EC2 instances in a private subnet must download OS patches from the internet, but must NOT accept inbound connections initiated from the internet. What should the architect deploy?
A.An internet gateway with a route from the private subnet
Routing a private subnet to an internet gateway does not help instances without public IPs, and is not the controlled egress pattern.
B.A NAT gateway in a public subnet with a route from the private subnet
Correct. NAT gateway provides outbound-only internet access for private subnets.
C.A VPC peering connection to another VPC
VPC peering connects two VPCs; it does not provide internet access.
D.An Elastic IP address assigned to each instance
Elastic IPs on private instances would expose them if the subnet routed to an IGW and defeats the 'private' design.
Why this answer
A NAT gateway in a public subnet lets private-subnet instances initiate outbound IPv4 connections to the internet while blocking unsolicited inbound connections — exactly the egress-only requirement.
Correct answer: B · Last reviewed 2026-10-25
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Network Security practice session.
Practice Network Security