ANS-C01 Network Design Practice Question
A company is designing a network architecture for a multi-tier web application. The application includes a public-facing Application Load Balancer (ALB) in a public subnet, web servers in private subnets, and an Amazon RDS database in a private subnet. The company requires that the database is not directly accessible from the application servers except through specific ports, and that traffic between the web servers and the database is encrypted. Which TWO actions should the company take to meet these requirements? (Choose two.)
⚠ Common exam trap
AWS often tests the distinction between security groups (stateful, instance-level) and network ACLs (stateless, subnet-level), and candidates mistakenly choose network ACLs for fine-grained access control when security groups are the correct choice for allowing traffic based on source security group IDs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable SSL/TLS encryption for connections between the web servers and the RDS database
Enabling SSL/TLS encryption for connections between the web servers and the RDS database ensures that data in transit is encrypted, meeting the requirement for encrypted traffic. Option D is correct because configuring a security group on the RDS instance that allows inbound traffic from the web servers' security group on the database port provides a stateful, instance-level firewall rule that restricts direct access to only the web servers, without exposing the database to the public subnet or relying on IP-based rules.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place the RDS database in a public subnet with a security group that allows only the web servers' IP addresses
Why it's wrong here
Placing a database in a public subnet is a security risk; it should remain in a private subnet.
- ✗
Establish a VPC peering connection between the web servers' VPC and the RDS VPC
Why it's wrong here
The web servers and database are in the same VPC, so peering is unnecessary.
- ✓
Enable SSL/TLS encryption for connections between the web servers and the RDS database
Why this is correct
SSL/TLS encrypts data in transit, meeting the encryption requirement.
- ✓
Configure a security group on the RDS instance that allows inbound traffic from the web servers' security group on the database port
Why this is correct
This ensures that only the web servers can connect to the database on the required port, providing least-privilege access.
- ✗
Use a network ACL to restrict inbound traffic to the RDS subnet to only the web server's IP range
Why it's wrong here
Network ACLs operate at the subnet level and are stateless, providing a coarse-grained firewall that cannot enforce the required traffic encryption between web servers and the database. While tempting because ACLs can restrict inbound traffic by IP range and port, their primary use is for broad, stateless subnet-level filtering, often as an additional layer of defence or for blocking specific malicious IP addresses, rather than granular instance-level access control and encryption enforcement.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a VPC with a CIDR of 172.16.0.0/16. They have a subnet 172.16.1.0/24 for web servers and another subnet 172.16.2.0/24 for database servers. The web servers need to access the database servers on port 3306. Which configuration is required?
medium- A.Configure network ACLs to allow inbound on port 3306 from web subnet.
- B.Web SG: inbound from 0.0.0.0/0 on port 3306. DB SG: outbound to web SG on port 3306.
- ✓ C.Web SG: outbound to DB SG on port 3306. DB SG: inbound from web SG on port 3306.
- D.Web SG: outbound to DB SG on all ports. DB SG: inbound from web SG on all ports.
Why C: Security groups are stateful and control traffic at the instance level. The web server security group needs an outbound rule allowing traffic to the database security group on port 3306, and the database security group needs an inbound rule allowing traffic from the web security group on port 3306. This ensures that only the web servers can initiate connections to the database servers on the required port.
Variation 2. A company is designing a network architecture for a multi-tier web application. The application consists of web servers, application servers, and database servers. The web servers must be accessible from the internet. The application servers should only be accessible from the web servers. The database servers should only be accessible from the application servers. Which TWO actions should the company take to meet these requirements? (Choose two.)
medium- A.Use a NAT gateway to allow the web servers to access the internet
- B.Use network ACLs to restrict traffic between the tiers
- ✓ C.Place the web servers in a public subnet and the application and database servers in private subnets
- ✓ D.Use security groups to restrict traffic between the tiers
- E.Place all servers in public subnets and use security groups to restrict traffic
Why C: The correct answers are C and D. Option C: Placing web servers in a public subnet (with an internet gateway) enables internet access, while placing application and database servers in private subnets prevents direct internet access, ensuring they are only reachable from within the VPC. Option D: Security groups act as stateful firewalls at the instance level, allowing fine-grained control over traffic between tiers (e.g., allowing only HTTP from web to app servers, and only database port from app to database servers). Option A is incorrect because a NAT gateway provides outbound internet access for private instances, not inbound access for web servers. Option B is incorrect because network ACLs are stateless and less granular; while they can restrict traffic between subnets, security groups are the recommended approach for tier-to-tier access control. Option E is incorrect because placing all servers in public subnets exposes application and database servers to the internet unnecessarily, increasing security risk.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.