SOA-C02 Question 273
Single answerYou are managing a VPC with two public subnets and one private subnet in the us-east-1 region. Instances in the private subnet are unable to access the internet, even though they need to download updates from an external repository. The private subnet is configured with a route table that has a route to a NAT Gateway in one of the public subnets. Security groups are configured to allow outbound traffic on all ports. What could be the reason for the connectivity issue?
- A
The NAT Gateway is not associated with an Elastic IP address.
- B
The private subnet is not associated with the correct route table.
- C
The network ACL of the public subnet hosting the NAT Gateway is blocking outbound traffic.
- D
The NAT Gateway is not configured to allow inbound traffic from the private subnet.
Show answer and explanation
Correct answer: A
Explanation
For instances in a private subnet to access the internet, the subnet must have a route to a NAT Gateway, and the NAT Gateway must be associated with an Elastic IP address to route traffic to the internet. In this scenario, although the private subnet has a proper route to the NAT Gateway, the NAT Gateway lacks an Elastic IP address, causing the connectivity failure.
- A. Correct.
Correct: A NAT Gateway must have an Elastic IP address associated with it to enable external internet access. Without this, the instances in the private subnet cannot route traffic to the internet.
- B. Incorrect.
Incorrect: While route table association is crucial, the question states that the private subnet has a route pointing to the NAT Gateway, so this is not the issue.
- C. Incorrect.
Incorrect: Network ACLs on the public subnet hosting the NAT Gateway would not block outbound traffic in this scenario if they have the default 'allow all outbound' rule. This is unlikely to be the issue unless explicitly misconfigured.
- D. Incorrect.
Incorrect: NAT Gateways do not require inbound traffic rules to be configured for private subnets. They automatically handle traffic initiated from the private subnet.