Scaling group, is correct, but the first part makes the setup insecure.Given these considerations, the best solution is:B. Add an inbound rule to the NLB security group that allows TCP Port 22 traffic from the IP addresses. Add an inbound rule to the security group referenced by the Auto Scaling group that allows TCP Port 22 traffic from the NLB security group.This solution ensures that only the specified IP addresses can initiate SSH connections, and those connections are then correctly routed and allowed to the EC2 instances via the NLB.