CV0-004 Cloud Architecture and Design Practice Question
A cloud architect is designing a VPC with three tiers: web, application, and database. Which subnet design provides the best security posture?
⚠ Common exam trap
The CV0-004 exam often tests the misconception that security groups alone are sufficient for network segmentation, leading candidates to choose Option D, but security groups are stateful firewalls at the instance level and do not replace the need for subnet-level isolation and controlled routing paths.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Web in public subnet, app and database in private subnets with appropriate routing
It follows the principle of least privilege and network segmentation. Placing the web tier in a public subnet allows it to receive internet traffic, while the application and database tiers reside in private subnets with no direct internet access. This design ensures that only the web tier is exposed, and the database is isolated, accessible only via the application tier through controlled routing, significantly reducing the attack surface.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Web in public subnet, app and database in private subnets with appropriate routing
Why this is correct
Placing only the web tier in a public subnet limits internet exposure to the presentation layer, while application and database tiers remain unreachable directly. Routing through NAT gateways or load balancers enforces tiered segmentation, satisfying least-privilege network access.
- ✗
Web and app in public subnets, database in private subnet
Why it's wrong here
Leaving the application tier in a public subnet gives it a route to the internet gateway, so it is not isolated from inbound traffic; the database alone being private does not protect the middle tier. It tempts because this pattern suits two-tier designs where the app must accept external connections.
- ✗
All tiers in private subnets with a VPN
Why it's wrong here
A VPN secures administrative access into the VPC but does not provide the inbound internet path the web tier requires, so public-facing traffic cannot reach it. It tempts because private subnets plus VPN suit internal-only workloads with no public endpoints.
- ✗
All tiers in the same public subnet with security groups
Why it's wrong here
Placing every tier in one public subnet exposes the database and application hosts to direct internet routing, so security groups become the only boundary and no network-layer isolation exists. It is tempting because a single flat subnet is quick to build, and security groups alone suffice for simple, single-tier public workloads.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CV0-004 question from scratch — 834 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.