Examkin

Question

Difficulty: EasyVPC Connectivity and Routing Troubleshooting

An application server running on an Amazon EC2 instance in a private subnet is unable to retrieve software updates from the internet. A SysOps administrator needs to troubleshoot this connectivity issue.

Which of the following configurations are required to resolve this problem? (Select TWO.)

  1. A NAT gateway deployed and running in a public subnet within the VPCAnswer
  2. A route in the private subnet's route table that directs 0.0.0.0/0 traffic to the NAT gatewayAnswer
  3. C
    A route in the private subnet's route table that directs 0.0.0.0/0 traffic directly to an Internet Gateway
  4. D
    An outbound rule in the private subnet's Network Access Control List (NACL) that blocks ephemeral ports (1024-65535)
  5. E
    A Gateway VPC endpoint for the update repository associated only with the public subnet's route table

Answer

The correct configurations are deploying a NAT gateway in a public subnet and adding a route in the private subnet's route table that directs 0.0.0.0/0 traffic to the NAT gateway.
For an EC2 instance in a private subnet to access the internet, outbound traffic must be routed to a NAT gateway located in a public subnet. The NAT gateway performs source network address translation and forwards the traffic to the Internet Gateway. Thus, the solution requires both a NAT gateway in a public subnet and a route directing internet-bound traffic (0.0.0.0/0) to that NAT gateway.

Step-by-Step Solution

1
Identify that the instance is in a private subnet and requires outbound-only internet connectivity for updates.
The solution must use network address translation since private instances lack public IP addresses.
Private subnets cannot directly route traffic to an Internet Gateway.
2
Deploy a NAT Gateway in a public subnet of the same VPC.
The NAT Gateway will have a public IP address and a route to the Internet Gateway, enabling it to perform NAT for private instances.
NAT gateways must reside in public subnets to communicate with the internet.
3
Modify the route table associated with the private subnet to add a route for 0.0.0.0/0 with the target as the NAT Gateway.
All outbound internet traffic from the private subnet is successfully routed through the NAT Gateway.
Subnets require explicit routing table entries to direct outbound traffic to the NAT gateway.

Key Concept

NAT Gateway and Routing Configuration for Private Subnets
Rate this question

Topics

VPC Connectivity and Routing Troubleshooting

More questions from this topic