DVA-C02 Security Practice Question
A developer is designing a multi-tier application. The web tier must be accessible from the internet, while the application tier should only be accessible from the web tier. Which security group configuration meets these requirements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Web tier SG allows inbound 0.0.0.0/0 on port 80; Application tier SG allows inbound from web tier SG on port 8080.
Application tier security group should allow inbound traffic only from the web tier security group, not from the internet or CIDR ranges.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Web tier SG allows inbound from application tier SG.
Why it's wrong here
This inverts the required trust direction: the internet-facing web tier must accept inbound traffic from the public internet, and it is the application tier that should restrict inbound access to only the web tier's security group, not the other way around.
- ✓
Web tier SG allows inbound 0.0.0.0/0 on port 80; Application tier SG allows inbound from web tier SG on port 8080.
Why this is correct
This correctly layers access: the web tier's security group permits inbound traffic from any source (0.0.0.0/0) on the public-facing port, while the application tier's security group references the web tier's security group ID as its only allowed inbound source, so app-tier instances are reachable exclusively from web-tier instances.
- ✗
Both SGs allow inbound 0.0.0.0/0 on necessary ports.
Why it's wrong here
Opening the application tier's security group to 0.0.0.0/0 exposes internal business logic directly to the public internet, defeating the entire purpose of a multi-tier architecture where the application layer should be shielded behind the web tier.
- ✗
Web tier SG allows inbound 0.0.0.0/0 on port 80; Application tier SG allows inbound from 0.0.0.0/0 on port 443.
Why it's wrong here
Allowing 0.0.0.0/0 inbound on the application tier's security group makes it internet-reachable on port 443 directly, bypassing the web tier entirely and violating the stated requirement that the application tier be accessible only from the web tier.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 1,135 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.