Question 397 of 1,570
SCS-C02 Infrastructure Security Practice Question
A security engineer is designing a multi-tier web application. The application uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances in private subnets. The engineer needs to ensure that the EC2 instances only accept traffic from the ALB and not from any other source. Which security group configuration should the engineer use?
⚠ Common exam trap
Watch out — candidates often think they need to use the ALB's public IP address (Option A) or the VPC CIDR (Option B) as the source, not realizing that security group referencing is the correct and more secure method for allowing traffic from an ALB to backend instances.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Allow inbound HTTP traffic from the ALB's security group on the EC2 instances' security group.
It uses a security group reference to allow inbound HTTP traffic from the ALB's security group. This ensures that only traffic originating from the ALB (which has that security group attached) can reach the EC2 instances, regardless of the ALB's IP addresses or changes in the VPC CIDR. This is the recommended AWS best practice for securing traffic between an ALB and backend instances.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Allow inbound HTTP traffic from the ALB's public IP address on the EC2 instances' security group.
Why it's wrong here
The ALB's public IP can change, and this does not account for the ALB's private IP.
- ✗
Allow inbound HTTP traffic from the VPC CIDR range on the EC2 instances' security group.
Why it's wrong here
This allows traffic from any resource in the VPC, not just the ALB.
- ✓
Allow inbound HTTP traffic from the ALB's security group on the EC2 instances' security group.
Why this is correct
This restricts traffic to only the ALB.
- ✗
Allow inbound HTTP traffic from 0.0.0.0/0 on the EC2 instances' security group.
Why it's wrong here
This allows traffic from any source, not just the ALB.
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jul 4, 2026
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.