Ensuring Internet Communication in Private Subnets | AWS Certified Advanced Networking - Specialty Exam
Question
Which of the following are used to ensure instances in the private subnet can communicate with the Internet.
Choose 2 answers from the options below.
Answers
Explanations
Click on the arrows to vote for the correct answer
A. B. C. D.Answer - B and C.
The AWS documentation mentions the following.
Customer EC2 instances in a private subnet sometimes need to communicate with the public Internet.
A NAT device enables this connection, replacing internal servers' private IP addresses with public IP addresses on the way out of the network, and retranslating response IP addresses on the way back in.
AWS offers two types of NAT options: NAT gateways and NAT instances.
NAT gateways are AWS managed while customers are responsible for managing NAT instances.
NAT gateways provide better availability and bandwidth over individual NAT instances, however customers can leverage multiple NAT instances to increase availability and network performance.
For more information on VPC egress traffic, please refer to the below link:
https://aws.amazon.com/answers/networking/controlling-vpc-egress-traffic/To enable instances in the private subnet to communicate with the Internet, we need to use either a Network Address Translation (NAT) instance or a NAT gateway. The correct answers are B. NAT instances and C. NAT gateway.
A NAT instance is a single EC2 instance that is deployed in the public subnet and acts as a bridge between instances in the private subnet and the Internet. NAT instances have an Elastic IP address that is used to communicate with the Internet. When instances in the private subnet want to communicate with the Internet, they send their traffic to the NAT instance, which then forwards the traffic to the Internet.
A NAT gateway, on the other hand, is a managed service provided by AWS that allows instances in a private subnet to access the Internet while keeping them isolated from the Internet. NAT gateways are highly available and scalable, and they are designed to handle a large amount of traffic. NAT gateways are preferred over NAT instances because they are easier to set up, more reliable, and more scalable.
An Internet gateway, as the name suggests, is used to provide connectivity between a VPC and the Internet. It is used to route traffic from instances in the public subnet to the Internet and vice versa. Instances in the private subnet cannot communicate with the Internet directly through an Internet gateway.
AWS Direct Connect is a dedicated network connection between your datacenter and AWS. It is used to establish a private, dedicated network connection between your datacenter and AWS, bypassing the public Internet. It is not used for enabling instances in the private subnet to communicate with the Internet.
In summary, NAT instances and NAT gateways are used to enable instances in the private subnet to communicate with the Internet. Internet gateway is used to provide connectivity between a VPC and the Internet, while AWS Direct Connect is used to establish a private, dedicated network connection between your datacenter and AWS.
