Question

A cloud architect is designing network controls for a three-tier web application hosted in IaaS. The web tier must accept HTTPS from the internet, the application tier should only receive traffic from the web tier, and the database tier should only be reachable from the application tier. The security team also insists on inspecting inbound HTTP payloads for SQL injection and cross-site scripting attempts. Which combination of controls BEST satisfies these requirements?

Accepted Answer

Apply network security groups between each tier for stateful port/protocol filtering, and place a web application firewall (WAF) in front of the web tier for payload inspection

Answer

Rely solely on network security groups on every subnet, since stateful rules can already detect SQL injection and XSS payloads

Answer

Deploy a single WAF in front of all three tiers and remove tier-to-tier filtering to reduce latency

Answer

Use an intrusion detection system (IDS) in passive tap mode at the perimeter and open all internal ports to simplify inter-tier communication