Which of the following are the recommended resources to be deployed in theAmazon VPC private subnet?
 

Answer options:

A.NAT Gateways
B.Bastion Hosts
C.Database Servers
D.Internet Gateways

Answer – C
As Database servers contain confidential information, so for a security perspective, it should be deployed in a Private Subnet.
Amazon Virtual Private Cloud (Amazon VPC) enables the user to launch AWS resources into a virtual network that a user has defined. 
Option A is incorrect because NAT devices (NAT Gateway, Nat Instance) allow instances in private subnets to connect to the internet, other VPCs, or on-premises networks. It is deployed in a public subnet.
Option B is incorrect because bastion host is a server whose purpose is to provide access (SSH access) to a private network from an external network, such as the Internet. It is deployed in a public subnet.
Option D is incorrect because an Internet Gateway is a horizontally scaled, redundant, and highly available VPC component that allows communication between your VPC and the internet.
For more information on AWS VPC, please refer to the below URL:
https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Networking.html
https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html
https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat.html
https://aws.amazon.com/blogs/security/how-to-record-ssh-sessions-established-through-a-bastion-host/