N10-009 Question 36
Single answerCloud gateways: Internet gateway, Network address translation (NAT) gatewayA company deploys a new cloud-based application in a virtual private network. The web servers are placed in a public subnet and must accept HTTPS connections from customers on the internet. The database servers are placed in a private subnet and must download operating system updates from vendor repositories, but they must not be directly reachable from the internet. Which solution best meets these requirements?
- A
Attach an internet gateway to the virtual network, place the web servers in the private subnet, and route the database servers directly to the internet gateway
- B
Attach an internet gateway to the virtual network for the public subnet, and use a NAT gateway for outbound internet access from the private subnet
- C
Use only a NAT gateway for both the public and private subnets so all systems can reach the internet without being exposed
- D
Deploy a NAT gateway in the public subnet and use it to accept inbound HTTPS traffic for the web servers and outbound update traffic for the database servers
Show answer and explanation
Correct answer: B
Explanation
The best answer is to use both gateway types for their intended purposes: an internet gateway for public-facing resources and a NAT gateway for private resources that need outbound-only internet access. In common cloud networking designs, public subnets have routes to an internet gateway, allowing resources such as web servers to be reachable from the internet when security rules and public addressing permit it. Private subnets commonly route outbound internet-bound traffic to a NAT gateway located in a public subnet. The NAT gateway allows update downloads and other outbound sessions while blocking unsolicited inbound access. This aligns with widely documented best practices from major cloud providers, which distinguish internet gateways for direct internet connectivity and NAT gateways for outbound access from private subnets.
- A. Incorrect.
Incorrect. An internet gateway is used to provide internet connectivity for resources that have appropriate public addressing and routing, typically in a public subnet. Placing the web servers in a private subnet would prevent them from directly accepting inbound HTTPS traffic from internet users. In addition, routing database servers in a private subnet directly to the internet gateway would expose them to direct internet routing if other controls allowed it, which does not meet the requirement to avoid direct internet reachability.
- B. Correct.
Correct. This is the standard design pattern for cloud networks. The internet gateway enables inbound and outbound internet connectivity for resources in the public subnet, such as public-facing web servers. A NAT gateway allows instances in a private subnet to initiate outbound connections, such as downloading updates, while preventing unsolicited inbound connections from the internet. This meets both the accessibility and security requirements in the scenario.
- C. Incorrect.
Incorrect. A NAT gateway supports outbound internet access for private resources, but it does not make public-facing servers reachable from the internet for inbound connections. Public web servers that must accept customer HTTPS traffic need a path through an internet gateway and appropriate public addressing or front-end service exposure. A NAT gateway is not a replacement for an internet gateway in that role.
- D. Incorrect.
Incorrect. A NAT gateway is not designed to terminate or accept unsolicited inbound connections from the internet on behalf of application servers. Its purpose is to translate outbound connections initiated by private-subnet resources. Someone might choose this option because the NAT gateway resides in a public subnet and has internet access, but that does not mean it functions as an inbound application gateway for web traffic.