nerdexam
Amazon

SAA-C03 · Question #214

A company is creating a low-latency payment processing application that supports TLS connections from IPv4 clients. The application requires outbound access to the public internet. Users must access t

The correct answer is A. Create a VPC that has an internet gateway, public subnets, and private subnets. Deploy a. Deploy a low-latency, secure payment processing application using ECS tasks (AWSVPC network mode) with TLS, IPv4 client support, public internet outbound access, and a single entry point.

Submitted by asante_acc· Mar 4, 2026Design Secure Architectures

Question

A company is creating a low-latency payment processing application that supports TLS connections from IPv4 clients. The application requires outbound access to the public internet. Users must access the application from a single entry point. The bank wants to use Amazon Elastic Container Service (Amazon ECS) tasks to deploy the application. The company wants to enable AWSVPC network mode. Which solution will meet these requirements MOST securely?

Options

  • ACreate a VPC that has an internet gateway, public subnets, and private subnets. Deploy a
  • BCreate a VPC that has an outbound-only internet gateway, public subnets, and private subnets.
  • CCreate a VPC that has an internet gateway, public subnets, and private subnets. Deploy an
  • DCreate a VPC that has an outbound-only internet gateway, public subnets, and private subnets.

How the community answered

(42 responses)
  • A
    79% (33)
  • B
    5% (2)
  • C
    12% (5)
  • D
    5% (2)

Why each option

Deploy a low-latency, secure payment processing application using ECS tasks (AWSVPC network mode) with TLS, IPv4 client support, public internet outbound access, and a single entry point.

ACreate a VPC that has an internet gateway, public subnets, and private subnets. Deploy aCorrect

Deploying an Application Load Balancer (ALB) in public subnets provides a single, TLS-terminating entry point for IPv4 clients, while ECS tasks in private subnets with `awsvpc` network mode register with the ALB and access the internet via a NAT Gateway in a public subnet for secure outbound connectivity.

BCreate a VPC that has an outbound-only internet gateway, public subnets, and private subnets.

An outbound-only internet gateway is exclusively for IPv6 traffic, which contradicts the requirement for supporting IPv4 clients.

CCreate a VPC that has an internet gateway, public subnets, and private subnets. Deploy an

A Network Load Balancer (NLB) operates at Layer 4 and cannot terminate TLS connections for HTTP/S traffic, failing to meet the requirement for TLS connections from clients.

DCreate a VPC that has an outbound-only internet gateway, public subnets, and private subnets.

An outbound-only internet gateway is exclusively for IPv6 traffic, which contradicts the requirement for supporting IPv4 clients.

Concept tested: Secure ECS VPC architecture, ALB, NAT Gateway

Source: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html

Community Discussion

No community discussion yet for this question.

Full SAA-C03 Practice