An organization has set up a VPC with a public subnet () and a private subnet (). A NAT gateway is deployed in the public subnet to grant internet access to resources in the private subnet. An Amazon EC2 instance is launched in the private subnet, but it cannot connect to any external internet repositories to download updates. Which of the following routing configuration steps are required to establish this connectivity? (Select TWO.)
- Add a route to in the private subnet's route table that targets the NAT gateway.Answer
- Add a route to in the public subnet's route table that targets the Internet Gateway.Answer
- CAdd a route to in the private subnet's route table that targets the Internet Gateway directly.
- DConfigure the security group of the NAT gateway to allow outbound HTTPS traffic to .
- EModify the private subnet's network ACL outbound rules to specify the NAT gateway's resource ID as the destination.
Answer
To resolve the internet connectivity issue for the EC2 instance in the private subnet, you must add a route to in the private subnet's route table targeting the NAT gateway, and ensure the public subnet's route table has a route to targeting the Internet Gateway.
The correct configuration requires two routing entries: first, the private subnet's route table must route all non-local traffic () to the NAT gateway; second, the public subnet's route table (where the NAT gateway resides) must route all non-local traffic () to the Internet Gateway. Together, these routes form the complete outbound path to the internet.
Step-by-Step Solution
Key Concept
Two-tier routing architecture with NAT Gateway and Internet Gateway