easyMultiple ChoiceObjective-mapped
CV0-004 Practice Question: Is responsible for securing a multi-tier…
A cloud engineer is responsible for securing a multi-tier application deployed on IaaS. The application consists of web servers, application servers, and database servers. The engineer needs to implement network segmentation to minimize the attack surface. Which of the following is the BEST approach?
⚠ Common exam trap
Candidates often confuse security groups with network ACLs or assume that placing servers in the same subnet with restrictive rules is sufficient, but CompTIA tests the understanding that true network segmentation requires separate subnets (or VLANs) to prevent layer-2 adjacency and lateral movement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create separate subnets for each tier and configure security groups to allow only required traffic between them.
Creating separate subnets for each tier enforces network segmentation at the IP layer, which is a fundamental security best practice for multi-tier applications. By configuring security groups (stateful firewalls) to allow only the specific required traffic (e.g., HTTP/HTTPS from web to app, SQL from app to database), the engineer minimizes the attack surface by preventing lateral movement if one tier is compromised. This approach aligns with the principle of least privilege and is the most effective method in IaaS environments like AWS, Azure, or GCP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a single security group for all instances and define rules to allow traffic between tiers.
Why it's wrong here
A single security group allows all instances to communicate, defeating segmentation.
- ✓
Create separate subnets for each tier and configure security groups to allow only required traffic between them.
Why this is correct
Separate subnets with security groups enforce network segmentation and least privilege.
- ✗
Place web servers in a public subnet and application and database servers in the same private subnet with a common security group.
Why it's wrong here
Combining app and db in one subnet with same security group does not segment them.
- ✗
Place all instances in the same subnet and use network ACLs to restrict traffic between tiers.
Why it's wrong here
A single subnet does not provide network segmentation; ACLs alone are insufficient for isolation.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 977 original CV0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.