Cloud Technology and Services A free question from our original CLF-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A company runs software-update servers in private subnets of its VPC.
The servers must download patches from the internet, but no one on the internet may be able to start a connection to them.
Which setup meets both requirements?
Choose one answer.
AA. Attach an Elastic IP address to each server, a static public IPv4 address
BB. Move the servers to a public subnet, with public IP addresses for each server
CC. Route private subnet traffic through a NAT gateway in a public subnet
DD. Create a VPC peering connection to a second VPC in the same account
Show the answer and explanation
Answer: C
A. Wrong: An Elastic IP address makes a server reachable from the internet, so outside parties could start connections to it. That breaks the company's rule.
B. Wrong: Public IP addresses make the servers reachable from the internet, so the inbound rule is broken. Patches could download, but the servers would be exposed.
C. Right: A NAT gateway lets instances in private subnets start outbound connections to the internet for patches. Connections cannot be started from the internet toward the instances through it. Learn more: NAT gateways (opens in a new tab)
D. Wrong: VPC peering connects two VPCs privately. It gives the servers no path to the internet, so the patches still cannot download.
Explanation
A NAT gateway in a public subnet gives private instances outbound-only internet access, so they can download patches while no internet host can start a connection to them. Public addressing exposes the servers, and peering provides no internet route.
Want more on Networking? The 5 full-length practice sets have 13 more Networking questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →