ANS-C01 Application Load Balancer (ALB) Practice Question
A company is deploying a new application in a VPC. The application consists of EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The ALB must only receive traffic from the company's on-premises network via an AWS Site-to-Site VPN. Which THREE steps should the network engineer take to meet this requirement?
⚠ Common exam trap
A common misconception is that an ALB must be placed in a public subnet to be reachable via a Site-to-Site VPN. However, by using a Transit Gateway, the ALB can remain in a private subnet while still receiving traffic from the on-premises network. Security must be enforced at both the network ACL and security group levels.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place the ALB in a private subnet and use a Transit Gateway.
To restrict ALB traffic exclusively to the on-premises network via Site-to-Site VPN, three steps are needed. First, place the ALB in a private subnet to keep it internal and use a Transit Gateway to route VPN traffic to private subnets. Second, configure the network ACL on the ALB's subnet to allow inbound traffic only from the on-premises CIDR. Third, configure the ALB's security group to allow inbound traffic from the same CIDR. Option B (public subnet) is incorrect because it would make the ALB internet-facing, which is unnecessary and less secure. Option E (NAT gateway) is irrelevant for inbound traffic restriction.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Place the ALB in a private subnet and use a Transit Gateway.
Why this is correct
Correct. Placing the ALB in a private subnet keeps it internal, and using a Transit Gateway allows the VPN to route traffic to private subnets efficiently.
- ✗
Place the ALB in a public subnet.
Why it's wrong here
Incorrect. Placing the ALB in a public subnet would expose it to the internet, which is not required and could introduce security risks. The ALB can be accessed via VPN while in a private subnet.
- ✓
Configure the network ACL on the ALB's subnet to allow inbound traffic from the on-premises CIDR range.
Why this is correct
Correct. The network ACL at the subnet level provides a stateless firewall to restrict inbound traffic to the on-premises CIDR.
- ✓
Configure the ALB security group to allow inbound traffic from the on-premises CIDR range.
Why this is correct
Correct. The security group on the ALB provides stateful filtering to allow inbound traffic only from the on-premises CIDR.
- ✗
Create a NAT gateway in the public subnet for outbound traffic.
Why it's wrong here
Incorrect. A NAT gateway is used for outbound traffic from private subnets to the internet, not for restricting inbound traffic from on-premises.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.