Architects debate placing a city API in a public subnet versus a private subnet in a VPC. Under shared responsibility, whose decision is that architecture choice?
Select an answer to reveal the explanation.
Short Explanation
AWS gives you the subnet tools, but you decide whether the city API sits in a public or private subnet. That placement choice is your architecture and exposure decision, not AWS's or a scanner's.
Full Explanation
The city is responsible for VPC placement and exposure decisions such as public versus private subnets for municipal workloads. AWS provides the networking constructs; customers decide whether an EC2-based system sits on a busy internet-facing street or a quiet private cul-de-sac. The option saying AWS alone assigns every workload to public or private subnets without customer input is wrong because normal architecture practice requires customer agency in placement. The option saying Amazon Inspector chooses subnet placement based on vulnerability scores alone is wrong because Amazon Inspector evaluates vulnerabilities; it does not choose subnet placement based solely on vulnerability scores. The option saying subnet placement is irrelevant because all EC2 instances are always internet-facing is wrong because subnet placement is not irrelevant, and EC2 instances are not always internet-facing by default in a well-designed VPC. These distractors fail by denying the importance of placement, by removing customer agency, or by confusing vulnerability scanning with network architecture decisions. Exam caveat: public subnet plus public IP plus open security groups is a common breach pattern that foundational questions probe indirectly through ownership of placement decisions. Operational check: place administrative and data tiers in private subnets where appropriate, limit public exposure to intended load balancers or controlled entry points, review route tables and NAT usage, verify security groups match the intended exposure model, and re-check after every network change ticket.