Q83 — AWS SAA-C03 Ch.14

Question 83 of 100 | ← Chapter 14

Q1083. A company is launching a new application that will be hosted on Amazon EC2 instances. A solutions architect needs to design a solution that does not allow public IPv4 access that originates from the internet. However,the solution must allow the EC2 instances to make outbound IPv4 internet requests. The initial design proposal shows that the EC2 instances would be located in two private subnets across two Availability Zones. The entire architecture must be highly available.How should the solutions architect change the architecture to meet these requirements?

Correct Answer: A. Deploy a NAT gateway in public subnets in both Availability Zones. Create and configure one route table for each private subnet.

Explanation

To design a solution that meets the requirements of not allowing public IPv4 access from the internet to the EC2 instances but allowing them to make outbound IPv4 internet requests, and ensuring high availability, let's evaluate each option:A. Deploy a NAT gateway in public subnets in both Availability Zones. Create and configure one route table for each private subnet.This option is correct in terms of deploying a NAT gateway in public subnets. NAT gateways allow outbound internet access while preventing inbound internet access. Configuring one route table for each private subnet is also a good practice to maintain isolation and control. B. Deploy an internet gateway in public subnets in both Availability Zones. Create and configure a shared route table for the private subnets.An internet gateway allows direct access to the internet, which would violate the requirement of not allowing public IPv4 access from the internet. A shared route table for private subnets could lead to less granular control over routing.C. Deploy a NAT gateway in public subnets in both Availability Zones. Create and configure a shared route table for the private subnets.Although deploying NAT gateways in public subnets is correct, using a shared route table for private subnets is not ideal as it could reduce control over routing and potentially introduce security risks. D. Deploy an egress-only internet gateway in public subnets in both Availability Zones. Create and configure one route table for each private subnet.Egress-only internet gateways allow outbound internet traffic but do not allow inbound traffic, which is similar to NAT gateways. However, they are typically used in scenarios where you need outbound access but do not need the additional features of a NAT gateway (like port forwarding, static IP addresses, etc.). Given the requirements, a NAT gateway would be more versatile and suitable.The best solution is:A. Deploy a NAT gateway in public subnets in both Availability Zones. Create and configure one route table for each private subnet.This architecture ensures that the EC2 instances in the private subnets cannot be accessed from the internet but can still make outbound internet requests via the NAT gateways. Configuring one route table for each private subnet maintains isolation and control.