You’ve been brought in as a solutions architect to assist an enterprise customer with their migration of an e-commerce platform to Amazon Virtual Private Cloud (VPC). The previous architect has already deployed a 3- tier VPC. The configuration is as follows. 

Answer options:

A.Create a bastion and NAT Instance in subnet-258bc44d and add a route to rtb-238bc44b pointing to subnet-258bc44d.
B.Add a route to rtb-238bc44b pointing to igw-2d8bc445 and add a bastion and NAT instance within Subnet-248bc44c.
C.Create a Bastion and NAT Instance in subnet-258bc44d. Add a route to rtb-238bc44b pointing to igw-2d8bc445, and a new NACL that allows access between subnet-258bc44d and subnet-248bc44c.
D.Create a Bastion and NAT instance in subnet-258bc44d and add a route to rtb-238bc44b pointing to the NAT instance.

Answer - D
Option A is incorrect because the route should be pointing to NAT.
Option B is incorrect because adding IGW to route rtb-238bc44b would expose the application and database server to the internet. Bastion and NAT should be in the public subnet.
Option C is incorrect because the route should point to NAT and not Internet Gateway else it would be internet accessible.
Option D is CORRECT because Bastion and NAT should be in the public subnet. As Web Server has direct access to the Internet, the subnet subnet-258bc44d should be public and Route rtb-218bc449 pointing to IGW. Route rtb-238bc44b for private subnets should point to NAT for outgoing internet access.