SAP-C02 Continuous Improvement for Existing Solutions Practice Question
A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance does not have a public IP. What is the most secure way to provide internet access?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a NAT Gateway in the public subnet and update the private subnet's route table.
A NAT Gateway in a public subnet enables instances in a private subnet to initiate outbound internet traffic for tasks like downloading patches, while preventing inbound connections from the internet. Option A is incorrect because a VPC endpoint is used for private connectivity to AWS services, not for general internet access. Option B is incorrect because a NAT instance is less managed and secure than a NAT Gateway, and it must be placed in a public subnet. Option C is incorrect because an Internet Gateway is attached to the VPC, not directly to a subnet, and attaching it to a private subnet would not function correctly and could expose the instance to inbound traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a VPC endpoint for the internet.
Why it's wrong here
VPC endpoints are for AWS services, not general internet.
- ✗
Launch a NAT instance in the private subnet.
Why it's wrong here
NAT instance must be in public subnet.
- ✗
Attach an Internet Gateway directly to the private subnet.
Why it's wrong here
Internet Gateway requires public IPs and allows inbound traffic.
- ✓
Add a NAT Gateway in the public subnet and update the private subnet's route table.
Why this is correct
NAT Gateway provides outbound internet access securely.
Visual reference
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.