SAA-C03 Design Secure Architectures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Place the RDS database in a public subnet and rely on a security group that allows only the application tier's IP range.

  Why it's wrong here

  Placing the database in a public subnet makes it potentially reachable from the internet if the security group or network ACL is misconfigured. The requirement is that the database tier is not accessible from the internet, so it must reside in private subnets. Security groups alone are not sufficient to guarantee isolation from the internet.

• ✓

  Configure the RDS database security group to allow inbound traffic only from the application tier security group.

  Why this is correct

  Referencing the application tier security group as the source in the RDS security group rules ensures that only application instances can connect to the database. This enforces least privilege and prevents internet access. It also simplifies management because instances added to the application security group automatically gain access.

• ✗

  Create a VPC peering connection between the application tier VPC and the database tier VPC, and route all database traffic over the peering connection.

  Why it's wrong here

  The scenario describes a single VPC with multiple tiers, so VPC peering is unnecessary and adds complexity. VPC peering is used to connect separate VPCs, not tiers within the same VPC. This option does not address the requirement for outbound internet access for the application tier and is irrelevant to database isolation.

• ✗

  Attach an Elastic IP address to each application tier instance and configure security groups to allow only outbound traffic.

  Why it's wrong here

  Attaching Elastic IPs makes the instances publicly addressable, violating the requirement that they not be directly reachable from the internet. Security groups only allow outbound traffic do not prevent inbound traffic if the instance has a public IP and the subnet is public. This approach increases the attack surface and does not meet the security requirement.

• ✓

  Place the application tier instances in private subnets and configure a NAT gateway in a public subnet to allow outbound internet access.

  Why this is correct

  NAT gateways allow instances in private subnets to initiate outbound traffic to the internet while preventing inbound traffic from the internet. This meets the requirement for software updates without exposing the instances. The NAT gateway must be in a public subnet with an Elastic IP and a route in the private subnet's route table pointing to it.

Go deeper

Related to this question