ANS-C01 Network Security, Compliance and Governance Practice Question
A company has a VPC with a public subnet and a private subnet. They have a web server in the public subnet and a database in the private subnet. The web server needs to communicate with the database on port 3306. Security groups are configured as follows: Web server SG allows inbound HTTP/HTTPS from 0.0.0.0/0 and outbound to database SG on port 3306. Database SG allows inbound from web server SG on port 3306. However, the web server cannot connect. Network ACLs are default. What is the issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The database security group inbound rule is not correctly referencing the web server security group ID.
The web server can initiate outbound traffic because the web server's security group has an outbound rule allowing traffic to the database security group on port 3306. Security groups are stateful, so the response traffic is automatically allowed. The issue is that the database security group's inbound rule must reference the web server security group ID correctly. If the rule references a misconfigured or incorrect security group ID, the database will not accept the connection. Network ACLs are default allow, so they are not blocking traffic. Therefore, the correct answer is D.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The network ACL on the private subnet denies inbound traffic on port 3306.
Why it's wrong here
Wrong: NACLs are default allow.
- ✗
Security groups are stateful, so no outbound rule is needed; the issue is something else.
Why it's wrong here
Wrong: Outbound rule is needed for initiated traffic.
- ✗
The web server security group does not allow outbound traffic to the database.
Why it's wrong here
Wrong: It includes outbound rule to database SG.
- ✓
The database security group inbound rule is not correctly referencing the web server security group ID.
Why this is correct
Correct: The rule must reference the security group ID, not the instance ID.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.