SOA-C03 - Networking and Content Delivery (18% of the exam) - Section 5.1

Configure a VPC with subnets, route tables, network ACLs, security groups, NAT gateways and internet gateways for the required connectivity.

Design a VPC with public and private subnets, route tables, NAT gateways for outbound internet access, internet gateways, network ACLs, and security groups to control inbound and outbound traffic. Distinguish between stateless network ACL rules and stateful security group rules when troubleshooting connectivity.

VPC subnetsRoute tablesNAT gatewaysSecurity groups

Practice question for this objective

Free sampleNetworking and Content Deliverymedium

A team is building a two-tier VPC. The application instances must sit in a private subnet, download operating system patches from public package repositories, and call a third-party licensing API over the internet, yet they must never be reachable from any connection that the internet initiates inbound. The VPC already has an internet gateway attached and a public subnet whose route table sends 0.0.0.0/0 to that gateway. Which two configuration steps together give the private instances outbound internet access while keeping them unreachable from the internet? (Select TWO.)

AProvision a NAT gateway in the existing public subnet and associate an Elastic IP address with it so it can forward traffic out through the internet gateway. Correct
BAssign a public IPv4 address to each application instance and add a route in the private subnet's route table that sends 0.0.0.0/0 directly to the internet gateway.
CAdd a route to the private subnet's route table that sends 0.0.0.0/0 to the NAT gateway so internet-bound traffic from those instances leaves through it. Correct
DAttach a second internet gateway to the VPC and associate it directly with the private subnet so that subnet gains its own independent path to the internet.
ECreate an inbound network ACL rule on the private subnet that denies all traffic from 0.0.0.0/0 so no internet-initiated connection can enter the subnet.

Outbound-only internet access for a private subnet needs a NAT gateway in a public subnet plus a private route table default route pointing to that NAT gateway. Giving a private tier internet access without inbound exposure requires both a translation device with a public path and a route that uses it. A NAT gateway placed in the public subnet reaches the internet through the internet gateway and, being stateful, relays only return traffic for connections the instances open. The private subnet's default route to that NAT gateway is what carries the outbound flow. Routing the private subnet straight to the internet gateway with public IPs would expose the instances inbound, a second internet gateway is not permitted and gateways do not attach to subnets, and a deny-all network ACL provides no outbound path at all.

Why A is correct: A NAT gateway in a public subnet translates outbound traffic to its Elastic IP and only relays return packets for connections instances start, so inbound-initiated connections cannot reach them.

Why B is wrong: Routing the private subnet straight to the internet gateway with public IPs turns it into a public subnet, which gives the outbound path but also exposes the instances to inbound connections from the internet.

Why C is correct: Pointing the private subnet's default route at the NAT gateway is what actually carries the instances' outbound traffic to the internet while no route exists for the internet to reach back in.

Why D is wrong: A VPC accepts only one internet gateway and gateways are not associated with subnets, so this misstates how AWS works and would still expose the tier inbound if it could be done.

Why E is wrong: A deny-all inbound network ACL rule is tempting as a lock-down, but it provides no outbound path and would also drop the return traffic for the patch downloads the instances need.

See more SOA-C03 practice questions, answers explained.

Exam traps in Networking and Content Delivery

Answers that look right on this material and are not. Each one is a distractor from a different question in the SOA-C03 bank for this domain.

A network ACL with an inbound allow on port 443 and a matching outbound allow on the ephemeral port range, because it evaluates each direction separately.
Why it is wrong: A network ACL is stateless and would work, but it needs explicit inbound and outbound rules including ephemeral ports, so it requires more rules to maintain than the stateful option the question favours.
Add an inbound network ACL rule allowing the ephemeral port range so the return responses can re-enter the subnet on their high source ports.
Why it is wrong: The responses are leaving the subnet toward clients, so they need an outbound allow, not another inbound rule, meaning an inbound ephemeral rule does not fix the dropped outbound responses.
Attach an internet gateway to the VPC and add a route from the private subnet to the internet gateway so the instances can reach the package repositories directly.
Why it is wrong: Routing a private subnet straight to an internet gateway makes those instances publicly addressable and reachable from the internet, which breaks the requirement that they stay unreachable from outside.

Examworthy is not affiliated with or endorsed by Amazon Web Services. Original, blueprint-aligned practice material only.