CAS-004 Security Architecture Practice Question
A security administrator is reviewing an architecture diagram for a new web application. The diagram shows the application servers in a private subnet, a database in a separate private subnet, and a public load balancer in a public subnet. The administrator wants to ensure that the application servers can retrieve software updates from the internet without being directly reachable from it. Which of the following should the administrator recommend?
⚠ Common exam trap
Candidates often confuse outbound internet access with public reachability, when a NAT gateway provides the former without granting the latter.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place a NAT gateway in a public subnet and route the application subnet's outbound traffic through it.
A NAT gateway located in a public subnet lets private application servers initiate outbound connections for updates while blocking unsolicited inbound connections from the internet. This preserves the private subnet's isolation and keeps the application tier unreachable externally. Direct internet gateway attachment, public IP assignment, and placing egress components in the database tier all either expose the servers or violate the intended tier separation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the application servers to use a proxy server hosted in the database subnet for all outbound update requests.
Why it's wrong here
Hosting a proxy in the database subnet places an internet-facing function in the same tier as sensitive data, violating the separation shown in the architecture diagram. The database subnet is intended to hold data stores, not egress components, and adding a proxy there expands the blast radius if the proxy is compromised. This design also complicates routing and does not align with the clean separation of tiers the administrator is trying to preserve.
- ✓
Place a NAT gateway in a public subnet and route the application subnet's outbound traffic through it.
Why this is correct
A NAT gateway in a public subnet allows instances in a private subnet to initiate outbound connections to the internet while preventing unsolicited inbound connections. This is exactly the pattern needed for software updates. The application servers remain unreachable from the internet, and the NAT gateway handles address translation and return traffic, preserving the private subnet's isolation while still permitting necessary outbound access.
- ✗
Assign public IP addresses to the application servers and use a security group that permits only outbound port 443.
Why it's wrong here
Assigning public IP addresses makes the application servers directly addressable from the internet, which defeats the goal of keeping them unreachable. Security groups are stateful and can restrict inbound traffic, but relying on them alone places the servers on the public internet and adds a configuration-dependent layer of protection. The scenario specifically calls for the servers not to be directly reachable, so public addressing is inappropriate.
- ✗
Attach an internet gateway directly to the application server subnet and allow outbound traffic on port 443.
Why it's wrong here
Attaching an internet gateway to the application subnet makes those servers directly routable from the internet, which is precisely what the administrator wants to avoid. An internet gateway provides bidirectional connectivity, so inbound initiation becomes possible if security groups or network ACLs are misconfigured. This design does not meet the requirement of outbound-only update retrieval and increases the attack surface of the application tier.
Visual reference
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 973-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.