There is a requirement to host a database server. The server needs to connect to the Internet while downloading the required database patches. But the ingress traffic to the instances is not allowed. Which of the following solutions would satisfy the above requirements at its best? 

Answer options:

A.Setup the database in a private subnet with a security group that only allows outbound traffic.
B.Setup the database in a public subnet with a security group that only allows inbound traffic.
C.Setup the database in a local data center and use a private gateway to connect the application to the database.
D.Setup the database in a private subnet that connects to the Internet via NAT Gateway.

Correct Answer – D
This setup coincides with Scenario 2 of setting up a VPC as per AWS documentation:
Scenario 2: VPC with Public and Private Subnets (NAT)
The instances in the public subnet can send outbound traffic directly to the internet, whereas the instances in the private subnet can`t. Instead, the instances in the private subnet can access the internet by using a network address translation (NAT) gateway that resides in the public subnet. The database servers can connect to the internet for software updates using the NAT gateway, but the internet cannot establish connections to the database servers.
References:
https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Scenario2.html