DOP-C02 Resilient Cloud Solutions Practice Question
A company is deploying a web application on Amazon ECS with Fargate. The application consists of a frontend service and a backend service. The DevOps team needs to ensure that the frontend service can communicate with the backend service securely without exposing the backend to the internet. Which THREE steps should the team take? (Choose THREE.)
⚠ Common exam trap
The trap here is that candidates might think a load balancer is required for service-to-service communication in ECS, but AWS Cloud Map service discovery combined with security group rules can achieve secure, direct communication without exposing the backend to the internet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy the backend service in a private subnet with no internet access.
Deploying the backend service in a private subnet with no internet access ensures that the backend is not reachable from the internet, which is a fundamental security requirement. In Amazon ECS with Fargate, tasks in a private subnet use an elastic network interface (ENI) with no public IP address, and outbound traffic can be routed through a NAT gateway if needed, but inbound traffic from the internet is blocked. This isolates the backend from direct external exposure while still allowing communication from the frontend service within the same VPC.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deploy the backend service in a private subnet with no internet access.
Why this is correct
Placing the backend ECS service in a private subnet with no route to an internet gateway ensures it has no public IP and cannot be reached from the internet. This is correct for internal-only workloads because the backend does not need outbound internet access, and any required image pulls can be handled via VPC endpoints or pre-pulled images. This isolation reduces the attack surface and aligns with the principle of least privilege.
- ✓
Use AWS Cloud Map service discovery for the backend service.
Why this is correct
AWS Cloud Map registers each backend task or service with a private DNS namespace, giving the frontend a stable, resolvable DNS name that automatically reflects healthy task IPs and port changes. It integrates natively with ECS service discovery, so scaling the backend does not break the frontend's ability to locate it. This provides reliable, VPC-internal service discovery without exposing any public endpoint.
- ✓
Configure a security group for the backend service that allows inbound traffic only from the frontend service's security group.
Why this is correct
By referencing the frontend service's security group ID as the source in the backend's inbound rule, only traffic originating from the frontend tasks—regardless of their current IP addresses—is permitted. This SG-to-SG reference is more secure than CIDR-based rules because it restricts access at the instance/task level and automatically accommodates scaling or task replacement. It also prevents any other resource in the VPC, even one with network access, from reaching the backend unless explicitly allowed.
- ✗
Deploy the backend service in a public subnet with an internet-facing Application Load Balancer.
Why it's wrong here
An internet-facing Application Load Balancer in a public subnet has a public DNS name and elastic IPs, so it directs traffic from the public internet directly to the backend tasks. This would expose the backend service to external users, creating a security risk and contradicting the requirement to keep the backend private. For internal frontend-to-backend communication, an internal load balancer or Cloud Map service discovery should be used instead.
- ✗
Use an internet-facing Network Load Balancer for the backend service.
Why it's wrong here
Although a Network Load Balancer can handle high-throughput TCP/UDP, choosing an internet-facing NLB still assigns public IPs and a publicly resolvable DNS name, making the backend reachable from the internet. It also cannot provide layer-7 inspection and would unnecessarily expose the service while adding operational overhead. Since the backend only needs to accept traffic from the frontend within the VPC, a public-facing NLB is an incorrect and insecure choice.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,487 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.