350-701 Cloud Security Practice Question
A company is deploying a multi-tier application on AWS. The web servers must be accessible from the internet only on ports 80 and 443, while the database servers should be accessible only from the web servers on port 3306. Which combination of cloud network security controls should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Security groups for each tier and a Network ACL on the database subnet
Security groups act as instance-level firewalls, allowing stateful filtering. NACLs are stateless and applied at the subnet level. Typically, security groups for each tier and NACLs for subnet-level filtering are used.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Only security groups for both tiers, no NACLs
Why it's wrong here
NACLs are not required but can be used for additional filtering.
- ✗
Only Network ACLs for both subnets, no security groups
Why it's wrong here
NACLs are stateless and cannot replace security groups; both are used.
- ✓
Security groups for each tier and a Network ACL on the database subnet
Why this is correct
Security groups control instance-level traffic; NACLs add subnet-level filtering.
- ✗
Network ACLs for the web tier and security groups for the database tier
Why it's wrong here
This mixes controls incorrectly; both tiers can use security groups.
Visual reference
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.