An Amazon EC2 instance resides in a private subnet. The instance must initiate outbound internet access to download operating system updates, but it must not be directly reachable from the internet. Which AWS managed component provides this capability?
Choose an answer
Tap an option to check your answer.
Correct answer: NAT gateway.
Why this is the answer
A NAT gateway allows instances in a private subnet to connect to the internet or other AWS services, but prevents the internet from initiating connections to those instances. This fulfills the requirement for outbound internet access without direct internet reachability. VPC endpoints allow private connections from your VPC to supported AWS services and VPC endpoint services powered by PrivateLink, but they don't provide general internet access for OS updates. Amazon PrivateLink is the technology powering VPC endpoints, not a direct solution for outbound internet access. VPC peering connects two VPCs privately, enabling communication between them, but it does not provide internet access.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed