AWS SAA-C03 #101

A solutions architect is designing a VPC with public and private subnets. The VPC and subnets use IPv4 CIDR blocks. There is one public subnet and one private subnet in each of three Availability Zones (AZs) for high availability. An internet gateway is used to provide internet access for the public subnets. The private subnets require access to the internet to allow Amazon EC2 instances to download software updates.
What should the solutions architect do to enable Internet access for the private subnets?

A. Create three NAT gateways, one for each public subnet in each AZ. Create a private route table for each AZ that forwards non-VPC traffic to the NAT gateway in its AZ.
B. Create three NAT instances, one for each private subnet in each AZ. Create a private route table for each AZ that forwards non-VPC traffic to the NAT instance in its AZ.
C. Create a second internet gateway on one of the private subnets. Update the route table for the private subnets that forward non-VPC traffic to the private internet gateway.
D. Create an egress-only internet gateway on one of the public subnets. Update the route table for the private subnets that forward non-VPC traffic to the egress-only Internet gateway.

---

The correct answer is A. Create three NAT gateways, one for each public subnet in each AZ. Create a private route table for each AZ that forwards non-VPC traffic to the NAT gateway in its AZ.

Here’s why:

• NAT Gateways are used to provide internet connectivity to EC2 instances in private subnets. They are highly available and scalable, and they reside within a specific Availability Zone and are redundant in that zone.
• Each private subnet in an AZ should have a route to the NAT Gateway in the same AZ. This ensures that if an AZ goes down, the instances in the private subnet of other AZs can still access the internet via their respective NAT Gateways.
• NAT instances could be used, but they are not as highly available or scalable as NAT Gateways.
• A second Internet Gateway or an Egress-only Internet Gateway would not provide the necessary routing for instances in a private subnet to access the internet. Internet Gateways are used for public subnets, and Egress-only Internet Gateways are used for IPv6 traffic in a VPC, not IPv4.