Secure Web App with VPN and Internet Access

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

B Deploy web app on EC2 in private subnets behind internal ALB with NAT gateways for outbound internet access.

Question

A company wants to deploy an internal web application on AWS. The web application must be accessible only from the company's office. The company needs to download security patches for the web application from the internet. The company has created a VPC and has configured an AWS Site-to-Site VPN connection to the company's office. A solutions architect must design a secure architecture for the web application. Which solution will meet these requirements?
  1. Deploy the web application on Amazon EC2 instances in public subnets behind a public Application Load Balancer (ALB). Attach an internet gateway to the VPC. Set the inbound source of the ALB's security group to 0.0.0.0/0.
  2. Deploy the web application on Amazon EC2 instances in private subnets behind an internal Application Load Balancer (ALB). Deploy NAT gateways in public subnets. Attach an internet gateway to the VPC. Set the inbound source of the ALB's security group to the company's office network CIDR block. Correct Answer
  3. Deploy the web application on Amazon EC2 instances in public subnets behind an internal Application Load Balancer (ALB). Deploy NAT gateways in private subnets. Attach an internet gateway to the VPSet the outbound destination of the ALB’s security group to the company's office network CIDR block.
  4. Deploy the web application on Amazon EC2 instances in private subnets behind a public Application Load Balancer (ALB). Attach an internet gateway to the VPC. Set the outbound destination of the ALB’s security group to 0.0.0.0/0.

Key Takeaways

The common trap is assuming a public subnet or ALB is needed for internet access; private subnets with NAT are the secure standard.

This question tests securing an internal web application accessible via Site-to-Site VPN while allowing outbound patch downloads using NAT gateways.

Common mistake: Learners often choose A because it seems simpler, ignoring that public subnets expose instances directly to the internet.

Expert Analysis

Why the Answer Is Correct

Option B correctly places EC2 instances in private subnets behind an internal ALB, ensuring they are not directly reachable from the internet. The inbound security group rule restricts access to the company's office CIDR block, satisfying the requirement for office-only access via the VPN. NAT gateways in public subnets allow the private instances to initiate outbound connections to the internet for patches without exposing them inbound.

Why the Other Options Are Wrong

Option A uses a public ALB and open inbound rules (0.0.0.0/0), violating the office-only access requirement. Option C incorrectly places NAT gateways in private subnets (NATs must be in public subnets) and uses an internal ALB with outbound rules, which is not how ALB security works. Option D uses a public ALB, which would expose the application to the internet regardless of outbound rules, failing the security constraint.

Community Comment Notes

As osmk noted, there is confusion about IGW vs NATGW roles, but B correctly utilizes both: IGW for the NAT GW to reach the internet, and NAT GW for private instance egress. Scheldon confirmed that keeping servers in private subnets hides them from the world, which is the core security principle here.

Exam Strategy

Always prioritize private subnets for backend resources. Use NAT Gateways in public subnets for outbound internet access, never direct routing from private subnets.

Frequently Asked Questions

Why can't I use a Public ALB for an internal app?

A Public ALB is associated with a public subnet and has a public DNS name, making it accessible from the internet. An internal ALB stays within the VPC/private network.

Do I need an Internet Gateway if I have a NAT Gateway?

Yes. The NAT Gateway itself resides in a public subnet and requires an Internet Gateway attached to the VPC to route traffic to the internet.

More SAA-C03 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. osmk 👍 6 Answered B
    none sense why IGW on top of NATGW.
  2. ogerber 👍 3
    To my opinion, with only having inbound of the companys CIDR block, it will not include access for the patches available online. i would go for D
  3. striker89 👍 1 Answered B
    I Would go for B even if NAT GW allow outbound traffic ONLY. Still wondering how the Company newtwork will access Private Subnet in the VPC.
  4. Scheldon 👍 1
    AnswerB Server and LB in Private will hide WEB application from the word. NAT will allow for server's access to the internet in case of need
  5. Andy_09 👍 7
    Option B
Show 1 more comment
  1. NayeraB 👍 3 Answered B
    B is well structured

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide