A citizen permit portal sits behind an internet-facing Application Load Balancer. How should the architect place the application servers and security groups?
Select an answer to reveal the explanation.
Short Explanation
The ALB is the front desk; the clerks stay in the back office. App servers live in private subnets and only accept traffic from the ALB’s security group—no internet SSH or RDP on the apps. Wide-open public instances or EIP-per-server HTTPS are how you turn a portal into a target range.
Full Explanation
A common three-tier pattern places an internet-facing ALB in public subnets and application instances in private subnets. Security groups should allow client traffic only to the ALB listener ports and allow the ALB security group as the sole source to the application ports. Administrative access should not expose SSH/RDP to the internet on the app tier. Public-subnet apps with open security groups or per-instance public HTTPS increase attack surface and weaken segmentation.