SAA-C03 Question 328
Select 3A company is designing a new VPC network architecture in AWS to host a multi-tier web application. The architecture must ensure that the application is highly secure, scalable, and adheres to AWS best practices. The application consists of a public-facing web tier, an application tier, and a database tier that must not be accessible from the internet. How should the VPC and subnet tiers be designed to meet these requirements?
- A
Place the web tier in public subnets and the application and database tiers in private subnets.
- B
Use a single NAT Gateway in the VPC to allow outbound internet access for resources in private subnets.
- C
Configure a route in the public subnets to direct traffic to the internet gateway.
- D
Place all tiers (web, application, and database) in a single private subnet to improve security.
- E
Configure a security group for the database tier that only allows inbound traffic from the application tier.
Show answer and explanation
Correct answers: A, C, E
Explanation
To design a secure and scalable VPC network architecture for a multi-tier web application, follow AWS best practices. Public-facing resources (web tier) should be placed in public subnets, while private resources (application and database tiers) should be isolated in private subnets. Public subnets require a route to the internet gateway for internet access, and security groups should strictly control traffic flows between tiers. This ensures the architecture is both secure and functional.
- A. Correct.
Correct. AWS best practices recommend placing the web tier in public subnets to allow internet access, while the application and database tiers should be in private subnets for security purposes.
- B. Incorrect.
Incorrect. While a NAT Gateway is useful for outbound internet access from private subnets, it is not mandatory in this scenario as the database tier likely does not need internet access.
- C. Correct.
Correct. Public subnets must have a route to an internet gateway to allow internet-facing traffic for resources like the web tier.
- D. Incorrect.
Incorrect. Placing all tiers in a single private subnet does not follow AWS best practices for security and scalability. Each tier should be isolated into its own subnet tier.
- E. Correct.
Correct. Security groups must be configured to allow only necessary traffic. In this case, the database tier should only accept inbound traffic from the application tier for enhanced security.