mediumMultiple ChoiceObjective-mapped
CV0-004 Practice Question: A financial services company is deploying a…
A financial services company is deploying a PCI-DSS compliant workload in a public cloud. The deployment must include a web application (port 443) and a database (port 3306). The security requirements mandate that the web application is internet-facing, but the database must be in a private subnet with no direct internet access. The cloud administrator creates two VPCs: one for the web tier and one for the database tier. The web tier is deployed in VPC-A with a public subnet and an internet gateway. The database tier is deployed in VPC-B with a private subnet and a NAT gateway for outbound updates. The administrator configures VPC peering between VPC-A and VPC-B, and updates route tables accordingly. The web application can connect to the database, but the database cannot initiate outbound connections to the internet for updates. What is the most likely issue?
⚠ Common exam trap
Many exam-takers assume a NAT gateway in the same VPC as the database can provide internet access through a VPC peering connection, but they overlook the non-transitive nature of VPC peering, which prevents routing traffic from a peered VPC to an internet gateway or NAT gateway in the other VPC.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The NAT gateway in VPC-B cannot be used for internet access through a VPC peering connection
The NAT gateway in VPC-B cannot be used for internet access through a VPC peering connection because VPC peering does not support transitive routing. When the database in VPC-B tries to reach the internet via the NAT gateway, traffic must go through the VPC peering connection to VPC-A and then to the internet gateway, but VPC peering does not allow a route that forwards traffic from one VPC to another VPC's internet gateway. The database's outbound traffic to the internet is effectively blocked because the NAT gateway's default route (0.0.0.0/0) points to the internet gateway in VPC-B, but the database's traffic must first traverse the peering connection, which is not a valid path for internet-bound traffic in this architecture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The database security group does not allow outbound traffic to the internet
Why it's wrong here
Security groups are stateful; outbound is allowed by default.
- ✗
The route table in VPC-B does not have a default route to the NAT gateway
Why it's wrong here
The administrator says the route tables are updated, but the NAT gateway may not work over peering.
- ✗
The VPC peering connection does not support DNS resolution between VPCs
Why it's wrong here
DNS resolution works across VPC peering if configured.
- ✓
The NAT gateway in VPC-B cannot be used for internet access through a VPC peering connection
Why this is correct
NAT gateways do not support traffic through VPC peering; each VPC needs its own NAT gateway.
Visual reference
Go deeper
Related to this question
About these practice questions
This CV0-004 question is part of Courseiva's 977-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.