A solutions architect is designing a VPC with public and private subnets. The VPC and subnets use IPv4 CIDR blocks. There is one public subnet and one private subnet in each of three Availability Zones (AZs) for high availability. An internet gateway provides internet access for the public subnets. The private subnets require internet access so Amazon EC2 instances can download software updates. What should the solutions architect do to enable internet access for the private subnets?

The correct solution is to create three NAT gateways, one in each public subnet, and configure private route tables to direct traffic to the NAT gateway in the same Availability Zone. This ensures high availability and fault tolerance, as instances in a private subnet will use the NAT Gateway in their AZ, preventing a single point of failure. NAT gateways are a managed service, offering better scalability and less operational overhead than NAT instances. Incorrect options: NAT instances require manual management, patching, and scaling, making them less ideal than NAT gateways for production environments. An internet gateway cannot be directly attached to a private subnet, nor can a VPC have multiple internet gateways. Internet gateways are for public subnets to allow inbound and outbound internet traffic. Egress-only internet gateways are specifically for IPv6 traffic to allow outbound-only internet access from private subnets and are not applicable to IPv4 CIDR blocks.