ANS-C01 Network Design Practice Question
Which TWO actions can be taken to reduce the attack surface of a VPC's public subnets? (Choose 2.)
⚠ Common exam trap
AWS often tests the misconception that disabling ICMP or using network ACLs alone is sufficient to reduce attack surface, when in fact the primary reduction comes from architectural changes like moving instances to private subnets and using a load balancer, combined with security group restrictions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place web servers in private subnets and use a load balancer in a public subnet
Placing web servers in private subnets and using a load balancer in a public subnet reduces the attack surface by ensuring that the web servers have no direct internet-facing IP addresses. The load balancer acts as a single point of ingress, allowing security groups to tightly control traffic from the load balancer to the web servers, while the public subnet only exposes the load balancer's endpoints. This architecture follows AWS best practices for a multi-tier application, minimizing the number of resources directly accessible from the internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Allow all inbound traffic from the internet to the public subnets
Why it's wrong here
Increases attack surface.
- ✓
Place web servers in private subnets and use a load balancer in a public subnet
Why this is correct
Reduces direct exposure of web servers.
- ✗
Use a single subnet for all application tiers
Why it's wrong here
Increases risk of lateral movement.
- ✓
Use security groups to restrict inbound traffic to only necessary ports and IPs
Why this is correct
Least-privilege reduces attack surface.
- ✗
Disable ICMP traffic on the network ACL
Why it's wrong here
Minor impact.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.