Private city subnet instances must download OS updates from the internet. An internet gateway exists in the VPC, yet private instances still cannot reach update endpoints. What is most likely missing or misconfigured?
Select an answer to reveal the explanation.
Short Explanation
Private means no public mailbox on the front door. Those instances need a NAT path—and a route that points default traffic at it—so updates can go out without giving every VM a public address.
Full Explanation
Private subnets typically reach the internet for outbound updates through a NAT gateway or NAT instance, with a route table entry sending 0.0.0.0/0 to that NAT target. An internet gateway alone serves public subnets with public addressing; private instances should not rely on per-instance public IPs. Disabling firewalls or co-locating AZs does not replace a correctly routed NAT path.