NAT gateway quiz · Level 0 · Todo.io Learns AWS

Question 1Servers in Todo.io's private subnets must download updates from the internet, but must not be reachable from it. Where does the NAT gateway go?

In a public subnet. The private subnets' route tables send 0.0.0.0/0 to it.Correct. The NAT gateway needs its own way out through the internet gateway, so it must sit in a public subnet.In the private subnet, next to the servers.Not this one. A NAT gateway in a private subnet has no route out itself.Outside the VPC.Not this one. A NAT gateway lives in a subnet of your VPC.One attached to each server.Not this one. One NAT gateway serves a whole set of subnets; servers reach it through their route table.

Learn it: NAT gateway

Question 2Todo.io attaches its Lambda function to the VPC so it can reach the MySQL database in a private subnet. Since then, the function's calls to SQS time out. IAM allows sqs:SendMessage. What fixes it?

Add a NAT gateway in a public subnet, and route the private subnets' internet traffic (0.0.0.0/0) to it.Correct. A VPC-attached Lambda function can only reach what its subnet can reach. A NAT gateway lets it call out to public AWS endpoints such as SQS, while nothing can call in. (A VPC endpoint is another fix, in a later level.)Move the function's network interfaces to a public subnet.Not this one. Lambda's network interfaces never get a public IP, so a public subnet doesn't help. This is a classic exam trap.Add an outbound rule for port 443 to the function's security group.Not this one. Security groups allow all outbound traffic by default, and a timeout means there's no route out at all. An outbound rule can't create a route.Add sqs:SendMessage to the function's execution role again.Not this one. IAM already allows it. A permission problem shows up as AccessDenied, not as a timeout.

Learn it: NAT gateway · Lambda · IAM policy · ENI

Question 3An EC2 instance sits in a private subnet with no NAT gateway. It needs to download a software update from the internet. What happens?

The download fails: the subnet has no route out. A NAT gateway in a public subnet would give it one.Correct. Private means no route to the internet gateway. A NAT gateway lets it call out while nothing calls in.It works, because security groups allow all outbound traffic by default.Not this one. Security groups allow it, but there is no route for the traffic to take.It works if the instance has a public IP.Not this one. In a private subnet a public IP leads nowhere: there is still no route to the internet gateway.It works through the internet gateway automatically.Not this one. Only subnets whose route table points to the internet gateway use it.

Learn it: NAT gateway · Subnet

Question 4Todo.io's Fargate tasks run in private subnets. Their IAM permissions are correct, but every call they make to SQS times out. What fixes it?

A NAT gateway in a public subnet, with the private subnets routing 0.0.0.0/0 to it.Correct. SQS is a public AWS service. From a private subnet, traffic needs a way out. (VPC endpoints are another fix, in a later level.)An outbound rule in the task's security group.Not this one. Security groups allow outbound traffic by default; the problem is the missing route.A public IP on each task, left in the private subnet.Not this one. A public IP is useless without a route to the internet gateway.More permissions on the task role.Not this one. A permission problem returns AccessDenied, not a timeout.

Learn it: NAT gateway · IAM policy

Question 5Todo.io wants traffic from its VPC to DynamoDB to stay off the internet, without paying extra for it. What should it add?

A VPC gateway endpoint for DynamoDB.Correct. Gateway endpoints (for DynamoDB and S3) add a route to the service that never leaves AWS, and cost nothing.A NAT gateway.Not this one. A NAT gateway costs per hour and per GB, and the traffic still goes out to the public endpoint.A public IP on every instance.Not this one. That puts more traffic on the internet, not less.Move the table into the VPC.Not this one. DynamoDB tables can't be placed in a VPC.

Learn it: VPC (Virtual Private Cloud) · DynamoDB · NAT gateway

Question 6What does "NAT gateway" mean?

Lets things in private subnets reach out to the internet, while nothing can reach in.Correct. Think of it as: A one-way turnstile at the gate. Staff can go out, strangers can't walk in.A virtual network card that gives something an address in a subnet.Not this one. That describes ENI (Elastic Network Interface).A firewall attached to a network card, listing what traffic is allowed in and out.Not this one. That describes Security group.An address the whole internet can reach.Not this one. That describes Public IP address.

Learn it: NAT gateway

Question 7Which term is this? "Lets things in private subnets reach out to the internet, while nothing can reach in."

NAT gatewayCorrect. Yes. Think of it as: A one-way turnstile at the gate. Staff can go out, strangers can't walk in.ENI (Elastic Network Interface)Not this one. ENI (Elastic Network Interface) is: A virtual network card that gives something an address in a subnet.Security groupNot this one. Security group is: A firewall attached to a network card, listing what traffic is allowed in and out.Public IP addressNot this one. Public IP address is: An address the whole internet can reach.

Learn it: NAT gateway

Question 8Which AWS term is described by this analogy? "A one-way turnstile at the gate. Staff can go out, strangers can't walk in."

NAT gatewayCorrect. Yes: Lets things in private subnets reach out to the internet, while nothing can reach in.ENI (Elastic Network Interface)Not this one. ENI (Elastic Network Interface) is: A virtual network card that gives something an address in a subnet. Its analogy: A phone line installed in a particular room.Security groupNot this one. Security group is: A firewall attached to a network card, listing what traffic is allowed in and out. Its analogy: A bouncer standing at one particular door, holding a guest list.Public IP addressNot this one. Public IP address is: An address the whole internet can reach. Its analogy: A street address printed on the outside of the building.

Learn it: NAT gateway

NAT gateway

Worth another look

Your weak spots

Services

Concepts