SAA-C03 practice question 1 of 35

A solutions architect is designing the architecture for a two-tier web application. The web application consists of an internet-facing Application…

Choose your answer, then check it against the explanation and the full breakdown below.

Domain Design Secure Architectures

A solutions architect is designing the architecture for a two-tier web application. The web application consists of an internet-facing Application Load Balancer (ALB) that forwards traffic to an Auto Scaling group of Amazon EC2 instances. The EC2 instances must be able to access an Amazon RDS database. The company does not want to rely solely on security groups or network ACLs. Only the minimum resources that are necessary should be routable from the internet. Which network design meets these requirements?

Answer options

Correct Answer:

Explanation

This architecture represents a standard and secure multi-tier design. An internet-facing Application Load Balancer (ALB) must be placed in public subnets (subnets with a route to an Internet Gateway) to be accessible from the internet. The EC2 instances, which form the application tier, do not need direct internet access; they only need to receive traffic from the ALB. Placing them in private subnets minimizes their exposure. Similarly, the RDS database, the data tier, should be isolated from the internet for maximum security and placed in private subnets, accessible only from the application tier (the EC2 instances). This design adheres to the principle of least privilege by exposing only the necessary component (the ALB) to the internet.

Why Incorrect

A. An internet-facing ALB cannot be placed in private subnets, as it would not be able to receive traffic directly from the internet.

C. Placing EC2 instances in public subnets unnecessarily increases the application's attack surface, violating the requirement to minimize resources routable from the internet.

D. An Application Load Balancer is a resource that must be provisioned within a VPC and associated with specific subnets; it cannot exist "outside the VPC".

References

1. AWS Documentation: Elastic Load Balancing User Guide: "To create an internet-facing load balancer

you must specify at least two public subnets... A public subnet has a route to an internet gateway." This confirms the required placement for the ALB. (Source: AWS Documentation

Elastic Load Balancing User Guide

"Subnets for your load balancer").

2. AWS Documentation: Amazon VPC User Guide: The guide presents a common scenario

"VPC with public and private subnets (NAT)

" which illustrates this exact architecture. It states

"The main components of this scenario are as follows: ... A public subnet with an elastic load balancer... A private subnet with the web server instances that run your application." (Source: AWS Documentation

Amazon VPC User Guide

"Example: VPC with servers in private subnets and NAT").

3. AWS Well-Architected Framework - Security Pillar: This framework advocates for defense in depth. "You can achieve this by using a virtual private cloud (VPC)... Place resources in a private subnet when they don't require direct access from the internet." This supports placing EC2 and RDS in private subnets. (Source: AWS Well-Architected Framework

Security Pillar

"SEC 04: How do you protect your networks?"

"Protect network and host-level boundaries").

4. AWS Documentation: Amazon RDS User Guide: "A common Amazon RDS scenario is to have a VPC in which you have an EC2 instance with a web server and a DB instance with a database. In this scenario

we recommend that you use private subnets for your DB instance because they have a higher level of security." (Source: AWS Documentation

Amazon RDS User Guide

"Scenarios for accessing a DB instance in a VPC").

Question 1 of 35

Question breakdown

Tests: Design secure multi-tier VPC network architecture
Difficulty: Easy

Key idea: Only the internet-facing entry point (the ALB) belongs in public subnets; app and data tiers stay in private subnets with no route from the internet.

How to reach the answer

Clue: 'Only the minimum resources that are necessary should be routable from the internet' and 'not rely solely on security groups or NACLs' means isolation must come from subnet routing.
An internet-facing ALB needs subnets with a route to an internet gateway, so it must be in public subnets.
EC2 instances only receive traffic from the ALB, which can reach targets in private subnets by private IP.
RDS only needs access from EC2, so it also goes in private subnets.
Therefore ALB public, EC2 and RDS private.

Each option

AIncorrect. An internet-facing ALB in private subnets has no internet gateway route, so clients cannot reach it.
BCorrect. Exposes only the ALB via public subnets while keeping both the app and database tiers unroutable from the internet.
CIncorrect. Putting EC2 in public subnets makes more resources internet-routable than necessary and leaves protection to security groups alone.
DIncorrect. An ALB is always deployed into subnets inside a VPC; it cannot sit outside one.

Common trap: Believing the ALB can only forward to instances that are themselves in public subnets, which makes option C look required.

In practice: This public-ALB / private-app / private-DB subnet layout is the default pattern for most production web workloads on AWS, often with NAT gateways for outbound patching.

Remember: Put only the load balancer in public subnets; targets and databases belong in private subnets.

Official documentation: Subnets for your Application Load Balancer · Subnets for your VPC

Drafted with AI assistance and checked against the answer key.

Keep practicing

Take the free SAA-C03 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test