hardMultiple ChoiceObjective-mapped
CV0-004 Practice Question: A cloud architect is designing a multi-tier…
A cloud architect is designing a multi-tier application in a public cloud that must comply with PCI DSS. The web tier must be accessible from the internet, but the application tier should not have any public IP addresses. Which architecture meets these requirements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place the web tier in a public subnet behind an internet-facing load balancer, and the app tier in a private subnet with a NAT gateway for outbound traffic.
It places the web tier in a public subnet with an internet-facing load balancer, allowing internet access, and the app tier in a private subnet with no public IP, meeting the requirement. The NAT gateway enables outbound traffic for the app tier (e.g., for updates) without exposing it inbound. Option A is wrong because it assigns public IPs to both tiers, which violates the requirement that the app tier should not have public IPs. Option B is wrong because deploying both in private subnets would prevent internet access to the web tier, and VPC peering to a data center does not address internet access. Option C is wrong because a site-to-site VPN would route all traffic through on-premises, which is unnecessary and doesn't provide direct internet access to the web tier as required.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign public IP addresses to both tiers and use security group rules to restrict traffic.
Why it's wrong here
Assigning public IPs to the app tier violates PCI DSS requirement to keep it non-public.
- ✗
Deploy both tiers in private subnets and use a VPC peering connection to the corporate data center.
Why it's wrong here
VPC peering does not provide internet access to the web tier; users must access through corporate network.
- ✗
Use a site-to-site VPN between the cloud VPC and an on-premises network for all traffic.
Why it's wrong here
This would force all traffic through on-premises, adding latency and not meeting the requirement.
- ✓
Place the web tier in a public subnet behind an internet-facing load balancer, and the app tier in a private subnet with a NAT gateway for outbound traffic.
Why this is correct
This provides internet access to the web tier while keeping the app tier isolated from direct internet.
Visual reference
Go deeper
Related to this question
About these practice questions
This CV0-004 question is part of Courseiva's 977-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.