ANS-C01 Network Design Practice Question
A company has a VPC with an application load balancer (ALB) in public subnets and web servers in private subnets. The web servers must be accessible only from the ALB. What is the most secure and efficient configuration?
⚠ Common exam trap
The ANS-C01 exam often tests the misconception that using the ALB's private IP addresses is more secure than using security group references, but the trap is that IP-based rules are static and break when the ALB scales, whereas security group references are dynamic and the recommended best practice.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the web server security group to allow inbound HTTP from the ALB's security group.
Referencing the ALB's security group in the web server security group rule allows traffic only from the ALB, regardless of its IP addresses. This is the most secure and efficient configuration as it leverages AWS security group referencing, which automatically scales with the ALB's elastic network interfaces and avoids managing IP changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the web server security group to allow inbound HTTP from 0.0.0.0/0.
Why it's wrong here
Wrong: Exposes web servers to the internet.
- ✓
Configure the web server security group to allow inbound HTTP from the ALB's security group.
Why this is correct
Correct: Only ALB traffic is allowed.
- ✗
Configure the web server security group to allow inbound HTTP from the ALB's private IP addresses.
Why it's wrong here
Wrong: ALB IPs can change; not scalable.
- ✗
Configure the web server security group to allow inbound HTTP from the VPC CIDR.
Why it's wrong here
Wrong: Allows any host in the VPC, not just the ALB.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.