SAP-C02 Question 231
Select 2A company is deploying a web application in a VPC. The application servers are deployed in a private subnet and must communicate with the internet for software updates. The architecture also requires that only the application servers can access the internet, while all other resources in the private subnet are restricted. How can this be achieved?
- A
Create a NAT gateway in a public subnet and update the private subnet's route table to direct internet-bound traffic to the NAT gateway.
- B
Configure a security group that allows outbound traffic from the application servers to the internet and attach it to the application servers.
- C
Update the network ACL of the private subnet to allow all inbound and outbound traffic for the application servers.
- D
Create an internet gateway and add a route in the private subnet's route table to direct all traffic to the internet gateway.
- E
Use a NAT instance instead of a NAT gateway and update the private subnet's route table to direct internet-bound traffic to the NAT instance.
Show answer and explanation
Correct answers: A, B
Explanation
The architecture requires application servers in the private subnet to access the internet for updates, while restricting other resources in the private subnet. A NAT gateway in a public subnet ensures secure outbound-only internet access for private subnet resources. Additionally, a security group must be configured to explicitly allow the application servers to send outbound traffic to the internet. Together, these configurations meet the requirements while maintaining security and isolation.
- A. Correct.
Correct: A NAT gateway enables private subnet instances to access the internet for updates while preventing inbound connections from the internet. Updating the private subnet's route table ensures the traffic is routed correctly.
- B. Correct.
Correct: A security group must explicitly allow outbound traffic to the internet for the application servers. Without this, the application servers will not be able to communicate with the internet.
- C. Incorrect.
Incorrect: While network ACLs can control traffic at the subnet level, they are stateless and cannot differentiate between application servers and other resources in the private subnet. This approach would allow all resources in the subnet to access the internet, violating the requirement.
- D. Incorrect.
Incorrect: An internet gateway allows bidirectional traffic between the VPC and the internet. Adding a route to the internet gateway in a private subnet's route table would make the private subnet public, exposing all resources, which violates the requirement.
- E. Incorrect.
Incorrect: While a NAT instance could be used as an alternative to a NAT gateway, it requires additional management and is not recommended for production environments. The question does not specify the need for a NAT instance.