ANS-C01 Question 232
Select 4You are designing a multi-tier application that runs in an Amazon VPC. The application has three layers: a public-facing web tier, an internal application tier, and a database tier. Your security requirements state that the web tier can be accessed from the internet, the application tier should only be accessible by the web tier, and the database tier should only be accessible by the application tier. Which combination of VPC networking configurations will meet these requirements?
- A
Place the web tier in a public subnet with an Internet Gateway attached to the VPC.
- B
Place the application tier in a private subnet with a route to the Internet Gateway.
- C
Place the database tier in a private subnet without direct internet access.
- D
Use security groups to allow web tier instances to communicate only with application tier instances.
- E
Use Network ACLs to block all traffic between the web tier and the database tier.
Show answer and explanation
Correct answers: A, C, D, E
Explanation
To meet the security requirements of the multi-tier application, the web tier must be in a public subnet with internet access via an Internet Gateway, the application tier should be in a private subnet without direct internet access, and the database tier should also be in a private subnet. Security groups should be used to enforce communication rules between tiers (e.g., allowing the web tier to communicate with the application tier) while Network ACLs can be used to block traffic that is not required between layers (e.g., preventing the web tier from accessing the database tier).
- A. Correct.
This is correct because the web tier needs public internet access, which requires being in a public subnet with an Internet Gateway attached.
- B. Incorrect.
This is incorrect because the application tier does not require direct internet access. It only needs to communicate with the web tier and the database tier.
- C. Correct.
This is correct because the database tier should not have direct internet access for security reasons, and placing it in a private subnet ensures this.
- D. Correct.
This is correct because security groups can be used to control traffic flow at the instance level, allowing communication between the web tier and application tier as required.
- E. Correct.
This is correct because Network ACLs are stateless and can be used to block unwanted traffic, such as communication between the web tier and database tier, which is not required.