CLF-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Internet Gateway

  Why it's wrong here

  An internet gateway is a VPC component that provides a target for internet-routable traffic and enables communication between a VPC and the public internet. Resources in public subnets with public IPs can use it for both inbound and outbound connectivity, but the internet gateway does not perform source-network address translation on behalf of private instances. A private subnet instance has only a private IP and no route through an internet gateway, so this component by itself cannot enable outbound internet access while blocking unsolicited inbound access; that is the NAT gateway's purpose.

• ✓

  NAT Gateway

  Why this is correct

  A NAT gateway is a managed AWS service deployed in a public subnet with an Elastic IP address. It is placed in private subnet route tables as the destination for 0.0.0.0/0, so instances there can initiate outbound traffic to the internet. The NAT gateway translates their private source IPs to its Elastic IP for outbound packets, and for return traffic it forwards responses back; unsolicited inbound connections from the internet are dropped because there is no port forwarding or inbound mapping. This makes a NAT gateway the correct answer for one-way internet access.

• ✗

  Security Groups

  Why it's wrong here

  Security groups are instance-level stateful firewalls that evaluate traffic against allow rules you define. They can block inbound traffic to an instance, but they do not perform any IP address translation, so an instance in a private subnet with a private IP cannot use a security group alone to reach the internet. The one-way NAT that gives private instances outbound connectivity while preventing unsolicited inbound is specifically the NAT gateway's job.

• ✗

  Network ACLs

  Why it's wrong here

  Network ACLs are stateless, subnet-level filters that inspect packets as they enter or leave a subnet. Because they are stateless, you must configure separate inbound and outbound rules, and they can certainly drop unwanted traffic at the subnet boundary. However, a network ACL does not translate private source IPs into public IPs, so it cannot supply outbound internet access to private subnet resources; it only filters traffic that already has a routing path. Any outbound connection still requires a public IP or a NAT device.