SAA-C03 Question 326
Select 3You are designing a multi-tier application hosted in AWS. The application has a front-end web tier, an application tier, and a database tier. The web tier needs to be accessible over the internet, while the application and database tiers must remain private but allow communication between tiers. How should you configure the subnets and routing to meet these requirements?
- A
Place the web tier in a public subnet with an Internet Gateway attached to the VPC and configure routing to allow public traffic.
- B
Place the application tier in a private subnet with a route to the Internet Gateway to allow traffic from the web tier.
- C
Place the database tier in a private subnet with no direct route to the Internet Gateway.
- D
Configure a NAT Gateway in a public subnet to allow the application tier to access external services without exposing it to the internet.
- E
Enable VPC Peering between the web tier and the database tier for direct communication.
Show answer and explanation
Correct answers: A, C, D
Explanation
To design a secure and efficient network architecture for a multi-tier application in AWS, you should place the web tier in a public subnet with internet access via an Internet Gateway, while the application and database tiers should remain in private subnets. The application tier can access external services using a NAT Gateway, and the database tier should have no direct internet access for security. Proper routing and security group configurations ensure tier-to-tier communication without requiring VPC Peering.
- A. Correct.
Correct: The web tier must be placed in a public subnet with an Internet Gateway to allow internet access. Routing should be configured to direct internet traffic through the Internet Gateway.
- B. Incorrect.
Incorrect: The application tier should remain in a private subnet. It does not need direct Internet Gateway access; instead, it can use a NAT Gateway for outbound internet traffic.
- C. Correct.
Correct: The database tier should remain in a private subnet with no direct route to the Internet Gateway for security purposes.
- D. Correct.
Correct: A NAT Gateway allows instances in private subnets (such as the application tier) to access external services without exposing the instances to the internet.
- E. Incorrect.
Incorrect: VPC Peering is unnecessary for communication between tiers within the same VPC. Communication across tiers can be achieved using appropriate subnetting and security group configurations.