nerdexam
Amazon

SAA-C03 · Question #316

A company wants to deploy an internal web application on AWS. The web application must be accessible only from the company's office. The company needs to download security patches for the web applicat

The correct answer is B. Deploy the web application on Amazon EC2 instances in private subnets behind an internal. Deploying the web application on EC2 instances in private subnets behind an internal ALB ensures that the application is not directly accessible from the internet. By setting up a Site-to- Site VPN connection, the application can be accessed securely from the company's office net

Submitted by suresh_in· Mar 4, 2026Design Secure Architectures

Question

A company wants to deploy an internal web application on AWS. The web application must be accessible only from the company's office. The company needs to download security patches for the web application from the internet. The company has created a VPC and has configured an AWS Site- to-Site VPN connection to the company's office. A solutions architect must design a secure architecture for the web application. Which solution will meet these requirements?

Options

  • ADeploy the web application on Amazon EC2 instances in public subnets behind a public
  • BDeploy the web application on Amazon EC2 instances in private subnets behind an internal
  • CDeploy the web application on Amazon EC2 instances in public subnets behind an internal
  • DDeploy the web application on Amazon EC2 instances in private subnets behind a public

How the community answered

(17 responses)
  • A
    6% (1)
  • B
    71% (12)
  • C
    18% (3)
  • D
    6% (1)

Explanation

Deploying the web application on EC2 instances in private subnets behind an internal ALB ensures that the application is not directly accessible from the internet. By setting up a Site-to- Site VPN connection, the application can be accessed securely from the company's office network. Deploying NAT gateways in public subnets allows instances in private subnets to initiate outbound connections to the internet for downloading security patches.

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SAA-C03 Practice