DOP-C02 Security and Compliance Practice Question
A company has a VPC with public and private subnets. An EC2 instance in the private subnet needs to download patches from the internet but must not be directly accessible from the internet. Which configuration allows this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a NAT gateway in a public subnet and route the private subnet's traffic through it.
A NAT gateway deployed in a public subnet allows instances in private subnets to initiate outbound traffic to the internet while preventing inbound connections from the internet. This matches the requirement for downloading patches without direct accessibility. Option B is correct. Option A is incorrect because a VPN connection provides access to an on-premises network, not general internet access. Option C is incorrect because a bastion host provides SSH/RDP access to instances, not outbound internet connectivity for patch downloads. Option D is incorrect because attaching an internet gateway and adding a route to the private subnet route table would make the instances directly accessible from the internet, violating the requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set up a VPN connection to the company's on-premises network and route traffic through it.
Why it's wrong here
A VPN connection is designed for secure, private connectivity between the VPC and an on-premises network, not for providing internet access. Routing a private subnet's default traffic through the VPN would send internet-bound packets to the on-premises edge, forcing reliance on on-premises NAT and internet egress, which introduces extra latency and complexity. Additionally, AWS uses a VPN as a way to extend the network, so it does not natively solve the outbound internet requirement without depending on an external infrastructure.
- ✓
Deploy a NAT gateway in a public subnet and route the private subnet's traffic through it.
Why this is correct
Deploying a NAT gateway in a public subnet is the correct solution because it allows instances in a private subnet to initiate outbound IPv4 traffic to the internet while blocking any unsolicited inbound connections. A NAT gateway is a highly available, managed service that resides in a public subnet with an Elastic IP; the private subnet's route table simply adds a 0.0.0.0/0 route pointing to the NAT gateway. This preserves the instance's private reachability and satisfies the requirement without exposing it publicly.
- ✗
Deploy a bastion host in the public subnet and configure the instance to use it.
Why it's wrong here
A bastion host is a jump server placed in a public subnet specifically for administrative access via SSH/RDP to private instances; it does not act as an internet gateway or NAT device. Configuring an EC2 instance to use a bastion host would require setting up a proxy or IP forwarding on the bastion, which is not a standard or scalable way to provide outbound internet access for all traffic. It would also remain a single point of failure and fail to meet the requirement for general internet connectivity.
- ✗
Attach an internet gateway to the VPC and add a route to the private subnet route table.
Why it's wrong here
Attaching an internet gateway to the VPC is a prerequisite for any internet connectivity, but adding a 0.0.0.0/0 route to the private subnet route table would make the subnet effectively public. This would allow inbound traffic from the internet to any instance with a public IP, violating the condition that the instance must not be reachable from the internet. Furthermore, instances in a private subnet typically lack public IPs, so the IGW route alone would not provide working outbound connectivity—it would only break the privacy boundary.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,487 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.