An administrator needs to download OS patches from the internet to an EC2 instance located in a private subnet. The VPC has an internet gateway and a NAT gateway placed in a public subnet, but the instance still cannot reach the internet. The private subnet must remain unreachable from the public internet. Given the following route tables, what entry should be added to the private subnet’s route table to enable outbound internet access?

The correct entry is 0.0.0.0/0 - NAT. For an EC2 instance in a private subnet to access the internet, its traffic must be routed through a NAT Gateway. The 0.0.0.0/0 destination represents all IP addresses, meaning any traffic not explicitly routed elsewhere will go to the specified target. In this case, directing it to the NAT Gateway allows the private instance to initiate outbound connections. 0.0.0.0/0 - IGW is incorrect because an Internet Gateway (IGW) is for public subnets and would expose the private subnet to the internet, violating the requirement. 10.0.1.0/24 is a specific CIDR block, not a default route for all internet traffic, making 10.0.1.0/24 - IGW and 10.0.1.0/24 - NAT incorrect for providing general internet access.