After replacing self-managed NAT instances with a managed NAT gateway, users report connections to the application close after about 6 minutes of inactivity. What should the network engineer do to resolve this?
Choose an answer
Tap an option to check your answer.
Correct answer: Monitor the NAT gateway's IdleTimeoutCount CloudWatch metric for rises. Enable TCP keepalive on the application EC2 instances..
Why this is the answer
NAT gateways have a 350-second (approximately 6-minute) TCP connection idle timeout. If a connection is idle for longer than this, the NAT gateway closes it. The IdleTimeoutCount CloudWatch metric tracks these occurrences. To prevent this, applications should send keep-alive packets within the timeout period. Enabling TCP keepalive on the EC2 instances ensures the application maintains active connections through the NAT gateway, preventing premature closure. The other options are incorrect: ErrorPortAllocation relates to port exhaustion, not idle timeouts. HTTP timeouts are for web servers, not general TCP connections. PacketsDropCount indicates packet loss, not idle connection closure. HTTPS timeouts are also specific to web servers. ActiveConnectionCount decreasing would be a symptom, not a cause or a metric to monitor for this specific issue. UDP is connectionless and doesn't use TCP keepalives.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed