SOA-C02 Question 230
Single answerYour company hosts a web application in an Amazon VPC with two public subnets and two private subnets. The application is fronted by an Application Load Balancer (ALB) in the public subnets, and the backend application servers are in the private subnets. You need to ensure that the backend servers can download updates from the internet while maintaining the security of the private subnets. What is the best solution to achieve this?
- A
Attach an Internet Gateway to the private subnets.
- B
Create a NAT Gateway in one of the public subnets and update the route table for the private subnets to use the NAT Gateway.
- C
Deploy a VPC Endpoint for S3 and route the traffic through it.
- D
Configure the backend instances with Elastic IPs and route traffic through the Internet Gateway.
Show answer and explanation
Correct answer: B
Explanation
To allow instances in private subnets to access the internet securely, a NAT Gateway is deployed in a public subnet. The route table for the private subnets is updated to direct outbound traffic through the NAT Gateway. This ensures that the backend servers can access the internet for updates while remaining inaccessible from the internet.
- A. Incorrect.
An Internet Gateway cannot be directly attached to subnets. It is attached to the VPC, and traffic from private subnets cannot directly route to it without a NAT Gateway or similar mechanism.
- B. Correct.
A NAT Gateway in the public subnet allows instances in private subnets to initiate outbound connections to the internet while preventing inbound connections from the internet. This is the correct solution.
- C. Incorrect.
A VPC Endpoint for S3 is used to connect to AWS services like S3 privately without requiring internet connectivity. However, it cannot be used for general internet access.
- D. Incorrect.
Assigning Elastic IPs to backend instances would expose them directly to the internet, defeating the purpose of keeping the subnets private and compromising security.