ANS-C01 Network Design Practice Question
A company is deploying a multi-tier application in a VPC. The web servers must be accessible from the internet, while the application servers must only be accessible from the web servers. Which architecture meets these requirements?
⚠ Common exam trap
AWS often tests the misconception that Security Groups alone can fully isolate traffic in a public subnet, but the trap here is that instances in public subnets still have public IP addresses and are reachable from the internet unless explicitly blocked by a Network ACL or Security Group, which is less reliable than using private subnets with no IGW route.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Web servers in public subnets with an Internet Gateway; application servers in private subnets with a route to the NAT Gateway.
It places web servers in public subnets with an Internet Gateway (IGW) for direct internet access, while application servers reside in private subnets that lack a direct route to the IGW. The private subnets have a route to a NAT Gateway, allowing the application servers to initiate outbound internet connections (e.g., for updates) without being reachable from the internet. Security Groups on the application servers can further restrict inbound traffic to only the web servers' security group, ensuring the application tier is isolated.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
All servers in private subnets; use a load balancer in a public subnet.
Why it's wrong here
Web servers in private subnets cannot be directly accessed from the internet.
- ✗
Web servers in private subnets; application servers in public subnets with an Internet Gateway.
Why it's wrong here
Application servers would be exposed to the internet.
- ✗
All servers in public subnets; use Security Groups to restrict access.
Why it's wrong here
All servers would have public IPs and be potentially exposed.
- ✓
Web servers in public subnets with an Internet Gateway; application servers in private subnets with a route to the NAT Gateway.
Why this is correct
This provides internet access to web servers while keeping app servers private.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is designing a VPC for a three-tier web application. The web servers must be accessible from the internet, while the application and database servers must be isolated. Which subnet design should the company use?
easy- A.A single subnet for all tiers with network ACLs to isolate traffic
- ✓ B.Public subnet for web servers, private subnets for application and database servers
- C.Private subnets for all tiers
- D.Public subnets for all tiers
Why B: It uses a public subnet with an Internet Gateway (IGW) for the web servers to receive inbound traffic from the internet, while placing the application and database servers in private subnets with no direct internet route. This design enforces the principle of least privilege by isolating sensitive tiers, using NAT Gateway or VPC endpoints for outbound traffic if needed, and relying on security groups and network ACLs for fine-grained access control.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.