A city's private-subnet application servers must download OS patches from the public internet, but the security office forbids assigning public IP addresses to those instances. Which AWS component best enables outbound internet access while keeping the instances private?
Select an answer to reveal the explanation.
Short Explanation
Picture a one-way door to the internet for servers that should stay hidden. A NAT gateway sits in a public subnet and lets private-subnet instances reach out for patches without giving those instances public IPs. Route the private subnet to the NAT—not straight to the internet gateway—and you get outbound access without putting the fleet on the public stage.
Full Explanation
A NAT gateway enables instances in private subnets to initiate outbound connections to the internet without requiring public IP addresses on those instances. Typically the NAT gateway resides in a public subnet with an internet gateway path, and private subnet route tables send internet-bound traffic to the NAT gateway. An internet gateway alone provides a path for resources that are appropriately addressed for public access; it does not by itself keep private instances private while enabling egress. Peering and CloudFront address different connectivity and content-delivery problems.