ANS-C01 Network Security, Compliance and Governance Practice Question
A company's security team is designing a network architecture for a multi-tier application. The web tier must be accessible from the internet, while the application and database tiers must be isolated. Which TWO actions should be taken to meet these requirements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place application and database servers in private subnets
A public subnet with an Internet Gateway allows web servers to be accessed from the internet. Private subnets isolate application and database tiers from direct internet access. Option A is incorrect because placing application and database servers in a public subnet exposes them to the internet. Option B is incorrect because web servers in a private subnet cannot be reached from the internet; NAT Gateway only provides outbound access. Option E is incorrect because security group rules alone do not provide subnet-level isolation; they are used for instance-level traffic control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place application and database servers in a public subnet with a VPC endpoint
Why it's wrong here
Public subnet would expose them to internet; VPC endpoints are not for internet access.
- ✗
Place web servers in a private subnet with a NAT Gateway
Why it's wrong here
Private subnet with NAT does not allow inbound internet traffic.
- ✓
Place application and database servers in private subnets
Why this is correct
Private subnets isolate them from direct internet access.
- ✓
Place web servers in a public subnet with an Internet Gateway
Why this is correct
Public subnet with IGW allows inbound internet traffic to web servers.
- ✗
Use security group rules to allow traffic only between tiers
Why it's wrong here
Security groups control traffic but do not provide subnet-level isolation; they are complementary.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.