A VPC runs dual-stack. IPv6 instances in a private subnet must reach the internet but must NOT accept inbound connections initiated from the internet. What provides this?
A.NAT gateway for IPv6
NAT gateways don't carry IPv6 in this pattern — IPv6 is routable, not translated.
B.Egress-only internet gateway
Correct. Egress-only IGW = outbound-only for IPv6 private subnets.
C.Internet gateway with security group deny rules
An IGW would expose the instances to inbound connections; filtering per-SG is fragile and the question asks for the network construct.
D.NAT64 on a NAT instance
NAT64 translates IPv6→IPv4 — it doesn't gate inbound initiation, and NAT instances are a legacy pattern.
Why this answer
IPv6 addresses are globally routable — there is no NAT for IPv6 outbound privacy. The egress-only internet gateway is the IPv6 analog of NAT: permits outbound connections and their return traffic, blocks inbound-initiated connections.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Network Operations practice session.
Practice Network Operations