SOA-C03 practice question: VPC subnets, routing and gateways (2 of 2)

Networking and Content Delivery A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A dental chain launched a new EC2 instance for a patient-reminder service in a subnet it believes is public.

The instance cannot reach the internet. The security group allows all outbound traffic, the network ACL is the default, and the VPC has an internet gateway attached.

The instance has only a private IPv4 address, and the subnet's route table contains only the local route.

Which TWO actions will give the instance internet access? (Choose two.)

Choose two answers.

A. Associate an Elastic IP address with the instance so that it has a public IPv4 address.
B. Add a 0.0.0.0/0 route that targets the internet gateway to the subnet's route table.
C. Add an inbound rule to the security group that allows all traffic from 0.0.0.0/0.
D. Turn on DNS hostnames for the VPC so that the instance can resolve and reach public domain names.
E. Add a 0.0.0.0/0 route that targets a NAT gateway placed in the same subnet as the instance.

Show the answer and explanation

Answers: A, B

A. Right: Correct. Traffic through an internet gateway needs a public IPv4 address on the instance. An Elastic IP address gives it one that stays the same across stops and starts. Learn more: Elastic IP addresses (opens in a new tab)
B. Right: Correct. A subnet is public only when its route table sends internet-bound traffic to an internet gateway. Without the route, traffic has nowhere to go but the local VPC. Learn more: Configure route tables (opens in a new tab)
C. Wrong: Security groups are stateful, so responses to outbound requests are already allowed. Opening all inbound traffic adds risk without fixing the missing route or address. Learn more: Control traffic to your AWS resources using security groups (opens in a new tab)
D. Wrong: DNS hostnames control whether instances get DNS names. Name resolution is not the problem here, the instance has no route and no public address. Learn more: DNS attributes for your VPC (opens in a new tab)
E. Wrong: A NAT gateway must sit in a public subnet whose route table points at the internet gateway. Placed in this subnet, which has no internet route, it cannot reach the internet itself. Learn more: NAT gateways (opens in a new tab)

Explanation

Internet access through an internet gateway needs both a route and an address. The subnet's route table must send 0.0.0.0/0 to the internet gateway, and the instance needs a public IPv4 address, such as an Elastic IP address. Security group and DNS changes do not fix either missing piece.

SOA-C03 practice question: VPC subnets, routing and gateways (2 of 2)

Explanation

Study

Keep practicing