Question 956 of 1,013
SY0-701 Security Architecture Practice Question
A security architect is designing the network security for a web application hosted in a public cloud environment such as AWS. The application uses an Application Load Balancer (ALB) that distributes traffic to a fleet of web servers. The web servers must only accept traffic from the ALB, and all other inbound traffic must be blocked. The ALB itself needs to accept HTTP/HTTPS traffic from anywhere on the internet. Which of the following cloud security controls should the architect configure on the web servers' network interface to best meet this requirement, assuming the cloud provider offers both stateful and stateless network filtering options?
⚠ Common exam trap
Candidates often confuse stateless network ACLs with stateful security groups, assuming a subnet-based ACL is sufficient, but they overlook that ACLs cannot filter by security group and require bidirectional rule management, making them unsuitable for this precise ALB-only access requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A stateful security group that allows inbound traffic from the ALB's security group only.
A stateful security group in AWS can reference another security group as a source, allowing inbound traffic only from instances associated with the ALB's security group. This ensures that web servers accept traffic exclusively from the ALB, while the ALB itself can accept HTTP/HTTPS from the internet via its own security group rules. Stateful filtering automatically allows return traffic, simplifying rule management and meeting the requirement precisely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A stateless network ACL that allows inbound traffic from the ALB's subnet only.
Why it's wrong here
A stateless network ACL lacks the ability to track connection state, so it cannot differentiate return traffic of an established session from new malicious inbound packets, meaning the web servers could receive unsolicited traffic from outside the ALB’s subnet if the ACL’s return-rule is too permissive. This option is tempting because stateless ACLs are commonly used for subnet-level perimeter filtering in cloud environments, and in a scenario where the ALB and web servers share the same subnet with no need to block return traffic from other sources, a stateless ACL would suffice.
- ✓
A stateful security group that allows inbound traffic from the ALB's security group only.
Why this is correct
Correct. Security groups are stateful and can use another security group as a source. This configuration cleanly allows only traffic originating from the ALB, automatically handles return traffic, and is the recommended cloud-native approach for controlling instance-level access.
- ✗
A web application firewall (WAF) that inspects all traffic for SQL injection.
Why it's wrong here
A WAF inspects HTTP/HTTPS traffic at the application layer to detect and block attacks like SQL injection or cross-site scripting. It does not control network-level access or filter traffic based on source IP/security group; it is a complementary security control, not a replacement for network-layer filtering.
When this WOULD be correct
A WAF would be correct if the question asked for a security control to protect the web application from common web exploits (e.g., SQL injection, XSS) at the application layer, without specifying source IP restrictions.
- ✗
A host-based firewall on each web server that allows traffic from the ALB's private IP address.
Why it's wrong here
A host-based firewall can be used, but it requires manual configuration on each server and does not leverage the cloud provider's built-in security group functionality. It is also harder to manage at scale compared to security groups, making it a less optimal choice for this scenario.
When this WOULD be correct
A host-based firewall would be correct if the cloud provider does not support security group references (e.g., in a non-cloud environment) or if the requirement is to allow traffic from a specific static IP address that is guaranteed not to change.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.
✓A stateful security group that allows inbound traffic from the ALB's security group only.Correct answer▾
Why this is correct
Correct. Security groups are stateful and can use another security group as a source. This configuration cleanly allows only traffic originating from the ALB, automatically handles return traffic, and is the recommended cloud-native approach for controlling instance-level access.
✗A web application firewall (WAF) that inspects all traffic for SQL injection.Wrong answer — click to see why▾
Why this is wrong here
A WAF inspects application-layer traffic for threats like SQL injection, but it does not restrict traffic sources. The requirement is to limit inbound traffic to only the ALB, which is a network access control, not a web application firewall function.
★ When this WOULD be the correct answer
A WAF would be correct if the question asked for a security control to protect the web application from common web exploits (e.g., SQL injection, XSS) at the application layer, without specifying source IP restrictions.
Why candidates choose this
Candidates may confuse a WAF's ability to filter malicious traffic with network access control, or they may think a WAF can replace network-level restrictions because it inspects all incoming traffic.
✗A host-based firewall on each web server that allows traffic from the ALB's private IP address.Wrong answer — click to see why▾
Why this is wrong here
Using the ALB's private IP address is not scalable because the ALB's IP can change (e.g., after scaling or replacement), and it does not leverage the cloud provider's native security group reference, which automatically tracks the ALB's IP changes.
★ When this WOULD be the correct answer
A host-based firewall would be correct if the cloud provider does not support security group references (e.g., in a non-cloud environment) or if the requirement is to allow traffic from a specific static IP address that is guaranteed not to change.
Why candidates choose this
Candidates may think that specifying the ALB's private IP is a precise way to restrict traffic, not realizing that cloud ALBs can have dynamic IPs and that security groups offer a more robust, managed solution.
Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.