SCS-C03 · Question #45
A security engineer has designed a VPC to segment private traffic from public traffic. The VPC includes two Availability Zones. Each Availability Zone contains one public subnet and one private…
The correct answer is A. Verify that a NAT gateway has been provisioned in the public subnet in each Availability Zone. D. Modify the route tables for the private subnets to route 0.0.0.0/0 to the NAT gateway in the public. AWS networking best practices require private subnets to access the internet only through NAT gateways located in public subnets. According to the AWS Certified Security - Specialty Study Guide, NAT gateways must be provisioned in public subnets and used as the default route…
Question
A security engineer has designed a VPC to segment private traffic from public traffic. The VPC includes two Availability Zones. Each Availability Zone contains one public subnet and one private subnet. Three route tables exist: one for the public subnets and one for each private subnet. The security engineer discovers that all four subnets are routing traffic through the internet gateway that is attached to the VPC. Which combination of steps should the security engineer take to remediate this scenario? (Select TWO.)
Options
- AVerify that a NAT gateway has been provisioned in the public subnet in each Availability Zone.
- BVerify that a NAT gateway has been provisioned in the private subnet in each Availability Zone.
- CModify the route tables for the public subnets to add a local route to the VPC CIDR range.
- DModify the route tables for the private subnets to route 0.0.0.0/0 to the NAT gateway in the public
- EModify the route tables for the private subnets to route 0.0.0.0/0 to the internet gateway.
How the community answered
(35 responses)- A80% (28)
- B3% (1)
- C11% (4)
- E6% (2)
Explanation
AWS networking best practices require private subnets to access the internet only through NAT gateways located in public subnets. According to the AWS Certified Security - Specialty Study Guide, NAT gateways must be provisioned in public subnets and used as the default route for outbound traffic from private subnets. Verifying NAT gateways in each Availability Zone ensures high availability and fault tolerance. Updating the private subnet route tables to send 0.0.0.0/0 traffic to the NAT gateway prevents direct internet access while allowing outbound connectivity. Routing private subnet traffic directly to an internet gateway violates subnet isolation principles. NAT gateways must never be placed in private subnets.
Topics
Community Discussion
No community discussion yet for this question.