Discuss Amazon SAA-C03 Exam Topic 3 Question 60

[Design Secure Architectures]

A company is designing a web application with an internet-facing Application Load Balancer (ALB).

The company needs the ALB to receive HTTPS web traffic from the public internet. The ALB must send only HTTPS traffic to the web application servers hosted on the Amazon EC2 instances on port 443. The ALB must perform a health check of the web application servers over HTTPS on port 8443.

Which combination of configurations of the security group that is associated with the ALB will meet these requirements? (Select THREE.)

AAllow HTTPS inbound traffic from 0.0.0.0/0 for port 443.

BAllow all outbound traffic to 0.0.0.0/0 for port 443.

CAllow HTTPS outbound traffic to the web application instances for port 443.

DAllow HTTPS inbound traffic from the web application instances for port 443.

EAllow HTTPS outbound traffic to the web application instances for the health check on port 8443.

FAllow HTTPS inbound traffic from the web application instances for the health check on port 8443.

Suggested Answer: A, C, E

Option A:The ALB must accept HTTPS traffic from the public internet. Allowing inbound traffic on port 443 from 0.0.0.0/0 enables this functionality.

Option C:The ALB must forward HTTPS traffic to the web application servers on port 443. Outbound traffic for port 443 must be allowed for this communication.

Option E:The ALB must perform health checks on the web application servers over HTTPS on port 8443. Outbound traffic for port 8443 must be allowed for this purpose.

Option B:Allowing all outbound traffic is overly permissive and does not align with the specific requirements.

Option D and F:Inbound traffic to the ALB from the web application instances is unnecessary because the flow of traffic is from the ALB to the web application instances, not vice versa.

AWS Documentation Reference:

Application Load Balancer Security Groups

Health Checks for ALBs

Get Premium SAA-C03 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

26 comments · newest first

Maia 10 months ago

Yup, E and C are essential for the health checks!

Tommy 10 months ago

I think allowing all outbound traffic on port 443 is overkill.

Tony 10 months ago

Definitely need to allow HTTPS inbound traffic on port 443!

Ardella 11 months ago

Wait, why are we checking health on port 8443? Seems odd.

Minna 11 months ago

Agree, HTTPS outbound to the app instances is a must.

Tanesha 11 months ago

I feel like we might need to allow inbound traffic from the web application instances for the health check too, but I can't recall if that's necessary.

Dannie 11 months ago

I’m a bit confused about the health check part. Should we allow HTTPS outbound traffic for the health check on port 8443?

Nadine 11 months ago

I think we also need to allow HTTPS outbound traffic to the web application instances for port 443, right? That seems important for the communication.

Nickolas 12 months ago

I remember we discussed allowing HTTPS inbound traffic from 0.0.0.0/0 for port 443, but I'm not sure if that's the only thing we need.

Tina 12 months ago

This is a good test of understanding security group configuration. I'll need to carefully consider each option and make sure the combination meets all the stated requirements.

Corazon 12 months ago

I'm not totally sure about the outbound rules. Do we need to allow all outbound traffic, or just the HTTPS traffic to the web app servers?

Vallie 1 year ago

Okay, I think I've got this. The key is allowing HTTPS traffic in and out on the right ports for both the public-facing ALB and the internal web app servers.

Valda 1 year ago

Hmm, I'm a bit confused by the health check port being different from the application port. I'll need to think through how the security group rules need to handle that.

Sabine 1 year ago

This looks like a straightforward security group configuration question. I'll need to carefully read through the requirements and match them to the options provided.

Yolande 1 year ago

I think we should also allow HTTPS outbound traffic to the web application instances for the health check on port 8443.

Lezlie 1 year ago

Haha, I bet the web dev team is already complaining about the extra security layers. 'But why do we need HTTPS for a health check? Can't we just use HTTP?'

Caprice 1 year ago

I agree with Dallas. We also need to allow HTTPS outbound traffic to the web application instances for port 443.

Dortha 1 year ago

I agree with Mozelle's analysis. This is a straightforward security group configuration for an ALB with HTTPS requirements.

Trinidad 1 year ago

↳ replying to Dortha

E) Allow HTTPS outbound traffic to the web application instances for the health check on port 8443.

Junita 1 year ago

↳ replying to Dortha

C) Allow HTTPS outbound traffic to the web application instances for port 443.

Gary 1 year ago

↳ replying to Dortha

A) Allow HTTPS inbound traffic from 0.0.0.0/0 for port 443.

Dallas 1 year ago

I think we should allow HTTPS inbound traffic from 0.0.0.0/0 for port 443.

Mozelle 1 year ago

A, C, and E are the correct answers. The ALB needs to allow HTTPS inbound traffic from the public internet on port 443, send HTTPS traffic to the web application servers on port 443, and allow HTTPS outbound traffic to the web application instances for the health check on port 8443.

Aron 1 year ago

↳ replying to Mozelle

E) Allow HTTPS outbound traffic to the web application instances for the health check on port 8443.

Rodolfo 1 year ago

↳ replying to Mozelle

C) Allow HTTPS outbound traffic to the web application instances for port 443.

Gracia 1 year ago

↳ replying to Mozelle

A) Allow HTTPS inbound traffic from 0.0.0.0/0 for port 443.

Amazon SAA-C03 Exam - Topic 3 Question 60 Discussion