What should the user do to ensure that the EC2 instances accept requests only from ELB?

A user has configured a website and launched it using the Apache web server on port 80. The user is using ELB with the EC2 instances for Load Balancing.

What should the user do to ensure that the EC2 instances accept requests only from ELB?
A . Configure the security group of EC2, which allows access to the ELB source security group
B . Configure the EC2 instance so that it only listens on the ELB port
C . Open the port for an ELB static IP in the EC2 security group
D . Configure the security group of EC2, which allows access only to the ELB listener

Answer: A

Explanation:

When a user is configuring ELB and registering the EC2 instances with it, ELB will create a source security group. If the user wants to allow traffic only from ELB, he should remove all the rules set for the other requests and open the port only for the ELB source security group.

Reference: http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/using-elb-security-groups.html