ANS-C01 Network Security, Compliance and Governance Practice Question
A company is designing a network security architecture for a VPC that hosts a multi-tier application. The security team requires that the web tier can only be accessed from the internet, the application tier can only be accessed from the web tier, and the database tier can only be accessed from the application tier. Additionally, the team needs to ensure that no traffic can bypass these controls. Which THREE actions should the team take?
⚠ Common exam trap
A common mix-up: candidates confuse VPC Flow Logs (a monitoring tool) with a security control, or they mistakenly think that adding an internet gateway alone enforces the tier-to-tier access rules, when in fact the correct actions must directly restrict traffic flow between tiers using security group references, security group rules, and NACLs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use security group rules that reference other security groups as sources.
Security group rules can reference other security groups as sources, which allows the web tier security group to permit traffic only from the application tier security group, and the application tier security group to permit traffic only from the database tier security group. This creates a logical, stateful firewall that enforces the required traffic flow between tiers without relying on IP addresses, ensuring that no traffic can bypass the controls even if subnet configurations change.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use security group rules that reference other security groups as sources.
Why this is correct
This allows allowing traffic from instances in another security group, enforcing tier-to-tier access.
- ✓
Configure security groups to allow only necessary traffic between tiers.
Why this is correct
Security groups provide stateful filtering at the instance level.
- ✓
Configure network ACLs (NACLs) to allow only necessary traffic between subnets as a defense-in-depth measure.
Why this is correct
NACLs provide stateless filtering at the subnet level.
- ✗
Enable VPC Flow Logs on all subnets and send logs to Amazon S3.
Why it's wrong here
Flow Logs are for monitoring, not enforcement.
- ✗
Attach an internet gateway to the VPC and add a default route to the internet gateway in the web tier subnet's route table.
Why it's wrong here
This is needed for internet access but does not enforce tier-to-tier restrictions.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.