Restrict EC2 Access to Only ALB Using Security Group Reference
A company hosts a web application on EC2 instances behind an Application Load Balancer. The security team wants to ensure that only traffic from the ALB can reach the EC2 instances. Which configuration should be applied?
Quick Answer
The answer is to configure the EC2 instances' security group to allow traffic from the ALB's security group as the source. This works because security groups support referencing other security groups as a source, creating a logical, dynamic trust boundary that automatically scales with the ALB’s elastic network interfaces. On the AWS Certified Security Specialty SCS-C02 exam, this scenario tests your understanding of security group chaining versus stateless network ACLs or IAM-based controls—common traps include suggesting the ALB’s source IP or a client CIDR block, which would allow direct traffic and break the restriction. A key memory tip is to think of the ALB’s security group as a “VIP pass” that only the load balancer can hand out, ensuring no other source can reach the instances.
⚠ Common exam trap
Test-takers frequently confuse network ACLs (stateless, IP-based) with security groups (stateful, group-based) and mistakenly choose option C, not realizing that security group referencing is the correct and more secure method for this scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the instances' security group to allow traffic from the ALB's security group.
Security groups support referencing other security groups as a source. By configuring the EC2 instances' security group to allow inbound traffic from the ALB's security group, only traffic originating from the ALB (which uses the ALB's security group) is permitted. This ensures that traffic from any other source, including direct internet traffic, is blocked at the instance level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure the instances' security group to allow traffic from the ALB's security group.
Why this is correct
This ensures only traffic that passes through the ALB can reach the instances.
- ✗
Configure the instances' security group to allow traffic from the client's source IP addresses.
Why it's wrong here
This would allow direct traffic bypassing the ALB.
- ✗
Configure a network ACL on the subnet to allow traffic from the ALB's private IP addresses.
Why it's wrong here
Network ACLs are stateless and would require managing IP changes.
- ✗
Assign an IAM role to the instances that allows traffic only from the ALB.
Why it's wrong here
IAM roles do not control network traffic.
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is running a critical application on EC2 instances behind an Application Load Balancer. The security team wants to ensure that only traffic from the ALB reaches the EC2 instances. How can this be achieved?
medium- A.Use the ALB's private IP address in the EC2 security group.
- B.Configure a Network ACL to allow only the ALB's subnet.
- ✓ C.Reference the ALB's security group in the EC2 security group inbound rule.
- D.Use the ALB's public IP address in the EC2 security group.
Why C: You can reference the ALB's security group as the source in the EC2 instance's security group inbound rule. This allows traffic only from the ALB, regardless of the ALB's IP addresses (which can change if the ALB scales). The security group reference is resolved dynamically by AWS, ensuring that only traffic originating from the ALB's elastic network interfaces (ENIs) is permitted.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.