SAA-C03 Q26 · Networking

Question

A company is launching a new application that will be hosted on Amazon EC2 instances. A solutions architect needs to design a solution that does not allow public IPv4 access that originates from the internet. However, the solution must allow the EC2 instances to make outbound IPv4 internet requests.

Accepted Answer

**Answer C: NAT gateways in public subnets + shared route table for private subnets**

**Requirement 1: No public IPv4 access from the internet** → EC2 instances are placed in **private subnets** (no direct internet gateway route). NAT gateway only allows **outbound-initiated** traffic — it does not accept inbound connections from the internet.

**Requirement 2: Allow outbound IPv4 internet requests** → NAT gateway translates private IPs to a public Elastic IP, enabling instances to reach the internet for updates, API calls, etc.

**Why a shared route table?** Both private subnets need the same routing behavior: route `0.0.0.0/0` to the NAT gateway. A **single shared route table** associated with both private subnets is the simplest, most operationally efficient design. There is no require

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips