SOA-C02 Networking and Content Delivery Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Deploy a NAT Gateway in a public subnet and add a route in the private subnet route tables pointing 0.0.0.0/0 to the NAT Gateway.

  Why this is correct

  A NAT Gateway is a managed service placed in a public subnet with an Elastic IP, and by adding a route for 0.0.0.0/0 in the private subnet route tables that targets the NAT Gateway, instances receive outbound internet access for tasks like software updates while remaining completely unreachable from the internet. This is the secure and correct design because the NAT Gateway performs stateful address translation, only allowing responses to initiated outbound connections, and it scales automatically without requiring you to manage a separate instance.

• ✗

  Set up a VPN connection to an on-premises network and route internet traffic through it.

  Why it's wrong here

  Routing internet-bound traffic through a VPN to an on-premises network introduces unnecessary latency, bandwidth costs, and a single point of failure for what is a simple outbound-only requirement. This approach is designed for hybrid connectivity, not for providing EC2 instances with direct internet access for software updates. It would be correct if the company needed to enforce all internet traffic through a centralised on-premises security inspection point, but the stem specifies no such need.

• ✗

  Assign public IP addresses to the EC2 instances and route traffic directly.

  Why it's wrong here

  Assigning public IP addresses to EC2 instances in private subnets directly exposes them to inbound traffic from the internet, even if you also add an internet gateway route. This defeats the purpose of using private subnets, dramatically increases the attack surface, and is unnecessary for outbound-only communication; instances do not need a public IP to initiate outbound connections if a NAT Gateway provides translation. Furthermore, public IPs cannot be dynamically added without stopping the instance, and managing firewall rules to protect them becomes significantly more complex, making this a poor security choice.

• ✗

  Attach an internet gateway to the private subnets and route 0.0.0.0/0 to it.

  Why it's wrong here

  An internet gateway is a VPC-level resource attached to the VPC itself, not to any specific subnet, and routing private subnet traffic directly to it creates a bidirectional path to the internet, exposing instances to unsolicited inbound connections. This configuration is fundamentally misconfigured for private subnets: they are defined by having no route to an internet gateway, and routing 0.0.0.0/0 to the IGW would make instances effectively public, undermining the required security boundary and failing to provide the outbound-only access pattern that a NAT Gateway offers.

Go deeper

Related to this question