A three-tier app must allow the web tier's instances to reach the app tier on port 8080, and nothing else. Instances in both tiers change frequently due to Auto Scaling. What's the most maintainable security-group design?
A.List every app-tier instance's private IP in a web-tier outbound rule
Hardcoded IPs break every time Auto Scaling replaces instances.
B.Allow 0.0.0.0/0 inbound on port 8080 in the app tier's security group
0.0.0.0/0 opens the port to anything that can reach the subnet — too broad.
C.Reference the web tier's security group as the source in the app tier's inbound port-8080 rule
Correct. SG-to-SG references track group membership automatically.
D.Add a NACL allow rule for the subnet
A NACL subnet rule can't distinguish instance roles; it controls subnets, not tiers.
Why this answer
Security groups can reference other security groups as a source — so only members of the web tier's group can reach the app tier's port, and Auto Scaling membership changes need no rule edits.
Correct answer: C · Last reviewed 2026-10-25
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Network Security practice session.
Practice Network Security