SAP-C02 · Question #531
A company has migrated a legacy application to the AWS Cloud. The application runs on three Amazon EC2 instances that are spread across three Availability Zones. One EC2 instance is in each…
The correct answer is C. Deploy a single NAT gateway in a public subnet. Assign the Elastic IP address to the NAT. To enable EC2 instances in private subnets to communicate with on-premises systems via a single allowed Elastic IP address, a single NAT Gateway should be deployed in a public subnet with the Elastic IP assigned to it, and private subnet route tables configured to direct…
Question
A company has migrated a legacy application to the AWS Cloud. The application runs on three Amazon EC2 instances that are spread across three Availability Zones. One EC2 instance is in each Availability Zone. The EC2 instances are running in three private subnets of the VPC and are set up as targets for an Application Load Balancer (ALB) that is associated with three public subnets. The application needs to communicate with on-premises systems. Only traffic from IP addresses in the company's IP address range are allowed to access the on-premises systems. The company's security team is bringing only one IP address from its internal IP address range to the cloud. The company has added this IP address to the allow list for the company firewall. The company also has created an Elastic IP address for this IP address. A solutions architect needs to create a solution that gives the application the ability to communicate with the on-premises systems. The solution also must be able to mitigate failures automatically. Which solution will meet these requirements?
Options
- ADeploy three NAT gateways, one in each public subnet. Assign the Elastic IP address to the NAT
- BReplace the ALB with a Network Load Balancer (NLB). Assign the Elastic IP address to the
- CDeploy a single NAT gateway in a public subnet. Assign the Elastic IP address to the NAT
- DAssign the Elastic IP address to the ALB. Create an Amazon Route 53 simple record with the
How the community answered
(25 responses)- A8% (2)
- B4% (1)
- C76% (19)
- D12% (3)
Why each option
To enable EC2 instances in private subnets to communicate with on-premises systems via a single allowed Elastic IP address, a single NAT Gateway should be deployed in a public subnet with the Elastic IP assigned to it, and private subnet route tables configured to direct on-premises traffic through this NAT Gateway.
Deploying three NAT Gateways but assigning the single Elastic IP to only one means that outbound traffic from instances routed through other NAT Gateways would use different public IPs, violating the 'single allowed IP' requirement.
Replacing the ALB with an NLB and assigning an EIP addresses inbound traffic to the application, not outbound communication from the EC2 instances to on-premises systems.
Deploying a single NAT Gateway in a public subnet and assigning the Elastic IP address to it ensures that all outbound traffic from the private EC2 instances, when routed through this NAT Gateway, originates from the single IP address allowed by the on-premises firewall.
Application Load Balancers (ALBs) do not support assigning Elastic IP addresses directly, and an ALB handles inbound traffic, not outbound traffic from EC2 instances.
Concept tested: NAT Gateway, Outbound Connectivity, Elastic IP, Hybrid Networking
Source: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html
Community Discussion
No community discussion yet for this question.