A solutions architect is designing a VPC for a three-tier web application. The database tier must be completely isolated from the internet. The application tier needs to download software updates from the internet but should not accept incoming internet connections. <br/><br/>How should the subnets be configured?

Answer options:

Place both the database and application in private subnets. Attach an Internet Gateway to the private subnets.

Place the database in a private subnet. Place the application in a public subnet with a NAT gateway.

Place the database in a private subnet. Place the application in a private subnet with a route to a NAT gateway in a public subnet.

Place the database in an isolated subnet. Place the application in a private subnet with a route to an egress-only internet gateway.

How to approach this question

Understand the difference between public subnets (IGW) and private subnets (NAT Gateway).

Full Answer

C.Place the database in a private subnet. Place the application in a private subnet with a route to a NAT gateway in a public subnet.✓ Correct

A public subnet has a route to an Internet Gateway (IGW). A private subnet does not. To allow instances in a private subnet to initiate outbound IPv4 traffic to the internet (e.g., for updates), you use a NAT gateway placed in a public subnet.

Common mistakes

Placing the application in a public subnet, which exposes it to inbound internet traffic.

Question 04 All questions Question 06

Practice the full AWS SAA-C03 Practice Exam 4

65 questions · hints · full answers · grading

More questions from this exam

Q01A company has multiple AWS accounts in an AWS Organizations organization. The security team wants...Medium Q02An application running on Amazon EC2 instances needs to access an Amazon DynamoDB table. Both res...Easy Q03A company is designing a web application that will be hosted on AWS. The application will use an ...Medium Q04A company is building a mobile app that requires users to authenticate using their social media a...Hard Q06A company requires that all data stored in Amazon S3 must be encrypted at rest using keys managed...Easy

View all 65 questions →