An EC2 instance in a private subnet must call an external API.
Do not expose it for inbound access; use a managed outbound path.
Which configuration is most appropriate?
Point the private subnet's default route to a NAT Gateway in a public subnet.
Detailed explanation
S3 object lifecycle management does not create VPC routes.
S3 object lifecycle management does not create VPC routes.
The NAT path permits outbound connections while preventing direct inbound internet access to the instance.
The NAT path permits outbound connections while preventing direct inbound internet access to the instance.
DNS records do not relay network packets.
DNS records do not relay network packets.
An Internet Gateway is associated with a VPC route, not directly with an instance.
An Internet Gateway is associated with a VPC route, not directly with an instance.
Check official documentation
Compare the following points with the official documentation.
VPC NAT Gateway routingの公式説明を確認する。
What to confirm
パブリック・プライベートサブネットとNAT経路を説明できる。
Key points
- Private route table
- NAT Gateway
- Default route
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Outbound-only path
NAT permits return traffic for connections initiated privately without exposing an inbound listener.
Subnet routing
The route belongs to the subnet route table; an Internet Gateway is not attached directly to an instance.