SOA-C02 Question 235
Select 3You are setting up a VPC in AWS for a web application that will have public-facing web servers and private database servers. The web servers need to be accessible from the internet, while the database servers must remain private but still be able to access the internet for patch updates. Which configuration steps should you take to meet these requirements?
- A
Create a public subnet and associate it with a route table that has a route to an internet gateway.
- B
Create a private subnet and associate it with a route table that has a route to a NAT gateway.
- C
Attach an internet gateway to the VPC and associate it with the private subnet.
- D
Create a security group for the web servers to allow inbound HTTP and HTTPS traffic from any source.
- E
Create a network ACL to allow inbound traffic from any source to the private subnet.
Show answer and explanation
Correct answers: A, B, D
Explanation
To meet the requirements, the VPC must have a public subnet for the web servers and a private subnet for the database servers. The public subnet should have a route to an internet gateway, while the private subnet should have a route to a NAT gateway to allow outgoing traffic without exposing the database servers. Security groups should be configured to allow HTTP and HTTPS traffic to the web servers. Configurations that expose the private subnet to the internet, such as associating it with an internet gateway or overly permissive network ACLs, should be avoided.
- A. Correct.
Correct: A public subnet requires a route table with a route to an internet gateway to allow the web servers to communicate with the internet.
- B. Correct.
Correct: A private subnet requires a route to a NAT gateway to allow internal instances, like the database servers, to access the internet without being exposed.
- C. Incorrect.
Incorrect: An internet gateway should only be associated with the public subnet, not the private subnet. Associating it with the private subnet would expose the database servers to the internet.
- D. Correct.
Correct: The security group for the web servers must allow inbound HTTP (port 80) and HTTPS (port 443) traffic from any source to handle public requests.
- E. Incorrect.
Incorrect: A network ACL is not required to allow all inbound traffic to the private subnet. That would expose the database servers, violating the requirement for them to remain private.