NAT Gateway for private subnet internet in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Architecture

intermediate

Identify the correct architecture for enabling internet access from a private subnet using a NAT Gateway

You have a VPC with public and private subnets. You want instances in the private subnet to access the internet securely. Which architecture correctly enables this?

A Place a NAT Gateway in the public subnet and update the private subnet route table to direct 0.0.0.0/0 traffic to the NAT Gateway.

B Place a NAT Gateway in the private subnet and update the public subnet route table to direct 0.0.0.0/0 traffic to the NAT Gateway.

C Place a NAT Gateway in the public subnet and update the public subnet route table to direct 0.0.0.0/0 traffic to the NAT Gateway.

D Place a NAT Gateway in the private subnet and update the private subnet route table to direct 0.0.0.0/0 traffic to the internet gateway.

💡 Hint

Remember, NAT Gateways must be in public subnets to route traffic for private subnets.

A NAT Gateway must be placed in a public subnet with a route to the internet gateway. Private subnets then route their internet-bound traffic to the NAT Gateway, enabling outbound internet access without exposing private instances directly.

❓ Configuration

intermediate

Determine the correct route table entry for private subnet internet access via NAT Gateway

You have a NAT Gateway in a public subnet. What is the correct route table entry for the private subnet to allow internet access through the NAT Gateway?

A Destination: 0.0.0.0/0, Target: Internet Gateway ID

B Destination: NAT Gateway ID, Target: 0.0.0.0/0

C Destination: 0.0.0.0/0, Target: NAT Gateway ID

D Destination: Private Subnet CIDR, Target: NAT Gateway ID

💡 Hint

Routes use destination CIDR blocks and targets like gateways or instances.

The private subnet's route table must have a route for all internet traffic (0.0.0.0/0) pointing to the NAT Gateway ID to enable outbound internet access.

❓ security

advanced

Analyze security group rules for instances in private subnet using NAT Gateway

Instances in a private subnet use a NAT Gateway for internet access. Which security group rule is necessary to allow outbound internet traffic?

A Allow outbound traffic on all ports to 0.0.0.0/0

B Allow inbound traffic on port 80 from 0.0.0.0/0

C Allow inbound traffic on all ports from the NAT Gateway's security group

D Allow outbound traffic only to the NAT Gateway's private IP

💡 Hint

Think about what outbound traffic the instance needs to send to reach the internet.

Instances must have outbound rules allowing traffic to the internet (0.0.0.0/0) on required ports. The NAT Gateway handles inbound return traffic, so inbound rules can be restrictive.

❓ service_behavior

advanced

Predict the behavior when NAT Gateway is deleted while private subnet instances are running

You delete the NAT Gateway used by private subnet instances for internet access. What happens to the instances' internet connectivity?

A Instances continue to access the internet using the internet gateway directly.

B Instances automatically switch to a backup NAT Gateway without interruption.

C Instances can still access the internet but with increased latency.

D Instances lose internet access immediately because their route to the internet is broken.

💡 Hint

Consider how routing depends on the NAT Gateway's presence.

Deleting the NAT Gateway breaks the route for private subnet instances to reach the internet, causing immediate loss of internet connectivity until the route is updated or a new NAT Gateway is created.

✅ Best Practice

expert

Choose the best high availability design for NAT Gateway in multi-AZ VPC

You want to design a VPC with private subnets in multiple Availability Zones (AZs) and ensure high availability for internet access via NAT Gateway. What is the best practice?

A Use an internet gateway directly for private subnets to avoid NAT Gateway complexity.

B Create a NAT Gateway in each AZ's public subnet and route private subnets in each AZ to their local NAT Gateway.

C Create one NAT Gateway in the private subnet and share it across AZs.

D Create one NAT Gateway in a single public subnet and route all private subnets to it.

💡 Hint

Think about fault tolerance and AZ isolation.

For high availability, create a NAT Gateway in each AZ's public subnet. Route private subnets in each AZ to their local NAT Gateway to avoid cross-AZ traffic and single points of failure.