A company uses an automated CI/CD pipeline to deploy utility servers into a designated subnet within a custom VPC. After a recent deployment, the utility servers are assigned public IPv4 addresses, but administrators are unable to establish SSH connections () or ping the servers from the internet. The security group and Network ACL associated with the subnet both explicitly allow SSH traffic.
Which of the following routing issues is preventing external access to these utility servers?
- A default route () targeting the VPC's Internet Gateway is missing from the subnet's route table.Answer
- BThe stateless Network ACL is missing an inbound rule to allow return traffic on ephemeral ports .
- CA route targeting the Gateway VPC Endpoint for SSH traffic has not been added to the subnet's routing configuration.
- DThe routing configuration directs all external traffic () to a NAT gateway provisioned in the same subnet.
Answer
A default route () targeting the VPC's Internet Gateway is missing from the subnet's route table.
A public subnet must have a route table containing a default route () pointing to the Internet Gateway. If this route is missing, instances in the subnet cannot communicate with resources outside the VPC, causing external connection attempts to time out.
Step-by-Step Solution
Key Concept
VPC Route Table Configuration for Public Subnets