SOA-C02 Practice Question 8: NAT Gateway Subnet Placement
AWS Certified SysOps Administrator – Associate (SOA-C02) · Test 1 · question 8 of 10
EC2 instances in a private subnet must download operating system patches from the internet, but every yum update times out. A NAT gateway exists in the VPC and is in the Available state, and the private subnet's route table has a 0.0.0.0/0 route pointing to that NAT gateway. On inspection, the NAT gateway was created in the same private subnet as the instances.
Which action resolves the problem?
Show answer and explanation
Answer:
A public NAT gateway must live in a *public* subnet, a subnet whose route table has a default route to an internet gateway. The NAT gateway's own outbound traffic follows the route table of the subnet it sits in, so a NAT gateway placed in a private subnet has no path to the internet and silently blackholes everything sent to it. A NAT gateway's subnet cannot be changed after creation, so the fix is to create one in a public subnet and repoint the private route table at it.
Option A does not work. A private subnet with a default route to an internet gateway is by definition no longer private, its instances have no public IP addresses, so return traffic could not reach them anyway, and two identical 0.0.0.0/0 destinations cannot coexist in one route table.
Option B is wrong because attaching Elastic IP addresses would expose the instances directly to the internet, defeating the reason they are in a private subnet, and it is not what the stem asks for.
Option D changes nothing. Security groups allow all outbound traffic by default, and the failure is a routing problem, not a filtering one.
Reference: NAT gateway use cases