A team is building a two-tier VPC. The application instances must sit in a private subnet, download operating system patches from public package repositories, and call a third-party licensing API over the internet, yet they must never be reachable from any connection that the internet initiates inbound. The VPC already has an internet gateway attached and a public subnet whose route table sends 0.0.0.0/0 to that gateway. Which two configuration steps together give the private instances outbound internet access while keeping them unreachable from the internet? (Select TWO.)
- AProvision a NAT gateway in the existing public subnet and associate an Elastic IP address with it so it can forward traffic out through the internet gateway. Correct
- BAssign a public IPv4 address to each application instance and add a route in the private subnet's route table that sends 0.0.0.0/0 directly to the internet gateway.
- CAdd a route to the private subnet's route table that sends 0.0.0.0/0 to the NAT gateway so internet-bound traffic from those instances leaves through it. Correct
- DAttach a second internet gateway to the VPC and associate it directly with the private subnet so that subnet gains its own independent path to the internet.
- ECreate an inbound network ACL rule on the private subnet that denies all traffic from 0.0.0.0/0 so no internet-initiated connection can enter the subnet.
Why A is correct: A NAT gateway in a public subnet translates outbound traffic to its Elastic IP and only relays return packets for connections instances start, so inbound-initiated connections cannot reach them.
Why B is wrong: Routing the private subnet straight to the internet gateway with public IPs turns it into a public subnet, which gives the outbound path but also exposes the instances to inbound connections from the internet.
Why C is correct: Pointing the private subnet's default route at the NAT gateway is what actually carries the instances' outbound traffic to the internet while no route exists for the internet to reach back in.
Why D is wrong: A VPC accepts only one internet gateway and gateways are not associated with subnets, so this misstates how AWS works and would still expose the tier inbound if it could be done.
Why E is wrong: A deny-all inbound network ACL rule is tempting as a lock-down, but it provides no outbound path and would also drop the return traffic for the patch downloads the instances need.