SAA-C03 Question 325
Select 3You are designing the network architecture for a highly available e-commerce application hosted on AWS. The application should span multiple Availability Zones (AZs) for fault tolerance. The architecture needs to include public and private subnets, where the public subnet hosts the load balancer and the private subnets host the application servers. Which of the following steps should you take to design this architecture correctly?
- A
Create a public subnet in at least two Availability Zones and associate them with an Internet Gateway.
- B
Create a private subnet in at least two Availability Zones and route traffic to the public subnet through a NAT Gateway.
- C
Attach a Virtual Private Gateway to the VPC to enable private communication between the public and private subnets.
- D
Configure route tables for the public subnet to point to the Internet Gateway and for the private subnet to point to a NAT Gateway.
- E
Deploy the application servers in the public subnet for direct access to the Internet.
Show answer and explanation
Correct answers: A, B, D
Explanation
To design a network architecture for a highly available application, you must utilize both public and private subnets. Public subnets host resources such as load balancers that require direct Internet access, and these subnets need to be associated with an Internet Gateway. Private subnets host application servers, which should not have direct Internet access but can route outbound traffic via a NAT Gateway. Configuring route tables properly ensures that traffic flows correctly between subnets and external resources. Using a Virtual Private Gateway or placing servers in public subnets would not meet the requirements for this architecture.
- A. Correct.
Correct. Public subnets are required to host the load balancer, and associating them with an Internet Gateway enables Internet access.
- B. Correct.
Correct. Private subnets host the application servers, and routing traffic to the public subnet via a NAT Gateway ensures secure outbound Internet access.
- C. Incorrect.
Incorrect. A Virtual Private Gateway is used for VPN connections, not for communication between public and private subnets.
- D. Correct.
Correct. Route tables must be configured to ensure proper routing: public subnets to the Internet Gateway and private subnets to the NAT Gateway for outbound Internet traffic.
- E. Incorrect.
Incorrect. Application servers should be placed in private subnets for security, not public subnets.