Question 867 of 977
hardMultiple ChoiceObjective-mapped
CV0-004 Practice Question: Deploying a multi-tier application in a cloud…
A company is deploying a multi-tier application in a cloud environment. The application must comply with PCI DSS, which requires encryption of data at rest and in transit. The database tier must be isolated from direct internet access, while the web tier must be accessible from the internet. Which of the following deployment architectures best meets these requirements?
⚠ Common exam trap
CompTIA often tests the misconception that security groups alone provide sufficient isolation, but network segmentation via separate subnets is required for PCI DSS compliance, and encryption must be explicitly enabled for both data at rest and in transit.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy web tier in a public subnet, database tier in a private subnet, and use SSL/TLS for encryption.
It separates the web tier into a public subnet for internet accessibility and the database tier into a private subnet for isolation, meeting PCI DSS requirements. SSL/TLS encryption ensures data in transit is protected, and encryption at rest can be applied to the database storage. This architecture aligns with cloud best practices for multi-tier applications requiring compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place all tiers in the same subnet and use security groups to restrict traffic.
Why it's wrong here
Same subnet cannot fully isolate database from internet.
- ✗
Use a single instance for web and database, and place it behind a load balancer.
Why it's wrong here
Single instance is not scalable or secure.
- ✗
Use a VPN connection from the web tier to the database tier and disable encryption.
Why it's wrong here
Encryption is still required for data at rest and in transit.
- ✓
Deploy web tier in a public subnet, database tier in a private subnet, and use SSL/TLS for encryption.
Why this is correct
Public subnet for web, private for database, and encryption satisfies PCI DSS.
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 30, 2026
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.