Free PBQ Demo · Advanced

Topology · Cloud VPC Security

Lock down an AWS-style VPC — public/private/DB subnets, security groups, NAT GW vs IGW, IAM roles instead of keys.

Tests: Cloud network security, well-architected pillars, security groups vs NACLs, IAM least privilege — Security+ Domain 3.

~10 minNo signup needed

Scenario

Configure security groups, NAT, IAM, and DB encryption for a 3-tier VPC deployment.

Internet talks to the ALB only. App layer talks out via NAT GW. DB has no internet path. IAM via roles.

Network Topology — Live View

monitoring

InfectedAlertConfiguredclick any hostto configure

ALB

public subnet

Load Balancer

Security group inbound from internet:

TCP 443 (HTTPS)TCP 80 (HTTP — redirect only)TCP 22 (SSH — never on public ALB)TCP 3306 (DB — never on public ALB)

Attach WAF (OWASP rules)

Redirect HTTP → HTTPS

Tasks

ALB — 443 only from internet, redirect 80 → 443, WAF attached.
EC2 app tier — accept 443 only from ALB SG, use IAM role.
RDS — accept 3306 only from EC2 SG, encrypt at rest + in transit, backups on, no public IP.

0 settings configured

Liked this PBQ? There are 80+ more inside.