ANS-C01 Network Design Practice Question
A financial services company must meet PCI DSS compliance for its VPC design. It requires that all traffic between application tiers be encrypted in transit and that no traffic can bypass the encryption. The architecture includes a public-facing Application Load Balancer (ALB), a web tier in public subnets, an app tier in private subnets, and a database tier in isolated subnets. Which design meets these requirements?
⚠ Common exam trap
A common mix-up: candidates assume terminating TLS at the ALB is sufficient for all internal traffic, overlooking the need for encryption between every tier, especially the web-to-app hop where HTTP is often mistakenly considered acceptable.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Terminate TLS at the ALB. Use HTTPS between ALB and web tier. Use TLS mutual authentication between web and app tier. Use TLS between app and database tier.
It ensures encryption in transit for all traffic between application tiers, meeting PCI DSS requirements. The ALB terminates TLS from clients, then uses HTTPS (TLS) to the web tier, mutual TLS between web and app tiers for strong authentication and encryption, and TLS between app and database tiers. This design prevents any unencrypted traffic from bypassing encryption, as every hop uses TLS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Terminate TLS at the ALB. Use HTTP between ALB and web tier. Use HTTPS between web and app tier. Use TLS between app and database tier.
Why it's wrong here
Traffic between ALB and web tier is unencrypted HTTP, violating the requirement.
- ✗
Terminate TLS at the ALB. Use HTTP between ALB and web tier. Use HTTPS between web and app tier. Use TLS between app and database tier.
Why it's wrong here
Traffic between ALB and web tier is unencrypted HTTP.
- ✓
Terminate TLS at the ALB. Use HTTPS between ALB and web tier. Use TLS mutual authentication between web and app tier. Use TLS between app and database tier.
Why this is correct
All traffic is encrypted: ALB to web (HTTPS), web to app (TLS mutual auth), app to database (TLS).
- ✗
Terminate TLS at the ALB. Use HTTPS between ALB and web tier. Use HTTP between web and app tier. Use TLS between app and database tier.
Why it's wrong here
Traffic between web and app tier is unencrypted HTTP.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.