AWS Certified Solutions Architect Associate SAA-C03 Practice Question
A company's architecture requires segregation between its web servers that are accessible from the internet and its backend databases that should not be directly accessible from the internet. As the Solutions Architect, you have to ensure that the databases remain protected while allowing the web servers to communicate with them. Which of the following options achieves this objective while adhering to AWS security best practices?
Place the databases in a private subnet and the web servers in a public subnet, and configure the security groups allowing specific traffic from the web servers to the databases.
Utilize a NAT gateway to translate traffic from the internet to the private subnet where the databases reside, ensuring internet traffic can only reach the databases through the NAT gateway.
Place the databases in a public subnet but do not assign a public IP, and configure a route table that has no routes to and from the internet gateway.
Deploy both the web servers and databases in the same public subnet, using a network ACL to deny inbound traffic from the internet to the database servers' IP addresses.
Implementing private and public subnets in a VPC can achieve network segmentation, providing a secure environment for resources. The databases should be placed in a private subnet with no direct access from the internet, while the web servers can be placed in a public subnet. By using security groups, one can allow specific traffic from the public subnet to the private subnet. This ensures that while the web servers can communicate with the databases, the databases remain inaccessible directly from the internet. A wrong answer might incorrectly suggest exposing the databases to the internet or using incorrect components for traffic control.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is the difference between a public and private subnet in a VPC?
Open an interactive chat with Bash
What are security groups in AWS, and how do they work to control traffic?
Open an interactive chat with Bash
Why is placing databases in a private subnet considered a best practice?