From the official WordPress documentation: https://codex.wordpress.org/Editing_wp-config.php
NOTE: Since Version 2.6, wp-config.php file can be moved to the directory directly above the WordPress install directory.
That's how it's possible.
As to whether or not doing so has any security benefit, see this lengthy StackExchange debate: Is moving wp-config outside the web root really beneficial?
Finally, in EE, the configuration file should be above the htdocs directory... eg /var/www/domain.com or /var/www/SUB.domain.com
