ANS-C01 Network Security, Compliance and Governance Practice Question
A company wants to allow a specific IP address range to access an EC2 instance in a private subnet using a bastion host. The bastion host is in a public subnet. Which security group configuration is correct?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Bastion security group: inbound SSH from the IP range. Private instance security group: inbound SSH from the bastion security group.
The bastion host, located in the public subnet, should allow inbound SSH from the specified IP address range (e.g., corporate network) because users initiate the connection from that range to the bastion. The private instance should only allow inbound SSH from the bastion host's security group, not directly from the IP range, to ensure that all access is mediated through the bastion. Option A is incorrect because the bastion should not allow SSH from the private instance; it's the other way around. Option B is incorrect because the bastion should allow SSH from the IP range, not from the private instance. Option C is incorrect because the private instance should not allow SSH directly from the IP range, as it violates the principle of using a bastion.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Bastion security group: inbound SSH from the private instance security group. Private instance security group: inbound SSH from the bastion security group.
Why it's wrong here
The bastion host should not accept inbound from the private instance; it should accept from the user.
- ✗
Bastion security group: inbound SSH from the private instance security group. Private instance security group: inbound SSH from the IP range.
Why it's wrong here
This reverses the roles and exposes the private instance to the internet directly.
- ✗
Bastion security group: inbound SSH from the IP range. Private instance security group: inbound SSH from the IP range.
Why it's wrong here
The private instance should only be accessible from the bastion, not directly from the IP range.
- ✓
Bastion security group: inbound SSH from the IP range. Private instance security group: inbound SSH from the bastion security group.
Why this is correct
This follows the principle of least privilege.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.