A company has set up a NAT gateway in a single Availability Zone (AZ1) in a VPC (VPC1) to access the internet from Amazon EC2 workloads in the VPC. The EC2 workloads are running in private subnets…

Question

Options

• ASet up two NAT gateways. Place each NAT gateway in a different public subnet in separate
• BSet up two NAT gateways. Place each NAT gateway in a different public subnet in separate
• CCreate a second VPC (VPC2). Set up two NAT gateways. Place each NAT gateway in a different
• DSet up two NAT gateways. Place each NAT gateway in a different public subnet in separate

• A
  16% (7)
• B
  2% (1)
• C
  9% (4)
• D
  72% (31)

Explanation

Explanation

Option D is correct because the best practice for NAT gateway high availability is to deploy one NAT gateway per Availability Zone - placing each in a separate public subnet within the same VPC, and updating each AZ's private subnet route table to point to the NAT gateway in its own AZ. This eliminates the single point of failure by ensuring that if one AZ's NAT gateway fails, workloads in the other AZs continue to have uninterrupted internet access.

Options A and B appear to describe only two NAT gateways across three Availability Zones, which still leaves one AZ dependent on another AZ's NAT gateway - meaning a partial single point of failure remains. Option C introduces an unnecessary second VPC (VPC2), which adds complexity, cost, and architectural overhead without solving the core problem; NAT gateway redundancy does not require multiple VPCs.

Memory Tip: Think "1 NAT per AZ, route stays local" - each Availability Zone should have its own NAT gateway in a public subnet, and each private subnet's route table should direct traffic to the NAT gateway within the same AZ. This mirrors AWS's own best practice documentation and is a common exam pattern for high-availability networking questions.

No community discussion yet for this question.