ANS-C01 Network Security, Compliance and Governance Practice Question
A company has a production VPC with a public subnet and a private subnet. The private subnet hosts a database instance that should be accessible only from the application servers in the same VPC. The security team has configured the database security group to allow inbound traffic on port 3306 from the application security group. However, the application servers cannot connect to the database. The network ACLs are configured with default allow all rules. What is the MOST likely cause?
⚠ Common exam trap
A common misconception is that security groups need outbound rules for return traffic, but they are stateful and automatically allow it. Instead, the issue lies with stateless NACLs, which can block traffic if configured with deny rules.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The network ACL on the private subnet has an inbound deny rule for port 3306.
The most likely cause is that the network ACL (NACL) on the private subnet has an inbound deny rule for port 3306. NACLs are stateless and evaluate rules in order; even though the default NACL allows all traffic, a custom NACL applied to the subnet could have a deny rule that overrides the default allow. This would block the inbound traffic from the application servers to the database on port 3306, preventing connectivity. Option B is incorrect because security groups are stateful; outbound rules do not affect return traffic for allowed inbound connections. Options A and D are irrelevant to the connectivity issue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The database instance does not have an IAM role assigned.
Why it's wrong here
IAM roles are not required for network connectivity; they grant permissions to AWS services, not network access.
- ✗
The database security group does not allow outbound traffic for the response.
Why it's wrong here
Security groups are stateful, so outbound rules do not block return traffic for allowed inbound connections. This is not the cause.
- ✓
The network ACL on the private subnet has an inbound deny rule for port 3306.
Why this is correct
NACLs are stateless; a deny rule on port 3306 inbound would block traffic from the application servers to the database, overriding the security group allow.
- ✗
The VPC is peered with another VPC that has overlapping CIDR.
Why it's wrong here
VPC peering with overlapping CIDR does not prevent connectivity within the same VPC; it affects inter-VPC routing.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.