ANS-C01 Network Design Practice Question
A company is designing a network for a multi-tier application. The web tier must be accessible from the internet, the application tier must be accessible only from the web tier, and the database tier must be accessible only from the application tier. Which architecture meets these requirements?
⚠ Common exam trap
The ANS-C01 exam often tests the distinction between stateful security groups and stateless network ACLs, and the trap here is that candidates assume network ACLs are the correct choice for subnet-level isolation, overlooking that security groups provide more granular, stateful control between tiers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place each tier in a separate subnet and use security groups to allow traffic between tiers
Security groups act as a stateful virtual firewall at the instance level, allowing you to specify inbound and outbound rules based on source/destination security group IDs. By placing each tier in a separate subnet and referencing the web tier's security group as the source for the application tier's inbound rule, and the application tier's security group as the source for the database tier's inbound rule, you achieve the required least-privilege access without exposing the application or database tiers to the internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place each tier in a separate subnet and use network ACLs to allow traffic between tiers
Why it's wrong here
Network ACLs are stateless and less granular than security groups.
- ✓
Place each tier in a separate subnet and use security groups to allow traffic between tiers
Why this is correct
This provides isolation and granular control using security groups.
- ✗
Place all tiers in the same subnet and use security groups to control traffic
Why it's wrong here
Same subnet cannot isolate tiers effectively; security groups can only control traffic to instances, not between tiers within the same subnet.
- ✗
Place all tiers in a public subnet and use a NAT gateway for the application and database tiers
Why it's wrong here
Public subnets expose instances to the internet, which is not desired for application and database tiers.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.