CV0-004 Cloud Architecture and Design Practice Question
A cloud architect is designing a VPC for a three-tier web application. The web servers must be accessible from the internet, the application servers should only be reachable from the web tier, and the database servers should not have any public IP addresses and should be isolated. Which subnet design meets these requirements?
⚠ Common exam trap
CV0-004 often tests the misconception that security groups alone can isolate tiers within a single public subnet — candidates must recognize that subnet-level routing (public vs. private, presence of IGW/NAT) is the primary segmentation control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Web tier in public subnet, app tier in private subnet, database tier in a separate private subnet with no internet gateway
A three-tier architecture requires strict network segmentation: the web tier in a public subnet with a route to an Internet Gateway for inbound traffic, the app tier in a private subnet reachable only from the web tier (via security groups or NACLs), and the database tier in a separate private subnet with no route to an Internet Gateway or NAT Gateway, ensuring complete isolation. This design enforces least-privilege network access and satisfies the stated requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Web tier in public subnet, app tier in private subnet, database tier in a separate private subnet with no internet gateway
Why this is correct
This design satisfies every stated constraint: the public subnet exposes web servers to the internet, the private app subnet is reachable only from the web tier via security groups, and the isolated database subnet lacks a route to an internet gateway, so no public IPs are needed.
- ✗
Web tier in public subnet, app and database tiers in the same private subnet
Why it's wrong here
Placing app and database tiers in one private subnet gives the database no isolation from the app tier, so a compromised app server reaches the database directly. It is tempting because both tiers avoid public IPs, but separate private subnets with security group or firewall rules are needed to restrict database access to the app tier alone.
- ✗
All servers in private subnets with a NAT gateway for inbound traffic
Why it's wrong here
A NAT gateway only translates outbound traffic from private subnets; it cannot accept inbound connections from the internet, so web servers would be unreachable. NAT gateways suit private instances needing outbound-only access, such as patching or API calls, not hosting public-facing tiers.
- ✗
All servers in the same public subnet with security groups
Why it's wrong here
Placing every tier in one public subnet gives the database servers routable public addresses, violating the isolation requirement, and security groups alone cannot remove that internet exposure. A single public subnet suits flat, uniformly public workloads, not segmented three-tier designs.
Visual reference
Go deeper
Related to this question
About these practice questions
This CV0-004 question is part of Courseiva's 834-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.