SAA-C03 Design Resilient Architectures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Deploy all tiers in a single public subnet in one AZ.

  Why it's wrong here

  Deploying all tiers in a single subnet and AZ creates a single point of failure and exposes every component to the internet. This violates basic security and resiliency principles, as a single failure or a compromised web server could easily expose the entire application stack to external threats.

• ✓

  Deploy web and app tiers across multiple subnets in multiple AZs, with app tiers in private subnets.

  Why this is correct

  This architecture provides both high availability and security. By spreading instances across multiple AZs, the application can survive a data center failure. Placing the application tier in private subnets ensures that sensitive back-end components are not directly reachable from the internet, significantly hardening the application against external attacks.

• ✗

  Put everything in a public subnet and use Security Groups for isolation.

  Why it's wrong here

  While Security Groups provide firewalling, the network architecture is still vulnerable to single-AZ failure. Furthermore, public subnets are inherently less secure than private subnets. Best practices dictate using subnets as a primary boundary for isolation and distributing resources across multiple AZs for high availability and resilience.

• ✗

  Use a single private subnet for both tiers and a NAT Gateway in the same subnet.

  Why it's wrong here

  A single private subnet lacks AZ redundancy. If that AZ goes down, the entire application fails. Additionally, placing both tiers in the same subnet prevents proper architectural separation, meaning that a breach in the web tier could easily propagate to the application tier, lacking adequate layered defense-in-depth.