DOP-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Place the EC2 instances in a private subnet with no internet gateway attachment.

  Why this is correct

  Placing the EC2 instances in a private subnet with no internet gateway (IGW) route ensures they cannot receive unsolicited inbound traffic from the internet. The ALB, deployed in a public subnet, is the only intentional ingress point; it forwards traffic to the instances over the private VPC network, which does not require an IGW. This design prevents direct exposure of instance IPs and relies on the security group to restrict traffic to just the ALB's interface.

• ✗

  Attach an Internet Gateway to the VPC and route the private subnet to it.

  Why it's wrong here

  Attaching an Internet Gateway to the VPC and routing the private subnet to it directly violates the definition of a private subnet. Such a route makes the subnet effectively public, giving every instance a publicly reachable IP and allowing inbound traffic to bypass the ALB entirely. This defeats the security architecture's principle of a single controlled entry point and exposes instances to direct scanning and attacks.

• ✗

  Configure a network ACL on the private subnet to allow inbound traffic on all ephemeral ports.

  Why it's wrong here

  Configuring a network ACL (NACL) to allow inbound traffic on ephemeral ports is unnecessary and ineffective here because the ALB typically communicates with instances on a fixed port (e.g., 80 or 443) defined in the security group, not on ephemeral ports. NACLs are stateless, so you would also need symmetric outbound rules, and they apply at the subnet boundary rather than per-instance. Most importantly, the real control should be the instance security group referencing the ALB's security group, which provides stateful, identity-aware filtering that NACLs cannot offer.

• ✓

  Configure the security group for the EC2 instances to allow traffic only from the ALB's security group.

  Why this is correct

  Configuring the EC2 instance security group to allow traffic only from the ALB's security group is a best practice and the correct fine-grained control. This reference rules permits traffic from the ALB's elastic network interface (ENI) while denying all other sources, and because security groups are stateful, return traffic from the instance is automatically allowed. It works regardless of whether the ALB is in the same VPC, and it enforces that only the ALB can reach the instances, complementing the private subnet placement.

• ✗

  Set up an AWS Direct Connect connection for the instances to access the internet.

  Why it's wrong here

  Setting up AWS Direct Connect does not provide internet access for the instances; it provides a dedicated private network connection from your on-premises data center to your VPC, bypassing the public internet. For inbound web traffic, you still need an internet-facing endpoint such as an ALB with an IGW, and for outbound internet from private instances you would use a NAT gateway. Direct Connect is irrelevant to the ALB-to-EC2 traffic flow inside the VPC and introduces unnecessary cost and complexity without addressing the security requirement.

Go deeper

Related to this question