SAA-C03 Question 182
Single answerYour company has an application running in a custom VPC on AWS. The application is hosted in a private subnet with no Internet Gateway attached. The application needs to download updates from a public software repository on the internet. What is the most cost-effective and secure way to enable this connectivity?
- A
Attach an Internet Gateway to the VPC and update the route table of the private subnet to point to the Internet Gateway.
- B
Create a NAT Gateway in a public subnet and update the route table of the private subnet to forward traffic destined for the internet to the NAT Gateway.
- C
Create a NAT Instance in a public subnet and update the route table of the private subnet to forward traffic destined for the internet to the NAT Instance.
- D
Enable VPC peering with another VPC that has internet access and route the traffic through the peered VPC.
Show answer and explanation
Correct answer: B
Explanation
To enable internet access for resources in a private subnet securely and cost-effectively, a NAT Gateway should be used. It allows outbound internet traffic from the private subnet while blocking any inbound internet traffic. This ensures the subnet remains private and secure while meeting the application's requirements.
- A. Incorrect.
Attaching an Internet Gateway to the VPC and routing traffic from the private subnet directly to it will expose the private subnet to the internet, which compromises security. This is not recommended for private subnets.
- B. Correct.
Creating a NAT Gateway in a public subnet is the recommended solution. It allows the private subnet to access the internet for updates without exposing the subnet to incoming traffic from the internet, ensuring security.
- C. Incorrect.
Using a NAT Instance is a possible solution, but it is less cost-effective and less scalable compared to using a NAT Gateway. Managing NAT Instances also requires more manual effort.
- D. Incorrect.
VPC peering does not support routing internet-bound traffic between peered VPCs. This solution is not feasible for enabling internet access for the private subnet.