Security Group Referencing ALB's Security Group for EC2 Instances
A company has a VPC with an application load balancer (ALB) in public subnets and EC2 instances in private subnets. The EC2 instances must only accept traffic from the ALB. Which security group configuration achieves this?
Quick Answer
The correct answer is to allow inbound traffic from the ALB's security group on the application port. This configuration works because security group referencing uses the source security group's ID as a logical rule, meaning the EC2 instance's security group will only accept traffic that originates from any resource associated with the ALB's security group—regardless of the ALB's IP address or subnet. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this concept tests your understanding of stateful security group behavior versus network ACLs, and it often appears in scenarios requiring least-privilege access between tiers. A common trap is confusing security group IDs with CIDR blocks: allowing the VPC CIDR or private subnet CIDR would permit traffic from any instance in that range, not exclusively the ALB. Remember the key distinction: security group rules follow logical identities, not IP addresses. Memory tip: think of it as a "group handshake"—only members of the ALB's security group can knock on the EC2's door.
⚠ Common exam trap
The ANS-C01 exam often tests the misconception that allowing traffic from the VPC CIDR or private subnet CIDR is sufficient, but the trap here is that those rules are too broad and do not restrict traffic exclusively to the ALB, which is a common oversight when candidates confuse network-level access with application-level access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Allow inbound traffic from the ALB's security group on the application port.
Referencing the ALB's security group as the source in the EC2 instances' inbound rule ensures that only traffic originating from the ALB is allowed. This leverages AWS security group referencing, which dynamically resolves to the private IP addresses of the ALB's elastic network interfaces (ENIs), providing a secure and scalable solution without exposing the instances to broader network ranges.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Allow inbound traffic from 0.0.0.0/0 on the application port.
Why it's wrong here
This allows traffic from anywhere, not just the ALB.
- ✗
Allow inbound traffic from the VPC CIDR on the application port.
Why it's wrong here
This allows traffic from all instances in the VPC, including potentially malicious ones.
- ✗
Allow inbound traffic from the private subnet CIDR on the application port.
Why it's wrong here
This allows traffic from any instance in the private subnet, not just the ALB.
- ✓
Allow inbound traffic from the ALB's security group on the application port.
Why this is correct
This ensures only traffic from the ALB is accepted.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a VPC with an Application Load Balancer (ALB) in front of a fleet of EC2 instances. The security group for the EC2 instances must allow traffic only from the ALB. Which source should be specified in the security group inbound rule?
easy- A.The ALB's public IP address
- B.The subnet CIDR block of the ALB's subnets
- ✓ C.The ID of the ALB's security group
- D.The VPC CIDR block
Why C: You can reference the ALB's security group ID as the source in the EC2 instances' security group inbound rule. This allows traffic from any network interface that is associated with the ALB's security group, regardless of the ALB's IP addresses or subnets. This is the recommended AWS best practice for controlling traffic between an ALB and its target instances, as it automatically adapts to changes in the ALB's underlying infrastructure.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.