nerdexam
Amazon

SAP-C02 · Question #619

A solutions architect is reviewing an application's resilience before launch. The application runs on an Amazon EC2 instance that is deployed in a private subnet of a VPC. The EC2 instance is…

The correct answer is A. Deploy an additional NAT gateway in the other Availability Zones. Update the route tables with. To ensure an application operating in a private subnet across multiple Availability Zones, the single NAT Gateway must be replaced with additional NAT Gateways in other AZs, with updated route tables.

Submitted by ngozi_ng· Mar 6, 2026Design for New Solutions

Question

A solutions architect is reviewing an application's resilience before launch. The application runs on an Amazon EC2 instance that is deployed in a private subnet of a VPC. The EC2 instance is provisioned by an Auto Scaling group that has a minimum capacity of 1 and a maximum capacity of 1. The application stores data on an Amazon RDS for MySQL DB instance. The VPC has subnets configured in three Availability Zones and is configured with a single NAT gateway. The solutions architect needs to recommend a solution to ensure that the application will operate across multiple Availability Zones. Which solution will meet this requirement?

Options

  • ADeploy an additional NAT gateway in the other Availability Zones. Update the route tables with
  • BReplace the NAT gateway with a virtual private gateway. Replace the RDS for MySQL DB
  • CReplace the NAT gateway with a NAT instance. Migrate the RDS for MySQL DB instance to an
  • DDeploy an additional NAT gateway in the other Availability Zones. Update the route tables with

How the community answered

(26 responses)
  • A
    77% (20)
  • B
    15% (4)
  • C
    4% (1)
  • D
    4% (1)

Why each option

To ensure an application operating in a private subnet across multiple Availability Zones, the single NAT Gateway must be replaced with additional NAT Gateways in other AZs, with updated route tables.

ADeploy an additional NAT gateway in the other Availability Zones. Update the route tables withCorrect

A single NAT Gateway is a single point of failure for instances in private subnets that require outbound internet access. Deploying additional NAT gateways in each of the other Availability Zones and configuring the private subnet route tables to point to the respective AZ's NAT gateway ensures high availability and resilience for outbound connectivity across AZs.

BReplace the NAT gateway with a virtual private gateway. Replace the RDS for MySQL DB

Replacing a NAT gateway with a virtual private gateway (VGW) is incorrect as VGWs are used for VPN or AWS Direct Connect connections, not for providing outbound internet access from private subnets. Replacing RDS with a Multi-AZ Aurora global database is a cross-Region solution that doesn't address the intra-Region multi-AZ need for the current RDS or the NAT Gateway SPOF.

CReplace the NAT gateway with a NAT instance. Migrate the RDS for MySQL DB instance to an

Replacing a NAT gateway with a NAT instance is a legacy solution that introduces operational overhead for management and patching, which is not recommended over managed NAT Gateways. Migrating RDS to an EC2 instance increases operational burden and shifts database high-availability responsibility to the user.

DDeploy an additional NAT gateway in the other Availability Zones. Update the route tables with

This option is identical to A and provides the same correct solution to the problem.

Concept tested: High availability for outbound internet in VPC private subnets

Source: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html#nat-gateway-high-availability

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SAP-C02 Practice