The company plans to run EC2 instances using only IPv6 addresses. These instances must be prevented from receiving inbound connections from the public internet, yet they must be able to initiate outbound internet connections. The VPC is dual-stack and the subnets are IPv6-only. How should the SysOps administrator configure routing to satisfy these requirements?
Choose an answer
Tap an option to check your answer.
Correct answer: Attach an egress-only internet gateway. Add a route that sends all IPv6 traffic to the egress-only internet gateway and assign that route table to the IPv6-only subnets..
Why this is the answer
An egress-only internet gateway (EIGW) is specifically designed for IPv6 traffic in private subnets. It allows instances to initiate outbound connections to the internet while preventing unsolicited inbound connections from the internet, perfectly matching the requirement. Attaching an internet gateway (IGW) would allow both inbound and outbound IPv6 traffic, violating the "no inbound connections from the public internet" rule. A NAT gateway is used for IPv4 traffic to enable instances in private subnets to connect to the internet or other AWS services, and it does not support IPv6. Attaching both an IGW and NAT gateway is incorrect because the subnets are IPv6-only, and the NAT gateway is not applicable for IPv6.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed