easyMultiple ChoiceObjective-mapped
CV0-004 Practice Question: A cloud administrator is designing a multi-tier…
A cloud administrator is designing a multi-tier application. The database tier must not be directly accessible from the internet, but the web tier must be able to connect to it. Which of the following should the administrator implement?
⚠ Common exam trap
Test-takers frequently confuse 'restricting the security group' with 'placing in a private subnet,' failing to realize that a public subnet inherently provides internet accessibility regardless of security group rules, which only filter traffic but do not remove the public route.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place the database servers in a private subnet and configure the security group to allow inbound traffic from the web tier's security group.
Placing the database servers in a private subnet ensures they have no direct internet route, meeting the security requirement. By configuring the security group to allow inbound traffic only from the web tier's security group, you enable the web tier to connect to the database while blocking all other traffic, including from the internet. This leverages AWS security group referencing (or similar cloud provider feature) to create a trusted, internal communication path.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement an application load balancer in front of the database.
Why it's wrong here
A load balancer adds complexity and is not needed for database access from the web tier.
- ✗
Place the database servers in a public subnet and restrict the security group.
Why it's wrong here
A public subnet has a route to the internet, making the database potentially accessible from the internet.
- ✗
Use a VPN connection for the web tier to access the database.
Why it's wrong here
A VPN is unnecessary since the web tier and database are in the same VPC.
- ✓
Place the database servers in a private subnet and configure the security group to allow inbound traffic from the web tier's security group.
Why this is correct
This isolates the database from the internet and allows only the web tier to connect.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 977 original CV0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.