ANS-C01 Network Implementation Practice Question
A company has a VPC with an Application Load Balancer (ALB) in front of a fleet of EC2 instances. The security group for the EC2 instances must allow traffic only from the ALB. Which source should be specified in the security group inbound rule?
⚠ Common exam trap
Test-takers frequently assume they need to use the ALB's IP addresses or subnet CIDR, not realizing that AWS security groups can reference other security groups as a source, which is the most secure and scalable method for this scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ID of the ALB's security group
You can reference the ALB's security group ID as the source in the EC2 instances' security group inbound rule. This allows traffic from any network interface that is associated with the ALB's security group, regardless of the ALB's IP addresses or subnets. This is the recommended AWS best practice for controlling traffic between an ALB and its target instances, as it automatically adapts to changes in the ALB's underlying infrastructure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The ALB's public IP address
Why it's wrong here
ALB public IPs can change, and using IPs is less flexible.
- ✗
The subnet CIDR block of the ALB's subnets
Why it's wrong here
This allows traffic from all instances in those subnets, not just the ALB.
- ✓
The ID of the ALB's security group
Why this is correct
Referencing the ALB's security group as a source ensures only traffic from the ALB is allowed.
- ✗
The VPC CIDR block
Why it's wrong here
Using the VPC CIDR block would permit traffic from any resource within the VPC, including compromised instances or unauthorised subnets, not solely from the ALB’s elastic network interfaces. This option is tempting because the VPC CIDR is a common, broad source for allowing internal traffic between VPC resources, and it would be correct if the requirement were to permit all intra-VPC communication rather than restricting ingress to a specific security principal.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a VPC with an application load balancer (ALB) in public subnets and EC2 instances in private subnets. The EC2 instances must only accept traffic from the ALB. Which security group configuration achieves this?
easy- A.Allow inbound traffic from 0.0.0.0/0 on the application port.
- B.Allow inbound traffic from the VPC CIDR on the application port.
- C.Allow inbound traffic from the private subnet CIDR on the application port.
- ✓ D.Allow inbound traffic from the ALB's security group on the application port.
Why D: Referencing the ALB's security group as the source in the EC2 instances' inbound rule ensures that only traffic originating from the ALB is allowed. This leverages AWS security group referencing, which dynamically resolves to the private IP addresses of the ALB's elastic network interfaces (ENIs), providing a secure and scalable solution without exposing the instances to broader network ranges.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.