SCS-C02 Infrastructure Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Configure the instance security group to allow HTTP traffic only from the VPC CIDR block.

  Why it's wrong here

  Allowing HTTP from the entire VPC CIDR block means any resource with an IP address in that range can reach the instance on port 80, including compromised instances, Lambda in the VPC, NAT gateways, or other workloads. This is far broader than the intended source—the Application Load Balancer—and is not a valid way to restrict traffic to only the ALB. Instead, you should reference the ALB security group as the source so only the ALB's elastic network interfaces are authorized.

• ✓

  Configure the instance security group to allow HTTP traffic only from the ALB's security group.

  Why this is correct

  Referencing the ALB's security group as the source in the instance security group rule limits inbound HTTP to traffic originating from the elastic network interfaces that actually belong to the ALB nodes. This SG-to-SG association follows the ALB as it scales or replaces its ENIs across Availability Zones, because any ENI that is a member of the ALB security group is automatically allowed. It is the recommended, least-privilege approach for placing an EC2 instance behind an Application Load Balancer.

• ✗

  Configure the network ACL on the instance's subnet to allow HTTP traffic only from the ALB's private IP address.

  Why it's wrong here

  Network ACLs are stateless, so an inbound rule permitting HTTP from the ALB's private IP only controls the request direction; you must also add an outbound rule to allow the ephemeral response ports, otherwise replies are dropped. The NACL is associated with the whole subnet, so it would apply the same rule to every instance in that subnet, not just the target instance. Additionally, ALB private IPs can change when nodes scale, so pinning the rule to a specific IP is fragile compared to using a security group reference.

• ✗

  Configure the instance security group to allow HTTP traffic only from the subnet CIDR block where the ALB resides.

  Why it's wrong here

  Using the ALB subnet's CIDR as the source authorizes every IP in that subnet, which includes not only the ALB nodes but also any other EC2 instances, containers, or services running in the same subnets, allowing them to bypass the load balancer entirely. If the ALB spans multiple subnets or Availability Zones, you would need to add rules for each subnet CIDR, and the rule still wouldn't update automatically when the ALB's membership changes. A security group reference is granular to the ALB itself and avoids these issues.

Go deeper

Related to this question