ANS-C01 Network Security, Compliance and Governance Practice Question
A network engineer is designing a security group for a web application that must allow inbound HTTPS traffic from the internet and outbound traffic to an RDS MySQL database. The web servers are in a public subnet and the RDS database is in a private subnet. What is the most secure way to configure the security groups?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Web SG: inbound HTTPS from 0.0.0.0/0; outbound MySQL to DB SG. DB SG: inbound MySQL from Web SG.
The most secure configuration. The web server security group allows inbound HTTPS from the internet (0.0.0.0/0) and outbound MySQL traffic specifically to the database security group. The database security group allows inbound MySQL only from the web server security group. This ensures that only the web servers can communicate with the database, minimizing exposure. Option B is less secure because the web server security group allows outbound traffic to 0.0.0.0/0, which is overly permissive. Option C is incorrect because the database security group allows inbound MySQL from 0.0.0.0/0, exposing the database to the internet. Option D combines both overly permissive outbound and inbound rules, making it the least secure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Web SG: inbound HTTPS from 0.0.0.0/0; outbound MySQL to DB SG. DB SG: inbound MySQL from Web SG.
Why this is correct
Least privilege: web outbound only to DB, DB inbound only from web.
- ✗
Web SG: inbound HTTPS from 0.0.0.0/0; outbound 0.0.0.0/0. DB SG: inbound MySQL from Web SG.
Why it's wrong here
Web outbound should be restricted to DB only.
- ✗
Web SG: inbound HTTPS from 0.0.0.0/0; outbound MySQL to DB SG. DB SG: inbound MySQL from 0.0.0.0/0.
Why it's wrong here
DB should not allow inbound from 0.0.0.0/0.
- ✗
Web SG: inbound HTTPS from 0.0.0.0/0; outbound 0.0.0.0/0. DB SG: inbound MySQL from 0.0.0.0/0.
Why it's wrong here
Outbound 0.0.0.0/0 is too permissive; DB should not allow from 0.0.0.0/0.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.