Your application has two tiers in AWS: the frontend layer and the backend layer. The frontend includes an Auto Scaling group deployed in a public subnet. The backend Auto Scaling group is located in another private subnet. The backend instances should only allow the incoming traffic from the frontend ASG through a custom port. For the backend security group, how would you configure the source in its inbound rule?

Answer options:

A.Configure the frontend security group ID as the source.
B.Configure the public subnet IP range as the source.
C.Configure the frontend Auto Scaling group ARN as the source.
D.Configure the frontend Auto Scaling launch configuration as the source.

Correct Answer – A
Refer to https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html#security-group-rules for how to configure security group rules.
Option A is CORRECT: By configuring the frontend security group as the source, any frontend instances that have the specified security group are allowed to access the backend.
Option B is incorrect: Other instances in this subnet can also access the backend. This option is not as good as option A.Option C is incorrect: Because Auto Scaling group ARN cannot be configured in the source of a security group inbound rule.
Option D is incorrect: Because the launch configuration cannot be configured in the source.