ANS-C01 Network Security, Compliance and Governance Practice Question
A company is designing a network security solution for a VPC that hosts a multi-tier web application. The web servers are in a public subnet, and the application servers are in a private subnet. The company wants to ensure that the web servers can only be accessed on port 443 from the internet, and the application servers can only be accessed from the web servers on port 3306. Which THREE components should be configured?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Network ACL on the public subnet allowing inbound 443 from 0.0.0.0/0 and outbound ephemeral ports
The correct components are: a security group for web servers allowing inbound 443 from 0.0.0.0/0 (E), a security group for application servers allowing inbound 3306 from the web server security group (D), and a network ACL on the public subnet allowing inbound 443 and outbound ephemeral ports (B) to add a stateless filtering layer. Option A is incorrect because the NACL rule lacks an outbound rule for return traffic, making it incomplete. Option C is unnecessary because the access control for the private subnet is best achieved with security groups, and a NACL is not required for this purpose.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Network ACL on the public subnet allowing inbound 443 from 0.0.0.0/0
Why it's wrong here
While possible, the security group already provides this; NACL is optional.
- ✓
Network ACL on the public subnet allowing inbound 443 from 0.0.0.0/0 and outbound ephemeral ports
Why this is correct
NACL on public subnet provides stateless filtering for inbound HTTPS and outbound responses.
- ✗
Network ACL on the private subnet allowing inbound 3306 from the public subnet CIDR
Why it's wrong here
NACL is stateless and can be used, but the security group is the recommended control.
- ✓
Security group for application servers allowing inbound 3306 from the web server security group
Why this is correct
This ensures only web servers can access the application servers on the database port.
- ✓
Security group for web servers allowing inbound 443 from 0.0.0.0/0
Why this is correct
This allows HTTPS traffic from the internet to the web servers.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.