ANS-C01 Network Implementation Practice Question
A company is designing a VPC with a public subnet and a private subnet. The private subnet hosts an RDS database, and the public subnet hosts a web server. The web server needs to access the database. Which TWO of the following are required to allow the web server to connect to the database?
⚠ Common exam trap
The ANS-C01 exam often tests the misconception that a NAT gateway or internet gateway is required for any cross-subnet communication, but the trap here is that traffic between subnets within the same VPC uses the local route and does not require any gateway.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An inbound rule in the database's security group that references the web server's security group.
Security group rules can reference other security groups as a source, allowing traffic from any instance associated with the referenced security group (the web server's security group) without needing to specify individual IP addresses. This is the recommended AWS best practice for inter-instance communication within a VPC, as it dynamically adapts to changes in the web server's IP or scaling events.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An inbound rule in the database's security group that allows traffic from the web server's private IP address.
Why it's wrong here
Using private IP is not scalable; use security group reference.
- ✓
An inbound rule in the database's security group that references the web server's security group.
Why this is correct
Allows traffic from any instance with that SG.
- ✗
An internet gateway attached to the VPC.
Why it's wrong here
Not required for internal VPC communication.
- ✓
A route table associated with the private subnet that includes a route to the public subnet's CIDR block via the local route.
Why this is correct
Local routes are automatically added, so this is implicitly satisfied.
- ✗
A NAT gateway in the public subnet.
Why it's wrong here
Not required for internal VPC communication.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.