These questions are independently created for study purposes. They are not official AWS exam questions, actual exam questions, leaked questions, or exam dumps.
SAA-007
You do not want EC2 instances behind an Application Load Balancer to receive direct HTTP access from the internet. Which security group configuration is the most appropriate?
Choices
Explanation and answer
Read the explanation and correct answer (spoiler — try answering first)
Correct answer: D. Allow only HTTP from the ALB security group on the EC2 security group.
Explanation
For EC2 behind an ALB, configure the EC2 security group to allow traffic only from the ALB security group.
Per-choice explanations
A. Allow only HTTP from EC2 on the ALB security group.
Incorrect. The ALB is the entry point that receives traffic from clients. Allowing only HTTP from EC2 to the ALB does not meet the requirement.
B. Allow HTTP from 0.0.0.0/0 on the EC2 security group.
Incorrect. This setting exposes EC2 directly to the internet.
C. Attach an Elastic IP to the EC2 instance so that it can be accessed directly.
Incorrect. Attaching an Elastic IP increases the likelihood of direct access.
D. Allow only HTTP from the ALB security group on the EC2 security group.
Correct. It allows only traffic that comes through the ALB.
Practical Use
For EC2 behind an Application Load Balancer (ALB), the configuration of "allowing inbound traffic only from the ALB security group" on the EC2-side security group (SG) structurally blocks direct access from the internet. Because a security group can reference another SG by ID as the source, not just CIDR, by allowing the ALB SG ID, you do not need to change rules on the EC2 side even when the ALB's IP varies. The standard pattern is a two-tier configuration: the ALB-side SG receives 80/443 from `0.0.0.0/0`, and the EC2-side SG receives 80/8080 etc. from the ALB SG. There is also the distinction that security groups are "allow rules only and stateful," while network ACLs (NACLs) are "allow and deny rules, and stateless," and SAA-C03 asks about the difference. The common configuration is to place EC2 in a private subnet of the VPC and the ALB in a public subnet, and there is no need to attach a public IP or Elastic IP to EC2. Communication is established with the private IP and health checks and traffic forwarding via the ALB alone. On SAA-C03, the pattern of allowing only the ALB SG on the EC2-side SG frequently appears for requirements such as "do not allow direct internet access to EC2 behind an ALB." Distractors line up patterns that conflict with consolidating the entry point at the ALB, such as opening `0.0.0.0/0`, attaching an Elastic IP to EC2, or setting up the ALB-side SG to allow only from EC2 in the wrong direction. Note also that SG-to-SG references are limited to the same VPC (or peered VPCs).