DOP-C02 Security and Compliance Practice Question

A company has a VPC with public and private subnets. They launch an EC2 instance in a private subnet that needs to download patches from the internet. Which solution is MOST secure and scalable?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create a NAT Gateway in a public subnet and update the private route table.

A NAT Gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet and receive responses, without allowing inbound traffic. This is the most secure and scalable solution because it is managed by AWS and scales automatically. Option B (a proxy server) is less scalable and requires ongoing management. Option C (assigning an Elastic IP to the private instance) would expose the instance to inbound internet traffic, violating the security of the private subnet. Option D (using a VPC endpoint) is only for accessing AWS services, not general internet patch repositories.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Create a NAT Gateway in a public subnet and update the private route table.
Why this is correct
A NAT Gateway is a fully managed service deployed in a public subnet with an Elastic IP. To grant a private subnet outbound internet access, you must add a route 0.0.0.0/0 to the private route table pointing to the NAT Gateway. This performs source NAT, translating private instance traffic to the gateway's Elastic IP, while dropping unsolicited inbound traffic. It is highly available and scales automatically, making it the recommended solution for outbound connectivity without exposing the instances.
✗
Launch a proxy server in a public subnet and route traffic through it.
Why it's wrong here
A proxy server such as an EC2 instance in a public subnet can forward outbound HTTP/HTTPS traffic, but it requires manual configuration (e.g., setting HTTP_PROXY environment variables) and is a single point of failure unless you deploy and manage multiple instances. You must handle OS patching, monitoring, auto-scaling, and throughput capacity. It also creates a predictable bottleneck, and a NAT Gateway—a managed, redundant service—offers the same functionality with far less operational burden, making the proxy approach less scalable and more costly to operate.
✗
Assign an Elastic IP to the instance in the private subnet.
Why it's wrong here
Assigning an Elastic IP to a private subnet instance is ineffective because private subnets have no route to an Internet Gateway. The Elastic IP is a static public address, but without an IGW route in the subnet, AWS will not advertise a public route for that IP; the instance's traffic cannot leave the VPC, and the public IP is ignored. To make an Elastic IP usable, the instance must reside in a public subnet, which contradicts the requirement of keeping the instance private. Thus this option fails to provide any outbound internet connectivity.
✗
Use a VPC endpoint to the Amazon Linux repository.
Why it's wrong here
A VPC endpoint provides private connectivity to AWS services such as S3, DynamoDB, or API Gateway, not to arbitrary internet destinations like the Amazon Linux yum repository. The Linux package repositories are hosted on the public internet, and VPC endpoints will not route to them, even if you create a gateway endpoint or interface endpoint. Without a NAT gateway or a proxy with internet access, the private instance cannot download updates or install packages. Therefore this option does not meet the requirement for accessing the Amazon Linux repository.

Visual reference

Go deeper

DOP-C02 Security and Compliance Practice Question

Why each option matters

Option-by-option breakdown

Related to this question