An Amazon EC2 instance is in a private subnet in a new VPC that has no outbound internet access. The EC2 instance must download monthly security updates from an external vendor. What should a solutions architect do to satisfy this requirement?

A NAT gateway allows instances in a private subnet to connect to the internet or other AWS services, but prevents the internet from initiating connections to those instances. Placing the NAT gateway in a public subnet with an associated internet gateway allows it to route outbound traffic from the private subnet to the internet. The private subnet's route table must then be updated to direct internet-bound traffic (0.0.0.0/0) to the NAT gateway. Incorrect options: An internet gateway alone would provide outbound internet access but would expose the private EC2 instance directly to the internet, which is generally not desired for private instances. A NAT instance in the same subnet as the EC2 instance would not work because the NAT instance itself needs internet access, which it wouldn't have in a private subnet without a NAT gateway or internet gateway. NAT instances are also less scalable and highly available than NAT gateways. Combining an internet gateway and a NAT instance in the same subnet is redundant and still problematic. The NAT instance would need to be in a public subnet to function correctly, and a NAT gateway is the preferred, managed solution.