SAA-C03 Question 181
Select 1You have created a VPC with a public and a private subnet. An EC2 instance in the private subnet needs to access the internet to download software updates. What configuration changes or additional resources should you implement to enable internet access for the EC2 instance?
- A
Add an Internet Gateway to the VPC and associate it with the private subnet.
- B
Create a NAT Gateway in the public subnet and update the private subnet’s route table to use the NAT Gateway for internet-bound traffic.
- C
Add a route in the private subnet’s route table pointing to the Internet Gateway for 0.0.0.0/0.
- D
Ensure the EC2 instance in the private subnet has a public IP address.
- E
Create a NAT Gateway in the private subnet and update the private subnet’s route table to use the NAT Gateway for internet-bound traffic.
Show answer and explanation
Correct answer: B
Explanation
Instances in a private subnet cannot access the internet directly. To enable internet access, a NAT Gateway must be deployed in a public subnet. Then, the private subnet’s route table must be updated to route internet traffic (0.0.0.0/0) through the NAT Gateway. This design ensures outbound internet access while maintaining the security of the private subnet.
- A. Incorrect.
Incorrect. An Internet Gateway provides internet access for resources in public subnets, but it cannot be directly associated with a private subnet.
- B. Correct.
Correct. A NAT Gateway in the public subnet allows instances in the private subnet to access the internet without exposing them to inbound traffic. The private subnet’s route table must direct internet traffic (0.0.0.0/0) to the NAT Gateway.
- C. Incorrect.
Incorrect. The private subnet cannot use an Internet Gateway directly. Internet Gateways are only accessible from public subnets.
- D. Incorrect.
Incorrect. Assigning a public IP to the EC2 instance in the private subnet does not provide internet access because the instance is in a private subnet and cannot directly communicate with the Internet Gateway.
- E. Incorrect.
Incorrect. A NAT Gateway must be placed in a public subnet. Placing it in the private subnet would prevent it from functioning correctly.