SAA-C03 Question 539
Single answerA company is running a web application in a public subnet of a VPC, and the application needs to fetch data from an external API hosted on the internet. The company wants to secure the infrastructure and ensure high availability for outgoing internet traffic. Which solution should the company choose, considering cost-effectiveness and ease of management?
- A
Use a NAT gateway in the public subnet to allow the application to access the internet.
- B
Deploy a NAT instance in the public subnet with auto-scaling enabled.
- C
Attach an internet gateway to the VPC and route outbound traffic directly through it.
- D
Use a VPC endpoint to connect to the external API.
Show answer and explanation
Correct answer: A
Explanation
NAT gateways are the recommended solution for enabling instances in private subnets to access the internet securely. They are fully managed, highly available, and scalable, making them a better choice than NAT instances for production environments, despite the higher cost. NAT instances require significant manual setup and do not scale automatically, which can lead to management overhead and potential outages.
- A. Correct.
This is the correct option. NAT gateways are highly available and managed by AWS, making them easier to manage than NAT instances. While they are more expensive than NAT instances, they are the recommended solution for production workloads due to their scalability and reliability.
- B. Incorrect.
NAT instances can provide outbound internet access, but they require manual configuration, management, and scaling. They are less reliable and less scalable compared to NAT gateways, which makes them a less ideal choice for production environments.
- C. Incorrect.
An internet gateway allows internet access for resources in a public subnet, but it does not provide the necessary security for private instances or subnets accessing external APIs. It is not suited for the described use case.
- D. Incorrect.
VPC endpoints are used to privately connect to AWS services without traversing the internet. They are not applicable for connecting to an external API hosted outside AWS.