Q70 — AWS SAA-C03 Ch.16

Question 70 of 100 | ← Chapter 16

Q1270. A company hosts an Amazon EC2 instance in a private subnet in a new VPC. The VPC also has a public subnet that has the default route set to an internet gateway. The private subnet does not have outbound internet access.The EC2 instance needs to have the ability to download monthly security updates from an outside vendor.However,the company must block any connections that are initiated from the internet.Which solution will meet these requirements?

• A. Configure the private subnet route table to use the internet gateway as the default route.
• B. Create a NAT gateway in the public subnet. Configure the private subnet route table to use the NAT gateway as the default route. ✓
• C. Create a NAT instance in the private subnet. Configure the private subnet route table to use the NAT instance as the default route.
• D. Create a NAT instance in the private subnet. Configure the private subnet route table to use the internet gateway as the default route.

Correct Answer: B. Create a NAT gateway in the public subnet. Configure the private subnet route table to use the NAT gateway as the default route.

Explanation

The correct solution must allow the private subnet's EC2 instance to download security updates (outbound internet access) while blocking all inbound internet traffic. Here's the analysis:Correct Answer: B. Create a NAT gateway in the public subnet. Configure the private subnet route table to use the NAT gateway as the default route.Why Option B is Best:Provides Outbound Internet Access (Only):A NAT Gateway (Network Address Translation) allows instances in the private subnet to initiate outbound connections to the internet (e.g., downloading security updates). Inbound traffic from the internet is blocked because the private subnet has no public IPs or internet gateway route.Correct Placement in Public Subnet:The NAT Gateway must reside in a public subnet (with a route to the internet via an internet gateway) to access the internet.The private subnet's route table is updated to send all outbound traffic (0.0.0.0/0) to the NAT Gateway.Managed & Scalable:AWS manages the NAT Gateway (unlike a self-managed NAT instance), ensuring high availability and automatic scaling.Why Other Options Fail:A. Configure the private subnet route table to use the internet gateway as the default route. Insecure: This would expose the private subnet to inbound internet traffic (violating the requirement to block external connections).Private subnets should not have direct internet access.C. Create a NAT instance in the private subnet. Configure the private subnet route table to use the NAT instance as the default route.Incorrect placement: A NAT instance must reside in a public subnet (not private) to access the internet. Self-managed: NAT instances require manual scaling, patching, and failover handling (unlike NAT Gateway).D. Create a NAT instance in the private subnet. Configure the private subnet route table to use the internet gateway as the default route.Contradictory & insecure:A NAT instance in a private subnet cannot reach the internet (no route to IGW). Using the internet gateway directly in the private subnet route table exposes it to inbound traffic.Key Concepts:RequirementSolutionOutbound internet access (private subnet)NAT Gateway (or NAT instance) in public subnet Block inbound internet trafficNo public IPs or IGW route in private subnet High availability & scalabilityUse AWS-managed NAT Gateway (not self-managed NAT instance)Final Architecture:Public Subnet:Contains the NAT Gateway (with an Elastic IP).Route table: 0.0.0.0/0 Internet Gateway.Private Subnet:Contains the EC2 instance (no public IP).Route table: 0.0.0.0/0 NAT Gateway.This ensures:EC2 can download updates (outbound).No inbound internet access (secure).Final Answer: B