A healthcare SaaS must deploy HIPAA workloads across three Availability Zones with web, app, and database tiers, non-overlapping CIDRs for future peering, and audit-ready IP tracking. Growth will require many VPCs and subnets. Which VPC architecture using segmentation and address management ensures scalable isolation?
Select an answer to reveal the explanation.
Short Explanation
You’re building hospital floors where each ward needs its own locked zone. IPAM is your master floor planner, preventing address collisions while tiered subnets isolate traffic.
Full Explanation
VPC IPAM provides centrally managed, non-overlapping CIDR allocation, audit history, and support for growth across many VPCs. Tiered public, private, and isolated subnets in each of three Availability Zones provide scalable isolation: web workloads use public subnets, app workloads use private subnets with NAT egress, and databases use isolated subnets with no internet route. The design with public and private subnets separated only by security groups fails on segmentation: databases remain routable in private subnets, weakening HIPAA network isolation and blast-radius control, even with IPAM and three-AZ coverage. The tiered design limited to two Availability Zones meets segmentation and address-management needs but fails the explicit three-AZ requirement, reducing fault tolerance. A central CIDR plan can initially avoid overlap, but without IPAM it lacks automated allocation, deconfliction, and audit-ready tracking for many VPCs and subnets. Exam caveat: security groups are stateful, instance-level filters; subnet tiers provide route-level isolation, and databases require both. Practical check: verify that IPAM pools show non-overlapping allocations and that each AZ’s subnet route tables have the intended internet gateway, NAT, or no-route associations; confirm flow logs support auditing.