Exams / CLF-C02 / Networking / Question 3
CLF-C02 practice question: Networking (3 of 3)
Cloud Technology and Services A free question from our original CLF-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
Amazon EC2 instances in a private subnet need to download software updates from the internet. Connections must not be allowed to start from the internet towards these instances. What should the company use?
Choose one answer.
- AA. Attach an Elastic IP address directly to each of the instances
- BB. Move the instances into a public subnet with public IPs
- CC. Route the subnet's internet traffic through a NAT gateway in a public subnet
- DD. Create a VPC peering connection to a second VPC
Show the answer and explanation
Answer: C
- A. Wrong: Public IP addresses would make the instances reachable from the internet, which the company wants to avoid.
- B. Wrong: Instances in a public subnet with public addresses can receive inbound connections from the internet.
- C. Right: Correct. A NAT gateway lets instances in private subnets connect out to the internet while blocking connections started from outside.
- D. Wrong: Peering connects two VPCs privately. It does not give access to the internet.
Explanation
A public NAT gateway sits in a public subnet and lets instances in private subnets start outbound connections to the internet, for example to download patches. External services cannot start connections to those instances. Internet gateways, by contrast, allow two-way internet access for resources with public addresses.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.