mediumMultiple ChoiceObjective-mapped
CV0-004 Security Group Practice Question
A cloud administrator is configuring a new virtual private cloud (VPC) and needs to ensure that traffic between web servers and database servers is restricted to only the necessary ports. Which security approach should the administrator implement?
⚠ Common exam trap
Candidates often confuse security groups with network ACLs. Security groups are stateful and operate at the instance level, while NACLs are stateless and operate at the subnet level. For restricting traffic between specific instances (like web and database servers), security groups are the more appropriate and granular control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a security group with inbound rules for the web tier and outbound rules for the database tier.
Security groups are stateful firewalls that operate at the instance level. By configuring a security group for the database tier with an inbound rule that allows traffic only from the web tier's security group on the necessary database port (e.g., 3306 for MySQL), and a corresponding outbound rule on the web tier's security group, the administrator can restrict traffic to only the required ports. Network ACLs are stateless and require explicit rules for return traffic, making them more complex and error-prone. IAM policies manage permissions, not traffic. Flow logs only monitor traffic, they do not block it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable VPC flow logs to detect and block malicious traffic.
Why it's wrong here
VPC flow logs capture network traffic metadata but do not block or filter traffic. They are used for monitoring and analysis, not as a security control to restrict ports.
- ✓
Configure a security group with inbound rules for the web tier and outbound rules for the database tier.
Why this is correct
Correct. Configuring security groups with inbound rules on the database tier to allow only the necessary database port from the web tier's security group, and outbound rules on the web tier, effectively restricts traffic to required ports.
- ✗
Create an IAM policy to restrict access between subnets.
Why it's wrong here
IAM policies control permissions for users, groups, and roles to access AWS resources, but they do not filter network traffic between subnets or instances.
- ✗
Implement network ACLs with rules that allow only database-specific ports (e.g., 3306) from web to database and block all other traffic.
Why it's wrong here
Network ACLs are stateless and operate at the subnet level. While they can filter traffic, allowing HTTP/HTTPS (ports 80/443) from web to database would not restrict to only necessary database ports (e.g., 3306 for MySQL). Also, because NACLs are stateless, you must manually allow ephemeral return traffic, adding complexity.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CV0-004 question from scratch — 977 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.