N10-009 Question 37
Single answerCloud gateways: Internet gateway, Network address translation (NAT) gatewayA company deploys a three-tier application in a public cloud. Web servers are placed in a public subnet, and application servers are placed in a private subnet with no public IP addresses. The application servers must download operating system updates from the internet, but the security team wants to prevent any inbound connections from the internet directly to those private instances. Which solution best meets these requirements?
- A
Attach an internet gateway to the virtual network and assign public IP addresses to the application servers
- B
Deploy a NAT gateway in a public subnet and route the private subnet's outbound internet traffic through it
- C
Place the application servers behind a load balancer in the public subnet
- D
Create a VPN gateway and route internet-bound traffic from the private subnet through the VPN tunnel
Show answer and explanation
Correct answer: B
Explanation
The best answer is to deploy a NAT gateway in a public subnet and route the private subnet's default route to it. In common cloud designs, an internet gateway provides internet connectivity for resources that have public IP addresses and appropriate routing. A NAT gateway, by contrast, is specifically used so private instances can initiate outbound internet sessions without being exposed to direct inbound connections from the internet. This is a standard best practice in major cloud platforms for patching, package downloads, and external API access from private subnets. Documentation from leading providers consistently distinguishes these roles: internet gateways support direct internet connectivity for public resources, while NAT gateways support outbound-only internet access for private resources.
- A. Incorrect.
Incorrect. An internet gateway enables communication between resources with public IP addresses and the internet. Assigning public IPs to the application servers would allow outbound access, but it would also make those instances directly addressable from the internet, which does not meet the requirement to avoid direct inbound internet connections to the private instances.
- B. Correct.
Correct. A NAT gateway allows instances in a private subnet to initiate outbound connections to the internet for tasks such as software updates, while preventing unsolicited inbound internet connections. The NAT gateway is placed in a public subnet and uses a route from the private subnet to translate and forward outbound traffic.
- C. Incorrect.
Incorrect. A load balancer distributes application traffic to backend systems, but it does not provide general outbound internet access for private instances. Putting application servers behind a load balancer also does not solve the need for those servers to reach external update repositories.
- D. Incorrect.
Incorrect. A VPN gateway is used to connect cloud networks to remote networks, such as an on-premises environment or another cloud network, over an encrypted tunnel. It is not the standard solution for allowing private-subnet instances to access the public internet for updates.