SAP-C02 Q604 · Networking

Question

A VPC spans three Availability Zones, each with public and private subnets. One NAT gateway and one internet gateway exist. Private EC2 instances must connect to the internet. What should the architect do?

Accepted Answer

**Answer A** is correct because it addresses both **functionality** and **high availability**:

1. **Requirement: Private EC2 instances need internet access** → NAT gateways allow outbound internet traffic from private subnets while keeping instances private (no inbound from internet).

2. **Current state: Only ONE NAT gateway exists** → This is a single point of failure. If the AZ containing that NAT gateway goes down, ALL private instances across ALL three AZs lose internet connectivity.

3. **Solution: One NAT gateway per AZ** → Adding two more NAT gateways (total of three, one per AZ) ensures:
   - **AZ-independent routing**: Each private subnet's route table points to the NAT gateway in its own AZ.
   - **Fault isolation**: If one AZ fails, only that AZ's instances are affected; the o

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🎯 Exam Tips