A county GIS VPC needs instances to download OS patches from the internet without giving those instances public IP addresses. Which design meets the requirement?
Select an answer to reveal the explanation.
Short Explanation
Private desks still need outbound mail through a mailroom—not a street address on every desk. NAT gateways in public subnets give private-subnet GIS hosts outbound internet for patches without public IPs on the instances. Public RDP everywhere or yanking the IGW entirely misses that balance.
Full Explanation
NAT gateways (or NAT instances) in public subnets enable private-subnet resources to initiate outbound internet connections while remaining unreachable from the internet by default. GIS instances keep private addressing; route tables send default traffic to the NAT. Assigning public IPs and opening RDP expands inbound risk, removing the internet gateway blocks legitimate egress, and unauthenticated public patch hosting does not replace controlled private-subnet egress design.