Question

A CloudOps engineer deploys EC2 instances in a private subnet within a VPC. The instances must download OS patches from the internet but must not be directly reachable from the internet. After launch, the instances cannot reach the internet at all. The engineer confirms a NAT gateway exists in a public subnet, the internet gateway is attached to the VPC, and the security groups allow outbound HTTPS. What is the MOST likely cause of the connectivity failure?

Accepted Answer

The private subnet's route table does not have a route for 0.0.0.0/0 pointing to the NAT gateway.

Answer

The NAT gateway must be placed in the private subnet to serve instances in that subnet.

Answer

The instances need public IP addresses assigned to route traffic through the NAT gateway.

Answer

The internet gateway must be associated with the private subnet's route table for outbound access.