Question

A company is deploying a three-tier web application in a single cloud region. The public-facing web servers must receive inbound traffic from the internet, while the application and database servers must never be directly reachable from the internet but still need to download OS patches from public repositories. The architect wants to follow the principle of least exposure. How should the VPC subnet layout be designed?

Accepted Answer

Place the web servers in a public subnet with a route to an internet gateway, and place the application and database servers in private subnets that reach the internet through a NAT gateway.

Answer

Place all three tiers in a single public subnet and use security group rules to block inbound traffic to the application and database servers.

Answer

Place all three tiers in private subnets and attach an internet gateway directly to the application and database subnets for patching.

Answer

Place the web servers in a private subnet behind a NAT gateway and place the application and database servers in public subnets with restrictive network ACLs.