SOA-C02 Question 271
Single answerAn application running in an Amazon VPC is experiencing intermittent connectivity issues when communicating with an external service over the internet. Upon investigation, you notice that the issue occurs only for certain instances in a private subnet. The private subnet is configured to route internet traffic through a NAT gateway in a public subnet. What is the most likely reason for this issue?
- A
The security group attached to the NAT gateway does not allow outbound traffic.
- B
The NAT gateway is associated with an incorrect Route Table.
- C
The instances in the private subnet are missing an Elastic IP address.
- D
The network ACL associated with the private subnet has an outbound rule blocking traffic to the external service.
Show answer and explanation
Correct answer: D
Explanation
In this scenario, the intermittent connectivity issue is most likely caused by a network ACL rule blocking outbound traffic to the external service. Network ACLs are stateless and apply to all traffic entering or leaving a subnet, but they can be misconfigured to allow or deny specific traffic. Since the issue is intermittent and only affects certain instances, it suggests a rule that might block traffic based on criteria like IP ranges or port numbers. Reviewing and updating the network ACL rules for the private subnet would likely resolve this issue.
- A. Incorrect.
NAT gateways do not use security groups. Security groups are stateful, but they are not relevant to NAT gateway configuration.
- B. Incorrect.
If the NAT gateway were associated with an incorrect Route Table, none of the instances in the private subnet would be able to access the internet, not just some of them.
- C. Incorrect.
Instances in a private subnet do not require Elastic IP addresses to communicate with external services. The NAT gateway handles the translation of private IP addresses to a public IP address.
- D. Correct.
A network ACL is stateless and can block specific outbound or inbound traffic. If there is an outbound rule blocking traffic to the external service, it could cause intermittent connectivity issues for some instances.