SCS-C02 · Question #257
A security engineer has designed a VPC to segment private traffic from public traffic. The VPC includes two Availability Zones. The security engineer has provisioned each Availability Zone with one…
The correct answer is A. Verify that a NAT gateway has been provisioned in the public subnet in each Availability Zone. D. Modify the route tables that are associated with each of the private subnets Create a new route. Verify that a NAT gateway has been provisioned in the public subnet in each Availability Zone. A NAT gateway should be provisioned in the public subnet to allow instances in the private subnet to send traffic to the internet (for updates, etc.) without exposing them directly to…
Question
A security engineer has designed a VPC to segment private traffic from public traffic. The VPC includes two Availability Zones. The security engineer has provisioned each Availability Zone with one private subnet and one public subnet. The security engineer has created three route tables for use with the environment. One route table is for the public subnets, and two route tables are for the private subnets (one route table for the private subnet in each Availability Zone). The security engineer discovers that all four subnets are attempting to route traffic out through the internet gateway that is attached to the VPC. Which combination of steps should the security engineer take to remediate this scenario? (Choose two.)
Options
- AVerify that a NAT gateway has been provisioned in the public subnet in each Availability Zone.
- BVerify that a NAT gateway has been provisioned in the private subnet in each Availability Zone.
- CModify the route tables that are associated with each of the public subnets. Create a new route
- DModify the route tables that are associated with each of the private subnets Create a new route
- EModify the route tables that are associated with each of the private subnets. Create a new route
How the community answered
(41 responses)- A73% (30)
- B15% (6)
- C10% (4)
- E2% (1)
Explanation
Verify that a NAT gateway has been provisioned in the public subnet in each Availability Zone. A NAT gateway should be provisioned in the public subnet to allow instances in the private subnet to send traffic to the internet (for updates, etc.) without exposing them directly to the internet. This ensures that private traffic can go through the NAT gateway while public traffic uses the internet gateway. Modify the route tables that are associated with each of the private subnets. Create a new route for the destination 0.0.0.0/0. Specify the NAT gateway in the public subnet of the same Availability Zone as the target of the route. For private subnets, traffic that needs to go to the internet should be routed through the NAT gateway, not the internet gateway. Modifying the route tables of the private subnets to use the NAT gateway ensures this traffic is properly routed. These steps ensure that private subnets route their internet-bound traffic through the NAT gateway, while public subnets route directly through the internet gateway, resolving the issue.
Topics
Community Discussion
No community discussion yet for this question.