Question 451 of 499

Security →hardMultiple ChoiceObjective-mapped

Quick Answer

The correct architecture places the web tier in a public subnet behind an internet-facing load balancer and the application tier in a private subnet with a NAT gateway for outbound traffic. This design enforces PCI DSS multi-tier architecture requirements by ensuring the application tier has no public IP addresses, isolating it from direct internet exposure while still allowing necessary outbound updates through the NAT gateway. On the CompTIA Cloud+ CV0-004 exam, this scenario tests your understanding of network segmentation and compliance controls within a public cloud environment—a common trap is assuming a VPN or VPC peering alone satisfies PCI DSS, but those options either bypass the isolation requirement or add unnecessary complexity. Remember the memory tip: “Public web, private app, NAT for outbound tap.” This reinforces that the web layer faces the internet, the app layer stays hidden, and a NAT gateway handles any outbound traffic without exposing the app tier.

CV0-004 Security Practice Question

This CV0-004 practice question tests your understanding of security. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A cloud architect is designing a multi-tier application in a public cloud that must comply with PCI DSS. The web tier must be accessible from the internet, but the application tier should not have any public IP addresses. Which architecture meets these requirements?

Question 1hardmultiple choice

Full question →

A
Assign public IP addresses to both tiers and use security group rules to restrict traffic.
Why wrong: Assigning public IPs to the app tier violates PCI DSS requirement to keep it non-public.
B
Deploy both tiers in private subnets and use a VPC peering connection to the corporate data center.
Why wrong: VPC peering does not provide internet access to the web tier; users must access through corporate network.
C
Use a site-to-site VPN between the cloud VPC and an on-premises network for all traffic.
Why wrong: This would force all traffic through on-premises, adding latency and not meeting the requirement.
D
Place the web tier in a public subnet behind an internet-facing load balancer, and the app tier in a private subnet with a NAT gateway for outbound traffic.
This provides internet access to the web tier while keeping the app tier isolated from direct internet.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Place the web tier in a public subnet behind an internet-facing load balancer, and the app tier in a private subnet with a NAT gateway for outbound traffic.

Option A is correct because placing the web tier in a public subnet with a load balancer and the app tier in a private subnet with no public IPs fulfills the requirement. Option B is wrong because a direct VPC peering does not restrict public access. Option C is wrong because a VPN adds unnecessary complexity. Option D is wrong because the app tier should not have public IPs.

Key principle: Count usable hosts — not total addresses — and remember that the network and broadcast addresses are not available to hosts in standard IPv4 subnets.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Assign public IP addresses to both tiers and use security group rules to restrict traffic.
Why it's wrong here
Assigning public IPs to the app tier violates PCI DSS requirement to keep it non-public.
✗
Deploy both tiers in private subnets and use a VPC peering connection to the corporate data center.
Why it's wrong here
VPC peering does not provide internet access to the web tier; users must access through corporate network.
✗
Use a site-to-site VPN between the cloud VPC and an on-premises network for all traffic.
Why it's wrong here
This would force all traffic through on-premises, adding latency and not meeting the requirement.
✓
Place the web tier in a public subnet behind an internet-facing load balancer, and the app tier in a private subnet with a NAT gateway for outbound traffic.
Why this is correct
This provides internet access to the web tier while keeping the app tier isolated from direct internet.
Related concept
CIDR notation defines the prefix length.

Common exam traps

Common exam trap: usable hosts are not the same as total addresses

Subnetting questions often tempt you into counting all addresses. In normal IPv4 subnets, the network and broadcast addresses are not usable host addresses.

Detailed technical explanation

How to think about this question

Subnetting questions test whether you can identify the network, broadcast address, usable range, mask and correct subnet. Slow down enough to calculate the block size correctly.

KKey Concepts to Remember

CIDR notation defines the prefix length.
Block size helps identify subnet boundaries.
Network and broadcast addresses are not usable hosts in normal IPv4 subnets.
The required host count determines the smallest suitable subnet.

TExam Day Tips

Write the block size before choosing the subnet.
Check whether the question asks for hosts, subnets or a specific address range.
Do not confuse /24, /25, /26 and /27 host counts.

Key takeaway

Count usable hosts — not total addresses — and remember that the network and broadcast addresses are not available to hosts in standard IPv4 subnets.

Real-world example

How this comes up in practice

A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.

What to study next

Got this wrong? Here's your next step.

Review block sizes, usable host formulas (2^n − 2), and how to find network and broadcast addresses for /24 through /30. Then practise related CV0-004 subnetting questions on CIDR, address ranges, and subnet selection.

Related CV0-004 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Operations and Support practice questions

Practise CV0-004 questions linked to Operations and Support.

Cloud Architecture and Design practice questions

Practise CV0-004 questions linked to Cloud Architecture and Design.

Security practice questions

Practise CV0-004 questions linked to Security.

Deployment practice questions

Practise CV0-004 questions linked to Deployment.

Troubleshooting practice questions

Practise CV0-004 questions linked to Troubleshooting.

CV0-004 fundamentals practice questions

Practise CV0-004 questions linked to CV0-004 fundamentals.

CV0-004 scenario practice questions

Practise CV0-004 questions linked to CV0-004 scenario.

CV0-004 troubleshooting practice questions

Practise CV0-004 questions linked to CV0-004 troubleshooting.

Practice this exam

Start a free CV0-004 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

CV0-004 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this CV0-004 question test?

Security — This question tests Security — CIDR notation defines the prefix length..

What is the correct answer to this question?

The correct answer is: Place the web tier in a public subnet behind an internet-facing load balancer, and the app tier in a private subnet with a NAT gateway for outbound traffic. — Option A is correct because placing the web tier in a public subnet with a load balancer and the app tier in a private subnet with no public IPs fulfills the requirement. Option B is wrong because a direct VPC peering does not restrict public access. Option C is wrong because a VPN adds unnecessary complexity. Option D is wrong because the app tier should not have public IPs.

What should I do if I get this CV0-004 question wrong?

What is the key concept behind this question?

CIDR notation defines the prefix length.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.