SAP-C02 Question 32
Select 2You are designing a multi-tier architecture for an application hosted on AWS. The application consists of a web tier, an application tier, and a database tier. The web tier EC2 instances need to communicate with the application tier EC2 instances over specific ports, while the application tier should access the database tier securely. To enhance security, each tier is placed in its own subnet. The design also requires that the database tier must not be reachable from the internet. Which of the following actions will meet these requirements? (Select TWO.)
- A
Create a public subnet for the web tier and configure a security group to allow inbound traffic on HTTP and HTTPS ports.
- B
Place the application tier in a private subnet and configure a security group to allow inbound traffic only from the web tier's security group on the required ports.
- C
Place the database tier in a private subnet and configure a security group to allow inbound traffic only from the application tier's security group on the required ports.
- D
Attach an internet gateway to the VPC and associate it with the database tier's private subnet to allow software updates.
- E
Ensure the NAT gateway is deployed in a public subnet to allow the application and database tiers to reach the internet for updates without exposing them directly.
Show answer and explanation
Correct answers: B, C
Explanation
To implement network segmentation and secure communication between tiers, the architecture must ensure that each tier is placed in an appropriate subnet with limited connectivity. The web tier, being internet-facing, is placed in a public subnet, while the application and database tiers are placed in private subnets. Security groups are used to enforce specific communication rules between the tiers. Options 2 and 3 align with best practices and meet the requirements of the scenario.
- A. Incorrect.
This option is correct because the web tier needs to be in a public subnet to allow internet access, and security groups should be configured to allow HTTP (port 80) and HTTPS (port 443) traffic.
- B. Correct.
This option is correct because placing the application tier in a private subnet isolates it from the internet, and configuring security groups ensures that only the web tier can communicate with it on the required ports.
- C. Correct.
This option is correct because the database tier should remain isolated in a private subnet, and the security group should allow access only from the application tier's security group to ensure secure communication.
- D. Incorrect.
This option is incorrect because attaching an internet gateway to the private subnet would expose the database tier to the internet, violating the requirement to keep it unreachable from the internet.
- E. Incorrect.
This option is incorrect because while deploying a NAT gateway in a public subnet is a valid way to allow private subnets to access the internet for updates, it is not explicitly required by the scenario to meet the stated requirements.