How to Use Security Group References to Control Traffic in Multi-Tier Applications
A company has a VPC with a public subnet hosting a web server and a private subnet hosting a database. The web server must connect to the database on port 3306. Security groups are configured: Web SG allows inbound HTTP/HTTPS from 0.0.0.0/0 and outbound to DB SG on port 3306. DB SG allows inbound from Web SG on port 3306. Network ACLs are default. The web server can connect to the database, but the security team notices that the database is also receiving connections from an unexpected IP address. What is the MOST likely cause?
Quick Answer
The answer is an unauthorized EC2 instance launched with the same Web security group attached. This is correct because security group referencing works by allowing traffic from any resource that has the referenced security group assigned, regardless of whether that resource is authorized or not. When the DB SG’s inbound rule references the Web SG, it effectively grants port 3306 access to every instance—both legitimate and rogue—that carries that security group. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this scenario tests your understanding that security group references are identity-based, not IP-based, and that they do not validate the source instance’s purpose or ownership. A common trap is assuming network ACLs or stateful filtering cause the issue, but the real vulnerability lies in the implicit trust of the security group reference itself. Memory tip: think of a security group reference as a “keycard” that opens a door for anyone wearing the same badge, not just the intended person.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An unauthorized EC2 instance has been launched with the same Web security group attached.
Security groups are stateful and allow outbound responses automatically, but the unexpected connections are likely due to another instance with the Web SG attached. The DB SG inbound rule allows traffic from the Web SG, which applies to all instances with that SG, including unauthorized ones. Option A is incorrect because default NACLs allow all traffic, but inbound NACL rules could be the issue if they were modified, but they are default. Option B is incorrect because the DB SG inbound rule is from the Web SG, not 0.0.0.0/0. Option D is incorrect because while security groups are stateful, that does not cause unexpected connections; it only ensures return traffic is allowed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The network ACL on the private subnet allows inbound traffic from all IPs.
Why it's wrong here
Wrong: NACLs are default allow, but the issue is about SG.
- ✗
The DB security group has an inbound rule allowing traffic from 0.0.0.0/0 on port 3306.
Why it's wrong here
Wrong: The rule allows only from Web SG.
- ✓
An unauthorized EC2 instance has been launched with the same Web security group attached.
Why this is correct
Correct: Any instance with Web SG can access DB due to the inbound rule.
- ✗
Security groups are stateful, so the DB SG automatically allows inbound responses.
Why it's wrong here
Wrong: Statefulness does not allow new inbound connections.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a VPC with multiple security groups. An EC2 instance in security group A needs to communicate with an RDS instance in security group B on port 3306. The security team wants to minimize exposure. What should the inbound rule in security group B be?
hard- A.Allow inbound TCP 3306 from the CIDR block of the subnet where the EC2 instance resides
- B.Allow inbound TCP 3306 from 0.0.0.0/0
- C.Allow inbound TCP 3306 from the private IP address of the EC2 instance
- ✓ D.Allow inbound TCP 3306 from security group A
Why D: Referencing security group A as the source allows inbound traffic on port 3306 from any instance associated with security group A, which is the most specific and secure method. This approach automatically adapts if instances in security group A change IP addresses. Option A is wrong because it allows traffic from any instance in the specified subnet, not just those that need to communicate. Option B is wrong because it allows traffic from all IP addresses, violating the principle of least privilege. Option C is wrong because it ties the rule to a single instance's IP address, which can change and requires updates if the instance is replaced.
Variation 2. A company has a VPC with a public subnet and a private subnet. They have a web server in the public subnet and a database in the private subnet. The web server needs to communicate with the database on port 3306. Security groups are configured as follows: Web server SG allows inbound HTTP/HTTPS from 0.0.0.0/0 and outbound to database SG on port 3306. Database SG allows inbound from web server SG on port 3306. However, the web server cannot connect. Network ACLs are default. What is the issue?
medium- A.The network ACL on the private subnet denies inbound traffic on port 3306.
- B.Security groups are stateful, so no outbound rule is needed; the issue is something else.
- C.The web server security group does not allow outbound traffic to the database.
- ✓ D.The database security group inbound rule is not correctly referencing the web server security group ID.
Why D: The web server can initiate outbound traffic because the web server's security group has an outbound rule allowing traffic to the database security group on port 3306. Security groups are stateful, so the response traffic is automatically allowed. The issue is that the database security group's inbound rule must reference the web server security group ID correctly. If the rule references a misconfigured or incorrect security group ID, the database will not accept the connection. Network ACLs are default allow, so they are not blocking traffic. Therefore, the correct answer is D.
Variation 3. A company has a VPC with public and private subnets. The public subnet hosts a web server that must be accessible from the internet. The private subnet hosts a database that should only be accessible from the web server. Which security group configuration should be used?
easy- ✓ A.Database security group: inbound rule allowing traffic from the web server security group on the database port
- B.Database security group: inbound rule allowing traffic from the VPC CIDR on the database port
- C.Database security group: inbound rule allowing traffic from the web server's private IP on the database port
- D.Database security group: inbound rule allowing traffic from 0.0.0.0/0 on the database port
Why A: Security groups can reference other security groups as sources. Option A is correct because it allows traffic from the web server's security group, which ensures only the web server can access the database. Option B is wrong because it allows all traffic from the VPC CIDR, which is too permissive. Option C is wrong because it allows traffic from a specific private IP, but that IP might change and is less flexible than using the security group. Option D is wrong because it allows traffic from 0.0.0.0/0, which permits inbound traffic from any IP address, making the database publicly accessible.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.