ANS-C01 Network Security, Compliance and Governance Practice Question
A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The application must be accessible only from a specific AWS Client VPN endpoint. The security team has configured the ALB security group to allow inbound traffic from the Client VPN CIDR range, but users report that they can still access the application from outside the VPN. What is the MOST likely cause of this issue?
⚠ Common exam trap
Test-takers frequently assume the ALB security group is automatically enforced, but AWS tests the nuance that an internet-facing ALB can still receive traffic from the internet if the security group is not properly applied or if the ALB is not configured to restrict traffic to the VPN CIDR.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ALB security group is not set as the source for inbound traffic; instead, traffic reaches the ALB directly from the internet.
The ALB security group is configured to allow inbound traffic from the Client VPN CIDR range, but if the ALB itself is internet-facing (i.e., it has public IP addresses and is deployed in public subnets), traffic can bypass the security group rules if the security group is not actually applied to the ALB's network interfaces. The most likely cause is that the ALB security group is not set as the source for inbound traffic; instead, traffic reaches the ALB directly from the internet, meaning the security group rules are not being enforced on the ALB's listener. This allows users outside the VPN to access the application because the ALB accepts traffic from any source unless the security group explicitly restricts it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The ALB security group is not set as the source for inbound traffic; instead, traffic reaches the ALB directly from the internet.
Why this is correct
If the ALB security group does not restrict inbound traffic, traffic can bypass the Client VPN.
- ✗
The network ACL is stateless and requires separate inbound and outbound rules for return traffic.
Why it's wrong here
NACL statelessness is not the issue here; the problem is with the ALB security group.
- ✗
The subnet's network ACL allows inbound HTTP/HTTPS traffic from 0.0.0.0/0.
Why it's wrong here
Network ACLs apply to all traffic entering the subnet, but the ALB security group should be the primary control.
- ✗
The EC2 instances' security group allows inbound traffic from 0.0.0.0/0.
Why it's wrong here
The EC2 security group is not the first line of defense; the ALB security group controls access to the ALB.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.