Jeff’s Note #
Unlike generic exam dumps, ADH analyzes this scenario through the lens of a Real-World Site Reliability Engineer (SRE).
For SOA-C02 candidates, the confusion often lies in how to enable secure outbound internet access from EC2 instances located strictly in private subnets. In production, this is about knowing exactly which VPC components enable internet egress without breaking isolation principles. Let’s drill down.
The Certification Drill (Simulated Question) #
Scenario #
A tech startup named Centauri Solutions runs critical backend applications on Amazon EC2 instances deployed inside private subnets within their custom VPC. Their IT security policy mandates that no EC2 instance should be placed in a public subnet to reduce exposure risks.
However, the backend application requires periodic software updates that must be downloaded from the internet. The VPC has both public and private subnets configured, and an Internet Gateway is attached to the VPC for public subnet usage.
The Requirement: #
How can the Site Reliability Engineering team enable these EC2 instances—hosted only in private subnets—to securely access the internet for downloads without violating the security mandate?
The Options #
- A) Attach an Internet Gateway (IGW) to the VPC. Add a route to the IGW in the private subnet’s route table.
- B) Create a NAT Gateway in the private subnet. Add a route to the NAT Gateway in the private subnet’s route table.
- C) Create a NAT Gateway in the public subnet. Add a route to this NAT Gateway in the private subnet’s route table.
- D) Attach two Internet Gateways to the VPC. Add routes in both private and public subnet route tables to the respective IGWs.
Google adsense #
leave a comment:
Correct Answer #
C
Quick Insight: The SysOps Imperative #
- EC2 instances in private subnets cannot route directly through an Internet Gateway. They must use a NAT Gateway deployed in a public subnet.
- This setup allows outbound internet access while keeping inbound connections blocked, preserving security compliance.
Content Locked: The Expert Analysis #
You’ve identified the answer. But do you know the implementation details that separate a Junior from a Senior?
The Expert’s Analysis #
Correct Answer #
Option C
The Winning Logic #
In AWS VPC architecture, EC2 instances placed in private subnets do not have direct routing to the Internet Gateway. Since the public subnets have the IGW attached for direct internet access, private subnets use a NAT Gateway located inside a public subnet to provide outbound internet connectivity. This NAT Gateway translates private IP addresses to a public IP, enabling secure one-way communications for updates/downloading software without exposing the instances to inbound internet traffic.
- The NAT Gateway must reside in a public subnet because only a subnet with a route to an Internet Gateway can enable internet-bound traffic to flow outward. The private subnet route table must include a default route (
0.0.0.0/0) pointing to this NAT Gateway.
The Trap (Distractor Analysis): #
-
Why not Option A?
Attaching an IGW and routing private subnet traffic directly to it violates VPC architecture, as private subnet instances lack public IPs and IGW route must not be in private subnet route tables. This would break security policy by exposing instances. -
Why not Option B?
NAT Gateways cannot be launched inside private subnets. They need to have internet access themselves, which requires placement in a public subnet. -
Why not Option D?
A VPC supports only one Internet Gateway. Attaching two IGWs is impossible, and private subnets cannot route directly to IGWs.
The Technical Blueprint #
# Create a NAT Gateway in the public subnet
aws ec2 create-nat-gateway --subnet-id subnet-public-12345678 --allocation-id eipalloc-abcde123
# Update the private subnet route table
aws ec2 create-route --route-table-id rtb-private-12345678 --destination-cidr-block 0.0.0.0/0 --nat-gateway-id nat-0abc123def456
# Verify route tables
aws ec2 describe-route-tables --route-table-ids rtb-private-12345678
The Comparative Analysis #
| Option | Operational Overhead | Automation Level | Impact on Security |
|---|---|---|---|
| A | Low | Simple | Violates private subnet isolation; insecure |
| B | Invalid configuration | N/A | Cannot deploy NAT Gateway in private subnet |
| C | Moderate | Standard | Correct, maintains security by controlled egress |
| D | Invalid | N/A | AWS forbids multiple IGWs; impossible scenario |
Real-World Application (Practitioner Insight) #
Exam Rule #
“For the exam, always remember: outbound internet access from private subnets must leverage a NAT Gateway deployed in a public subnet.”
Real World #
“In real deployments, we might consider NAT Instances for cost savings in low-throughput scenarios, but NAT Gateways provide higher availability and managed maintenance.”
(CTA) Stop Guessing, Start Mastering #
Disclaimer
This is a study note based on simulated scenarios for the AWS SOA-C02 exam.