SOA-C02 Question 233
Select 4You are setting up a new VPC for your organization’s web application. The application requires public-facing web servers and private backend servers. The web servers need to communicate with the internet, while the backend servers should not have direct internet access but still need to download software updates from external sources. Which of the following steps should you take to meet the requirements?
- A
Create an internet gateway and attach it to the VPC.
- B
Create a NAT gateway in a public subnet and associate it with a route table used by private subnets.
- C
Assign Elastic IPs to the backend servers in the private subnet.
- D
Create a security group for the web servers that allows inbound HTTP/HTTPS traffic and outbound traffic to any destination.
- E
Set up a route in the private subnet’s route table that directs 0.0.0.0/0 traffic to the NAT gateway.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
To meet the requirements, the web servers need an internet gateway for internet connectivity and a security group to allow HTTP/HTTPS traffic. The backend servers, placed in private subnets, require a NAT gateway for downloading updates without direct exposure to the internet. Elastic IPs for private servers would violate the requirement of no direct internet access. Proper route table configurations are necessary to direct traffic appropriately.
- A. Correct.
Correct: Attaching an internet gateway to the VPC enables internet access for public-facing resources such as web servers.
- B. Correct.
Correct: A NAT gateway allows instances in private subnets to access the internet for updates without exposing them to direct inbound connections.
- C. Incorrect.
Incorrect: Assigning Elastic IPs to backend servers directly would expose them to the internet, violating the requirement for no direct internet access.
- D. Correct.
Correct: The security group for web servers must allow inbound HTTP and HTTPS traffic for public access, and outbound traffic is required for responses to client requests.
- E. Correct.
Correct: Adding a route in the private subnet's route table that directs traffic to the NAT gateway ensures that backend servers can reach the internet for software updates.