AWS Certified SysOps Administrator – AssociateNetworking and Content DeliveryMedium
A SysOps administrator is configuring a new VPC and needs to ensure that EC2 instances in a private subnet can download patches and updates from the internet but cannot receive unsolicited inbound connections from the internet. Which TWO AWS networking components must be configured to achieve this securely and efficiently?
- AVPC Endpoint and Security Group
- BVirtual Private Gateway and Network ACL
- CNAT Gateway and Route Table
- DInternet Gateway and Security Group
Show answer & explanationAnswer & explanation
Correct answer: C. NAT Gateway and Route Table
A NAT Gateway allows instances in a private subnet to connect to the internet (e.g., for patches) but prevents the internet from initiating connections to those instances. A Route Table must be configured in the private subnet to direct outbound internet-bound traffic (0.0.0.0/0) to the NAT Gateway in a public subnet. This combination ensures secure outbound-only internet access.
Why the other options are wrong
- A. VPC Endpoints allow private access to AWS services, not general internet access for patches. Security Groups are for filtering but don't provide outbound internet access from private instances without a NAT Gateway.
- B. Virtual Private Gateway is for VPN connections to on-premises. Network ACLs are subnet-level firewalls but don't provide NAT functionality for outbound internet access.
- D. Internet Gateway provides direct internet access; instances would need public IPs and would be exposed to inbound connections. Security Groups are for instance-level filtering but don't provide the NAT functionality.
NAT Gateway
A Network Address Translation (NAT) service that enables instances in a private subnet to connect to the internet or other AWS services, but prevents the internet from initiating connections with the instances.
- Placed in a public subnet.
- Requires a route table entry from private subnets.
- Used for outbound-only internet access from private instances.
Memory trick: NAT Gateway is the private door to the internet, guided by the Route Table.