Retail instances in a private cloud subnet have no public addresses. They must open outbound internet sessions and must not accept inbound connections from the internet. Which service provides that egress?
Select an answer to reveal the explanation.
Short Explanation
These servers need a mailroom that stamps outgoing packages and refuses unsolicited ones from the street. You give the private instances a NAT gateway so their outbound internet sessions are translated, and nothing on the internet can open a connection inward. An internet gateway with no public address, a VPN that nobody asked for, or a load balancer does not provide that egress.
Full Explanation
A NAT gateway lets instances that have only private addresses initiate connections to the internet. It translates their source addresses for the outbound session and allows the replies back. It does not publish the instances for unsolicited inbound connections, which is the retail requirement. An internet gateway attaches a cloud network to the internet, and instances still need their own public addresses to use it for direct client connections. The stem says these instances have no public addresses, so an internet gateway alone leaves them unable to egress. A VPN concentrator terminates tunnels from remote sites or users. It can be a path into a private network, and it is not required when the only goal is outbound internet from the subnet. Making it the only egress invents a remote peer the store does not need. A load balancer distributes inbound connections across targets and presents a listener. It does not give private instances a general outbound path to arbitrary internet hosts, and publishing a listener would work against the ban on inbound connections. Exam caveat: the private subnet's route for unknown destinations has to point at the NAT gateway. An internet gateway on the virtual network does nothing for instances whose route never uses it. Operational check: from a private instance, open an outbound test to the internet and confirm it succeeds, then from outside attempt a connection to the instance's private address and confirm it cannot be reached.