A healthcare SaaS runs a 3-tier app in one VPC and must keep PHI databases offline, inspect app-tier east/west traffic, and filter north/south internet traffic centrally. Which segmentation design provides the required north/south and east/west protections with isolated subnets?
Select an answer to reveal the explanation.
Short Explanation
You've got traffic flowing like hallways and front doors, and you're locking each one correctly. Segmentation with public, private, and isolated subnets plus central inspection nails both directions at once.
Full Explanation
The correct design meets all constraints together because public subnets contain the internet-facing load balancer for controlled north-south ingress, private subnets contain application servers with no direct inbound internet and centralized inspected egress, and isolated subnets contain PHI databases with no internet route while VPC endpoints provide private AWS service access and a network firewall inspects east-west traffic between tiers. The private-database design with NAT access fails isolation by concept because a default route to a NAT gateway still allows outbound internet initiation and return traffic, which violates strict offline storage for PHI even when traffic is logged centrally. The security-group-only design fails inspection by concept because security groups enforce stateful port-level filtering at network interfaces but cannot perform deep packet inspection or centralized intrusion prevention needed to detect lateral movement between application and database layers. The distributed-NAT design fails centralization by concept because per-AZ gateways send outbound traffic directly to the internet from each zone, splitting policy enforcement and logging instead of routing all flows through one inspected choke point. An exam caveat is to distinguish private from isolated subnets carefully since private allows outbound NAT while isolated has no internet route and requires endpoints, so any 0.0.0.0/0 route on a PHI subnet breaks compliance. A practical check is to audit isolated route tables for no internet routes, validate required VPC endpoints and endpoint policies, and confirm firewall associations, Suricata rules, and flow logs cover inter-subnet and egress traffic.