Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 122 discussion

Exam question from Amazon's AWS Certified Security - Specialty SCS-C02

Question #: 122
Topic #: 1

[All AWS Certified Security - Specialty SCS-C02 Questions]

A company is implementing a new application in a new AWS account. A VPC and subnets have been created for the application. The application has been peered to an existing VPC in another account in the same AWS Region for database access Amazon EC2 instances will regularly be created and terminated in the application VPC, but only some of them will need access to the databases in the peered VPC over TCP port 1521. A security engineer must ensure that only the EC2 instances that need access to the databases can access them through the network.

How can the security engineer implement this solution?

A. Create a new security group in the database VPC and create an inbound rule that allows all traffic from the IP address range of the application VPC. Add a new network ACL rule on the database subnets. Configure the rule to TCP port 1521 from the IP address range of the application VPC. Attach the new security group to the database instances that the application instances need to access.
B. Create a new security group in the application VPC with an inbound rule that allows the IP address range of the database VPC over TCP port 1521. Create a new security group in the database VPC with an inbound rule that allows the IP address range of the application VPC over port 1521. Attach the new security group to the database instances and the application instances that need database access.
C. Create a new security group in the application VPC with no inbound rules. Create a new security group in the database VPC with an inbound rule that allows TCP port 1521 from the new application security group in the application VPAttach the application security group to the application instances that need database access and attach the database security group to the database instances.
D. Create a new security group in the application VPC with an inbound rule that allows the IP address range of the database VPC over TCP port 1521. Add a new network ACL rule on the database subnets. Configure the rule to allow all traffic from the IP address range of the application VPC. Attach the new security group to the application instances that need database access.

Show Suggested Answer

Suggested Answer: C 🗳️

by Zek at May 13, 2024, 4:04 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

aescudero51

6 months, 2 weeks ago

Selected Answer: C

The VPCs are peered, so you can reference security groups in other VPCs: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-security-groups.html

upvoted 4 times

...

Zek

6 months, 4 weeks ago

Agree - C New custom SG allows all outbound communication and no inbound, so the application SG will allow the applictaion to make outbound request while the return inboud response will be automatically allowed. On the database VPC, inbound access is allowed for request from the application security group https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/default-custom-security-groups.html#creating-your-own-security-groups Also see https://www.examtopics.com/discussions/amazon/view/47599-exam-aws-certified-security-specialty-topic-1-question-232/

upvoted 1 times

...

Exam AWS Certified Security - Specialty SCS-C02 All Questions

View all questions & answers for the AWS Certified Security - Specialty SCS-C02 exam

Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 122 discussion

Comments

aescudero51

Zek

SY0-701