ANS-C01 Question 134
Single answerYour company has deployed a VPC with a private subnet and a public subnet. Instances in the private subnet need to access the internet to download software updates, but they should not be directly accessible from the internet. Which solution would you implement to meet this requirement?
- A
Attach an Elastic IP to the instances in the private subnet
- B
Set up a NAT Gateway in the public subnet and update the route table for the private subnet
- C
Deploy a VPN connection between the private subnet and the internet
- D
Use an Internet Gateway directly with the private subnet
Show answer and explanation
Correct answer: B
Explanation
To allow instances in a private subnet to access the internet while keeping them inaccessible from the internet, you must use a NAT Gateway. The NAT Gateway should be deployed in the public subnet, and the route table for the private subnet should be updated to direct internet-bound traffic to the NAT Gateway. This ensures instances in the private subnet can initiate outbound traffic while remaining secure.
- A. Incorrect.
Elastic IPs are used to provide a public IP address directly to an instance, which would make the instances in the private subnet directly accessible from the internet. This solution does not meet the requirement.
- B. Correct.
A NAT Gateway allows instances in a private subnet to initiate outbound communication to the internet while remaining inaccessible from the internet. This is the correct solution.
- C. Incorrect.
A VPN connection is used to establish a secure connection between the VPC and an on-premises network or another AWS VPC. It does not solve the requirement for internet access for the private subnet.
- D. Incorrect.
Using an Internet Gateway directly with the private subnet would make the private subnet publicly accessible, which violates the requirement of keeping the instances in the private subnet inaccessible from the internet.