AWS Certified Advanced Networking - Specialty ANS-C01Demo

By Amazon · Question Mode

QuestionQ187

Network Design

A company is rolling out a new stateless web application on AWS. The web application will run on Amazon EC2 instances in private subnets behind an Application Load Balancer. The EC2 instances are in an Auto Scaling group. The web application includes a stateful management application for administration that will run on EC2 instances in a separate Auto Scaling group.

The company wants to access the management application by using the same URL as the web application, with a /management path prefix. The protocol, hostname, and port number must remain the same for both the web application and the management application. Access to the management application must be limited to the company's on-premises IP address space. An SSL/TLS certificate from AWS Certificate Manager (ACM) will secure the web application.

Which combination of steps should a network engineer take to meet these requirements?

Choose two
  • A Insert a rule for the load balancer HTTPS listener. Configure the rule to check the path-pattern condition type for the /management prefix and to check the source-ip condition type for the on-premises IP address space. Forward requests to the management application target group if there is a match. Edit the management application target group and enable stickiness.
  • B Modify the default rule for the load balancer HTTPS listener. Configure the rule to check the path-pattern condition type for the /management prefix and to check the source-ip condition type for the on-premises IP address space. Forward requests to the management application target group if there is not a match. Enable group-level stickiness in the rule attributes.
  • C Insert a rule for the load balancer HTTPS listener. Configure the rule to check the path-pattern condition type for the /management prefix and to check the X-Forwarded-For HTTP header for the on-premises IP address space. Forward requests to the management application target group if there is a match. Enable group-level stickiness in the rule attributes.
  • D Modify the default rule for the load balancer HTTPS listener. Configure the rule to check the path-pattern condition type for the /management prefix and to check the source-ip condition type for the on-premises IP address space. Forward requests to the web application target group if there is not a match.
  • E Forward all requests to the web application target group. Edit the web application target group and disable stickiness.
Explanation

An Application Load Balancer non-default listener rule can match both a path pattern and source IP CIDR, allowing only on-premises requests to /management to be forwarded to the management target group. Target-group stickiness keeps a stateful management session on the same target. The listener’s default action forwards all other requests to the stateless web target group, where stickiness is unnecessary and should be disabled. AWS documents that conditions such as path-pattern and source-ip are available on non-default listener rules, and that sticky sessions are enabled at the target-group level for applications that maintain state.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!