A city's private-subnet application servers must download OS patches from the public internet, but the security office forbids assigning public IP addresses to those instances. Which AWS component best enables outbound internet access while keeping the instances private?
Select an answer to reveal the explanation.
Short Explanation
Picture a one-way door to the internet for servers that should stay hidden. A NAT gateway sits in a public subnet and lets private-subnet instances reach out for patches without giving those instances public IPs. Route the private subnet to the NAT—not straight to the internet gateway—and you get outbound access without putting the fleet on the public stage.
Full Explanation
For municipal application servers that must stay in private subnets—no public IP addresses allowed by the security office—outbound internet access for OS patches is achieved with a NAT gateway pattern. Place the NAT gateway in a public subnet that already has a path to an internet gateway, then add a route in the private subnet route table that sends internet-bound traffic (0.0.0.0/0) to the NAT gateway. Private instances initiate outbound connections through the NAT, which translates and forwards them to the internet, while inbound unsolicited traffic from the internet cannot directly target those private addresses. That satisfies the dual civic requirement: patch the fleet and keep the servers off the public stage.
An internet gateway attached only to a private subnet route table without NAT does not solve the no-public-IP constraint in the intended way. Private instances still need a public-facing hop that can translate outbound traffic; routing private subnet traffic straight to an IGW without public IPs on the instances does not create a workable outbound path for typical IPv4 designs. VPC peering to another account's public subnet is about private connectivity between VPCs or accounts; it is not the standard Cloud Practitioner pattern for giving private-subnet instances outbound internet access for patches. Amazon CloudFront in front of each EC2 instance is a content delivery and caching front door for HTTP(S) content, not a VPC outbound NAT path for OS package repositories.
Exam caveat: CLF-level questions often test the mental model that "private" means no IGW route (or no public IP), while outbound-only internet access is the NAT gateway (or NAT instance) story—not CloudFront, not peering, and not "just attach an IGW to the private route table." Also distinguish NAT gateway (managed, AZ-scoped) from security groups and NACLs, which filter traffic but do not provide address translation.
Operational check for the city: confirm the NAT gateway is in a public subnet with an IGW route, confirm each private subnet's route table points 0.0.0.0/0 to that NAT gateway, verify instances have no public IPs, and test outbound HTTPS to a patch mirror while ensuring inbound SSH or RDP from the internet still fails. Monitor NAT gateway data-processing charges and Multi-AZ NAT design if patch windows cannot tolerate a single AZ failure.