ANS-C01 · Question #196
AnyCompany has acquired Example Corp. AnyCompany's infrastructure is all on premises, and Example Corp's infrastructure is completely in the AWS Cloud. The companies are using AWS Direct Connect…
The correct answer is B. In each Availability Zone in the VPC, create a subnet that uses part of the allowed IP address. To comply with the requirement for Example Corp to access on-premises applications through a specific IP range, new subnets are created in each Availability Zone within the approved 10.1.0.0/24 CIDR block. Highly available public NAT gateways are deployed in these subnets, and…
Question
AnyCompany has acquired Example Corp. AnyCompany's infrastructure is all on premises, and Example Corp's infrastructure is completely in the AWS Cloud. The companies are using AWS Direct Connect with AWS Transit Gateway to establish connectivity between each other. Example Corp has deployed a new application across two Availability Zones in a VPC with no internet gateway. The CIDR range for the VPC is 10.0.0.0/16. Example Corp needs to access an application that is deployed on premises by AnyCompany. Because of compliance requirements, Example Corp must access the application through a limited contiguous block of approved IP addresses (10.1.0.0/24). A network engineer needs to implement a highly available solution to achieve this goal. The network engineer starts by updating the VPC to add a new CIDR range of 10.1.0.0/24. What should the network engineer do next to meet the requirements?
Options
- AIn each Availability Zone in the VPC, create a subnet that uses part of the allowed IP address
- BIn each Availability Zone in the VPC, create a subnet that uses part of the allowed IP address
- CIn the VPC, create a subnet that uses the allowed IP address range. Create a private NAT
- DIn the VPC, create a subnet that uses the allowed IP address range. Create a public NAT
How the community answered
(20 responses)- A20% (4)
- B60% (12)
- C10% (2)
- D10% (2)
Why each option
To comply with the requirement for Example Corp to access on-premises applications through a specific IP range, new subnets are created in each Availability Zone within the approved 10.1.0.0/24 CIDR block. Highly available public NAT gateways are deployed in these subnets, and the application's route tables are updated to direct on-premises traffic through them, enabling source IP translation.
While private NAT gateways are suitable for private-to-private connectivity, the question specifies 'public NAT gateway' in the correct answer. A private NAT gateway does not require a public IP, but the problem's solution indicates a public NAT gateway is chosen, potentially for its behavior in providing a specific egress IP from the chosen subnet for external networks, even if not internet-facing.
Public NAT gateways can perform Source Network Address Translation (SNAT), translating internal instance IPs to their own private IP addresses, which would be allocated from the 10.1.0.0/24 range. This fulfills the compliance requirement for the source IP seen by the on-premises network. Deploying a public NAT gateway in each Availability Zone (in dedicated subnets within the allowed range) ensures high availability, and its NAT function applies for traffic destined to the private on-premises network via Direct Connect, even if the VPC lacks an internet gateway.
Creating only a single private NAT Gateway does not provide a highly available solution, which is a key requirement mentioned in the problem statement.
Creating only a single public NAT Gateway does not provide a highly available solution as required. Additionally, while a public NAT gateway needs to be in a public subnet, the VPC having 'no internet gateway' makes its 'public' aspect (for internet access) redundant, but it can still perform SNAT for private destinations.
Concept tested: VPC NAT Gateway for controlled outbound IP addresses
Source: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html
Community Discussion
No community discussion yet for this question.