SOA-C02 Networking and Content Delivery Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Public subnet route table: 0.0.0.0/0 -> Internet Gateway; Private subnet route table: 0.0.0.0/0 -> Internet Gateway via the NAT Gateway.

  Why it's wrong here

  A route table entry can only specify a single target, and the target must be a gateway, NAT gateway, or other valid endpoint; it cannot be a chain like 'Internet Gateway via the NAT Gateway.' The internet gateway is a distinct resource, and AWS does not support transitive routing through a NAT gateway to an internet gateway in one route. To provide outbound access, the private subnet's default route must point directly to the NAT gateway, which then uses the public subnet's route to the internet gateway.

• ✗

  Public subnet route table: 0.0.0.0/0 -> Internet Gateway; Private subnet route table: 0.0.0.0/0 -> Internet Gateway.

  Why it's wrong here

  Directing the private subnet's default route to the internet gateway would give every instance in that subnet a public IP address and direct internet access, completely bypassing the NAT gateway and eliminating the privacy that a private subnet is designed to provide. This configuration would allow inbound traffic from the internet to reach those instances, which is not acceptable for a private subnet. Instances in a private subnet should only reach the internet through a NAT gateway, which enables outbound communication while blocking unsolicited inbound connections.

• ✗

  Public subnet route table: 0.0.0.0/0 -> NAT Gateway; Private subnet route table: 0.0.0.0/0 -> Internet Gateway.

  Why it's wrong here

  The public subnet must route to the internet gateway so resources like the NAT gateway can communicate with the internet, not to the NAT gateway itself—doing so would create a routing loop because the NAT gateway resides in the public subnet and would have nowhere to send traffic. Meanwhile, the private subnet must point to the NAT gateway as its default target, not the internet gateway, because sending private traffic directly to the internet gateway would expose it publicly and negate the need for NAT. Reversing these routes breaks the intended network architecture and leaves private instances directly internet-accessible.

• ✓

  Public subnet route table: 0.0.0.0/0 -> Internet Gateway; Private subnet route table: 0.0.0.0/0 -> NAT Gateway.

  Why this is correct

  This is the correct setup for a VPC with public and private subnets. The public subnet route table sends all outbound traffic (0.0.0.0/0) to the internet gateway, allowing resources like a bastion host or NAT gateway to reach the internet directly. The private subnet route table sends all outbound traffic to the NAT gateway, which resides in the public subnet and performs source network address translation (SNAT) to forward traffic to the internet while keeping instances in the private subnet unreachable from the internet. This preserves the security of private instances while still enabling them to download updates or access external services.

Go deeper

Related to this question