AWS Certified Security – Specialty — Question 340

A security engineer has designed a VPC to segment private traffic from public traffic. The VPC includes two Availability Zones. The security engineer has provisioned each Availability Zone with one private subnet and one public subnet. The security engineer has created three route tables for use with the environment. One route table is for the public subnets, and two route tables are for the private subnets (one route table for the private subnet in each Availability Zone).

The security engineer discovers that all four subnets are attempting to route traffic out though the internet gateway that is attached to the VPC.

Which combination of steps should the security engineer take to remediate this scenario? (Choose two.)

Answer options

• A. Verify that a NAT gateway has been provisioned in the public subnet in each Availability Zone.
• B. Verify that a NAT gateway has been provisioned in the private subnet in each Availability Zone.
• C. Modify the route tables that are associated with each of the public subnets. Create a new route for local destinations to the VPC CIDR range.
• D. Modify the route tables that are associated with each of the private subnets. Create a new route for the destination 0.0.0.0/0. Specify the NAT gateway in the public subnet of the same Availability Zone as the target of the route
• E. Modify the route tables that ae associated with each of the private subnets. Create a new route for the destination 0.0.0.0/0. Specify the internet gateway in the public subnet of the same Availability Zone as the target of the route.

Correct answer: A, D

Explanation

To allow private subnets to securely access the internet without direct exposure, a NAT gateway must be deployed in a public subnet within each Availability Zone (Option A). The route tables for the private subnets must then be updated to route all outbound internet traffic (0.0.0.0/0) to these NAT gateways rather than the internet gateway (Option D). Option B is incorrect because NAT gateways must reside in public subnets, and Option E is incorrect because routing private traffic directly to an internet gateway violates the private subnet architecture.