Three-Tier Web App Security Group Rules
Short answer
ACE Configure inbound rules for the web, application, and database tiers to allow traffic from the preceding tier's security group.
Question
Key Takeaways
The core concept tested is that AWS security groups are stateful, meaning you only need to explicitly define inbound rules; return traffic is automatically allowed. A common trap is over-configuring outbound rules or misunderstanding traffic flow between tiers.
This question tests the design of secure access for a three-tier web application using stateful security groups in AWS. The correct configuration relies on allowing inbound traffic from specific source security groups while relying on default outbound rules.
Common mistake: Candidates often incorrectly select options involving explicit outbound rules (like B or D) because they mistakenly believe security groups require symmetric rule definitions for both directions, ignoring their stateful nature.
Expert Analysis
Why the Answer Is Correct
Security groups act as virtual firewalls and are inherently stateful. This means that if you allow an inbound request, the corresponding outbound response is automatically permitted without needing an explicit outbound rule. For a three-tier architecture protected by an internet-facing ALB, traffic flows from the ALB to the Web tier, then to the Application tier, and finally to the Database tier. Option A is correct because the Web tier instances must accept HTTPS traffic initiated by the ALB, specified via the ALB's security group ID. Option E is correct because the Application tier must accept HTTPS traffic initiated by the Web tier, specified via the Web tier's security group ID. Option C is correct because the Database tier must accept SQL Server traffic initiated by the Application tier, specified via the Application tier's security group ID.
Why the Other Options Are Wrong
Option B suggests configuring the Web tier to allow outbound HTTPS to 0.0.0.0/0. While this might be necessary for patching or external API calls, it is not required for the internal communication path described (ALB -> Web -> App -> DB), and default security group rules already allow all outbound IPv4 traffic. Option D suggests allowing outbound SQL Server traffic from the Database tier. Since security groups are stateful, once the inbound SQL traffic is allowed (Option C), the outbound response is automatic. Explicitly allowing outbound SQL traffic is redundant and potentially insecure if misconfigured. Furthermore, allowing outbound SQL to the Web tier makes no sense as the Web tier does not run SQL Server.
Community Comment Notes
Community consensus strongly supports ACE based on the stateful nature of security groups. As EdricHoang noted, "Security group is stateful, just need allow Inbound." Sandordini illustrated the traffic flow clearly: "ALB >>HTTPS>> WEB tier >>HTTPS>> Application >>SQL traffic>> SQL DB," confirming that only inbound rules at each stage are needed to permit this flow.
Official Reference
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-rules.html
This link opens the official vendor documentation in a new tab.
Exam Strategy
Always remember that AWS security groups are stateful. You only need to configure inbound rules to allow incoming traffic; the return traffic is handled automatically. When designing multi-tier architectures, map the traffic flow and apply inbound rules only at each destination instance type.
Frequently Asked Questions
Why don't we need explicit outbound rules?
Can I use IP addresses instead of SG IDs?
Community Votes
100% of anonymous learners picked answer ACE. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
EdricHoang 👍 6Security group is stateful, just need allow Inbound.
-
sandordini 👍 4ALB >>HTTPS>> WEB tier >>HTTPS>> Application >>SQL traffic>> SQL DB
-
Scheldon 👍 3AnswerACE: Security Group is protecting instances, it's statefull. by defoult is allowing for outgoing traffic but not incomming. hence we need to allow for inboud traffic. path looks like below ALB >>HTTPS>> WEB tier >>HTTPS>> Application >>SQL traffic>> SQL DB hence we need allow for incoming https traffic on web tier then incomming http on app tier and on the end for incomming sql traffic on DB tier
-
sk1974 👍 1Since SG's are stateful , allow inbound only. Ignore all outbound roles
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SAA-C03 Questions
Access 120 questions with complete answers and detailed explanations.
View Full SAA-C03 Practice Test →