Network Diagram PBQs: AWS Certified Security - Specialty (SCS-C03)

You are a security engineer designing a VPC for a web application that must meet baseline security requirements. The VPC has three subnets: a Public Subnet for internet-facing resources, a Private Subnet for application workloads that should not be directly reachable from the internet, and a Restricted Subnet for sensitive data stores. An Internet Gateway and a WAF are already deployed. Assign the remaining AWS security and application resources to their correct subnets based on defense-in-depth principles.