NAT Gateway for Private Subnet Internet Access
A Security Engineer is configuring a VPC with a public subnet for a web server and a private subnet for a database. The web server needs to download patches from the internet. Which TWO actions should the Engineer take to allow the web server internet access without exposing the database to the internet?
Quick Answer
The correct answer is to add a route in the private subnet’s route table that points 0.0.0.0/0 to a NAT Gateway. This works because a NAT Gateway, deployed in a public subnet with an Elastic IP, allows instances in private subnets to initiate outbound traffic to the internet for tasks like downloading patches, while blocking any unsolicited inbound connections that could expose the database. On the AWS Certified Security Specialty SCS-C02 exam, this scenario tests your understanding of VPC networking and the distinction between NAT Gateways and Internet Gateways—a common trap is confusing the two, but remember that only public subnets use an Internet Gateway directly. The exam often pairs this with a distractor like a VPC endpoint for S3, which is for private AWS service access, not general internet. A helpful memory tip: NAT Gateway = outbound only, private subnet; Internet Gateway = bidirectional, public subnet.
⚠ Common exam trap
Candidates often confuse a NAT Gateway with a bastion host or assume that a VPC endpoint for S3 can provide general internet access, but the key distinction is that a NAT Gateway enables outbound internet connectivity for private subnets without exposing them to inbound traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a NAT Gateway in the public subnet.
A NAT Gateway in the public subnet allows instances in the private subnet to initiate outbound IPv4 traffic to the internet (e.g., to download patches) while preventing unsolicited inbound connections from the internet. By adding a route in the private subnet's route table that points 0.0.0.0/0 to the NAT Gateway, the web server's outbound traffic is forwarded to the NAT Gateway, which then uses the Internet Gateway to reach the internet. The database remains isolated because it has no direct route to the Internet Gateway and no public IP address.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a bastion host in the public subnet and configure the web server to use it as a proxy.
Why it's wrong here
A bastion host is for administrative access, not for internet connectivity for patching.
- ✗
Create a VPC endpoint for Amazon S3.
Why it's wrong here
This only allows access to S3, not general internet.
- ✓
Create a NAT Gateway in the public subnet.
Why this is correct
NAT Gateway enables outbound internet access for instances in private subnets.
- ✗
Attach an Internet Gateway to the VPC and add a route to the Internet Gateway in the private subnet's route table.
Why it's wrong here
Private subnets should not have direct routes to an Internet Gateway.
- ✓
Add a route in the private subnet's route table that points 0.0.0.0/0 to the NAT Gateway.
Why this is correct
This routes outbound internet traffic from the private subnet through the NAT Gateway.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security engineer is configuring a VPC with public and private subnets. The engineer needs to allow instances in the private subnet to download software updates from the internet. Which component should be added to the VPC?
easy- A.VPN connection to on-premises.
- B.VPC endpoint for Amazon S3.
- C.Bastion host in a public subnet.
- ✓ D.NAT gateway in a public subnet.
Why D: A NAT gateway in a public subnet allows instances in private subnets to initiate outbound connections to the internet for downloading updates. Option A is incorrect because a VPN connection is used for secure connectivity to on-premises networks, not for general internet access. Option B is incorrect because a VPC endpoint provides private connectivity to AWS services like S3, not to the internet. Option C is incorrect because a bastion host is used for administrative access (SSH/RDP) to instances, not for providing internet access.
Variation 2. A security engineer is configuring a VPC with a public subnet for web servers and a private subnet for databases. The web servers need to download patches from the internet. Which TWO components are required to allow the web servers to access the internet while keeping the database servers isolated?
easy- ✓ A.Internet gateway attached to the VPC.
- B.VPC endpoint for Amazon S3.
- C.Transit gateway between the public and private subnets.
- ✓ D.NAT gateway in the public subnet.
- E.Virtual private gateway attached to the VPC.
Why A: Web servers in a private subnet require both an Internet Gateway (IGW) attached to the VPC and a NAT Gateway in a public subnet to access the internet. The IGW provides internet connectivity to the VPC, and the NAT Gateway allows instances in private subnets to initiate outbound connections to the internet while preventing inbound connections from the internet. The database servers remain isolated because they are in a private subnet without a NAT Gateway or direct route to the IGW.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.