PAS-C01 Migration Practice Question
A company is migrating a multi-tier application to AWS. The application includes a web tier, application tier, and database tier. To ensure security, the database tier must not be accessible from the internet. Which VPC configuration should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place the database tier in private subnets
Placing the database tier in private subnets ensures it is not directly accessible from the internet. Option A (subnets with a NAT Gateway) provides outbound internet access only, not inbound. Option B (subnets with an Internet Gateway) would allow direct internet access. Option C (all tiers in public subnets) would expose all tiers to the internet. Only option D correctly restricts internet access to the database tier by placing it in private subnets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place the database tier in subnets with a NAT Gateway
Why it's wrong here
NAT Gateway provides outbound internet, not inbound isolation.
- ✗
Place the database tier in subnets with an Internet Gateway
Why it's wrong here
Internet Gateway provides inbound internet access.
- ✗
Place all tiers in public subnets
Why it's wrong here
Would expose database to internet.
- ✓
Place the database tier in private subnets
Why this is correct
Private subnets have no direct internet access.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,616 original PAS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.