NAT Gateway for private subnet internet in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Architecture

intermediate

Identify the correct architecture for enabling internet access from a private subnet using a NAT Gateway

You have a VPC with public and private subnets. You want instances in the private subnet to access the internet securely. Which architecture correctly enables this?

A Place a NAT Gateway in the public subnet and update the private subnet route table to direct 0.0.0.0/0 traffic to the NAT Gateway.

B Place a NAT Gateway in the private subnet and update the public subnet route table to direct 0.0.0.0/0 traffic to the NAT Gateway.

C Place a NAT Gateway in the public subnet and update the public subnet route table to direct 0.0.0.0/0 traffic to the NAT Gateway.

D Place a NAT Gateway in the private subnet and update the private subnet route table to direct 0.0.0.0/0 traffic to the internet gateway.

💡 Hint

Remember, NAT Gateways must be in public subnets to route traffic for private subnets.

A NAT Gateway must be placed in a public subnet with a route to the internet gateway. Private subnets then route their internet-bound traffic to the NAT Gateway, enabling outbound internet access without exposing private instances directly.

❓ Configuration

intermediate

Determine the correct route table entry for private subnet internet access via NAT Gateway

You have a NAT Gateway in a public subnet. What is the correct route table entry for the private subnet to allow internet access through the NAT Gateway?

A Destination: 0.0.0.0/0, Target: Internet Gateway ID

B Destination: NAT Gateway ID, Target: 0.0.0.0/0

C Destination: 0.0.0.0/0, Target: NAT Gateway ID

D Destination: Private Subnet CIDR, Target: NAT Gateway ID

💡 Hint

Routes use destination CIDR blocks and targets like gateways or instances.

The private subnet's route table must have a route for all internet traffic (0.0.0.0/0) pointing to the NAT Gateway ID to enable outbound internet access.

❓ security

advanced

Analyze security group rules for instances in private subnet using NAT Gateway

Instances in a private subnet use a NAT Gateway for internet access. Which security group rule is necessary to allow outbound internet traffic?

A Allow outbound traffic on all ports to 0.0.0.0/0

B Allow inbound traffic on port 80 from 0.0.0.0/0

C Allow inbound traffic on all ports from the NAT Gateway's security group

D Allow outbound traffic only to the NAT Gateway's private IP

💡 Hint

Think about what outbound traffic the instance needs to send to reach the internet.

Instances must have outbound rules allowing traffic to the internet (0.0.0.0/0) on required ports. The NAT Gateway handles inbound return traffic, so inbound rules can be restrictive.

❓ service_behavior

advanced

Predict the behavior when NAT Gateway is deleted while private subnet instances are running

You delete the NAT Gateway used by private subnet instances for internet access. What happens to the instances' internet connectivity?

A Instances continue to access the internet using the internet gateway directly.

B Instances automatically switch to a backup NAT Gateway without interruption.

C Instances can still access the internet but with increased latency.

D Instances lose internet access immediately because their route to the internet is broken.

💡 Hint

Consider how routing depends on the NAT Gateway's presence.

Deleting the NAT Gateway breaks the route for private subnet instances to reach the internet, causing immediate loss of internet connectivity until the route is updated or a new NAT Gateway is created.

✅ Best Practice

expert

Choose the best high availability design for NAT Gateway in multi-AZ VPC

You want to design a VPC with private subnets in multiple Availability Zones (AZs) and ensure high availability for internet access via NAT Gateway. What is the best practice?

A Use an internet gateway directly for private subnets to avoid NAT Gateway complexity.

B Create a NAT Gateway in each AZ's public subnet and route private subnets in each AZ to their local NAT Gateway.

C Create one NAT Gateway in the private subnet and share it across AZs.

D Create one NAT Gateway in a single public subnet and route all private subnets to it.

💡 Hint

Think about fault tolerance and AZ isolation.

For high availability, create a NAT Gateway in each AZ's public subnet. Route private subnets in each AZ to their local NAT Gateway to avoid cross-AZ traffic and single points of failure.

Practice

1. What is the main purpose of a NAT Gateway in AWS for private subnets?

easy

A. To block all internet traffic from private subnets

B. To provide direct internet access to public subnets

C. To assign public IP addresses to private subnet instances

D. To allow instances in private subnets to access the internet securely

Solution

1. Step 1: Understand NAT Gateway role

   A NAT Gateway enables instances in private subnets to initiate outbound internet traffic while preventing inbound internet connections.

2. Step 2: Compare options

   Only To allow instances in private subnets to access the internet securely correctly describes this purpose; others describe unrelated or incorrect functions.

3. Final Answer:

   To allow instances in private subnets to access the internet securely -> Option D

4. Quick Check:

   NAT Gateway purpose = Allow private subnet internet access [OK]

Hint: NAT Gateway = private subnet internet access [OK]

Common Mistakes:

• Confusing NAT Gateway with Internet Gateway
• Thinking NAT Gateway assigns public IPs
• Believing NAT Gateway blocks internet traffic

2. Which AWS resource must a NAT Gateway be associated with to provide internet access for private subnets?

easy

A. An Elastic IP in a public subnet

B. A private IP in a private subnet

C. A security group allowing inbound SSH

D. A VPC endpoint for S3

Solution

1. Step 1: Identify NAT Gateway placement

   NAT Gateway must be placed in a public subnet and associated with an Elastic IP to route internet traffic.

2. Step 2: Evaluate options

   Only An Elastic IP in a public subnet correctly states the Elastic IP in a public subnet; others are unrelated or incorrect.

3. Final Answer:

   An Elastic IP in a public subnet -> Option A

4. Quick Check:

   NAT Gateway needs Elastic IP in public subnet [OK]

Hint: NAT Gateway needs Elastic IP in public subnet [OK]

Common Mistakes:

• Placing NAT Gateway in private subnet
• Associating NAT Gateway with private IP
• Confusing security groups with subnet placement

3. Given a private subnet with route table entry 0.0.0.0/0 -> NAT Gateway, what happens when an instance in this subnet tries to access the internet?

medium

A. Traffic is blocked because private subnets cannot access the internet

B. Traffic goes directly to the Internet Gateway

C. Traffic is routed through the NAT Gateway to the internet

D. Traffic is routed to the VPC endpoint

Solution

1. Step 1: Analyze route table entry

   The route 0.0.0.0/0 -> NAT Gateway directs all internet-bound traffic from the private subnet to the NAT Gateway.

2. Step 2: Understand traffic flow

   The NAT Gateway forwards traffic to the internet, allowing outbound access while hiding private IPs.

3. Final Answer:

   Traffic is routed through the NAT Gateway to the internet -> Option C

4. Quick Check:

   Route 0.0.0.0/0 to NAT Gateway = internet access [OK]

Hint: Route 0.0.0.0/0 to NAT Gateway = internet access [OK]

Common Mistakes:

• Assuming private subnet traffic goes directly to Internet Gateway
• Thinking private subnet traffic is blocked by default
• Confusing VPC endpoint with internet routing

4. You created a NAT Gateway in a public subnet but instances in the private subnet cannot access the internet. What is the most likely cause?

medium

A. The private subnet has a public IP assigned

B. The private subnet route table does not have a route to the NAT Gateway

C. The Internet Gateway is not attached to the VPC

D. The NAT Gateway is missing an Elastic IP

Solution

1. Step 1: Check route table configuration

   Instances in private subnets need a route directing internet traffic (0.0.0.0/0) to the NAT Gateway.

2. Step 2: Identify missing route issue

   If this route is missing, traffic won't reach the NAT Gateway, causing no internet access.

3. Final Answer:

   The private subnet route table does not have a route to the NAT Gateway -> Option B

4. Quick Check:

   Missing route to NAT Gateway = no internet [OK]

Hint: Check private subnet route table for NAT Gateway route [OK]

Common Mistakes:

• Ignoring route table routes
• Assuming Elastic IP is optional
• Confusing Internet Gateway attachment with NAT Gateway routing

5. You want to allow instances in a private subnet to access the internet for software updates but prevent inbound internet traffic. Which setup is correct?

hard

A. Place a NAT Gateway in a public subnet with an Elastic IP and route private subnet traffic (0.0.0.0/0) to it

B. Assign public IPs to private subnet instances and route traffic through the Internet Gateway

C. Place a NAT Gateway in the private subnet and route traffic to it

D. Use a VPC endpoint for internet access

Solution

1. Step 1: Understand NAT Gateway placement and function

   NAT Gateway must be in a public subnet with an Elastic IP to allow outbound internet access for private subnet instances without exposing them to inbound traffic.

2. Step 2: Evaluate options for security and functionality

   Place a NAT Gateway in a public subnet with an Elastic IP and route private subnet traffic (0.0.0.0/0) to it correctly describes this setup. Assign public IPs to private subnet instances and route traffic through the Internet Gateway exposes instances publicly. Place a NAT Gateway in the private subnet and route traffic to it places NAT Gateway incorrectly. Use a VPC endpoint for internet access does not provide internet access.

3. Final Answer:

   Place a NAT Gateway in a public subnet with an Elastic IP and route private subnet traffic (0.0.0.0/0) to it -> Option A

4. Quick Check:

   NAT Gateway in public subnet + route private subnet = secure internet access [OK]

Hint: NAT Gateway in public subnet with route from private subnet [OK]

Common Mistakes:

• Assigning public IPs to private subnet instances
• Placing NAT Gateway in private subnet
• Using VPC endpoint for general internet access