Q70 — AWS SAA-C03 Ch.17

Question 70 of 89 | ← Chapter 17

Q1370. A solutions architect is designing an architecture that includes web, application, and database tiers. The web tier must be capable of auto scaling. The solutions architect has decided to separate each tier into its own subnets. The design includes two public subnets and four private subnets.The security team requires that tiers be able to communicate with each other only when there is a business need and that all other network traffic be blocked.What should the solutions architect do to meet these requirements?

Correct Answer: C. Create specific security groups for each tier to limit traffic to only the required source and destinations.

Explanation

Let's analyze each option to determine the best approach for the solutions architect to meet the given requirements:Option A: Create an Amazon GuardDuty source/destination rule set to control communication Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect AWS accounts, workloads, and data. It is not designed to control the source - destination communication between different tiers of an application. GuardDuty focuses on detecting security threats rather than enforcing network - level access control policies. So, this option is incorrect.Option B: Create one security group for all tiers to limit traffic to only the required source and destinations Using a single security group for all tiers (web, application, and database) would not provide the necessary granularity. Different tiers have different communication requirements. For example, the web tier may need to communicate with the application tier, and the application tier may need to communicate with the database tier, but the web tier should not have direct access to the database tier in most cases. A single security group would not be able to enforce these tier - specific access rules effectively. So, this option is incorrect.Option C: Create specific security groups for each tier to limit traffic to only the required source and destinationsSecurity groups act as virtual firewalls for Amazon EC2 instances. By creating specific security groups for each tier (web, application, and database), the solutions architect can define inbound and outbound rules that allow communication only when there is a business need. For example, the security group for the web tier can be configured to allow inbound traffic from the internet (if required) and outbound traffic only to the application tier. The application tier's security group can be set to allow inbound traffic from the web tier and outbound traffic only to the database tier. This approach provides the necessary granularity and meets the security team's requirement of allowing communication only when there is a business need. So, this option is correct.Option D: Create network ACLs in all six subnets to limit traffic to the sources and destinations required for the application to functionNetwork Access Control Lists (NACLs) are stateless firewalls that operate at the subnet level. While NACLs can be used to control traffic, they are less granular than security groups. Security groups are stateful, which means that if an inbound request is allowed, the corresponding outbound response is automatically allowed. NACLs require explicit rules for both inbound and outbound traffic. Moreover, managing NACLs for all six subnets to enforce tier - specific communication rules can be complex and error - prone. Security groups are a more appropriate choice for controlling traffic between different tiers of an application. So, this option is incorrect.Therefore, the solutions architect should create specific security groups for each tier to limit traffic to only the required source and destinations, and the answer is C.