Q83 — AWS SAA-C03 Ch.17

Question 83 of 89 | ← Chapter 17

Q1383. A company creates a VPC that has one public subnet and one private subnet. The company attaches an internet gateway to the VPC. An Application Load Balancer (ALB) in the public subnet communicates with Amazon EC2 instances in the private subnet.The EC2 instances in the private subnet must be able to download operating system(OS) and application updates from the internet. The instances must not be accessible from the internet.Which combination of steps will meet these requirements?(Select THREE.)

Correct Answer: A. Associate an Elastic IP address with the NAT gateway., B. Add a route of 0.0.0.0/0 to the private subnet route table. Set the NAT gateway as a target., C. Deploy a NAT gateway in the public subnet.

Explanation

The problem requires enabling EC2 instances in a private subnet to download updates from the internet while keeping them inaccessible from the internet. The key is to use a NAT gateway, which allows outbound internet access for private subnet instances without exposing them to inbound traffic. Here's the analysis of the options:Correct Options:C. Deploy a NAT gateway in the public subnetA NAT gateway must reside in a public subnet to access the internet via the attached internet gateway (IGW). Placing it in the private subnet (Option D) would isolate it from the IGW, rendering it ineffective. B. Add a route of 0.0.0.0/0 to the private subnet route table. Set the NAT gateway as a target The private subnet's route table must direct all outbound traffic (0.0.0.0/0) to the NAT gateway. This enables instances in the private subnet to reach the internet through the NAT gateway while remaining inaccessible from the internet.A. Associate an Elastic IP address with the NAT gatewayA NAT gateway requires an Elastic IP (EIP) to communicate with the internet. The EIP provides a static public IP address, ensuring consistent outbound connectivity for the private subnet instances.Incorrect Options:D. Deploy a NAT gateway in the private subnetA NAT gateway in the private subnet cannot access the internet because it lacks a path to the IGW, which resides in the public subnet.E. Add a route of 0.0.0.0/0 to the public subnet route table. Set the NAT gateway as a target The public subnet's route table should direct traffic to the IGW (not the NAT gateway) for internet access. The NAT gateway is only needed for private subnet traffic. F. Associate an Elastic IP address with the internet gateway An IGW does not require an EIP. It automatically handles public IP addressing for the VPC. The EIP is assigned to the NAT gateway, not the IGW.Final Answer:A, B, CDeploy the NAT gateway in the public subnet (C), configure the private subnet's route table to use the NAT gateway (B), and associate an EIP with the NAT gateway (A). This setup allows private subnet instances to download updates while remaining inaccessible from the internet.