ANS-C01 Question 334
Single answerYour organization uses Amazon VPC with multiple subnets and has deployed a fleet of EC2 instances within a private subnet for a critical application. These instances need to download software patches from an external repository on the internet. Due to compliance requirements, direct internet access is not allowed from the private subnet. Which option will allow the EC2 instances to securely access the external repository while adhering to the compliance requirement?
- A
Configure a NAT Gateway in a public subnet and route the traffic from the private subnet through the NAT Gateway.
- B
Attach an Internet Gateway directly to the private subnet to enable internet access.
- C
Use a VPC endpoint to connect to the external repository if it supports AWS PrivateLink.
- D
Set up a bastion host in the private subnet and use it to tunnel the traffic to the external repository.
Show answer and explanation
Correct answer: A
Explanation
Using a NAT Gateway in a public subnet is the best approach in this scenario. It enables EC2 instances in the private subnet to securely access the internet for downloading software patches without exposing them to direct internet access, which adheres to the compliance requirements. The other options either violate the compliance requirement or are not feasible for the given use case.
- A. Correct.
This is the correct option. A NAT Gateway deployed in a public subnet allows instances in a private subnet to securely access the internet for updates or patches without exposing the instances to direct internet access.
- B. Incorrect.
This is incorrect because attaching an Internet Gateway to a private subnet directly violates the compliance requirement of avoiding direct internet access.
- C. Incorrect.
This is incorrect because AWS PrivateLink (using a VPC endpoint) only works for services that explicitly support it. External repositories not hosted on AWS are unlikely to support PrivateLink.
- D. Incorrect.
This is incorrect because a bastion host is typically used for secure remote access to instances, not for routing traffic to external repositories. Additionally, this setup does not fulfill the compliance requirement.