A SysOps administrator has launched an Amazon EC2 instance in a newly created private subnet () to run a database client. The client needs to connect to an external API on the internet. The administrator has deployed a NAT Gateway in another subnet () within the same VPC. However, the EC2 instance cannot establish any connection to the internet. Which of the following configuration changes are required to resolve this connectivity issue? (Select TWO.)
- Add a route in the route table associated with the database client's subnet () with a destination of pointing to the NAT Gateway.Cevap
- Add a route in the route table associated with the NAT Gateway's subnet () with a destination of pointing to the Internet Gateway.Cevap
- CAssociate the Internet Gateway directly with the route table of the database client's subnet () as the target for .
- DModify the Network ACL associated with the NAT Gateway's subnet () to allow inbound traffic on ports and but deny all outbound ephemeral ports ().
- ECreate a gateway VPC endpoint and associate it with the route table of the database client's subnet () to route all outbound internet traffic.
Cevap
Add a route in the route table associated with the database client's subnet pointing to the NAT Gateway, and add a route in the route table associated with the NAT Gateway's subnet pointing to the Internet Gateway.
To allow instances in a private subnet to access the internet, the routing must be configured in two stages. First, the route table for the private subnet where the client resides must direct all outbound traffic () to the NAT Gateway. Second, the NAT Gateway itself must be located in a public subnet, which requires a route table with a route directing outbound traffic () to the Internet Gateway.
Adım Adım Çözüm
Anahtar Kavram
Two-tier routing setup is required for private instances accessing the internet via a NAT Gateway: private subnet routes to the NAT Gateway, and the NAT Gateway's subnet routes to the Internet Gateway.