Jeff’s Note #
Unlike generic exam dumps, ADH analyzes this scenario through the lens of a Real-World Site Reliability Engineer (SRE).
For SOA-C02 candidates, the confusion often lies in how to control outbound IP addresses for multiple EC2 instances in a VPC to meet external security requirements. In production, this is about precisely choosing network components such as NAT gateways that provide a static egress IP, versus internet gateways which do not. Let’s drill down.
The Certification Drill (Simulated Question) #
Scenario #
A cloud operations team at FinTech Dynamics manages a fleet of Amazon EC2 instances within a VPC. These instances build software artifacts and upload them to an external partner’s repository. Recently, the partner implemented a strict IP allowlist firewall requiring all upload traffic to originate from a single, consistent public IP address. Currently, each EC2 instance sends uploads directly to the internet, causing multiple outbound IPs to appear.
The Requirement: #
Ensure all builds upload traffic originates from one known public IP address that can be provided to the external partner for their allowlist.
The Options #
- A) Move all EC2 instances to private subnets behind a NAT Gateway and provide the NAT Gateway’s Elastic IP address to the partner.
- B) Attach all EC2 instances to a public subnet with an Internet Gateway and provide the Internet Gateway’s IP address to the partner.
- C) Consolidate all EC2 instances into a single Availability Zone and provide the AZ’s IP range to the partner.
- D) Move all EC2 instances into a peered VPC and provide the peered VPC’s IP range to the partner.
Google adsense #
leave a comment:
Correct Answer #
A
Quick Insight: The SOA-C02 Imperative #
The critical requirement is controlling consistent egress IP for multiple EC2s. NAT Gateways provide a fixed Elastic IP for outbound traffic, while Internet Gateways do not translate IPs and thus traffic comes from each instance’s public IP. This distinction is fundamental for external IP allowlisting.
Content Locked: The Expert Analysis #
You’ve identified the answer. But do you know the implementation details that separate a Junior from a Senior?
The Expert’s Analysis #
Correct Answer #
Option A: Move all EC2 instances to private subnets behind a NAT Gateway and provide the NAT Gateway’s Elastic IP address to the partner.
The Winning Logic #
- EC2 instances in private subnets do not have direct public IPs and cannot access the internet directly.
- A NAT Gateway allows outbound internet access for private instances while providing a single, static Elastic IP for all egress traffic.
- The external partner needs a single known IP; NAT Gateway’s Elastic IP is exactly that fixed, stable IP address.
- This design also follows AWS best practices for security by placing EC2 instances private facing only with controlled outbound internet access.
The Trap (Distractor Analysis): #
- Why not Option B? Internet Gateway (IGW) is just a route to the internet but does not provide IP masquerading. Public instances use their individual public IPs, so multiple outbound IPs appear, violating the single IP requirement.
- Why not Option C? Availability Zone IP ranges are large CIDR blocks; the external partner wants a single IP, not a massive range. Also, AZ does not guarantee IP address consistency for egress.
- Why not Option D? VPC peering does not provide IP address translation or a single outward-facing IP address for internet-bound traffic, so traffic still comes from individual EC2 public IPs or NAT gateways within that VPC.
The Technical Blueprint #
# Create NAT Gateway in a public subnet with an Elastic IP
aws ec2 allocate-address --domain vpc
aws ec2 create-nat-gateway --subnet-id subnet-abc12345 --allocation-id eipalloc-12345678
# Update route tables of private subnets to route 0.0.0.0/0 via NAT Gateway
aws ec2 create-route --route-table-id rtb-12345678 --destination-cidr-block 0.0.0.0/0 --nat-gateway-id nat-0abcd1234
# Modify EC2 instances to be launched in private subnets without public IPs
# Ensure security groups and NACLs allow necessary outbound traffic
The Comparative Analysis #
| Option | Operational Overhead | Automation Level | Impact on IP Control |
|---|---|---|---|
| A | Moderate (subnet change, NAT GW cost) | High (stable IP, managed NAT GW) | Provides a single static NAT EIP, ensures compliance |
| B | Low | Low | Fails to provide single outbound IP; multiple public IPs |
| C | Low | Low | AZ IP range too broad; does not guarantee single IP |
| D | High (additional VPC peering setup) | Low | Does not address IP translation for egress traffic |
Real-World Application (Practitioner Insight) #
Exam Rule #
For SOA exams, always pick NAT Gateway when asked to consolidate EC2 egress traffic behind a single IP address.
Real World #
In production, NAT gateways are the industry standard for private subnet internet access with predictable egress IPs. Sometimes AWS PrivateLink or proxy appliances are alternatives but NAT Gateway is simplest and fully managed.
(CTA) Stop Guessing, Start Mastering #
Disclaimer
This is a study note based on simulated scenarios for the AWS SOA-C02 exam.