ANS-C01 Network Implementation Practice Question
A company has multiple VPCs connected via a transit gateway. Each VPC has a security group that allows traffic from the other VPCs' CIDR blocks. The security group rules are getting complex. How can the company simplify security group management while maintaining the same level of security?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use managed prefix lists in security group rules.
Use managed prefix lists. Prefix lists allow you to group CIDR blocks and reference them in security group rules, simplifying management. Option B is wrong because VPC endpoints are for accessing AWS services privately, not for inter-VPC communication. Option C is wrong because AWS Network Firewall adds another layer of complexity and cost; prefix lists achieve simplification more directly. Option D is wrong because network ACLs are stateless and less granular than security groups, and they cannot use prefix lists for rule simplification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use managed prefix lists in security group rules.
Why this is correct
Prefix lists simplify by grouping CIDRs.
- ✗
Use VPC endpoints for inter-VPC communication.
Why it's wrong here
VPC endpoints are for AWS services, not VPCs.
- ✗
Deploy AWS Network Firewall to centralize rules.
Why it's wrong here
Adds another layer, not simplification.
- ✗
Replace security groups with network ACLs.
Why it's wrong here
NACLs are stateless and do not simplify.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.