SOA-C03 practice question: VPC subnets, routing and gateways (1 of 2)
Networking and Content Delivery A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
Instances in a private subnet now have IPv6 addresses and must download updates from IPv6 internet repositories.
The security team requires that no host on the internet can start a connection to these instances over IPv6, even if someone later adds a permissive security group rule.
What should a CloudOps engineer add to the private subnet's route table?
Choose one answer.
AA. A ::/0 route to an egress-only internet gateway attached to the VPC.
BB. A ::/0 route to the VPC's internet gateway, with security groups that allow only outbound traffic.
CC. A ::/0 route to a NAT gateway in a public subnet, so that IPv6 traffic is translated to the NAT gateway's address.
DD. A ::/0 route to a gateway VPC endpoint, which keeps the IPv6 update traffic inside the AWS network.
C. Wrong: NAT gateways translate traffic to IPv4 addresses and do not provide outbound-only access for IPv6 to IPv6 traffic. The egress-only internet gateway is the IPv6 equivalent of this pattern. Learn more: NAT gateways (opens in a new tab)
For IPv6, there is no NAT step to hide instances, because every address is public. The egress-only internet gateway fills that role: it is stateful, allows outbound connections and their replies, and drops connections started from outside. Routing ::/0 to it gives private subnets outbound-only IPv6 access.
Want more on VPC subnets, routing and gateways? The 5 full-length practice sets have 10 more VPC subnets, routing and gateways questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →