SAA-C03 Question 179
Single answerA company has set up a VPC with two subnets: a public subnet and a private subnet. The public subnet contains an Application Load Balancer (ALB), and the private subnet contains an EC2 instance hosting a backend application. The company wants to ensure that the backend EC2 instance can communicate with the ALB, but it should not have direct access to the internet. Which route table configuration in the private subnet will fulfill this requirement?
- A
A route table with a route to the ALB's private IP and a route to an internet gateway.
- B
A route table with a route to the ALB's private IP and a route to a NAT gateway.
- C
A route table with a route to the ALB's private IP and a route to a VPC endpoint.
- D
A route table with a route to the ALB's private IP and a route to the local VPC CIDR block.
Show answer and explanation
Correct answer: D
Explanation
In this scenario, the EC2 instance in the private subnet only needs to communicate with the ALB, which resides within the same VPC. The correct route table configuration includes a route to the local VPC CIDR block, allowing internal communication while ensuring that the private subnet does not have internet access. The other options either introduce unnecessary routes or violate the requirement to restrict internet access.
- A. Incorrect.
This configuration would expose the private subnet to the internet, which violates the requirement that the backend EC2 instance should not have direct internet access.
- B. Incorrect.
While a NAT gateway allows private subnet instances to access the internet for outbound traffic, it is unnecessary for communication between the ALB and the EC2 instance inside the VPC. This route is not required.
- C. Incorrect.
A VPC endpoint is used for private communication with AWS services like S3 or DynamoDB, not for communication between the ALB and the EC2 instance within the same VPC.
- D. Correct.
This configuration ensures that the backend EC2 instance communicates with the ALB over the local VPC network without exposing the private subnet to the internet. The local route covers all internal communication within the VPC.