ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Placing the internet-facing Application Load Balancer in a public subnet that has a route to an Internet Gateway creates a DMZ accessible from the Internet but logically separate from internal resources. Locating the web, application, and database instances in private subnets without an Internet Gateway keeps them in an intranet zone; they can initiate outbound traffic through a NAT gateway if required. Partners connect over a dedicated Site-to-Site VPN that terminates in an isolated extranet subnet. That subnet's route tables and security groups are configured to allow traffic only to the application tier, preventing direct access to the DMZ or database. This clearly separates Internet, DMZ, intranet, and extranet zones. The other options either collapse multiple tiers into the same public subnet, expose private resources directly to the Internet, rely solely on security groups without subnet isolation, or make every tier reachable through a single public endpoint, violating the required zoning model.