SAA-C03 Question 537
Single answerA company is running its workloads in a public VPC with private subnets to host application servers. These servers need to access the internet to download software updates, but they should not be directly exposed to the internet. The solutions architect must choose between using a NAT instance or a NAT gateway. Which of the following is the MOST cost-effective and scalable solution for this scenario?
- A
Use a NAT instance in an Auto Scaling group with the required configuration to handle high availability.
- B
Use a NAT gateway in each Availability Zone where the private subnets are located.
- C
Deploy a NAT instance in one Availability Zone and configure private subnets to route traffic through it.
- D
Use a NAT gateway in a single Availability Zone and configure all private subnets to route traffic through it.
Show answer and explanation
Correct answer: B
Explanation
To ensure both scalability and high availability, using a NAT gateway in each Availability Zone where private subnets are located is the best solution. NAT gateways are fully managed, require no manual intervention, and can handle bursts of traffic automatically, making them a reliable and cost-effective choice for production workloads. While NAT instances can be cheaper in some scenarios, they require significant manual effort to manage and scale, and they introduce potential single points of failure.
- A. Incorrect.
Using a NAT instance in an Auto Scaling group can handle high availability, but it requires manual setup, management, and monitoring. It is also less scalable compared to NAT gateways and may not be the most cost-effective option depending on the workload.
- B. Correct.
Using a NAT gateway in each Availability Zone ensures high availability and eliminates cross-Availability Zone data transfer costs. While NAT gateways are more expensive than NAT instances in some cases, they are highly scalable and fully managed, which makes them the most cost-effective option for workloads requiring scalability and availability.
- C. Incorrect.
Deploying a NAT instance in one Availability Zone is less expensive than a NAT gateway, but it becomes a single point of failure. It does not scale automatically and requires manual management, which makes it less desirable for highly available production workloads.
- D. Incorrect.
Using a NAT gateway in a single Availability Zone is not recommended for high availability. If the Availability Zone hosting the NAT gateway fails, private subnets in other zones will lose internet connectivity. This setup might reduce costs slightly but compromises availability.