SCS-C02 Infrastructure Security Practice Question
A security engineer is designing a network architecture for a multi-tier application. The web servers must be accessible from the internet, while the application servers must only be accessible from the web servers. Which TWO configurations should be used? (Choose TWO.)
⚠ Common exam trap
Watch out — candidates often confuse network ACLs with security groups, incorrectly assuming that a stateless network ACL with IP-based rules is the correct way to restrict traffic between tiers, when in fact security group references provide a more secure and manageable solution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place the web servers in a public subnet with a route to an internet gateway.
Placing web servers in a public subnet with a route to an internet gateway allows them to receive inbound traffic from the internet. This is the standard AWS design for internet-facing resources, where the subnet's route table directs 0.0.0.0/0 traffic to an internet gateway, enabling direct communication from the internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a NAT gateway in the private subnet for the application servers.
Why it's wrong here
NAT gateway is for outbound internet, not inbound access.
- ✓
Place the web servers in a public subnet with a route to an internet gateway.
Why this is correct
This allows internet traffic to reach the web servers.
- ✗
Use a network ACL on the application subnet to allow inbound traffic from the web subnet's IP range.
Why it's wrong here
Security groups are preferred for stateful filtering between tiers; network ACLs are less granular.
- ✗
Place the application servers in a public subnet with a route to an internet gateway.
Why it's wrong here
Application servers would be directly accessible from the internet, violating security.
- ✓
Configure the application servers' security group to allow traffic only from the web servers' security group.
Why this is correct
This restricts traffic to only from the web servers.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.