SOA-C03 · Question #170
SOA-C03 Question #170: Real Exam Question with Answer & Explanation
The correct answer is C: Deploy a NAT gateway in each public subnet and update private subnet route tables.. For IPv4 traffic, private subnets require a NAT gateway in a public subnet to access the internet. NAT gateways must be deployed in public subnets and associated with an Elastic IP address. Private subnet route tables must direct 0.0.0.0/0 traffic to the NAT gateway. The question
Question
A company moves workloads from public subnets to private subnets to improve security. During testing, servers in the private subnets cannot reach an external API. The VPC has a CIDR block of 10.0.0.0/16, two public subnets, two private subnets, one internet gateway, and a NAT gateway in each private subnet. The company must ensure that workloads in the private subnets can reach the external API. Which solution will meet this requirement?
Options
- ADeploy an outbound-only internet gateway and update route tables.
- BCreate an Amazon API Gateway HTTP API as a proxy.
- CDeploy a NAT gateway in each public subnet and update private subnet route tables.
- DCreate a VPC interface endpoint and update route tables.
Explanation
For IPv4 traffic, private subnets require a NAT gateway in a public subnet to access the internet. NAT gateways must be deployed in public subnets and associated with an Elastic IP address. Private subnet route tables must direct 0.0.0.0/0 traffic to the NAT gateway. The question states that NAT gateways are incorrectly placed in private subnets, which cannot provide internet access. Deploying NAT gateways in public subnets resolves this issue and restores outbound connectivity to external APIs. Option A applies only to IPv6. Option B adds unnecessary complexity. Option D is not applicable because external APIs are not AWS services.
Community Discussion
No community discussion yet for this question.