Exam AWS-SysOps topic 1 question 832 discussion

C as the ALB is public facing, your webservers (as your database servers) should be in the private subnets to limit exposure refer to https://aws.amazon.com/premiumsupport/knowledge-center/public-load-balancer-private-ec2/

By configuring the infrastructure in this way, the web application can achieve high availability by deploying resources across multiple Availability Zones (AZs) while also limiting direct public access to the instances that don't require it. The ALB serves as the public-facing entry point, and the web servers and database servers are protected within private subnets.

I vote C

Ans is B, why would u need 2 subnets for ALB??

I'll go for C, we have to limit public access to the max, ALB allows accessing to the Web servers; therefore we can pub the WS in a private subnet

C as the ALB is public facing, your webservers (as your database servers) should be in the private subnets to limit exposure

C. Create two public subnets for the Application Load Balancer, two private subnets for the web servers, and two private subnets for the database servers. Example of accessibility to the web servers via the Internet is shown in Figure 1 of the linked documentation but we should add two separate private subnets for the database servers https://docs.aws.amazon.com/quickstart/latest/magento/architecture.html

I'll go with C

As per https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-application-load-balancer.html Select one subnet per zone to enable. If you enabled dual-stack mode for the load balancer, select subnets with associated IPv6 CIDR blocks. You can specify one of the following: Subnets from at least two Availability Zones Subnets from one or more Local Zones One Outpost subnet + Requirement to secure instances -> Put Webservers in Private subnet Answer -> C

The question is posed wrong. ALB don't exist in a subnet, they only point to subnets when EC2 are their targets. ALB is more of a regional service that sits outside subnets. The only thing for sure is should be 2 subnets for web and 2 subnets for DB to ensure HA. All subnets should be private, the only service exposed to the internet is the load balancer. So the closest answer is C.

Are the web servers not supposed to be public facing, or what am I missing here...? I would opt for B.

B is correct, you dont need WS in private sub. otherwise you put both DB and WS in private.

Ans C -->ALB is public facing tne Webservers can run in private subnet.

It should be B because you need to put the ELB to public subnet

why not B

C. Create two public subnets for the Application Load Balancer, two private subnets for the web servers, and two private subnets for the database servers.

C for sure