ANS-C01 Public subnet Practice Question
A company has a multi-tier web application running on EC2 instances in a VPC. The web tier must be accessible from the internet, but the application tier should only be accessible from the web tier. Which network design configuration meets these requirements?
⚠ Common exam trap
The trap is that candidates may think a private subnet is required for the application tier, but security groups can provide sufficient isolation even in public subnets. Alternatively, they may incorrectly choose D because it mentions a private subnet, not realizing that VPC peering is for connecting separate VPCs, not subnets within the same VPC.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place both tiers in public subnets and use security groups to restrict traffic from the web tier to the application tier.
Placing both tiers in public subnets with an internet gateway allows the web tier to be accessible from the internet. Security groups can then be used to restrict inbound traffic to the application tier to only come from the web tier's security group, ensuring that the application tier is not directly accessible from the internet. This design meets the requirement without unnecessary complexity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a VPN connection from the web tier to the application tier, and place both tiers in private subnets.
Why it's wrong here
VPN does not provide internet access to the web tier.
- ✓
Place both tiers in public subnets and use security groups to restrict traffic from the web tier to the application tier.
Why this is correct
Public subnets expose both tiers to the internet, increasing attack surface.
- ✗
Place web servers in a public subnet with a NAT gateway, and application servers in a private subnet with a default route to the NAT gateway.
Why it's wrong here
NAT gateway only provides outbound internet access, not inbound.
- ✗
Place web servers in a public subnet with an internet gateway, and application servers in a private subnet with a route to the web subnet via a VPC peering connection.
Why it's wrong here
Correct design for inbound internet access to web tier and internal access to app tier.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.