SOA-C02 Networking and Content Delivery Practice Question
A company has a VPC with public and private subnets. The private subnets need outbound internet access to download software updates while preventing any inbound internet traffic. The SysOps administrator must minimize costs. Which solution should the administrator implement?
⚠ Common exam trap
It's easy for candidates to choose the NAT Gateway (Option A) because it is fully managed and simpler, overlooking the explicit cost-minimization requirement that favors the cheaper, self-managed NAT instance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Launch a NAT instance in a public subnet with an Elastic IP and disable source/destination check, then update private subnet route tables
A NAT instance, when launched in a public subnet with an Elastic IP and source/destination check disabled, can route outbound traffic from private subnets to the internet while blocking unsolicited inbound connections. This solution minimizes costs compared to a NAT Gateway, as NAT instances use existing EC2 instance pricing and can be further reduced with spot instances or smaller instance types.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a NAT Gateway in a public subnet and update the private subnet route table to use it
Why it's wrong here
While a NAT Gateway provides the required outbound connectivity, it incurs an hourly charge and data processing fees that fail to satisfy the requirement to minimise costs. This solution is typically used when high availability and managed scaling are necessary for production workloads. In contrast, a NAT Instance fulfils the same routing purpose without the fixed hourly cost of a managed gateway service.
- ✓
Launch a NAT instance in a public subnet with an Elastic IP and disable source/destination check, then update private subnet route tables
Why this is correct
Launching a NAT instance is the correct cost-minimizing solution because it uses a regular EC2 instance, which incurs only standard instance-hour charges and no per-gigabyte data processing fees, unlike a NAT Gateway. To make it work, you must assign an Elastic IP so the NAT instance has a stable public address, disable the source/destination check so the instance can forward traffic, and update the private subnet route tables to point 0.0.0.0/0 at the NAT instance's private IP. This configuration provides outbound internet access for private instances while preserving the cost advantage over the managed gateway service.
- ✗
Attach an Internet Gateway to the VPC and add a default route to the Internet Gateway in the private subnets
Why it's wrong here
Attaching an Internet Gateway (IGW) and adding a default route to it in private subnet route tables does not provide outbound internet access because an IGW only routes traffic for resources that have public IP addresses. Instances in private subnets have no public IPs, and the IGW does not perform network address translation, so packets from private instances would attempt to egress with private source addresses and be dropped by the IGW. To enable internet access from a private subnet, a NAT device must translate private source IPs to a public Elastic IP, which is exactly why a NAT instance or NAT Gateway is required.
- ✗
Use AWS Transit Gateway with a VPN connection to an on-premises data center for internet access
Why it's wrong here
AWS Transit Gateway with a VPN to an on-premises data centre introduces unnecessary infrastructure and operational cost, whereas the requirement is to minimise costs by using a managed AWS service such as a NAT gateway or a VPC endpoint for software updates. This option is tempting because Transit Gateway is designed to centralise connectivity between multiple VPCs and on-premises networks, and it would be correct in a scenario requiring hybrid network routing across many VPCs with an existing VPN backhaul to a data centre.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SOA-C02 question from scratch — 247 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.