SAP-C02 Design for New Solutions Practice Question
A company is designing a new multi-tier web application on AWS. The application consists of a public-facing Application Load Balancer, a fleet of EC2 instances in private subnets, and an RDS database in a private subnet. The security team requires that all traffic between the ALB and EC2 instances be encrypted, and that the EC2 instances have no direct internet access. Which TWO actions should the company take to meet these requirements? (Choose TWO.)
⚠ Common exam trap
The trap here is the distinction between 'direct internet access' and 'indirect internet access'. Candidates may incorrectly assume that having any internet access (even via a NAT gateway) violates the requirement. However, the requirement explicitly states 'no direct internet access', which means no public IP and no route to an internet gateway. A NAT gateway provides outbound-only internet access from private subnets, which is indirect and does not allow inbound connections. This is permissible and often necessary for patching and updates.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the ALB to use HTTPS listeners and the target group to use HTTPS.
Configuring the ALB with HTTPS listeners and the target group with HTTPS ensures that traffic between the ALB and EC2 instances is encrypted using TLS. This meets the security team's requirement for encrypted traffic end-to-end, as the ALB terminates the client HTTPS connection and re-encrypts traffic to the targets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure the ALB to use HTTPS listeners and the target group to use HTTPS.
Why this is correct
This encrypts traffic between the client and ALB, and between ALB and EC2 instances if the target group uses HTTPS.
- ✓
Place the EC2 instances in private subnets and use a NAT gateway for outbound internet access.
Why this is correct
Private subnets prevent direct inbound internet access, and NAT gateway allows necessary outbound traffic.
- ✗
Attach an Internet Gateway to the VPC and route traffic through it.
Why it's wrong here
An Internet Gateway provides direct internet access, which violates the requirement that EC2 instances have no direct internet access.
- ✗
Enable VPC Flow Logs on the private subnets.
Why it's wrong here
VPC Flow Logs capture network traffic information but do not encrypt traffic or block internet access.
- ✗
Configure network ACLs to deny all inbound traffic from the internet.
Why it's wrong here
Network ACLs are stateless and do not encrypt traffic. They also require careful configuration to not block legitimate traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.