Architects are laying out a three-tier VPC for a municipal web app: internet-facing load balancers, private application instances, and private databases. Which subnet and routing approach supports scale and correct exposure?
Select an answer to reveal the explanation.
Short Explanation
Front door on the public street, clerks and vault in the locked back offices. Load balancers can face the Internet Gateway; app and database subnets stay private with the routes they actually need.
Full Explanation
A three-tier municipal web app should expose only what must be public. Place internet-facing load balancers in public subnets with routes to an Internet Gateway so citizens can reach the portal. Keep application instances and databases in private subnets without public IPs, using NAT gateways or VPC endpoints for outbound needs and tightly scoped security groups between tiers. That layout supports horizontal scale of each tier while preventing direct internet exposure of the database that holds permits, payments, or personal data.
Placing databases in public subnets with a default route to an Internet Gateway simplifies “debugging” by expanding the blast radius—unacceptable for civic data. Putting all tiers in one subnet with open security groups and no deliberate route tables collapses segmentation and makes least-privilege networking nearly impossible. Attaching Internet Gateways directly to every private database ENI misunderstands IGW attachment (IGWs attach to VPCs, not randomly to private ENIs) and would undermine private placement.
Exam caveat: “private subnet” means no IGW route for that subnet’s outbound path to the internet as a default public model—NAT or endpoints are how private tiers reach AWS APIs. Public load balancers still need proper security groups; private does not mean “no routes at all.”
Operational check: confirm DB instances have no public IP and no IGW route; verify app tiers reach the DB on the data port only from app security groups; test outbound patching via NAT or endpoints; and validate the load balancer subnet map across multiple AZs for availability.