SCS-C02 Infrastructure Security Practice Question
A Security Engineer is designing a network architecture for a multi-tier application. The web tier must be accessible from the internet, while the application tier should only be accessible from the web tier, and the database tier only from the application tier. All tiers are in the same VPC. Which configuration meets these requirements with minimal administrative overhead?
⚠ Common exam trap
A common mix-up: candidates confuse network ACLs with security groups, assuming stateless ACLs can use logical references like security group IDs, or they overlook the administrative overhead of managing CIDR-based rules in dynamic architectures.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use security groups with inbound rules that reference the security group of the previous tier.
Security groups are stateful and can reference other security groups as a source in inbound rules, allowing traffic from any instance associated with the referenced security group regardless of IP address changes. This creates a logical dependency chain (web SG → app SG → db SG) that enforces the required tier-to-tier access with zero maintenance when instances scale or subnets change. Option D meets the requirement with minimal administrative overhead because security group references automatically adapt to dynamic environments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use network ACLs with inbound rules that reference the prefix list of the previous tier's subnets.
Why it's wrong here
Network ACLs are stateless, subnet-level filters that only accept CIDR blocks in their inbound and outbound rule definitions; they do not support referencing AWS prefix lists or security groups. A prefix list is a feature used in route tables and certain security group configurations, but it cannot be applied as a source in NACL rules. Even if it were possible, NACLs require separate inbound and outbound rules for each direction, so this approach adds complexity without providing the instance-level awareness of security groups.
- ✗
Use network ACLs with inbound rules that allow traffic from the previous tier's subnet CIDR.
Why it's wrong here
Although NACL inbound rules can specify a CIDR range such as the previous tier's subnet block, NACLs are stateless, so every inbound rule requires a matching outbound rule to allow return traffic, roughly doubling the number of rules that need to be maintained. Additionally, NACLs apply uniformly to every instance in the subnet, so you cannot restrict traffic based on instance identity or security group membership, making the rule less precise. Over time this increases operational overhead and the risk of misconfiguration compared to a stateful security group. This approach is technically possible but not the best practice for tier-to-tier traffic.
- ✗
Use security groups with inbound rules that allow traffic from the previous tier's public IP addresses.
Why it's wrong here
Security groups do allow inbound rules to reference IP addresses, but using the previous tier's public IP addresses for internal traffic introduces security and stability problems. Public IPs are often ephemeral and can change (for example, if an instance is stopped and started without a fixed Elastic IP), which would silently break the rule. More importantly, routing traffic via public IP addresses can force it through an internet gateway or NAT, exposing internal traffic to unnecessary network paths and management overhead. The recommended pattern is to reference the source security group ID, which dynamically tracks any instance associated with that group regardless of its IP address.
- ✓
Use security groups with inbound rules that reference the security group of the previous tier.
Why this is correct
Referencing the previous tier's security group as the source in an inbound rule is the correct approach because security groups are stateful and allow logical references to other security groups, not just IP addresses. When you assign an instance to the source security group, it automatically becomes allowed to reach the target tier, even if its IP address changes or new instances are added. This eliminates the need to manage CIDR blocks or public IPs and keeps security policies tightly aligned with architectural tiers. It is the AWS-recommended pattern for multi-tier security group design.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.