SAA-C03 Q461 · Networking

Question

A company wants to deploy an internal web application on AWS. The web application must be accessible only from the company's office. The company needs to download security patches for the web application from the internet. The company has created a VPC and has configured an AWS Site-to-Site VPN connection to the company's office. A solutions architect must design a secure architecture for the web application. Which solution will meet these requirements?

Accepted Answer

Let's map each requirement to the solution:

**Requirement 1: Web app accessible only from the company's office**
→ EC2 instances in **private subnets** + **internal ALB** means the ALB has no public IP and is not internet-facing. It's only reachable via the existing Site-to-Site VPN connection. The ALB security group restricts inbound to the **company's office CIDR block**, ensuring only office traffic reaches the app.

**Requirement 2: Download security patches from the internet**
→ **NAT gateways in public subnets** + **internet gateway** on the VPC allows the EC2 instances in private subnets to initiate outbound internet connections (for downloading patches) without being directly reachable from the internet. The NAT gateway performs source NAT, translating private IPs to the NAT gatew

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips