Exam SAA-C03 All QuestionsBrowse all questions from this exam
Go to Exam
Question 101

A solutions architect is designing a VPC with public and private subnets. The VPC and subnets use IPv4 CIDR blocks. There is one public subnet and one private subnet in each of three Availability Zones (AZs) for high availability. An internet gateway is used to provide internet access for the public subnets. The private subnets require access to the internet to allow Amazon EC2 instances to download software updates.

What should the solutions architect do to enable Internet access for the private subnets?

    Correct Answer: A

    To enable internet access for the private subnets in a VPC, the correct approach is to use NAT gateways. A NAT gateway allows instances in a private subnet to connect to the internet or other AWS services, but prevents the internet from initiating connections with the instances. In this scenario, you should create a NAT gateway in each public subnet within each Availability Zone (AZ) to ensure high availability and fault tolerance. Then, you need to create a private route table for each AZ and configure it to route traffic destined for outside the VPC through the NAT gateway in the same AZ. This setup ensures that each private subnet has a reliable path to the internet for downloading software updates. NAT gateways are the preferred solution over NAT instances due to their ease of management, better performance, and higher availability.

Discussion
Gil80Option: A

NAT Instances - OUTDATED BUT CAN STILL APPEAR IN THE EXAM! However, given that A provides the newer option of NAT Gateway, then A is the correct answer. B would be correct if NAT Gateway wasn't an option.

Shrestwt

NAT instance or NAT Gateway always created in public subnet to provide internet access to private subnet. In option B. they are creating NAT Instance in private subnet which is not correct.

BuruguduystunstugudunstuyOption: A

The correct answer is option A. To enable Internet access for the private subnets, the solutions architect should create three NAT gateways, one for each public subnet in each Availability Zone (AZ). NAT gateways allow private instances to initiate outbound traffic to the Internet but do not allow inbound traffic from the Internet to reach the private instances. The solutions architect should then create a private route table for each AZ that forwards non-VPC traffic to the NAT gateway in its AZ. This will allow instances in the private subnets to access the Internet through the NAT gateways in the public subnets.

cookieMr

By creating a NAT gateway in each public subnet, the private subnets can route their Internet-bound traffic through the NAT gateways. This allows EC2 in the private subnets to download software updates and access other resources on the Internet. Additionally, a separate private route table should be created for each AZ. The private route tables should have a default route that forwards non-VPC traffic (0.0.0.0/0) to the corresponding NAT gateway in the same AZ. This ensures that the private subnets use the appropriate NAT gateway for Internet access. B is incorrect because NAT instances require manual management and configuration compared to NAT gateways, which are a fully managed service. NAT instances are also being deprecated in favor of NAT gateways. C is incorrect because creating a second internet gateway on a private subnet is not a valid solution. Internet gateways are associated with public subnets and cannot be directly associated with private subnets. D is incorrect because egress-only internet gateways are used for IPv6 traffic.

Guru4CloudOption: A

The best solution is to create a NAT gateway in each public subnet (one per availability zone), and update the route tables for the private subnets to send internet traffic to the NAT gateway. NAT gateways allow private subnets to access the internet for things like software updates, without exposing those instances directly to the internet. An egress-only internet gateway would allow outbound access, but also allow inbound internet traffic, which is not desired for the private subnets.

Ruffyit

https://docs.aws.amazon.com/vpc/latest/userguide/vpc-example-private-subnets-nat.html

james2033Option: A

"Egress" means outbound connection, remove D. "Second gateway", remove C. Now has only A and B. The different between A versus B is "1 NAT gateway, 1 for public subnet in each AZ" (A) and "1 NAT gateway, 1 for private subnet in each AZ" (B). Choose A.

HericOption: A

Now NAT Instances is avoided by AWS. Then choose the NAT Gateway

cheese929Option: A

A is correct. https://docs.aws.amazon.com/vpc/latest/userguide/vpc-example-private-subnets-nat.html

RODCCN

You should create 3 NAT gateways, but not in the public subnet. So, even NAT instance is already deprecated, is the right answer in this case, since it's relate to create in a private subnet, not public.

Ben2008

Refer: https://docs.aws.amazon.com/vpc/latest/userguide/nat-gateway-scenarios.html#public-nat-gateway-overview Should be A.

jaradat02Option: A

the correct answer is A, to connect a private subnet to the internet using internet gateways is irrelevant, you have to use either NAT gateway or NAT instance, and NAT gateway is the better choice.

soufiyaneOption: A

Nat instances can do the same except it's not cost effective also it need a lot of managment, going with nat gateways makes more sense

ronin201

in Azure there is 1 NAT GW multi AZ, 1 per network, I think this is example for AWS to change

pentium75

But in AWS a NAT GW is attached to a subnet, and a subnet resides in a single AZ. Can't create multi-AZ NAT GW without changing whole architecture. You CAN use one NAT GW from multiple subnets in multiple AZs I think, but then it would not be HA.

Jeeva28

NAT Gateway will be created Public Subnet and Provide access to Private Subnet

alexiscloud

A: NAT Gateway

RudramanOption: A

NAT Gateway - AWS-managed NAT, higher bandwidth, high availability, no administration

erik29

aaaaaa