CLF-C02 Security and Compliance Practice Question
A company hosts a multi-tier web application on AWS. The web tier runs on Amazon EC2 instances in a public subnet, and the database tier runs on Amazon EC2 instances in a private subnet. The security team needs to configure security groups to allow only the web tier instances to communicate with the database tier on port 3306 (MySQL). The web tier must be accessible from the internet on port 443. Which security group configuration meets these requirements?
⚠ Common exam trap
It's easy for candidates to confuse security group references with IP-based rules or incorrectly assume that the web security group should reference itself for inbound internet traffic, rather than using 0.0.0.0/0 for public access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Web security group: inbound rule allowing 0.0.0.0/0 on port 443. Database security group: inbound rule allowing the web security group as source on port 3306.
It uses a security group reference as the source for the database security group's inbound rule on port 3306, which allows traffic only from instances associated with the web security group. The web security group allows inbound HTTPS traffic from the internet (0.0.0.0/0) on port 443, meeting the requirement for public access. This configuration ensures least-privilege access by restricting database communication to only the web tier, without exposing the database to the internet or requiring IP-based rules.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Web security group: inbound rule allowing 0.0.0.0/0 on port 443. Database security group: inbound rule allowing the web security group as source on port 3306.
Why this is correct
This is correct. The web SG allows internet traffic on port 443, and the database SG uses the web SG as a source, which permits only traffic from instances associated with the web SG on port 3306.
- ✗
Web security group: inbound rule allowing 0.0.0.0/0 on port 443. Database security group: inbound rule allowing 0.0.0.0/0 on port 3306.
Why it's wrong here
This configuration is incorrect because it leaves the database openly accessible to the entire internet. While the web security group correctly permits HTTPS traffic on port 443, the database security group rule for 0.0.0.0/0 on port 3306 (MySQL) exposes the database to attackers from any IP address, enabling brute-force attacks, unauthorized data access, or even data exfiltration. AWS security best practices mandate that database security groups should reference only the security group of the application tier (the web security group) as the source, not a global IP range, to enforce the principle of least privilege and maintain a private database tier.
When this WOULD be correct
If the requirement were to allow the database to be publicly accessible from the internet on port 3306 (e.g., for external database administration), then this rule would be correct.
- ✗
Web security group: inbound rule allowing the web security group as source on port 443. Database security group: inbound rule allowing the web security group as source on port 3306.
Why it's wrong here
This is incorrect because the web SG allows inbound traffic from itself (self-reference) on port 443, which does not allow internet traffic. Internet users cannot reach the web tier, so the application would be inaccessible.
When this WOULD be correct
This configuration would be correct if the requirement was to allow only internal web-to-web communication on port 443 (e.g., for health checks or inter-instance communication) and the database tier should only accept traffic from the web security group on port 3306, with no internet access needed for the web tier.
- ✗
Web security group: inbound rule allowing 0.0.0.0/0 on port 443. Database security group: inbound rule allowing the internet-facing Application Load Balancer security group as source on port 3306.
Why it's wrong here
This is incorrect because the scenario does not mention an Application Load Balancer (ALB). Even if an ALB were present, the requirement is for direct communication between the web tier EC2 instances and the database tier, not through a load balancer.
When this WOULD be correct
If the question required the database to be accessed only through an Application Load Balancer (e.g., for a proxy or connection pooling), and the web tier was not directly connecting to the database, then allowing the ALB security group as source on the database security group would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓Web security group: inbound rule allowing 0.0.0.0/0 on port 443. Database security group: inbound rule allowing the web security group as source on port 3306.Correct answer▾
Why this is correct
This is correct. The web SG allows internet traffic on port 443, and the database SG uses the web SG as a source, which permits only traffic from instances associated with the web SG on port 3306.
✗Web security group: inbound rule allowing 0.0.0.0/0 on port 443. Database security group: inbound rule allowing 0.0.0.0/0 on port 3306.Wrong answer — click to see why▾
Why this is wrong here
This option allows any IP (0.0.0.0/0) to access the database on port 3306, violating the requirement that only the web tier should communicate with the database.
★ When this WOULD be the correct answer
If the requirement were to allow the database to be publicly accessible from the internet on port 3306 (e.g., for external database administration), then this rule would be correct.
Why candidates choose this
Candidates may mistakenly think that allowing 0.0.0.0/0 on the database is acceptable because they focus only on the web tier's internet access, overlooking the security constraint for the private database.
✗Web security group: inbound rule allowing the web security group as source on port 443. Database security group: inbound rule allowing the web security group as source on port 3306.Wrong answer — click to see why▾
Why this is wrong here
The web security group's inbound rule references itself as source on port 443, which would only allow traffic from other instances in the same web security group, not from the internet. The requirement is to allow internet traffic on port 443.
★ When this WOULD be the correct answer
This configuration would be correct if the requirement was to allow only internal web-to-web communication on port 443 (e.g., for health checks or inter-instance communication) and the database tier should only accept traffic from the web security group on port 3306, with no internet access needed for the web tier.
Why candidates choose this
Candidates may mistakenly think that referencing the web security group as source for both inbound rules is a secure way to restrict traffic, overlooking that the web tier must be accessible from the internet on port 443.
✗Web security group: inbound rule allowing 0.0.0.0/0 on port 443. Database security group: inbound rule allowing the internet-facing Application Load Balancer security group as source on port 3306.Wrong answer — click to see why▾
Why this is wrong here
The database tier is in a private subnet and should only accept traffic from the web tier, not from an ALB. The ALB does not directly communicate with the database; the web tier instances do. Using the ALB security group as source would allow traffic from the ALB, which is unnecessary and incorrect.
★ When this WOULD be the correct answer
If the question required the database to be accessed only through an Application Load Balancer (e.g., for a proxy or connection pooling), and the web tier was not directly connecting to the database, then allowing the ALB security group as source on the database security group would be correct.
Why candidates choose this
Candidates may mistakenly think that the ALB handles all traffic, including database connections, or they may confuse the ALB security group with the web tier security group, especially if the question mentions an internet-facing ALB for the web tier.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.