SOA-C02 Question 274
Select 3You are tasked with troubleshooting connectivity issues for an Amazon EC2 instance in a private subnet within an Amazon VPC. The instance cannot connect to the internet despite being configured with a NAT gateway in a public subnet. Which of the following configurations in the VPC should you check to resolve this issue?
- A
The route table associated with the private subnet includes a route to the NAT gateway.
- B
The security group associated with the EC2 instance allows outbound traffic to the internet.
- C
The network ACL associated with the private subnet allows outbound and inbound traffic.
- D
The NAT gateway's security group allows inbound traffic from the EC2 instance.
- E
The route table associated with the public subnet includes a route to an internet gateway.
Show answer and explanation
Correct answers: A, C, E
Explanation
To enable internet connectivity for an EC2 instance in a private subnet, several configurations must be in place. The private subnet's route table must include a route to the NAT gateway. The public subnet where the NAT gateway resides must include a route to an internet gateway to forward traffic. Additionally, network ACLs must allow both outbound and inbound traffic for the instance to communicate with the NAT gateway. Security groups do not need specific configurations for NAT gateway communication as they are stateful by default, and NAT gateways do not require security groups.
- A. Correct.
Correct. The private subnet must have a route to the NAT gateway in its route table to enable internet access for instances.
- B. Incorrect.
Incorrect. Security groups are stateful, and by default, they allow all outbound traffic. The issue is not related to the security group in this case.
- C. Correct.
Correct. Network ACLs are stateless, so both outbound and inbound traffic rules must be explicitly allowed for the EC2 instance to communicate with the NAT gateway.
- D. Incorrect.
Incorrect. NAT gateways do not require security groups. Instead, traffic to and from the NAT gateway is controlled via route tables and network ACLs.
- E. Correct.
Correct. The public subnet where the NAT gateway resides must have a route to an internet gateway in its route table to enable the NAT gateway to forward traffic to the internet.