ANS-C01 Network Design Practice Question
A company is designing a network architecture for a multi-tier web application. The application consists of web servers, application servers, and database servers. The web servers must be accessible from the internet. The application servers should only be accessible from the web servers. The database servers should only be accessible from the application servers. Which TWO actions should the company take to meet these requirements? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place the web servers in a public subnet and the application and database servers in private subnets
The correct answers are C and D. Option C: Placing web servers in a public subnet (with an internet gateway) enables internet access, while placing application and database servers in private subnets prevents direct internet access, ensuring they are only reachable from within the VPC. Option D: Security groups act as stateful firewalls at the instance level, allowing fine-grained control over traffic between tiers (e.g., allowing only HTTP from web to app servers, and only database port from app to database servers). Option A is incorrect because a NAT gateway provides outbound internet access for private instances, not inbound access for web servers. Option B is incorrect because network ACLs are stateless and less granular; while they can restrict traffic between subnets, security groups are the recommended approach for tier-to-tier access control. Option E is incorrect because placing all servers in public subnets exposes application and database servers to the internet unnecessarily, increasing security risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a NAT gateway to allow the web servers to access the internet
Why it's wrong here
Incorrect; NAT gateway is for private instances to access internet, not for web servers.
- ✗
Use network ACLs to restrict traffic between the tiers
Why it's wrong here
Network ACLs are stateless and operate at the subnet level, making them unsuitable for the granular, instance-level, stateful traffic filtering required for dynamic multi-tier applications. They cannot easily manage the ephemeral ports needed for return traffic between specific servers. This option is tempting as ACLs do restrict traffic, and they are appropriate for broad, stateless subnet-level filtering, such as blocking entire IP ranges or as an additional, coarse-grained security layer for an entire subnet.
- ✓
Place the web servers in a public subnet and the application and database servers in private subnets
Why this is correct
Correct; this provides proper isolation.
- ✓
Use security groups to restrict traffic between the tiers
Why this is correct
Correct; security groups provide stateful filtering.
- ✗
Place all servers in public subnets and use security groups to restrict traffic
Why it's wrong here
Incorrect; all servers should not be in public subnets.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.