SAP-C02 Design for New Solutions Practice Question

Exhibit

Refer to the exhibit.
{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "VPC with public and private subnets",
  "Resources": {
    "VPC": {
      "Type": "AWS::EC2::VPC",
      "Properties": {
        "CidrBlock": "10.0.0.0/16"
      }
    },
    "PublicSubnet": {
      "Type": "AWS::EC2::Subnet",
      "Properties": {
        "VpcId": { "Ref": "VPC" },
        "CidrBlock": "10.0.1.0/24",
        "MapPublicIpOnLaunch": true
      }
    },
    "PrivateSubnet": {
      "Type": "AWS::EC2::Subnet",
      "Properties": {
        "VpcId": { "Ref": "VPC" },
        "CidrBlock": "10.0.2.0/24"
      }
    }
  }
}

A company deployed the above CloudFormation template. An EC2 instance launched in the PrivateSubnet needs to access the internet for software updates. Which action is required?

⚠ Common exam trap

Candidates often confuse a NAT Gateway with an Internet Gateway, thinking that routing a private subnet directly to an Internet Gateway is sufficient, but this would expose instances to inbound traffic and require public IPs, defeating the purpose of a private subnet.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Add a NAT Gateway in the PublicSubnet and update the PrivateSubnet's route table to point to the NAT Gateway

A NAT Gateway placed in a public subnet with an Internet Gateway attached allows instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing inbound connections from the internet. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway. This is the standard AWS pattern for outbound-only internet access from private subnets.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Create a VPC Peering connection to a public VPC
Why it's wrong here
Peering does not provide internet access.
✓
Add a NAT Gateway in the PublicSubnet and update the PrivateSubnet's route table to point to the NAT Gateway
Why this is correct
NAT Gateway enables outbound internet for private instances.
✗
Add an Internet Gateway to the VPC and route the private subnet's route table to it
Why it's wrong here
IGW alone does not provide internet access to private instances.
✗
Modify the PrivateSubnet to assign public IP addresses on launch
Why it's wrong here
Public IP alone does not provide internet access; needs IGW.

Visual reference

Go deeper

SAP-C02 Design for New Solutions Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question