A company is designing a multi-tier web application in a VPC. The web servers are in public subnets, and the database servers are in private subnets. The database servers must only accept traffic from the web servers. Which TWO actions should the solutions architect take to secure the database tier? (Select TWO.)

Answer options:

Configure the database security group to allow inbound traffic from the public subnets' CIDR blocks.

Configure the database security group to allow inbound traffic from the web servers' security group.

Attach a Network Access Control List (NACL) to the private subnet that denies all inbound traffic from the internet.

Place the database instances in a private subnet with no route to an Internet Gateway.

Assign Elastic IP addresses to the database instances and restrict access via AWS WAF.

How to approach this question

Use Security Group referencing for tier-to-tier communication. Ensure databases are in private subnets.

Full Answer

B,D

To secure a multi-tier architecture, database instances should be placed in private subnets (no route to an IGW). To allow traffic only from the web tier, the database security group should have an inbound rule that references the web tier's security group ID, rather than IP addresses.

Common mistakes

Using CIDR blocks instead of Security Group IDs for internal VPC traffic.

Question 13 All questions Question 15

Practice the full AWS SAA-C03 Practice Exam 1

65 questions · hints · full answers · grading

More questions from this exam

Q01A company has multiple AWS accounts in an AWS Organizations organization. The security team wants...Medium Q02A solutions architect is designing an application that will run on Amazon EC2 instances. The appl...Easy Q03A company wants to implement a federated identity solution for its employees to access the AWS Ma...Medium Q04A mobile application needs to access Amazon DynamoDB directly to read user-specific data. The app...Hard Q05A company is hosting a web application on Amazon EC2 instances. The application connects to an Am...Medium

View all 65 questions →