N10-009 Question 31
Single answerVirtual private cloud (VPC)A company has moved a web application into a virtual private cloud (VPC). The application uses two subnets: a public subnet for a load balancer and a private subnet for application servers. Users on the internet can reach the load balancer, but the application servers in the private subnet cannot download operating system updates or reach external package repositories. The security group attached to the servers already allows all outbound traffic. Which change is the BEST way to restore outbound internet access for the private-subnet servers while keeping them unreachable directly from the internet?
- A
Attach a public IP address to each application server in the private subnet
- B
Create a NAT gateway or NAT instance in the public subnet and route the private subnet's default traffic to it
- C
Add an inbound rule to the application servers' security group allowing HTTPS from 0.0.0.0/0
- D
Move the application servers into the same public subnet as the load balancer
Show answer and explanation
Correct answer: B
Explanation
The best practice in a VPC is to place internet-facing components, such as load balancers, in public subnets and application or database servers in private subnets. Private-subnet instances that need outbound internet access for updates or package downloads should use a NAT gateway or NAT instance located in a public subnet. This preserves the security boundary because the instances can initiate outbound sessions, but unsolicited inbound internet traffic cannot reach them directly. This design aligns with common cloud networking guidance from major providers such as AWS and Azure, where private subnets/virtual networks rely on NAT-based egress rather than direct public addressing for backend systems.
- A. Incorrect.
This is incorrect because assigning public IP addresses would make the application servers directly reachable from the internet, which violates the requirement to keep them private. In a VPC design, private-subnet resources typically do not have public IPs and instead use controlled egress mechanisms for outbound access.
- B. Correct.
This is correct because a NAT gateway or NAT instance placed in a public subnet allows instances in a private subnet to initiate outbound connections to the internet without accepting unsolicited inbound connections. The private subnet needs a route, typically 0.0.0.0/0, pointing to the NAT device, while the NAT device itself uses the internet gateway through the public subnet.
- C. Incorrect.
This is incorrect because security group inbound rules do not provide internet egress. Allowing HTTPS from 0.0.0.0/0 would permit inbound traffic if a route and public reachability existed, but it would not solve the missing outbound path from a private subnet. This reflects a common misconception that firewall rules alone create connectivity.
- D. Incorrect.
This is incorrect because placing the servers in a public subnet would expose them more directly and remove the isolation benefit of the private subnet. Public subnets are generally used only for resources that must be directly reachable, such as load balancers, bastion hosts, or NAT devices.