ANS-C01 Question 202
Select 3Your company has deployed an application in a VPC consisting of two subnets: a private subnet and a public subnet. The private subnet hosts application servers, while the public subnet hosts a NAT Gateway. The application in the private subnet needs to communicate with an external service over the internet. You notice that the application cannot establish a connection to the external service. Which of the following could be the reason for the connectivity issue?
- A
The private subnet does not have a route in its route table pointing to the NAT Gateway.
- B
The NAT Gateway is not associated with an Elastic IP address.
- C
The public subnet does not have a route in its route table pointing to an internet gateway.
- D
The security group of the application servers in the private subnet does not allow outbound traffic to the destination IP or port.
- E
The NAT Gateway is deployed in the private subnet instead of the public subnet.
Show answer and explanation
Correct answers: A, B, D
Explanation
For instances in a private subnet to access the internet through a NAT Gateway, the private subnet's route table must have a route to the NAT Gateway. Additionally, the NAT Gateway must be associated with an Elastic IP address and deployed in a public subnet. Security groups must also allow the necessary outbound traffic. Any misconfiguration in these areas can prevent the application from connecting to external services.
- A. Correct.
Correct. For instances in the private subnet to communicate with external services, the private subnet's route table must have a route to the NAT Gateway.
- B. Correct.
Correct. A NAT Gateway must be associated with an Elastic IP address to enable outbound internet access for resources in a private subnet.
- C. Incorrect.
Incorrect. While the internet gateway is required for internet access, this issue would prevent the NAT Gateway from working entirely, not just the private subnet's connectivity.
- D. Correct.
Correct. The security group of the application servers must allow outbound traffic to the destination IP and port for the connection to succeed.
- E. Incorrect.
Incorrect. A NAT Gateway must be deployed in a public subnet to provide outbound internet access to private subnets.