CV0-004 Cloud Architecture and Design Practice Question
A cloud architect is designing a VPC with three tiers: web, application, and database. Which subnet design provides the best security posture?
⚠ Common exam trap
The CV0-004 exam often tests the misconception that security groups alone are sufficient for network segmentation, leading candidates to choose Option D, but security groups are stateful firewalls at the instance level and do not replace the need for subnet-level isolation and controlled routing paths.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Web in public subnet, app and database in private subnets with appropriate routing
It follows the principle of least privilege and network segmentation. Placing the web tier in a public subnet allows it to receive internet traffic, while the application and database tiers reside in private subnets with no direct internet access. This design ensures that only the web tier is exposed, and the database is isolated, accessible only via the application tier through controlled routing, significantly reducing the attack surface.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Web in public subnet, app and database in private subnets with appropriate routing
Why this is correct
This separates internet-facing from internal tiers, reducing risk.
- ✗
Web and app in public subnets, database in private subnet
Why it's wrong here
Application should not be directly exposed to the internet.
- ✗
All tiers in private subnets with a VPN
Why it's wrong here
Web tier needs internet access; VPN only for admin access.
- ✗
All tiers in the same public subnet with security groups
Why it's wrong here
This exposes all tiers to the internet, increasing attack surface.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CV0-004 question from scratch — 977 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.