Web tier → app tier → database tier. You want the app tier to accept traffic ONLY from web-tier instances, and the DB tier only from app-tier instances — without hardcoding IPs. What mechanism expresses this?
A.NACL rules per subnet
NACLs work on CIDR ranges — you'd maintain subnet math, not tier semantics.
B.Security group rules that reference other security groups as the source
Correct. SG-to-SG referencing tracks tier membership automatically.
C.Route table restrictions between subnets
Route tables steer traffic — they don't filter per-instance access.
D.Separate VPCs per tier with peering
Multiple VPCs add routing complexity when one VPC with layered SGs suffices.
Why this answer
Security groups can reference other SGs as a source — the app SG allows inbound from the web SG regardless of IPs, so instances inherit access simply by membership. This is the canonical tiered-access pattern.
Correct answer: B · Last reviewed 2026-11-01
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Network Security practice session.
Practice Network Security