SOA-C02 Question 231
Single answerYou are managing an application hosted in a private subnet within a VPC. The application needs to download security patches from the internet periodically. For security reasons, direct internet access should not be granted to resources in the private subnet. How can you enable this connectivity while adhering to the security requirements?
- A
Associate an Elastic IP with the instances in the private subnet.
- B
Create a NAT Gateway in the public subnet and update the route table for the private subnet to route traffic through the NAT Gateway.
- C
Configure a VPC Endpoint for S3 to allow the application to download the patches.
- D
Attach an Internet Gateway to the private subnet and modify the route table to point to it.
Show answer and explanation
Correct answer: B
Explanation
To allow instances in a private subnet to access the internet securely for outbound traffic like downloading patches, a NAT Gateway is the ideal solution. It ensures that the instances remain private while still being able to communicate with external services for specific outbound needs. Other options either fail to meet the security requirements or do not provide the required functionality.
- A. Incorrect.
Elastic IPs are used to provide static public IP addresses to instances, which requires instances to be in a public subnet. This does not align with security requirements for a private subnet.
- B. Correct.
A NAT Gateway allows instances in the private subnet to access the internet for outbound traffic, such as downloading patches, without exposing them to inbound internet connections. This approach adheres to the security requirements.
- C. Incorrect.
VPC Endpoints enable private connectivity to AWS services like S3 without needing an internet connection, but they cannot be used to download general internet content or security patches.
- D. Incorrect.
An Internet Gateway allows instances to directly access the internet, which would expose the private subnet to the internet and violate the security requirements.