mediumMultiple ChoiceObjective-mapped
CV0-004 Practice Question: Is tasked with automating the deployment of a…
A cloud engineer is tasked with automating the deployment of a three-tier application. The engineer wants to ensure that the database tier is not directly accessible from the internet but can be reached by the application tier. Which of the following should be implemented?
⚠ Common exam trap
A common mix-up: candidates confuse 'restrictive security group' with network isolation, failing to realize that a public subnet inherently provides internet accessibility regardless of security group rules, so the database must be placed in a private subnet to meet the requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place the database tier in a private subnet and configure a security group to allow traffic only from the application tier
Placing the database tier in a private subnet ensures it has no direct route to the internet, while a security group configured to allow inbound traffic only from the application tier's security group (or CIDR) enforces least-privilege access. This design aligns with the AWS Well-Architected Framework's security pillar, using network segmentation and stateful firewall rules to isolate the database from public exposure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the same subnet for all tiers and allow traffic via security groups
Why it's wrong here
Does not isolate the database tier from potential compromise.
- ✗
Place the database tier in a public subnet with a restrictive security group
Why it's wrong here
Public subnet is reachable from internet, even with restrictive rules.
- ✗
Connect the database tier to a site-to-site VPN and disable public access
Why it's wrong here
Unnecessary complexity; can be done within VPC.
- ✓
Place the database tier in a private subnet and configure a security group to allow traffic only from the application tier
Why this is correct
Private subnet has no internet gateway, and security group restricts access.
Visual reference
Go deeper
Related to this question
About these practice questions
This CV0-004 question is part of Courseiva's 977-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.