Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 234 discussion

Provision NAT Gateways in Public Subnets (A): Private subnets require NAT gateways for outbound internet access. NAT gateways must be in public subnets (as per search result 1 and 4) because they need internet connectivity via the internet gateway. Each Availability Zone (AZ) should have its own NAT gateway to ensure redundancy and prevent cross-AZ data transfer costs. Update Private Subnet Route Tables (D): Private subnets should route 0.0.0.0/0 traffic to the NAT gateway in the same AZ’s public subnet. This ensures private instances use the NAT gateway for outbound traffic instead of the internet gateway. Public Subnets: Route 0.0.0.0/0 to the internet gateway (correctly configured). Private Subnets: Route 0.0.0.0/0 to the NAT gateway (traffic is masked via NAT and forwarded through the public subnet’s internet gateway).

A. NAT Gateway Provisioning: NAT gateways need to be in the public subnet of each Availability Zone to enable instances in the private subnets to connect to the internet for updates and other tasks, without exposing these instances directly to the internet. D. Route Table Modification: Private subnets should route their outbound internet traffic to the NAT gateway in the corresponding public subnet. This ensures that private subnet traffic passes through the NAT gateway, which then routes it to the internet gateway, maintaining security by preventing direct internet access.