Question

A company deploys a new VPC (10.20.0.0/16) with two subnets: a subnet 10.20.1.0/24 hosting web servers that must be reachable from the internet, and a subnet 10.20.2.0/24 hosting a database tier that must never receive inbound connections from the internet but requires software updates from public repositories. An internet gateway is attached to the VPC and a single NAT gateway is deployed in 10.20.1.0/24. Which route table configuration meets both requirements?

Accepted Answer

Associate a route table with 10.20.1.0/24 that has 0.0.0.0/0 pointing to the internet gateway; associate a separate route table with 10.20.2.0/24 that has 0.0.0.0/0 pointing to the NAT gateway.

Answer

Associate a single route table with both subnets that has 0.0.0.0/0 pointing to the internet gateway, and rely on security groups to block inbound traffic to the database tier.

Answer

Associate a route table with 10.20.1.0/24 that has 0.0.0.0/0 pointing to the NAT gateway; associate a route table with 10.20.2.0/24 that has 0.0.0.0/0 pointing to the internet gateway.

Answer

Associate a route table with 10.20.1.0/24 that has 0.0.0.0/0 pointing to the internet gateway; associate a route table with 10.20.2.0/24 that has only the local route and no default route.