Question 357 of 247
SOA-C02 Networking and Content Delivery Practice Question
A company runs an application across multiple Availability Zones. The application servers are in private subnets and need outbound internet access to download software updates and patches. The SysOps administrator needs a highly available, fully managed solution to provide this outbound connectivity. Which solution should be used?
⚠ Common exam trap
Many candidates confuse NAT Gateways with NAT instances or assume a single NAT Gateway is sufficient for high availability, overlooking the need for one per Availability Zone to achieve true fault tolerance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a NAT Gateway in each public subnet
Deploying a NAT Gateway in each public subnet provides a highly available, fully managed solution for outbound internet access from private subnets. NAT Gateways are managed by AWS, automatically scale, and are resilient within an Availability Zone; using one per AZ ensures that if one AZ fails, the others continue to provide outbound connectivity. This meets the requirement for high availability without the operational overhead of managing NAT instances.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy a NAT instance in each private subnet
Why it's wrong here
Placing a NAT instance inside a private subnet cannot provide outbound internet access because the instance itself has no route to an Internet Gateway; a NAT device must reside in a public subnet with a route to an Internet Gateway. Even if it were correctly placed, NAT instances are self-managed Amazon EC2 instances that require you to disable Source/Destination Check, configure routing, and implement your own failover and health-checking logic. This significantly increases operational overhead and does not meet the requirement for a fully managed, highly available solution.
- ✗
Deploy a single NAT Gateway in one public subnet
Why it's wrong here
A single NAT Gateway is deployed in one specific Availability Zone and is not resilient to failure of that zone. If that Availability Zone becomes unavailable, all private subnets that rely on the gateway—including those in other Availability Zones—will lose outbound internet connectivity, causing a single point of failure. While a NAT Gateway is fully managed, it is AZ-scoped; for high availability, you must deploy one NAT Gateway in each public subnet and configure each private subnet to use the gateway in its own Availability Zone.
- ✓
Deploy a NAT Gateway in each public subnet
Why this is correct
By deploying a NAT Gateway in each Availability Zone's public subnet and configuring private subnets to use the NAT Gateway in the same AZ, the solution is both fully managed and highly available. If one AZ fails, the other AZ's NAT Gateway continues to provide internet access.
- ✗
Attach an Internet Gateway directly to the private subnets
Why it's wrong here
An Internet Gateway cannot be attached directly to a private subnet. Private subnets have no direct route to the internet. An Internet Gateway is associated with the VPC and must be used in public subnets.
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.