SAA-C03 Question 327
Select 3An organization is deploying a web application in a VPC with the following requirements:
- The application must be highly available and span multiple Availability Zones (AZs).
- The front-end web servers must be accessible from the internet.
- The back-end application servers should not be directly accessible from the internet.
- The database must be in a private subnet and should only be accessible by the application servers.
What is the most appropriate way to design the subnets and routing to meet these requirements?
- A
Create public subnets in two AZs for the web servers and private subnets in two AZs for the application servers and database. Configure an Internet Gateway for the public subnets.
- B
Create a single public subnet for the web servers, a private subnet for the application servers, and a private subnet for the database. Configure a NAT Gateway in the private subnet for internet access.
- C
Deploy the database in a private subnet and associate a route table that does not have a route to the Internet Gateway.
- D
Associate the public subnets with a route table that has a route to the Internet Gateway and the private subnets with a route table that has a route to a NAT Gateway in the public subnet.
- E
Deploy all resources in a single private subnet and use a VPN to allow external access to the web servers.
Show answer and explanation
Correct answers: A, C, D
Explanation
To meet the requirements, the web servers should be deployed in public subnets spanning multiple AZs with a route to the Internet Gateway for external access. Application servers and the database should reside in private subnets for isolation. The database should have no direct internet access, and the application servers can use a NAT Gateway for outbound internet access if needed. This design ensures high availability, proper security boundaries, and appropriate routing.
- A. Correct.
Correct. Creating public subnets for the web servers and private subnets for the application servers and database ensures proper isolation and supports high availability by spanning multiple AZs. The Internet Gateway enables internet access for the public subnets.
- B. Incorrect.
Incorrect. A single public subnet and private subnet configuration violates the high availability requirement since it does not span multiple AZs. Additionally, a NAT Gateway should be in a public subnet, not a private subnet.
- C. Correct.
Correct. Deploying the database in a private subnet with a route table that does not have a route to the Internet Gateway ensures that the database is not directly accessible from the internet, meeting the security requirements.
- D. Correct.
Correct. Associating public subnets with a route table containing a route to the Internet Gateway ensures that the web servers are accessible from the internet. Associating private subnets with a route table containing a route to a NAT Gateway enables private resources to access the internet for updates or outbound requests.
- E. Incorrect.
Incorrect. Deploying all resources in a single private subnet violates the requirements for proper isolation, high availability, and internet accessibility for the web servers.