What should a SysOps administrator do to meet these requirements?
Add an internet gateway to the VPC. In the route table for the private subnets, add a route to the internet gateway.
Add aNAT gateway to a private subnet. In the route table for the private subnets, add a route to the NAT gateway.
Add a NAT gateway to public subnet. In the route table for the private subnets, add a route to the NAT gateway.
Add two internet gateways to the VPC. In the route tables for the private subnets and public subnets, add a route to each internet gateway.
Explanations:
A public internet gateway cannot be used for private subnets. Private subnets must not have direct access to the internet via an internet gateway.
A NAT gateway must be placed in a public subnet, not a private subnet. A route to the NAT gateway from private subnets is necessary, but the NAT gateway must reside in a public subnet.
A NAT gateway should be placed in a public subnet. Private subnets should route internet-bound traffic to the NAT gateway, allowing instances in private subnets to access the internet for updates while maintaining security.
Only one internet gateway is needed for a VPC. Multiple internet gateways are unnecessary and cannot be used in this scenario as the requirement is to restrict instances to private subnets with controlled internet access.
I estimate that the answer is:
Add a NAT gateway to public subnet. In the route table for the private subnets, add a route to the NAT gateway.