ANS-C01 Network Design Practice Question
A company is designing a network for a three-tier web application. The web tier must be accessible from the internet, the application tier must only be accessible from the web tier, and the database tier must only be accessible from the application tier. All tiers must be in private subnets except the web tier. Which combination of AWS services and routing should be used to meet these requirements?
⚠ Common exam trap
The ANS-C01 exam often tests the distinction between stateful security groups and stateless network ACLs, and the trap here is that candidates mistakenly choose network ACLs (Option C) because they think ACLs are the only way to filter traffic between subnets, overlooking that security groups can be applied to instances in private subnets and referenced by other security groups for cross-tier filtering.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use an internet gateway attached to the VPC, public subnet for web tier, private subnets for app and database tiers, and security groups to restrict traffic between tiers.
It uses an internet gateway attached to the VPC to provide internet access to the web tier in a public subnet, while the application and database tiers are placed in private subnets. Security groups are stateful and can restrict traffic between tiers by allowing inbound traffic only from the specific security group of the preceding tier (e.g., app tier SG allows traffic only from web tier SG), which meets the requirement without exposing private tiers to the internet. Network ACLs are stateless and less suitable for this granular, stateful filtering between tiers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a NAT gateway in the public subnet for web tier, and route all traffic through it.
Why it's wrong here
NAT gateway is for outbound, not inbound internet traffic.
- ✗
Use a VPN connection to the internet gateway and route traffic through a virtual private gateway.
Why it's wrong here
Unnecessary complexity; internet gateway directly provides internet access.
- ✗
Use an internet gateway, public subnet for web tier, private subnets for app and database, and network ACLs to filter traffic between tiers.
Why it's wrong here
NACLs are less flexible than security groups for stateful filtering between tiers.
- ✓
Use an internet gateway attached to the VPC, public subnet for web tier, private subnets for app and database tiers, and security groups to restrict traffic between tiers.
Why this is correct
This standard architecture meets all requirements.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.