Question

A cloud architect is designing a VPC for a three-tier application. The application servers reside in private subnets and must download OS patches and software updates from public internet repositories. For security, these servers must NOT be reachable from the internet by inbound connections. Which design element should the architect implement to meet both requirements?

Accepted Answer

Deploy a NAT gateway in a public subnet and route the private subnets' outbound traffic through it

Answer

Assign public IP addresses to the application servers and attach an internet gateway to the private subnet route table

Answer

Configure a VPC peering connection between the private subnets and a public repository VPC

Answer

Attach an internet gateway directly to the private subnets and use security groups to block inbound traffic