ANS-C01 Network Security, Compliance and Governance Practice Question
A company is deploying a multi-tier web application on EC2 instances behind an Application Load Balancer (ALB). The security team requires that the web servers only accept traffic from the ALB and that the ALB only accepts traffic from the internet on ports 80 and 443. Additionally, the web servers should be able to make outbound connections to the internet for updates. Which combination of security group rules meets these requirements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ALB SG: inbound 0.0.0.0/0 on 80/443, outbound to web SG on app port; Web SG: inbound from ALB SG on app port, outbound to 0.0.0.0/0 on ephemeral
The ALB security group should allow inbound from 0.0.0.0/0 on ports 80 and 443, and outbound to the web server security group on the application port. The web server security group should allow inbound from the ALB security group on the application port, and outbound to 0.0.0.0/0 on ephemeral ports to allow outbound internet access for updates. Option B correctly describes these rules. Option A is incorrect because it suggests using NACLs instead, which are stateless and less granular for security group requirements. Option C is incorrect because the ALB outbound rule should allow traffic to web servers, not deny all. Option D is incorrect because the web server inbound should be from the ALB security group, not the VPC CIDR, to ensure only ALB traffic is received.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use network ACLs instead: public subnet NACL allow 80/443 inbound, private subnet NACL allow from ALB on app port
Why it's wrong here
Network ACLs are stateless, so they cannot track connection state; the private subnet NACL would need separate outbound rules to allow ephemeral return traffic from the ALB, which the question’s requirement for web servers to make outbound internet updates further complicates, as NACLs also cannot filter by source security group. This option is tempting because NACLs provide a subnet-level filter that can block traffic before it reaches security groups, and in a scenario where all traffic is stateless and no outbound-initiated connections need state tracking, they would suffice.
- ✓
ALB SG: inbound 0.0.0.0/0 on 80/443, outbound to web SG on app port; Web SG: inbound from ALB SG on app port, outbound to 0.0.0.0/0 on ephemeral
Why this is correct
Correct use of security group references.
- ✗
ALB SG: inbound 0.0.0.0/0 on 80/443, outbound deny all; Web SG: inbound from ALB SG on app port, outbound allow all
Why it's wrong here
ALB outbound deny all would block traffic to web servers.
- ✗
ALB SG: inbound 0.0.0.0/0 on 80/443, outbound to web SG on app port; Web SG: inbound from VPC CIDR on app port, outbound to 0.0.0.0/0 on ephemeral
Why it's wrong here
Web SG inbound from VPC CIDR is too broad; should be from ALB SG.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.