A county GIS VPC needs instances to download OS patches from the internet without giving those instances public IP addresses. Which design meets the requirement?
Select an answer to reveal the explanation.
Short Explanation
Private desks still need outbound mail through a mailroom—not a street address on every desk. NAT gateways in public subnets give private-subnet GIS hosts outbound internet for patches without public IPs on the instances. Public RDP everywhere or yanking the IGW entirely misses that balance.
Full Explanation
County GIS instances that must download OS patches without public IP addresses belong in private subnets whose default route (0.0.0.0/0) points to NAT gateways in public subnets. NAT allows outbound-initiated internet access for patch repositories while keeping the instances unreachable from the internet by default—the municipal equivalent of outbound mail through a mailroom rather than a street address on every desk.
Assigning public IPs and opening inbound RDP from the internet for patching tools fails because it exposes administrative ports and contradicts the no-public-IP requirement. Removing the internet gateway so no subnet can reach vendor patch repositories fails conceptually: it blocks required outbound patching entirely rather than providing controlled egress. Storing patch binaries in an unauthenticated public S3 website and forcing anonymous HTTP fails because it weakens integrity and authenticity controls and is not a substitute for a proper private-subnet egress design to trusted vendors (or a private mirror with verified packages).
Exam caveat: NAT provides outbound reachability, not inbound admin access or content filtering—pair with patch management, security groups, and optionally tighter egress controls. Operational check: confirm GIS route tables send default traffic to NAT, instances lack public IPs, inbound RDP/SSH from the internet is absent, and patch jobs succeed while external SYN scans to instance addresses fail.