Question
A security engineer is working with a company to design an ecommerce application. The application will run on Amazon EC2 instances that run in an Auto Scaling group behind an Application Load Balancer (ALB). The application will use an Amazon RDS DB instance for its database.
The only required connectivity from the internet is for HTTP and HTTPS traffic to the application. The application must communicate with an external payment provider that allows traffic only from a preconfigured allow list of IP addresses. The company must ensure that communications with the external payment provider are not interrupted as the environment scales.
Which combination of actions should the security engineer recommend to meet these requirements? (Choose three.)
- A. Deploy a NAT gateway in each private subnet for every Availability Zone that is in use. Correct
- B. Place the DB instance in a public subnet.
- C. Place the DB instance in a private subnet. Correct
- D. Configure the Auto Scaling group to place the EC2 instances in a public subnet.
- E. Configure the Auto Scaling group to place the EC2 instances in a private subnet. Correct
- F. Deploy the ALB in a private subnet.
Explanation
The correct answers are A, C and E. Placing the EC2 instances in private subnets (E) means they have no public IP addresses, so the only inbound internet traffic reaches them through the internet-facing ALB on HTTP and HTTPS; the ALB therefore stays in public subnets (not F). Outbound traffic from the instances to the payment provider goes through a NAT gateway in each Availability Zone in use (A). Each NAT gateway has a fixed Elastic IP address, so the company can give those addresses to the payment provider's allow list, and they do not change as Auto Scaling adds or replaces instances; one gateway per AZ also keeps the connection working if an AZ fails. The NAT gateway itself sits in the public subnet of its AZ and serves that AZ's private subnet through the route table. The RDS DB instance belongs in a private subnet (C) because it needs no internet access. Public instances (D) would each get a different public IP address, which would break the allow list as the group scales.
