DEA-C01 Question 425
Single answerYou are designing a data processing application hosted on Amazon EC2 instances within a private subnet of a VPC. The application needs to fetch large datasets from an external API over the internet. To ensure secure and scalable access to the external API without exposing your EC2 instances to the public internet, what should you do?
- A
Attach an Elastic IP to each EC2 instance in the private subnet.
- B
Configure a NAT Gateway in a public subnet and update the route table of the private subnet to point to the NAT Gateway.
- C
Use an Internet Gateway and directly associate it with the private subnet.
- D
Set up a VPN connection with the external API provider to enable direct communication.
Show answer and explanation
Correct answer: B
Explanation
To enable secure and scalable internet access for instances in a private subnet, a NAT Gateway is the best solution. The NAT Gateway resides in a public subnet and acts as an intermediary, allowing instances in the private subnet to initiate outbound internet connections while keeping them isolated from inbound internet traffic. This approach aligns with best practices for VPC security and networking.
- A. Incorrect.
Attaching an Elastic IP to each EC2 instance would require the instances to be in a public subnet, which exposes them directly to the internet and is not a secure solution for private subnets.
- B. Correct.
Using a NAT Gateway in a public subnet allows instances in private subnets to securely access the internet by routing traffic through the NAT Gateway. This is the recommended approach when allowing private subnet instances to access external resources.
- C. Incorrect.
An Internet Gateway cannot be directly associated with a private subnet. It is used to enable communication between public subnets and the internet.
- D. Incorrect.
Setting up a VPN connection with the external API provider is unnecessary for accessing a public API over the internet and adds complexity without addressing the requirement.