A company is planning to deploy a multi-tier web application in Amazon VPC. The architecture requires that the database tier be completely isolated from the public internet, while the web servers must be accessible to the public internet. Which subnet configuration should the company use to meet these requirements?
- AAll resources placed in different Availability Zones without configuring subnets
- Public subnets for the web servers and private subnets for the database tierAnswer
- CA single subnet with stateful Security Groups for the web servers and stateless Network ACLs for the database tier
- DAWS Transit Gateway to route traffic directly between the database and the public internet
Answer
Public subnets for the web servers and private subnets for the database tier
The correct answer is to place the web servers in public subnets and the database tier in private subnets. Public subnets are configured with a route to an Internet Gateway, allowing them to send and receive traffic from the public internet. Private subnets do not have a route to the Internet Gateway, keeping the resources inside them isolated from direct internet access.
Step-by-Step Solution
Key Concept
Understanding how subnets (public and private) within an Amazon VPC are used to isolate or expose application tiers.
Estimated Time:45s