N10-009 Question 30
Single answerVirtual private cloud (VPC)A company deploys a new payroll application in a virtual private cloud (VPC). The web servers are placed in a public subnet so remote employees can reach the site over HTTPS, while the database servers are placed in a private subnet. Security policy requires that the database servers must not be directly reachable from the internet, but they still need to download operating system updates from vendor repositories. Which solution best meets these requirements?
- A
Place the database servers in the public subnet and restrict access with security group rules
- B
Configure a NAT service or NAT gateway for the private subnet so the database servers can initiate outbound internet access without accepting inbound internet connections
- C
Assign public IP addresses to the database servers only during patch windows and remove them afterward
- D
Create a site-to-site VPN from the private subnet directly to the update vendor
Show answer and explanation
Correct answer: B
Explanation
In a VPC, a public subnet generally has a route to an internet gateway, while a private subnet does not expose workloads directly to the internet. When private instances need outbound-only internet access, a NAT device or managed NAT gateway is the standard design pattern. This enables systems such as database servers to download updates or reach external services without permitting inbound sessions initiated from the internet. This aligns with common cloud networking best practices published by major providers such as AWS and Google Cloud: keep sensitive backend resources in private subnets and provide controlled egress through NAT rather than assigning public IP addresses.
- A. Incorrect.
This is incorrect because placing database servers in a public subnet increases exposure and does not align with the requirement that they must not be directly reachable from the internet. Even if firewall or security group rules are restrictive, public subnet placement typically involves routing to an internet gateway, which is not the preferred design for protected backend systems.
- B. Correct.
This is correct because a NAT service or NAT gateway allows instances in a private subnet to initiate outbound connections to the internet for tasks such as downloading patches, while preventing unsolicited inbound connections from the internet. This is a common best practice in VPC design for private workloads that need limited outbound internet access.
- C. Incorrect.
This is incorrect because temporarily assigning public IP addresses creates unnecessary operational risk and complexity. It also increases the chance of misconfiguration and brief exposure of sensitive systems. Best practice is to keep database servers in private subnets consistently rather than making them internet-routable during maintenance periods.
- D. Incorrect.
This is incorrect because a site-to-site VPN is typically used to securely connect networks, such as an on-premises environment to a cloud VPC, not to connect directly to a software vendor's public update infrastructure. Most update vendors do not provide customer-specific VPN endpoints for standard patch downloads, so this does not represent a practical or typical solution.