DOP-C02 Configuration Management and IaC Practice Question

A company uses AWS CloudFormation to deploy a VPC with public and private subnets. They want to ensure that the VPC has internet access for the public subnets. Which THREE resources must be included in the template?

⚠ Common exam trap

Many exam-takers assume an Internet Gateway alone is sufficient for internet access, forgetting that a route in the route table pointing to the IGW is mandatory to make the connection functional.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

AWS::EC2::Route (pointing to InternetGateway)

An AWS::EC2::Route resource that points to an InternetGateway is required to direct traffic from the public subnet's route table to the internet. Without this route, instances in the public subnet cannot send or receive traffic from the internet, even if an Internet Gateway is attached to the VPC.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
AWS::EC2::VPCEndpoint
Why it's wrong here
An AWS::EC2::VPCEndpoint enables private connectivity to specific AWS services (such as S3 or DynamoDB) via the AWS network backbone, eliminating the need to traverse the public internet. It is not a general-purpose internet gateway and cannot provide internet egress for instances in a public subnet. Endpoints are scoped to service-specific destinations, so they cannot serve as a 0.0.0.0/0 route target for general internet traffic.
✓
AWS::EC2::Route (pointing to InternetGateway)
Why this is correct
An AWS::EC2::Route entry with destination 0.0.0.0/0 and target pointing to an InternetGateway is the precise mechanism that makes a public subnet public. This route directs all non-local traffic to the internet gateway, enabling instances with public IPs to reach outbound and receive inbound internet traffic. Without this specific route, the internet gateway exists but the subnet cannot use it, so creating the route is the decisive step.
✓
AWS::EC2::RouteTable
Why this is correct
An AWS::EC2::RouteTable itself is a logical container that holds route rules but does not actually forward traffic until it contains a route to an internet gateway. For public internet access, the route table must include a default route (0.0.0.0/0) targeting the IGW, and the table must be explicitly associated with the subnet. Simply creating a route table, without the required route and association, leaves the subnet effectively private.
✗
AWS::EC2::NatGateway
Why it's wrong here
An AWS::EC2::NatGateway is designed for private subnets that need outbound-only internet access; it resides in a public subnet and translates private instance IPs to its Elastic IP, but it rejects inbound connections initiated from the internet. For a public subnet, using a NAT gateway is unnecessary and would not achieve the intended public accessibility because public subnet instances are expected to route directly through an internet gateway. NAT gateways also incur hourly charges and cannot be used as a substitute for an IGW.
✓
AWS::EC2::InternetGateway
Why this is correct
An AWS::EC2::InternetGateway is a VPC-level, horizontally scaled resource that provides a target for internet-bound traffic and is required for any bidirectional communication between the VPC and the public internet. It is not attached to individual subnets; instead, subnets use it by having a route in their route table destined to 0.0.0.0/0 with the IGW as target. The IGW supports both IPv4 and IPv6 and also performs source/destination checks, making it the essential connectivity layer, though it must be paired with the appropriate route.

Visual reference

Go deeper

DOP-C02 Configuration Management and IaC Practice Question

Why each option matters

Option-by-option breakdown

Related to this question