A research VPC must let private subnets open outbound IPv6 connections and must not accept unsolicited inbound IPv6 from the internet. NAT gateways already handle IPv4. What should they add for IPv6?
Select an answer to reveal the explanation.
Short Explanation
NAT gateways speak IPv4. For IPv6 you want a door that only opens outward, which is an egress-only internet gateway. You point the private subnets' IPv6 default route at it, and you do not open every inbound port, which would do the opposite of what the lab asked.
Full Explanation
An egress-only internet gateway provides outbound IPv6 and blocks unsolicited inbound IPv6 connections. Private subnets use it by routing ::/0 to that gateway. A NAT gateway does not forward IPv6, so another NAT gateway and an IPv6 route aimed at it will not carry this traffic. A public IPv4 address does not create an IPv6 path. An inbound allow for every port invites the unsolicited traffic the requirement forbids, and a security group rule is not the egress path. Caveat: the VPC and the subnets still need IPv6 CIDRs, and the instances need IPv6 addresses, or the new route has nothing to forward. Operational check: from a private instance, confirm an outbound IPv6 connection succeeds and an unsolicited inbound IPv6 probe does not. Egress-only internet gateways are IPv6-only and stateful for connections the instance starts. They are not a substitute for the NAT gateway you already use for IPv4, and you keep both. Instances need an IPv6 address from the subnet, or the route exists and the guest still has nothing to source the connection from.