Exam AWS-SysOps topic 1 question 857 discussion

Exam question from Amazon's AWS-SysOps

Question #: 857
Topic #: 1

A SysOps Administrator maintains several Amazon EC2 instances that do not have access to the public internet. To patch operating systems, the instances require outbound internet connectivity. For security reasons, the instances should not be reachable from the public Internet.
The Administrator deploys a NAT instance, updates the security groups, and configures the appropriate routes within the route table. However, the instances are still unable to reach the Internet.
What should be done to resolve the issue?

A. Assign Elastic IP addresses to the instances and create a route from the private subnets to the internet gateway
B. Delete the NAT instance and replace it with AWS WAF
C. Disable source/destination checks on the NAT instance
D. Start/stop the NAT instance so it is launched on a different host

Show Suggested Answer

Suggested Answer: A 🗳️
Reference:
https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Scenario2.html

by Newguru2020 at Nov. 1, 2020, 11:17 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

Newguru2020

Highly Voted 2 years, 9 months ago

Easy. Disable Source/Destination check on Instance to make it a NAT instance Ans: C

upvoted 8 times

mrphuongbn

2 years, 8 months ago

Right. If this is a NAT instance, you must stop source / destination checking. A NAT instance must be able to send and receive traffic when the source or destination is not itself. https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Instance.html#EIP_Disable_SrcDestCheck

upvoted 6 times

...

albert_kuo

Most Recent 11 months, 2 weeks ago

Selected Answer: C

By disabling source/destination checks on the NAT instance, the instance can effectively serve as a gateway for instances in the private subnet to access the internet, and the internet traffic will flow through the NAT instance without being blocked.

upvoted 1 times

...