Architects are laying out a three-tier VPC for a municipal web app: internet-facing load balancers, private application instances, and private databases. Which subnet and routing approach supports scale and correct exposure?
Select an answer to reveal the explanation.
Short Explanation
Front door on the public street, clerks and vault in the locked back offices. Load balancers can face the Internet Gateway; app and database subnets stay private with the routes they actually need.
Full Explanation
A scalable three-tier VPC places internet-facing load balancers in public subnets routed to an Internet Gateway, while application and database tiers remain in private subnets without public IPs. Private tiers reach out via NAT gateways or VPC endpoints as required. Publishing databases on public IGW paths or collapsing tiers into one flat open subnet weakens isolation and scale hygiene.