ANS-C01 Question 234
Select 3Your company is running a multi-tier application in AWS, hosted in a VPC. The application consists of web servers in a public subnet and database servers in a private subnet. The web servers need to communicate with the internet to fetch updates, while the database servers should only be accessible by the web servers. Which combination of networking configurations should you implement to meet these requirements?
- A
Attach an internet gateway to the VPC and configure a route in the public subnet's route table to point to the internet gateway.
- B
Use a NAT gateway in the public subnet and configure a route in the private subnet's route table to point to the NAT gateway.
- C
Configure a security group for the database servers that allows inbound traffic only from the web servers' security group.
- D
Attach a transit gateway to the VPC for internet access and route all traffic through it.
- E
Use VPC peering to allow communication between the web servers and the database servers.
Show answer and explanation
Correct answers: A, B, C
Explanation
To meet the requirements of the scenario, the web servers need internet access via an internet gateway, and the private subnet hosting database servers needs access to the internet via a NAT gateway for outbound communication. Additionally, security groups should enforce that database servers only accept inbound traffic from the web servers for secure communication. Options involving transit gateways or VPC peering are unrelated to this scenario and do not address the specific requirements.
- A. Correct.
Correct. An internet gateway is required to allow resources in the public subnet (such as web servers) to communicate with the internet. The route table for the public subnet must also include a route to the internet gateway.
- B. Correct.
Correct. A NAT gateway enables resources in the private subnet (such as database servers) to initiate outbound communication to the internet, such as fetching updates, while preventing inbound internet access.
- C. Correct.
Correct. Security groups should be configured to restrict database access so that only the web servers can communicate with the database servers, ensuring secure communication.
- D. Incorrect.
Incorrect. A transit gateway is used for interconnecting multiple VPCs or on-premises networks, not for providing internet access within a single VPC.
- E. Incorrect.
Incorrect. VPC peering is used to enable communication between two VPCs, but it is not appropriate for connecting resources within the same VPC, such as web servers and database servers.