SAA-C03 Question 180
Select 3You are designing a VPC with two public subnets and two private subnets for a web application. The web servers in the public subnets need to communicate with the application servers in the private subnets. Additionally, the application servers need access to the internet for software updates. Which of the following configurations is required to enable this architecture?
- A
Create a route table for the public subnets with a route directing internet traffic (0.0.0.0/0) to an Internet Gateway.
- B
Create a route table for the private subnets with a route directing internet traffic (0.0.0.0/0) to a NAT Gateway.
- C
Attach an Internet Gateway to the VPC.
- D
Add a route to the public subnet route table to direct traffic to the private subnets using their CIDR block.
- E
Associate the private subnets with the main route table that has a route to the Internet Gateway.
Show answer and explanation
Correct answers: A, B, C
Explanation
To implement the described architecture, the public subnets need internet access through an Internet Gateway, and the private subnets need internet access through a NAT Gateway. The route tables must be properly configured: the public subnets' route table requires a route to the Internet Gateway, and the private subnets' route table requires a route to the NAT Gateway. Additionally, an Internet Gateway must be attached to the VPC to enable internet access.
- A. Correct.
This option is correct because public subnets require route tables with a route to the Internet Gateway to allow public internet access.
- B. Correct.
This option is correct because private subnets need a route to a NAT Gateway to enable outgoing internet access (e.g., for software updates) while keeping the resources private.
- C. Correct.
This option is correct because an Internet Gateway is required to enable internet communication for the VPC.
- D. Incorrect.
This option is incorrect because public subnets do not need a route to private subnets. Instead, traffic between public and private subnets is handled automatically within the VPC.
- E. Incorrect.
This option is incorrect because associating private subnets with a route table that has a route to the Internet Gateway would make them public, which violates the architecture's requirement of keeping them private.