SCS-C02 Infrastructure Security Practice Question
A company is designing a VPC with public and private subnets. The web servers in the public subnets must be accessible from the internet on port 443, but the database servers in the private subnets should only be accessible from the web servers on port 3306. Which combination of security group rules and network ACL rules should be used to meet these requirements with the least administrative overhead?
⚠ Common exam trap
It's easy for candidates to confuse the stateful nature of security groups with the stateless nature of network ACLs, leading them to incorrectly add outbound rules (Option B) or choose network ACLs (Options C and D) when security group references provide a simpler, more scalable solution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use security groups for all tiers; add an inbound rule to the database security group allowing traffic from the web security group on port 3306.
Security groups are stateful and support referencing other security groups as a source, which allows you to permit traffic from the web security group to the database security group on port 3306 without needing to specify IP addresses. This approach minimizes administrative overhead as security group rules are automatically applied to all instances associated with the group, and changes propagate without updating network ACLs or CIDR ranges. The web security group can have an inbound rule allowing HTTPS (port 443) from the internet (0.0.0.0/0), while the database security group only allows inbound MySQL/Aurora (port 3306) from the web security group, meeting the access requirements precisely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use security groups for all tiers; add an inbound rule to the database security group allowing traffic from the web security group on port 3306.
Why this is correct
Security groups are stateful and support referencing other security groups as a source, allowing an inbound rule on the database security group to permit traffic only from instances associated with the web security group on port 3306. This removes the need to track instance IP addresses or rely on broad CIDR ranges, and it automatically scales with the web tier's launch or termination. Because security groups are stateful, return traffic from the database to the web tier is implicitly allowed, reducing operational overhead while maintaining least-privilege access.
- ✗
Use security groups for all tiers; add an inbound rule to the web security group allowing internet traffic on port 443, and add an outbound rule to the web security group allowing traffic to the database security group on port 3306.
Why it's wrong here
This allows outbound from web to database, but inbound to database must be allowed on the database security group. The outbound rule on the web SG alone is insufficient because the database SG controls inbound.
- ✗
Use security groups for the web tier and network ACLs for the database tier; add an inbound rule to the database network ACL allowing traffic from the web subnet CIDR on port 3306.
Why it's wrong here
Using a network ACL for the database tier introduces unnecessary overhead because NACLs are stateless, meaning you must configure both inbound and outbound rules to support the bidirectional MySQL traffic on port 3306. The proposed inbound rule allows traffic from the entire web subnet CIDR, which is broader than necessary and includes any host in that subnet, not just the web security group's instances. Additionally, NACL rules are evaluated in numeric order and require manual management of IP address changes, making security groups the more precise and lower-maintenance choice for this traffic flow.
- ✗
Use security groups for the web tier and network ACLs for the database tier; add an inbound rule to the database network ACL allowing all traffic from the web security group.
Why it's wrong here
This option is technically invalid because network ACLs cannot reference security groups as a source or destination; NACL rules operate exclusively on IP addresses, port numbers, and protocols at the subnet boundary. Attempting to use the web security group as the source would cause the rule to be ineffective or rejected, and allowing all traffic would violate the principle of least privilege by exposing the database to any protocol and port from anywhere in that source. The correct approach is to use a security group on the database that explicitly allows inbound TCP 3306 from the web security group, preserving stateful filtering and instance-level granularity.
Visual reference
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.