A solutions architect must let EC2 instances in a private subnet download software updates from the internet without letting the internet initiate any connection to them. Which service accomplishes this?
Show answer and explanation
Answer: C
A NAT Gateway translates traffic so private-subnet instances can initiate outbound sessions to the internet — updates, package pulls, API calls — while the translation tables block unsolicited inbound connections. That one-directional guarantee is exactly the requirement.
Expectations around a public subnet, direct links, or inter-VPC links all miss the outbound-only nuance.
Why the other options are wrong
- A. An Internet Gateway enables general two-way connectivity, which would require public subnets and expose the instances to inbound traffic.
- B. Direct Connect is a dedicated link to on-premises networks, not an internet egress path for updates.
- D. VPC Peering links two VPCs privately and provides no route to the internet for updates.