CV0-004 Cloud Architecture and Design Practice Question
A cloud engineer is designing a VPC for a web application that requires a public subnet for a load balancer and a private subnet for application servers. The application servers must access the internet for software updates without being directly accessible from the internet. Which configuration should the engineer implement?
⚠ Common exam trap
The trap here is assuming that an Internet Gateway can be used directly by private subnet instances, but private instances lack public IPs and would require a NAT device for outbound internet access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a NAT Gateway in the public subnet and update the private subnet's route table to point to the NAT Gateway.
A NAT Gateway in a public subnet allows private subnet instances to initiate outbound internet traffic while remaining inaccessible from the internet. The private subnet's route table must direct outbound traffic to the NAT Gateway. This is the standard AWS design pattern for enabling updates and patches for private instances without exposing them publicly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a NAT Gateway in the public subnet and update the private subnet's route table to point to the NAT Gateway.
Why this is correct
A NAT Gateway allows instances in a private subnet to initiate outbound traffic to the internet while preventing inbound traffic from reaching them. Placing the NAT Gateway in a public subnet gives it internet access via the Internet Gateway. Updating the private subnet's route table to point to the NAT Gateway enables the application servers to download updates without being directly accessible.
- ✗
Attach an Internet Gateway to the VPC and configure the private subnet's route table to point to the Internet Gateway.
Why it's wrong here
An Internet Gateway allows resources in a public subnet to communicate with the internet. If the private subnet's route table points to the Internet Gateway, the instances would become publicly accessible, which violates the requirement. Additionally, instances in a private subnet do not have public IP addresses, so they cannot use an Internet Gateway directly.
- ✗
Set up a VPN connection between the VPC and the on-premises data center and route all internet traffic through the VPN.
Why it's wrong here
A VPN connection provides secure access to on-premises resources, but it does not provide direct internet access for software updates unless the on-premises network has a gateway to the internet. This adds complexity and latency. It also does not meet the requirement for the application servers to access the internet directly; it would route traffic through the data center, which is not ideal.
- ✗
Assign Elastic IP addresses to the application servers and configure security groups to allow outbound traffic only.
Why it's wrong here
Assigning Elastic IP addresses makes the instances publicly accessible, which violates the requirement that they not be directly accessible from the internet. Security groups can restrict inbound traffic, but the instances would still have public IPs and could be targeted. This approach does not align with best practices for private subnets.
Visual reference
Go deeper
Related to this question
About these practice questions
This CV0-004 question is part of Courseiva's 834-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.