ANS-C01 Question 233
Select 2You are designing a VPC network for a company that requires highly available, fault-tolerant applications across two Availability Zones. The company wants to use private IP addresses for communication between resources within the VPC and also access the internet for software updates using NAT. Which configuration would meet these requirements?
- A
Create a NAT Gateway in one Availability Zone, associate it with a public subnet, and configure route tables to forward traffic to the NAT Gateway.
- B
Deploy two NAT Gateways, one in each Availability Zone, and update the route tables of the private subnets in each Availability Zone to use the local NAT Gateway.
- C
Use a single Internet Gateway to allow private subnets to access the internet for updates.
- D
Deploy an Elastic Load Balancer across two Availability Zones to ensure high availability for inbound traffic.
- E
Ensure private subnets have direct access to the internet using Elastic IPs assigned to the instances.
Show answer and explanation
Correct answers: B, D
Explanation
For private subnets to access the internet while maintaining security, NAT Gateways must be used. To ensure high availability and fault tolerance, deploying NAT Gateways in multiple Availability Zones and configuring private subnets to use the local NAT Gateway is critical. Additionally, using an Elastic Load Balancer across Availability Zones guarantees high availability for inbound application traffic.
- A. Incorrect.
This configuration does not ensure high availability because the NAT Gateway is in only one Availability Zone. If the NAT Gateway or its Availability Zone fails, resources in other Availability Zones would lose internet access.
- B. Correct.
This is the correct approach to ensure high availability and fault tolerance. Deploying NAT Gateways in both Availability Zones and configuring route tables to use the local NAT Gateway ensures resilience and performance.
- C. Incorrect.
An Internet Gateway does not provide private subnets with direct access to the internet. It is used for public subnets and does not substitute for a NAT Gateway for private subnets.
- D. Correct.
Using an Elastic Load Balancer across two Availability Zones ensures high availability for inbound traffic, which aligns with the application requirements in the scenario.
- E. Incorrect.
This is incorrect because private subnets are not designed to have direct internet access via Elastic IPs. NAT Gateways should be used for private subnets to access the internet.