SOA-C03 practice question: VPC subnets, routing and gateways (1 of 2)

Networking and Content Delivery A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A public library is adding IPv6 to its VPC. Instances in a private subnet now have IPv6 addresses and must download updates from IPv6 internet repositories. The security team requires that no host on the internet can start a connection to these instances over IPv6, even if someone later adds a permissive security group rule. What should a CloudOps engineer add to the private subnet's route table?

Choose one answer.

A. A ::/0 route to an egress-only internet gateway attached to the VPC.
B. A ::/0 route to the VPC's internet gateway, with security groups that allow only outbound traffic.
C. A ::/0 route to a NAT gateway in a public subnet, so that IPv6 traffic is translated to the NAT gateway's address.
D. A ::/0 route to a gateway VPC endpoint, which keeps the IPv6 update traffic inside the AWS network.

Show the answer and explanation

Answer: A

A. Right: Correct. An egress-only internet gateway allows outbound IPv6 connections and their responses, and it blocks connections that start on the internet. The control is at the gateway, so security group mistakes cannot open inbound access. Learn more: Enable outbound IPv6 traffic using an egress-only internet gateway (opens in a new tab)
B. Wrong: IPv6 addresses are globally reachable, so with an internet gateway route the only inbound protection is the security groups. A later permissive rule would expose the instances. Learn more: Enable VPC internet access using internet gateways (opens in a new tab)
C. Wrong: NAT gateways translate traffic to IPv4 addresses and do not provide outbound-only access for IPv6 to IPv6 traffic. The egress-only internet gateway is the IPv6 equivalent of this pattern. Learn more: NAT gateways (opens in a new tab)
D. Wrong: Gateway endpoints reach only Amazon S3 and DynamoDB. They cannot route traffic to repositories on the internet. Learn more: Gateway endpoints (opens in a new tab)

Explanation

For IPv6, there is no NAT step to hide instances, because every address is public. The egress-only internet gateway fills that role: it is stateful, allows outbound connections and their replies, and drops connections started from outside. Routing ::/0 to it gives private subnets outbound-only IPv6 access.

Study

Enable outbound IPv6 traffic using an egress-only internet gateway

SOA-C03 practice question: VPC subnets, routing and gateways (1 of 2)

Explanation

Study

Keep practicing