Private city subnet instances must download OS updates from the internet. An internet gateway exists in the VPC, yet private instances still cannot reach update endpoints. What is most likely missing or misconfigured?
Select an answer to reveal the explanation.
Short Explanation
Private means no public mailbox on the front door. Those instances need a NAT path—and a route that points default traffic at it—so updates can go out without giving every VM a public address.
Full Explanation
Private city subnet instances that must download OS updates from the Internet, where an Internet gateway exists in the VPC yet private instances still cannot reach update endpoints, are most likely missing a NAT gateway or NAT instance with a correct route from the private subnet. IGWs serve public subnets; private subnets need NAT for egress without public IPs. Putting a public IP on every private instance's primary NIC contradicts private placement goals. Disabling the VPC firewall for all outbound ports is not the required pattern and overexposes workloads. Moving instances into the same availability zone as the Internet gateway does not replace NAT routing semantics. Exam caveat: also verify NACL/SG egress and that the default route points at NAT, not a black hole—routing mistakes mimic missing NAT. Operational check: confirm the private route table 0.0.0.0/0 target is NAT, test HTTPS to an update endpoint from a private instance, review SG/NACL egress, and document the municipal private-egress pattern. In municipal cloud operations, record the chosen control and the rejected alternatives in the change or incident ticket so future on-call staff understand which failure modes were avoided for city services. Re-validate after the next maintenance window that the same decision still holds under current provider limits, identity bindings, and application versions used by the civic platform team.