ANS-C01 Security Group Reference Practice Question
A company is designing a security group configuration for a three-tier application. The web servers must be accessible from the internet on ports 80 and 443. The application servers must only communicate with the web servers on port 8080. The database servers must only communicate with the application servers on port 3306. Which TWO of the following are best practices for implementing this with security groups? (Choose TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the security group ID of the web tier as the source in the app tier inbound rule.
Options A and D are correct. Using security group IDs as source in inbound rules ensures that only instances with the specified security group can communicate, providing fine-grained control. Option A allows web servers to communicate with app servers on port 8080. Option D allows app servers to communicate with database servers on port 3306. Option B is incorrect because using CIDR blocks is less secure and less granular than using security group IDs. Option C is incorrect because network ACLs are stateless and operate at the subnet level, not at the instance level; security groups are more appropriate for this requirement. Option E is incorrect because assigning the same security group to all instances would allow all instances to communicate with each other, violating the principle of least privilege.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use the security group ID of the web tier as the source in the app tier inbound rule.
Why this is correct
Restricts inbound traffic to only resources with the web security group.
- ✗
Use the CIDR block of the subnet for the source security group rules.
Why it's wrong here
CIDR blocks are broader; using security group IDs is more precise.
- ✗
Use network ACLs to enforce rules at the subnet level instead of security groups.
Why it's wrong here
Network ACLs are stateless and evaluate rules in numeric order, whereas security groups are stateful and automatically allow return traffic. This scenario requires stateful filtering so that ephemeral ports for responses from application servers to web servers are permitted without explicit rules, which network ACLs cannot provide. The option is tempting because network ACLs do control traffic at the subnet boundary and are useful for broad IP-based deny rules, such as blocking a specific CIDR range across all instances, but they lack the connection tracking needed for this three-tier communication pattern.
- ✓
Use the security group ID of the app tier as the source in the database tier inbound rule.
Why this is correct
Restricts database access to only the app tier.
- ✗
Assign the same security group to all instances to simplify management.
Why it's wrong here
This would allow unnecessary communication between tiers, violating least privilege.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.