ANS-C01 Network Design Practice Question
A company has a large VPC with multiple workloads. They need to isolate development and production environments within the same VPC, but allow limited communication between them via specific ports. Which approach meets these requirements?
⚠ Common exam trap
Test-takers frequently confuse the stateless behavior of network ACLs with the stateful behavior of security groups, leading them to choose Option A or B, thinking that security groups can enforce subnet-level isolation or that a single subnet with ACLs can separate internal traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create separate subnets for dev and prod, use network ACLs to allow only specific ports between them.
Placing development and production workloads in separate subnets allows you to apply stateless network ACLs at the subnet boundary. Network ACLs can explicitly allow only specific ports (e.g., TCP 443) between the subnets while blocking all other traffic, providing a clear isolation boundary within the same VPC. Security groups alone cannot enforce inter-subnet filtering because they are stateful and applied at the instance level, not at the subnet edge.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place dev and prod in the same subnet and use security groups to filter traffic.
Why it's wrong here
Security groups cannot isolate traffic within the same subnet; they apply to instances.
- ✗
Use a single subnet and rely on network ACLs to separate traffic.
Why it's wrong here
Network ACLs are applied at subnet boundaries, not within a subnet.
- ✓
Create separate subnets for dev and prod, use network ACLs to allow only specific ports between them.
Why this is correct
Network ACLs are stateless and can control traffic between subnets effectively.
- ✗
Create two VPCs and use VPC peering to allow communication.
Why it's wrong here
This adds complexity and is not necessary if isolation can be achieved within one VPC.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.