A municipal architect marks one VPC subnet "public" and another "private" for a citizen portal. What primarily distinguishes the public subnet for inbound internet access patterns?
Select an answer to reveal the explanation.
Short Explanation
"Public" here is really about the route table, not a fancy name tag. If the subnet can send internet-bound traffic to an internet gateway, inbound public patterns can work with public IPs or load balancers in that subnet. Private subnets skip that IGW route and stay tucked away—often using NAT when they need outbound only.
Full Explanation
In municipal VPC design, labeling a subnet "public" versus "private" is primarily a routing decision, not a cosmetic tag or a CIDR-size rule. A public subnet's route table includes a route that sends internet-bound traffic to an internet gateway. That path, combined with public IP addressing or public-facing load balancers placed in the subnet, enables inbound internet access patterns for citizen portals, bastions, or edge tiers. Private subnets deliberately omit that IGW route so application or data tiers remain unreachable from the public internet and typically use NAT for outbound-only needs when required.
CIDR block size does not define public versus private; both can use any valid subnet size appropriate to address planning. Application Load Balancers are commonly placed in public subnets for internet-facing civic portals, but saying only private subnets can host ALBs is incorrect—internet-facing ALBs need public subnet placement with IGW reachability. Public subnets do not automatically disable security groups; security groups remain mandatory stateful firewalls on instances and ENIs regardless of subnet type. The distinguishing Cloud Practitioner fact is the presence of the IGW route in the public subnet's route table.
Exam caveat: AWS does not magically make a subnet public because of its name. Always reason from the route table: IGW route implies public pattern; no IGW route implies private. Do not confuse network ACLs, security groups, or Elastic IPs with the definition of public subnet—those are related controls and addressing choices that sit on top of the routing foundation.
Operational check for the citizen portal: inspect the public subnet route table for 0.0.0.0/0 → igw-..., confirm the private subnet lacks that route (or points outbound to a NAT gateway instead), verify the ALB or portal instances that need inbound internet sit in the public subnet with appropriate security groups, and test that private-tier instances cannot be reached from the internet while still meeting outbound patching policy if NAT is configured.