You provisioned a VPC with one public subnet and one private subnet. Instances launched in the private subnet cannot reach the internet. The VPC subnets are still using the default network ACL, and all security groups permit all outbound traffic. What change will enable internet access for the instances in the private subnet?

Instances in a private subnet require a NAT gateway to access the internet. The NAT gateway must reside in a public subnet, meaning it has a route to an Internet Gateway. The private subnet's route table then needs a route (typically for 0.0.0.0/0) pointing to the NAT gateway. This setup allows instances in the private subnet to send outbound traffic to the internet through the NAT gateway, which translates their private IP addresses to its public IP. The other options are incorrect because: A NAT gateway in the public subnet with a route on the public subnet is incorrect; the private subnet needs the route. A NAT gateway in the private subnet is incorrect; NAT gateways must be in a public subnet to reach the internet gateway.