Question

A company runs application servers in a private subnet of a VPC. These servers must download operating system patches and dependency packages from public internet repositories, but they must never be reachable from inbound connections originating on the internet. The solutions architect must enable outbound-only internet access while keeping the servers unreachable from external hosts. Which configuration meets these requirements?

Accepted Answer

Deploy a NAT gateway in a public subnet and add a route in the private subnet route table sending 0.0.0.0/0 traffic to the NAT gateway.

Answer

Assign Elastic IP addresses to the application servers and add a route to the internet gateway in the private subnet route table.

Answer

Attach an internet gateway directly to the private subnet and configure security groups to deny all inbound traffic.

Answer

Create a VPC gateway endpoint for the repositories and route all internet-bound traffic through it.