ANS-C01 Network Security, Compliance and Governance Practice Question
A company runs a multi-tier application on AWS. The web tier consists of EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application tier runs on EC2 instances in a separate Auto Scaling group, and the database tier uses an Amazon RDS MySQL instance. All resources are in the same VPC. The security team has identified that the application tier instances are receiving traffic from unknown IP addresses on port 22 (SSH). The team wants to ensure that only the web tier instances can communicate with the application tier on the application port (8080), and only from a specific security group. Additionally, the database tier should only accept traffic from the application tier on port 3306. Currently, the security groups are configured as follows: Web-SG allows inbound from 0.0.0.0/0 on ports 80 and 443; App-SG allows inbound from 0.0.0.0/0 on port 8080 and from 0.0.0.0/0 on port 22; DB-SG allows inbound from 0.0.0.0/0 on port 3306. The team has also noticed that the web tier instances can be accessed via SSH from the internet. Which course of action should the team take to remediate the security issues?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Update Web-SG to allow SSH from a specific management CIDR. Update App-SG to allow inbound on port 8080 from Web-SG only, and remove inbound SSH from App-SG (or restrict to management CIDR). Update DB-SG to allow inbound on port 3306 from App-SG only.
This option comprehensively addresses the security issues: restrict SSH access to the web tier from a trusted management CIDR, limit application tier access (port 8080) to only the web tier security group, and restrict database access (port 3306) to only the application tier security group. Additionally, it removes the overly permissive SSH rule on the application tier or restricts it to a management CIDR. Option A is insufficient because it leaves App-SG and DB-SG open to the internet on their respective ports. Option B removes SSH entirely, which may be needed for management, and does not address application traffic restrictions between tiers. Option D suggests using network ACLs, which are stateless and more complex; security groups are stateful and more appropriate for this use case.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Update Web-SG to allow SSH from a specific management CIDR. Leave App-SG and DB-SG as is because they are not directly accessible from the internet.
Why it's wrong here
App-SG still allows SSH from 0.0.0.0/0, which is a security risk, and DB-SG allows access from anywhere.
- ✗
Remove inbound SSH rules from all security groups and rely on AWS Systems Manager Session Manager for administrative access.
Why it's wrong here
While Session Manager is a good practice, the question asks for a course of action to remediate the issues; this option does not address the application tier and database tier inbound rules.
- ✓
Update Web-SG to allow SSH from a specific management CIDR. Update App-SG to allow inbound on port 8080 from Web-SG only, and remove inbound SSH from App-SG (or restrict to management CIDR). Update DB-SG to allow inbound on port 3306 from App-SG only.
Why this is correct
This properly restricts traffic to only necessary sources and removes open SSH access.
- ✗
Use network ACLs on the subnets to restrict traffic between tiers instead of security groups.
Why it's wrong here
Network ACLs operate at the subnet level and are stateless, meaning they cannot enforce traffic rules based on source security group IDs, which is the explicit requirement for restricting application-tier access to only the web tier’s security group. This option is tempting because network ACLs are commonly used for subnet-level traffic filtering as a defence-in-depth layer, and they would be the correct choice if the requirement were to block or allow traffic based on IP address ranges or ports across entire subnets, rather than requiring security-group-based identity.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.