mediumMultiple ChoiceObjective-mapped
CV0-004 Practice Question: A cloud administrator is configuring a new…
A cloud administrator is configuring a new virtual private cloud (VPC) for a three-tier application. The web tier must be accessible from the internet, the application tier should only be accessible from the web tier, and the database tier should only be accessible from the application tier. Which network architecture should be used?
⚠ Common exam trap
Watch out — candidates often confuse network ACLs (stateless, subnet-level) with security groups (stateful, instance-level) and assume a single subnet with ACLs can achieve the same isolation, but ACLs cannot filter based on source security group IDs and require manual IP management, making them unsuitable for this multi-tier access control requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place each tier in a separate subnet with appropriate security group rules controlling traffic.
Placing each tier in a separate subnet and using security group rules provides stateful, instance-level traffic control. Security groups act as virtual firewalls at the hypervisor layer, allowing you to specify inbound rules that restrict the application tier to only accept traffic from the web tier's security group, and the database tier to only accept traffic from the application tier's security group. This aligns with the principle of least privilege and ensures that each tier is isolated within the VPC while maintaining necessary connectivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use one subnet with network ACLs to restrict traffic between tiers.
Why it's wrong here
A single subnet with network ACLs cannot enforce the required isolation because ACLs are stateless and evaluate traffic based only on source/destination IP and port, not on the originating tier’s role; the web, application, and database tiers would share the same broadcast domain, allowing lateral movement if an ACL rule is misconfigured or if an instance is compromised. This option is tempting because network ACLs provide a simple, subnet-level stateless filter for basic inbound/outbound control, and in a flat network where only coarse IP-based restrictions are needed—such as blocking a specific range from accessing a public-facing subnet—they would be a correct choice.
- ✗
Place all tiers in the same subnet and use host-based firewalls.
Why it's wrong here
Same subnet lacks network isolation; host firewalls add complexity and may not be sufficient.
- ✓
Place each tier in a separate subnet with appropriate security group rules controlling traffic.
Why this is correct
Correct. Separate subnets with security groups allow granular control and align with security best practices.
- ✗
Deploy each tier in a different VPC and peer them.
Why it's wrong here
Peering separate VPCs would allow traffic between tiers, but this architecture fails to enforce the required unidirectional access restrictions: the web tier must be reachable from the internet, yet a peered VPC does not inherently block the application tier from initiating outbound connections to the database tier, nor does it prevent the database tier from being exposed if its security group or network ACL is misconfigured. This approach is tempting because VPC peering is commonly used to connect isolated networks for resource sharing, such as linking a production VPC to a shared-services VPC, where full bidirectional connectivity between peered VPCs is acceptable.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CV0-004 question from scratch — 977 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.