SOA-C02 Question 275
Single answerAn organization has a VPC configured with two public subnets and two private subnets. The VPC has an internet gateway attached. The applications hosted in the private subnets are unable to access the internet, but resources in the public subnets can access the internet without issues. What could be the cause of this problem?
- A
The private subnets do not have a route to the internet gateway in their route table.
- B
The private subnets are missing a NAT gateway or NAT instance for outbound internet connectivity.
- C
The security group associated with the private subnet resources does not allow outbound traffic to the internet.
- D
The network ACL associated with the private subnets explicitly denies internet traffic.
Show answer and explanation
Correct answer: B
Explanation
Resources in private subnets cannot directly access the internet via an internet gateway. To enable this access, a NAT gateway or NAT instance must be configured in a public subnet and added to the route table for the private subnets. Without this configuration, the resources in the private subnets will not be able to establish outbound connections to the internet.
- A. Incorrect.
Internet gateways are used to provide internet connectivity, but they cannot be directly used by private subnets. Therefore, this is not the cause of the issue.
- B. Correct.
Private subnets require a NAT gateway or NAT instance to allow resources within them to access the internet. This is the correct answer.
- C. Incorrect.
Security groups are stateful and allow responses to outbound traffic by default. If outbound rules allow traffic, lack of inbound rules would not block internet connectivity.
- D. Incorrect.
The default network ACL allows all inbound and outbound traffic unless explicitly modified. While a custom ACL could block traffic, this is not the most common reason for the issue described.