Welcome to the sixth example exam question.
Let's just go ahead and get started.
By now you know the drill.
So let's jump in.
This is the question that we're going to review
in this lesson.
The question is that you're auditing the AWS environment
for the Catagram enterprise application.
It runs from EC2 instances provisioned
via an autoscaling group connected
to an application load balancer.
A SysAdmin team manages the AWS and EC2 environment,
and development teams connect to EC2
when they perform application maintenance.
You're adding SSL capability
and need to ensure the development team,
who have root access to the EC2 instances,
can't access the SSL certificate for catagram.io.
Which solution should you suggest?
Choose one.
By now, you should be getting pretty good
at analyzing these questions,
so give it a go, pause the video while you do
and when you resume,
we can compare what points I found versus yours.
Okay, so let's compare what you discovered
versus the points that I identified.
Now, this one isn't too complex.
I've highlighted the block of text,
which gives an overview of the environment
because it might matter.
So EC2 instances provisioned via and autoscaling group,
connected to an application load balancer.
Then we have two teams, a SysAdmin team
who manages AWS and EC2,
and a development team, who connects to EC2 instances,
and that could be important.
So both of those I've highlighted.
You're also told that the development team
have root access and this suggests Linux EC2 instances
but beyond that, it also suggests
that the development teams have unrestricted access
to everything inside the instance.
So everything inside the operating system,
the development team have access to.
And the question requires
that you prevent the development team
having access to this SSL certificate
whilst the environment has to continue operating correctly.
So this is a fairly tricky question
that requires knowledge of all of the individual parts.
It requires knowledge of SLL,
how to configure SLL on Linux-based instances,
and then how permissions work within an AWS environment
and within an operating system.
So it's a lot more challenging than it appears
at first glance.
Now, the question requires you pick one answer
and as I just mentioned,
it's clearly focused on knowledge of role separation
and SSL usage between instances and load balances.
So let's look at the answers that we have for this question.
Now, we have a total of four answers for the question
and notice how the last two have very similar wording.
And that's key because it means
that we can speed up the review process
for all of these answers
by just identifying the differences
between the last two answers
and then the last two answers and everything else.
So go ahead and pause the video
and just spend some time analyzing the answers,
identifying what you think matters
and then when you resume,
we can review this together.
Now, let's step through the key points
that I identified in the answers.
And the way that I tackle this question
to speed things up is to notice,
as I mentioned perviously
that the top two answers
and the bottom two share something.
The bottom two answers both use ACM
and the top two don't.
So if you can quickly identify whether ACM
should be used in the solution or not,
it can help you immediately eliminate 50%
of the available answers.
Now, you do actually have enough information
to make this decision from the question text
but only if you understand a few really important points.
The first important point
is that the aim is to stop the development team
from accessing the SSL certificate.
The development team have root access to the EC2 instances
and this means any security,
which relies on the operating system
within the EC2 instances
can be rendered invalid by the development team,
simply changing those permissions
because they have root access
and you can't restrict or prevent the root user
on a Linux machine changing permissions.
So the top two answers both rely
on how EC2 security is configured.
The top answer, which is to store the SSL certificate
on S3 and copy it into the instance at boot,
then load it and remove it afterwards,
well, with this answer, anyone with root access
can just remove the part which removes the certificate
at the end.
And then they have access to the certificate.
So if the certificate is loaded onto the instance at boot
and rogue developer simply removes the line
of the script that deletes the certificate
after it's loaded, then they will have access
to the certificate.
Anyone with root access can make changes
to any security configuration on that instance.
And so that means the top answer is eliminated as invalid.
And with the second answer,
even if you could set operating system-level permissions
to only allow an IAM group access,
well, any user with root permissions
can remove this restriction.
And for the record, you can't do this anyway.
Permissions in Linux are POSIX-based permissions,
so internal to that instance or file system.
You can't set IAM users or groups
on POSIX permissions within a Linux operating system,
at least not by default.
So if you see this style of question in the exam,
which suggests SSL and role separation,
then think ACM.
It's usually going to involve ACM.
Now, ACM as a service can store certificates
and distribute them to supported services
and you can tightly control the security
of those certificates.
Now, if we focus on the bottom two answers,
both of them share a lot of wording.
Both of them use ACM
and both of them configure it
so the application load balancer makes use
of the SSL certificate managed by ACM.
But there are two differences.
The first difference is whether the certificate
is generated by ACM or imported into ACM.
That's difference number one.
And the second difference
is whether the instances use HTTP or HTTPS
to communicate with the load balancer.
Now, ACM is capable of generating
or importing certificates
and so that doesn't influence the answer that we pick.
The key part of selecting between these remaining answers
is actually the protocol that the backend instances use.
If they use HTTPS, then it means
that the instances need a valid SSL certificate.
It needs to be a valid public trusted SSL certificate
in order for it to work.
If the backend instances use HTTP,
then they don't need an SSL certificate.
Now, if the instances have the SSL certificate on them.
It means that the development team,
who have root permissions will be able
to access that SSL certificate
and so it means that we can't use answer three
because this will provide the development team access
to the SSL certificate.
Because we're using HTTPS for the backend instances,
they'll need a certificate installed
and the whole point of this
is to prevent the development team
from having access to this certificate.
So answer four is the right answer.
This architecture is called SSL offload
where connections to the load balancer use HTTPS
and then connections from the load balancer
to the instances use HTTP.
It means that the instances don't need
to use SSL certificates at all.
It's less admin overhead
and it means that the SSL certificate
can be tightly controlled.
Now, I hope this makes sense.
I'm trying to get you used to identifying the key parts
of all of these questions and all of these answers.
I want you to get used to finding the information
which matters in questions quickly and efficiently,
that's the key to getting good exam marks.
Okay, well, that's everything for this lesson.
Thanks for watching.
Go ahead and complete the lesson.
And when you're ready, I look forward to you joining me
in the next.