ANS-C01 · Question #230
A company is migrating an application to the AWS Cloud. The company has successfully provisioned and tested connectivity between AWS Direct Connect and the company's on- premises data center. The…
The correct answer is A. Configure a private NAT gateway in the subnets for each Availability Zone that the application. Explanation Option A is correct because a private NAT gateway provides a fixed, predictable set of IP addresses (one per Availability Zone) that all EC2 instances in the Auto Scaling group will use when communicating outbound through Direct Connect to the on-premises vendor…
Question
A company is migrating an application to the AWS Cloud. The company has successfully provisioned and tested connectivity between AWS Direct Connect and the company's on- premises data center. The application runs on Amazon EC2 instances across multiple Availability Zones. The instances are in an Auto Scaling group. The application communicates through HTTPS to a third-party vendor's data service that is hosted at the company's data center. The data service implements a static ACL through explicit allow listing of client IP addresses. A network engineer must design a network solution so that the migrated application can continue to access the vendor's data service as the application scales. Which solution will meet these requirements with the LEAST amount of ongoing change to the vendor's allow list?
Options
- AConfigure a private NAT gateway in the subnets for each Availability Zone that the application
- BConfigure an elastic network interface in the subnets for each Availability Zone that the
- CConfigure an elastic network interface in the subnets for each Availability Zone that the
- DConfigure an Application Load Balancer (ALB) in the subnets for each Availability Zone that the
How the community answered
(46 responses)- A76% (35)
- B7% (3)
- C4% (2)
- D13% (6)
Explanation
Explanation
Option A is correct because a private NAT gateway provides a fixed, predictable set of IP addresses (one per Availability Zone) that all EC2 instances in the Auto Scaling group will use when communicating outbound through Direct Connect to the on-premises vendor service - meaning the vendor's static ACL only needs to allow a small, stable set of NAT gateway IPs regardless of how many EC2 instances scale in or out.
Why the distractors are wrong:
- Options B and C (elastic network interfaces on subnets) are incorrect because ENIs attach to individual EC2 instances, not subnets as a shared resource - as the Auto Scaling group launches new instances, each gets a new IP, requiring constant updates to the vendor's allow list.
- Option D (Application Load Balancer) is designed to handle inbound traffic distribution, not outbound traffic from EC2 instances to an external service, making it architecturally inappropriate for this use case.
Memory Tip
Think of a NAT gateway as a "traffic funnel" - many instances pour in, but only the NAT gateway's fixed IP comes out the other side. Whenever you see Auto Scaling + static IP whitelisting/allow-listing, NAT gateway is almost always the answer, as it decouples the scaling behavior from the IP addresses seen by external parties.
Topics
Community Discussion
No community discussion yet for this question.