Handling Inbound Web Traffic for Private EC2 Instances

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

B Provision an internet-facing Application Load Balancer (ALB) in a public subnet to route external HTTP/HTTPS traffic to the private EC2 instance.

Question

A solutions architect creates a VPC that includes two public subnets and two private subnets. A corporate security mandate requires the solutions architect to launch all Amazon EC2 instances in a private subnet. However, when the solutions architect launches an EC2 instance that runs a web server on ports 80 and 443 in a private subnet, no external internet traffic can connect to the server. What should the solutions architect do to resolve this issue?
  1. Attach the EC2 instance to an Auto Scaling group in a private subnet. Ensure that the DNS record for the website resolves to the Auto Scaling group identifier.
  2. Provision an internet-facing Application Load Balancer (ALB) in a public subnet. Add the EC2 instance to the target group that is associated with the ALEnsure that the DNS record for the website resolves to the ALB. Correct Answer
  3. Launch a NAT gateway in a private subnet. Update the route table for the private subnets to add a default route to the NAT gateway. Attach a public Elastic IP address to the NAT gateway.
  4. Ensure that the security group that is attached to the EC2 instance allows HTTP traffic on port 80 and HTTPS traffic on port 443. Ensure that the DNS record for the website resolves to the public IP address of the EC2 instance.

Key Takeaways

The core concept tested is network architecture for secure access; the common trap is confusing inbound exposure with outbound connectivity provided by NAT gateways.

This question addresses how to expose web servers running in private subnets to the internet securely. The correct approach involves using an internet-facing Application Load Balancer (ALB) placed in public subnets.

Common mistake: Many learners incorrectly choose Option C (NAT Gateway), misunderstanding that NAT gateways only facilitate outbound traffic from private instances, not inbound connections from the internet.

Expert Analysis

Why the Answer Is Correct

Option B is the correct solution because an internet-facing Application Load Balancer (ALB) is designed specifically to distribute incoming traffic from the internet to targets, such as EC2 instances, in private subnets. By placing the ALB in public subnets, it can receive HTTP/HTTPS traffic on ports 80 and 443 and forward it to the target group containing the private EC2 instances. This setup ensures that the web server remains in a private subnet (enhancing security) while still being accessible externally.

Why the Other Options Are Wrong

Option A is incorrect because Auto Scaling groups manage capacity scaling, not network routing or inbound traffic accessibility. Option C describes a NAT Gateway configuration, which allows instances in private subnets to initiate outbound connections to the internet but does not allow unsolicited inbound connections from the internet. Option D is invalid because an instance in a private subnet lacks a direct public IP address and cannot be reached directly from the internet without a gateway like an ALB or NAT instance (though NAT instances are legacy).

Community Comment Notes

Community consensus strongly favors Option B. As user sandordini noted, "NAT gateway is to allow [outbound] internet traffic, but this is about inbound traffic." Another commenter, LeonSauveterre, explained that "The internet-facing ALB is deployed in a public subnet and acts as a bridge between the internet and the private EC2 instance." Some users initially considered C or D due to confusion about security groups or NAT functionality, but the majority correctly identified the ALB as the necessary component for inbound web traffic.

Official Reference

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/introduction.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When asked to make a private resource accessible via the internet, always look for a load balancer (ALB/NLB) in a public subnet. Do not confuse this with a NAT Gateway, which is strictly for outbound traffic from private resources.

Frequently Asked Questions

Why can't I just use a NAT Gateway for inbound traffic?

A NAT Gateway only allows outbound internet traffic from private instances. It does not support unsolicited inbound connections from the internet.

Can an EC2 instance in a private subnet have a public IP?

No, instances in private subnets do not automatically get public IPs. They require a gateway like an ALB to be reachable from the internet.

More SAA-C03 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 11 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 11

  1. sandordini 👍 6 Answered B
    Not A - Autoscaling Irrelevant B - ALB, route tales for the public subnet with a route to Priv subnet C - "NAT gateway" is "to allow [outbound] internet traffic", but this is about inbound traffic D - Instances are in the private subnet, therefore it wont work from the public.
  2. anikolov 👍 5 Answered B
    B: Provision an internet-facing Application Load Balancer (ALB) in a public subnet makes more sense
  3. TruthWS 👍 2
    B - because ALB do it better NAT
  4. LeonSauveterre 👍 1 Answered B
    A - Auto Scaling groups are for managing instance scaling. B - The internet-facing ALB is deployed in a public subnet and acts as a bridge between the internet and the private EC2 instance. Then, The ALB forwards HTTP/HTTPS traffic to the EC2 instance in the private subnet. C - A NAT gateway provides outbound internet access for private instances, but it does not solve inbound traffic issues. D - Private EC2 instances do not have public IP addresses at all.
  5. boluwatito 👍 1 Answered D
    nsure that the security group attached to the EC2 instance allows inbound traffic on ports 80 and 443 from the desired sources (e.g., any IP or specific IP ranges). This allows external internet traffic to reach the web server running on the EC2 instance
Show 6 more comments
  1. 8621a7c 👍 1 Answered C
    Is the question ask to solve the external connection?
  2. Andy_09 👍 1
    C should be the correct answer
  3. mestule 👍 4 Answered B
    B makes most sense
  4. Cali182 👍 1 Answered C
    Option C from Chatgt
  5. Andy_09 👍 1
    Changing to option D
  6. waldirlsantos 👍 1
    Why not "D"?

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide