Exam AWS Certified Solutions Architect - Professional topic 1 question 203 discussion

Exam question from Amazon's AWS Certified Solutions Architect - Professional

Question #: 203
Topic #: 1

[All AWS Certified Solutions Architect - Professional Questions]

An EC2 instance that performs source/destination checks by default is launched in a private VPC subnet. All security, NACL, and routing definitions are configured as expected. A custom NAT instance is launched.
Which of the following must be done for the custom NAT instance to work?

A. The source/destination checks should be disabled on the NAT instance.
B. The NAT instance should be launched in public subnet.
C. The NAT instance should be configured with a public IP address.
D. The NAT instance should be configured with an elastic IP address.

Show Suggested Answer

Suggested Answer: A 🗳️
Each EC2 instance performs source/destination checks by default. This means that the instance must be the source or destination of any traffic it sends or receives. However, a NAT instance must be able to send and receive traffic when the source or destination is not itself. Therefore, you must disable source/ destination checks on the NAT instance.
Reference:
http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_NAT_Instance.html#EIP_DisableSrcDestCheck

by doyb at March 30, 2020, 7:14 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

mnsait

8 months, 2 weeks ago

Selected Answer: A

A is correct (this step is not mandatory). All others are needed. Explanation: A: Correct. It is not necessary for NAT to always be in public subnet. We have architectures where NAT is private. The next hop is AWS network account within the organization where there is a NAT in the public subnet. There is communication between the NAT in private subnet in the project account and the NAT in the public subnet in the organization network account. Hence it is not a general rule that ALL NAT should be in public subnet.

upvoted 1 times

...

amministrazione

1 year ago

A. The source/destination checks should be disabled on the NAT instance.

upvoted 1 times

...

johnnsmith

3 years, 5 months ago

A is correct. The ask is "must". A is a must. B is not a must. C or D alone is not a must.

upvoted 2 times

...

Pb55

3 years, 9 months ago

Agree, question should be NOT and then D is correct.

upvoted 2 times

robertomartinez

3 years, 9 months ago

agree the question sux with weird mix of must and should, imho the whole question is wrong , but having an EIP on NAT instance is not an issue (often a solution to whitelist NAT IP into external firewall)

upvoted 1 times

...