SOA-C02 Question 234
Single answerAn organization is hosting a web application in a VPC on AWS. The application servers are deployed in a private subnet, and the organization wants to allow these servers to download software updates from the internet while ensuring they are not directly accessible from the internet. How can this be accomplished?
- A
Attach an Internet Gateway to the private subnet and configure a route to it.
- B
Set up a NAT Gateway in a public subnet and configure a route from the private subnet to the NAT Gateway.
- C
Set up a NAT Gateway in the private subnet and configure a route to it.
- D
Attach a VPN Gateway to the private subnet to access the internet.
Show answer and explanation
Correct answer: B
Explanation
To allow instances in a private subnet to access the internet for outbound communication while preventing inbound access, a NAT Gateway is the correct solution. The NAT Gateway must be placed in a public subnet and a route must be configured in the private subnet's route table to direct internet-bound traffic to the NAT Gateway. This ensures the instances in the private subnet can download updates from the internet securely.
- A. Incorrect.
An Internet Gateway provides internet access to public subnets, but it cannot be directly used to provide internet access to resources in private subnets. This option is incorrect.
- B. Correct.
A NAT Gateway in a public subnet allows private subnets to access the internet for outbound communication while preventing inbound traffic from the internet. Configuring a route from the private subnet to the NAT Gateway achieves the desired outcome. This is the correct option.
- C. Incorrect.
A NAT Gateway cannot be deployed in a private subnet because it requires internet access to function. This option is incorrect.
- D. Incorrect.
A VPN Gateway is used to establish secure connections to on-premises networks or between AWS regions, but it is not used for internet access. This option is incorrect.