ANS-C01 Question 424
Select 2You are designing a VPC for a multi-tier application in AWS. The application has a public-facing web layer, an internal application layer, and a backend database layer. The web layer requires internet access, while the application and database layers must be isolated for security. How should you optimize the VPC subnets to meet these requirements, while ensuring high availability across multiple Availability Zones?
- A
Create public subnets for the web layer in at least two Availability Zones and associate them with an internet gateway.
- B
Place the application and database layers in private subnets across multiple Availability Zones and associate them with a NAT gateway for internet access.
- C
Use a single VPC with one public subnet for all layers to simplify the network design.
- D
Create private subnets for the application and database layers in at least two Availability Zones and associate them with a VPN gateway for secure communication.
- E
Route the public subnet's traffic to an internet gateway and the private subnet's traffic to a NAT gateway.
Show answer and explanation
Correct answers: A, E
Explanation
To optimize the VPC subnets for a multi-tier application, you should separate the web layer into public subnets for internet access and the internal layers (application and database) into private subnets for isolation. Using multiple Availability Zones ensures high availability for all layers. Additionally, routing the public subnet's traffic to an internet gateway and private subnet's traffic appropriately (e.g., to a NAT gateway if needed) aligns with standard VPC design principles.
- A. Correct.
Correct. Public subnets are required for the web layer to allow internet-facing traffic, and using multiple Availability Zones ensures high availability.
- B. Incorrect.
Incorrect. While private subnets are appropriate for the application and database layers, they do not require direct internet access via a NAT gateway for this scenario since they are isolated for security.
- C. Incorrect.
Incorrect. Placing all layers in a single public subnet violates security best practices by exposing internal resources to the public internet.
- D. Incorrect.
Incorrect. While a VPN gateway can provide secure communication for hybrid architectures, it is not necessary for this scenario since the focus is on subnet optimization within AWS.
- E. Correct.
Correct. Routing traffic properly between public subnets (to an internet gateway) and private subnets (to a NAT gateway, if required) follows AWS best practices for subnet configuration.