Answer-first summary for fast verification
Answer: Configure the security group that is associated with the EC2 instances to allow traffic from only the security group that is associated with the NLB
NLB does not have a fixed security group, but you can reference the NLB's security group in the target SG if NLB has one, but actually for NLB, best is to use the client IP or for private, but standard is to allow from the NLB SG if assigned, or use prefix lists. But option A uses SG to SG reference which works for ALB but for NLB it's the same if NLB SG is set. Least overhead is SG referencing another SG.
Author: LeetQuiz Editorial Team
Ultimate access to all questions.
A company deploys a new application on three Amazon EC2 instances across three Availability Zones. The company uses a Network Load Balancer (NLB) to route traffic to the EC2 instances. A SysOps administrator must implement a solution so that the EC2 instances allow traffic from only the NLB. What should the SysOps administrator do to meet these requirements with the LEAST operational overhead?
A
Configure the security group that is associated with the EC2 instances to allow traffic from only the security group that is associated with the NLB
B
Configure the security group that is associated with the EC2 instances to allow traffic from only the elastic network interfaces that are associated with the NLB
C
Create a network ACL Associate the network ACL with the application subnets. Configure the network ACL to allow inbound traffic from only the CIDR ranges of the NLB
D
Use a third-party firewall solution that is installed on a separate EC2 instance. Configure a firewall rule that allows traffic to the application's EC2 instances from only the subnets where the NLB is deployed.
No comments yet.