AWS Certified SysOps Administrator – AssociateNetworking and Content DeliveryMedium
A SysOps administrator is configuring a new VPC and needs to ensure that EC2 instances in a private subnet can download operating system patches from the internet, but cannot be directly accessed from the internet. The solution must be highly available and managed by AWS. Which networking component should be used?
- ANAT Gateway.
- BNAT instance.
- CInternet Gateway.
- DVPC Endpoint.
Show answer & explanationAnswer & explanation
Correct answer: A. NAT Gateway.
A NAT Gateway provides a highly available and managed solution for instances in a private subnet to initiate outbound connections to the internet (e.g., for OS patches) while preventing unsolicited inbound connections from the internet. It operates from a public subnet and uses an Elastic IP.
Why the other options are wrong
- B. A NAT instance is a self-managed EC2 instance, requiring manual scaling and high availability configuration, not managed by AWS.
- C. An Internet Gateway allows both inbound and outbound internet traffic, exposing instances if they have public IPs.
- D. VPC Endpoints provide private connectivity to AWS services, not general internet access for OS patches.
NAT Gateway
A NAT Gateway allows instances in a private subnet to connect to the internet while preventing external hosts from initiating connections to those instances. It is a highly available and managed AWS service.
- Managed by AWS, highly available.
- Resides in a public subnet.
- Enables outbound internet access for private subnets.
Memory trick: For private subnets, a 'NAT Gateway' is the AWS-managed 'gate' to the 'net'.