ANS-C01 Network Security, Compliance and Governance Practice Question
A company is designing a network security architecture for a multi-tier web application. Which THREE best practices should they implement? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use network ACLs as a stateless firewall for subnet-level traffic
The correct answers are C, D, and E. Option C is correct because network ACLs provide a stateless firewall at the subnet level. Option D is correct because databases in private subnets have no direct internet access, enhancing security. Option E is correct because security groups control traffic at the instance level. Option A is wrong because internet gateways should be attached to public subnets, not private. Option B is wrong because security groups are stateful, not stateless.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attach an internet gateway to the private subnet for outbound traffic
Why it's wrong here
Internet gateway should be attached to public subnets; use NAT for private subnets.
- ✗
Use security groups as a stateless firewall
Why it's wrong here
Security groups are stateful, not stateless.
- ✓
Use network ACLs as a stateless firewall for subnet-level traffic
Why this is correct
NACLs are stateless and provide subnet-level filtering.
- ✓
Place databases in private subnets with no direct internet access
Why this is correct
Private subnets isolate databases from the internet.
- ✓
Use security groups to control traffic at the instance level
Why this is correct
Security groups act as virtual firewalls for instances.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is designing a network security architecture for a multi-tier application. The web tier must be accessible from the internet, but the application and database tiers must not. Which TWO design choices meet these requirements? (Choose two.)
medium- A.Use a VPC Gateway Endpoint for the web tier to access the internet.
- B.Use a NAT gateway in a public subnet to provide internet access to the app and database tiers for updates.
- ✓ C.Use a security group on the web tier to allow HTTP/HTTPS from 0.0.0.0/0, and security groups on the app and database tiers that only allow traffic from the web tier security group.
- D.Place all tiers in a public subnet with a security group that restricts access to the app and database tiers.
- ✓ E.Place the web tier in a public subnet with an internet gateway in the route table, and the app and database tiers in private subnets.
Why C: The correct answers are C and E. Option C uses security groups to control traffic between tiers: the web tier security group allows HTTP/HTTPS from 0.0.0.0/0, and the app and database tier security groups only allow traffic from the web tier security group. This ensures that the application and database tiers are not directly accessible from the internet. Option E places the web tier in a public subnet with an internet gateway in its route table, so it can receive inbound traffic from the internet. The app and database tiers are placed in private subnets without a direct route to the internet gateway, so they cannot be accessed from the internet. Option A is incorrect because a VPC Gateway Endpoint is used for private connectivity to AWS services like S3 or DynamoDB, not for internet access. Option B is incorrect because a NAT gateway provides outbound internet access for private subnets, not inbound internet access to the web tier. Option D is incorrect because placing all tiers in a public subnet exposes the application and database tiers to the internet, even with restrictive security groups, because they would still have a route to the internet gateway.
Variation 2. A company is designing a network security architecture for a multi-tier application. The web tier must be accessible from the internet, while the application and database tiers must be isolated. The security team wants to minimize the attack surface. Which design should they choose?
medium- ✓ A.Place the web tier in public subnets with an internet gateway, and the app and DB tiers in private subnets. Use security groups to allow traffic only from the web tier to the app tier and from the app tier to the DB tier.
- B.Place all tiers in private subnets and use a NAT gateway for internet access.
- C.Place all tiers in the same subnet and use a single security group for all instances.
- D.Place all tiers in public subnets and use network ACLs to restrict inbound traffic to the app and DB tiers.
Why A: It follows best practices by placing the web tier in public subnets for direct internet access via an internet gateway, and isolating the application and database tiers in private subnets. Security groups are used to allow traffic only from the web tier to the app tier and from the app tier to the DB tier, implementing least privilege. Option B is wrong because placing all tiers in private subnets with only a NAT gateway does not provide inbound internet access to the web tier; NAT gateway only supports outbound traffic. Option C is wrong because placing all tiers in the same subnet with a single security group violates the principle of least privilege, allowing unnecessary communication between tiers. Option D is wrong because placing all tiers in public subnets exposes the app and DB tiers to the internet, increasing the attack surface, and network ACLs are stateless and less flexible than security groups for controlling traffic between tiers.
Variation 3. A company is designing a network security architecture for a multi-tier application. Which TWO of the following are best practices for implementing defense in depth?
medium- A.Use network ACLs as stateful firewalls at the subnet level
- ✓ B.Use security groups to control traffic between instances
- C.Attach internet gateways to all subnets for high availability
- ✓ D.Place web servers in public subnets and application servers in private subnets
- E.Use the same security group for all tiers to simplify management
Why B: The correct answers are B and D. Security groups act as stateful, instance-level firewalls, making them a best practice for controlling traffic between instances (B). Placing web servers in public subnets and application servers in private subnets provides network segmentation, a key defense-in-depth principle (D). Option A is incorrect because network ACLs are stateless, not stateful. Option C is incorrect because internet gateways should only be attached to public subnets, not all subnets. Option E is incorrect because using the same security group for all tiers reduces security boundaries.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.