Architects place a public web tier and a private application tier in separate address ranges inside one VPC. Which VPC component creates that segmentation?
Select an answer to reveal the explanation.
Short Explanation
Subnets are like separate floors in the same building—one floor for the public lobby (web), another for back-office rooms (app) that stay off the street. IAM handles permissions, S3 stores objects, Cognito handles users—they do not carve up VPC IP space.
Full Explanation
When architects place a public web tier and a private application tier in separate address ranges inside one VPC, subnets are the VPC component that creates that segmentation. Subnets partition the VPC IP space so resources can be placed into distinct network segments—commonly public subnets with routes to an internet gateway for load balancers or bastion patterns, and private subnets for application and database tiers without direct internet exposure. That tiering is foundational municipal VPC design.
AWS IAM roles grant AWS API permissions; they do not partition IP address space. Amazon S3 buckets are object containers, not VPC subnets. Amazon Cognito user pools manage application users and do not assign private CIDR blocks for network tiers.
Exam caveat: Segmentation inside a VPC by address range → subnets. IAM is identity, Cognito is app auth, S3 is object storage. Do not mix identity constructs with CIDR segmentation.
Operational check: allocate public and private subnets across at least two AZs, place the ALB in public subnets and app/db ENIs in private subnets, verify route tables match the intended exposure model, and peer-review the diagram before the next citizen-facing release.