An application runs on EC2 instances inside private subnets of a VPC. The application must be able to download software updates from the internet, and company policy mandates that all EC2 instances reside in private subnets. What should a SysOps administrator do to provide internet access for outbound updates while keeping instances private?

The correct solution is to create a NAT gateway in a public subnet and configure the private subnets' route tables to direct internet-bound traffic (0.0.0.0/0) to this NAT gateway. This setup allows instances in private subnets to initiate outbound connections to the internet for updates while preventing unsolicited inbound connections from the internet, thus maintaining their privacy. Incorrect options: Attaching an internet gateway directly to the private subnets' route table would expose the instances to the internet, violating the requirement for them to remain private. Creating a NAT gateway in a private subnet would not work because the NAT gateway itself needs internet access through a public subnet and an internet gateway to function. Attaching two internet gateways to the VPC is unnecessary and doesn't solve the problem of providing private instances with outbound internet access without exposing them. A single internet gateway is sufficient for a VPC.