ANS-C01 Network Design Practice Question
A financial services company must meet PCI DSS compliance requirements. They have a VPC with public and private subnets. The web servers in the public subnets must only accept traffic from the internet on ports 80 and 443. The application servers in the private subnets must only accept traffic from the web servers. Which network design ensures least-privilege access?
⚠ Common exam trap
Many exam-takers default to using Network ACLs for subnet-level control, forgetting that security groups provide stateful, instance-level filtering with the ability to reference other security groups, which is more aligned with least-privilege and PCI DSS requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a Network ACL on the public subnet allowing inbound ports 80 and 443 from 0.0.0.0/0, and security groups on web and app servers with the app servers' security group referencing the web servers' security group
It uses security groups for stateful, least-privilege access control. The web servers' security group allows inbound ports 80 and 443 from 0.0.0.0/0, and the app servers' security group references the web servers' security group as the source, ensuring only traffic from the web servers is permitted. This design leverages security group chaining, which automatically handles return traffic and avoids the need for explicit CIDR management, aligning with PCI DSS least-privilege requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use security groups on web servers allowing 0.0.0.0/0 on ports 80/443, and on app servers allowing the web servers' CIDR block
Why it's wrong here
Allowing the entire CIDR is not least-privilege; should reference the security group.
- ✓
Use a Network ACL on the public subnet allowing inbound ports 80 and 443 from 0.0.0.0/0, and security groups on web and app servers with the app servers' security group referencing the web servers' security group
Why this is correct
This provides least-privilege with stateful security groups and stateless NACL.
- ✗
Use a single Network ACL for both public and private subnets with allow rules for ports 80 and 443
Why it's wrong here
NACLs are stateless; a single NACL would not provide least-privilege.
- ✗
Use a single Network ACL on the private subnet allowing inbound ports 80 and 443 from the public subnet CIDR
Why it's wrong here
NACL would not distinguish between web server traffic and internet traffic that bypasses web servers.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.