ANS-C01 Network Security, Compliance and Governance Practice Question
A company is deploying a web application behind an Application Load Balancer (ALB). The application must only accept traffic from the ALB. Which security group configuration should be used for the EC2 instances?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Allow inbound from the ALB security group on port 80
To ensure the EC2 instances only accept traffic from the ALB, the security group should reference the ALB's security group as the source. This is a best practice because the ALB acts as a proxy, and using its security group dynamically allows traffic from any ALB instance, even if the ALB's IP addresses change. Option A is insecure as it allows traffic from any source (0.0.0.0/0). Option C is not recommended because the ALB's private IP addresses can change (e.g., during scaling or replacement), making static IP rules difficult to maintain. Option D is too broad, as it would allow traffic from any resource within the VPC CIDR, not just the ALB.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Allow inbound from 0.0.0.0/0 on port 80
Why it's wrong here
Incorrect. Allowing inbound from 0.0.0.0/0 on port 80 is insecure because it permits traffic from any source, not just the ALB.
- ✓
Allow inbound from the ALB security group on port 80
Why this is correct
Correct. Allowing inbound from the ALB security group on port 80 ensures that only traffic originating from the ALB is accepted, as the ALB's security group is automatically associated with all ALB nodes.
- ✗
Allow inbound from the ALB's private IP addresses on port 80
Why it's wrong here
Incorrect. Allowing inbound from the ALB's private IP addresses on port 80 is impractical because the ALB's IP addresses are dynamic and can change without notice, making it difficult to maintain an accurate rule.
- ✗
Allow inbound from the VPC CIDR on port 80
Why it's wrong here
Incorrect. Allowing inbound from the VPC CIDR on port 80 is too broad, as it would allow traffic from any resource within the VPC (e.g., other EC2 instances) that are not necessarily the ALB.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.