SOA-C02 Question 229
Single answerYour company has deployed a web application in a VPC with public and private subnets. The application servers are hosted in the private subnet, while the frontend servers are in the public subnet. You are tasked with ensuring that the application servers in the private subnet can download software updates from the internet without exposing them directly. What is the BEST solution to achieve this while minimizing costs?
- A
Deploy a NAT Gateway in the public subnet and configure the route table of the private subnet to use it for internet-bound traffic.
- B
Deploy an internet gateway and attach it to the private subnet.
- C
Deploy a NAT Instance in the public subnet and configure the route table of the private subnet to use it for internet-bound traffic.
- D
Attach an Elastic IP to the application servers in the private subnet.
Show answer and explanation
Correct answer: A
Explanation
The best way to enable internet access for instances in a private subnet without exposing them directly is to use a NAT Gateway. It is a fully managed, scalable, and cost-effective solution for this purpose. While a NAT Instance could also work, it requires more administrative effort and does not offer the same level of availability or scalability.
- A. Correct.
This is the correct solution. A NAT Gateway allows instances in a private subnet to access the internet for tasks such as software updates while keeping them inaccessible from the internet. It is a highly available and managed service that minimizes operational overhead.
- B. Incorrect.
This is incorrect because an internet gateway provides direct internet access to resources, which would expose the private instances to the internet, violating the security requirement.
- C. Incorrect.
While a NAT Instance can be used for the same purpose as a NAT Gateway, it involves more management overhead (e.g., scaling, patching) and is less reliable compared to a NAT Gateway. It is not the best solution in this scenario.
- D. Incorrect.
This is incorrect because attaching an Elastic IP to private instances would expose them directly to the internet, defeating the purpose of keeping them private.