ANS-C01 Network Security, Compliance and Governance Practice Question
A company has a VPC with public and private subnets. They launch an Application Load Balancer (ALB) in the public subnets and targets in private subnets. Security requirements dictate that the targets should only accept traffic from the ALB. Which security group configuration meets this requirement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the target security group inbound rule to allow HTTP from the ALB security group ID.
Referencing the ALB security group by ID in the target security group inbound rule allows traffic only from that specific security group, ensuring that only the ALB can reach the targets. This is a best practice for securing traffic between an ALB and its targets. Option A is incorrect because allowing HTTP from 0.0.0.0/0 would permit traffic from any source, not just the ALB. Option C is incorrect because the ALB's traffic originates from its elastic network interfaces (ENIs), which are associated with the ALB security group, not a fixed public IP. Option D is incorrect because allowing traffic from the entire VPC CIDR would permit any resource in the VPC to reach the targets, not just the ALB.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set the target security group inbound rule to allow HTTP from 0.0.0.0/0.
Why it's wrong here
Allows traffic from any IP, not just the ALB.
- ✓
Set the target security group inbound rule to allow HTTP from the ALB security group ID.
Why this is correct
This allows traffic only from the ALB's elastic network interfaces.
- ✗
Set the target security group inbound rule to allow HTTP from the ALB's public IP address.
Why it's wrong here
ALB IPs can change, and this does not scale; also does not restrict to ALB only.
- ✗
Set the target security group inbound rule to allow HTTP from the VPC CIDR.
Why it's wrong here
Allows traffic from any resource in the VPC, not just ALB.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.