CV0-004 Cloud Architecture and Design Practice Question
A cloud architect is designing a VPC for a three-tier web application. The web servers must be accessible from the internet, the application servers should only be reachable from the web tier, and the database servers should not have any public IP addresses and should be isolated. Which subnet design meets these requirements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Web tier in public subnet, app tier in private subnet, database tier in a separate private subnet with no internet gateway
A typical three-tier architecture uses public subnets for web servers (with internet gateway), private subnets for application servers (with NAT for outbound if needed), and isolated database subnets with no internet access. Security groups/NACLs enforce traffic rules.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Web tier in public subnet, app tier in private subnet, database tier in a separate private subnet with no internet gateway
Why this is correct
This design isolates tiers appropriately: web is public, app is private, database is isolated.
- ✗
Web tier in public subnet, app and database tiers in the same private subnet
Why it's wrong here
App and database should be in separate subnets for security and manageability.
- ✗
All servers in private subnets with a NAT gateway for inbound traffic
Why it's wrong here
Private subnets cannot receive inbound internet traffic; NAT is for outbound only.
- ✗
All servers in the same public subnet with security groups
Why it's wrong here
Putting all servers in a public subnet exposes app and database to the internet unnecessarily.
Visual reference
Go deeper
Related to this question
About these practice questions
This CV0-004 question is part of Courseiva's 977-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.