A web company is looking to implement an external payment service into their highly available application deployed in a VPC. Their application EC2 instances are behind a public-facing ELB with NAT instances and Public IP s in place. Auto Scaling is used to add additional instances as traffic increases under normal load. The application runs 2 instances in the Auto Scaling group, but it can scale 3x in size at the peak. The application instances need to communicate with the payment service over the Internet, which requires whitelisting all public IP addresses to communicate with it. A maximum of 4 whitelisting IP addresses are allowed at a time and can be added through an API. How should they architect their solution?

Answer options:

A.Route payment requests through two NAT instances setup for High Availability and whitelist the Elastic IP addresses attached to the NAT instances.
B.Whitelist the VPC Internet Gateway Public IP and route payment requests through the Internet Gateway.
C.Whitelist the ELB IP addresses and route payment requests from the Application servers through the ELB.D.Automatically assign public IP addresses to the application instances in the Auto Scaling group and run a script on boot that adds each instance`s public IP address to the payment validation whitelist API.

Answer - A
Option A is CORRECT because (a) the requests originated from the instances in the subnet would be routed through the NAT, so they would have the NAT’s IP address (which is whitelisted), and (b) two NAT instances would provide high availability.
Option B is incorrect because (a) Internet Gateway (IGW) can only route the traffic. It cannot whitelist any particular IP and payment requests, and (b) EC2 instances with public IP addresses in a public subnet are routed through the gateway. Still, they will keep their own IP address. So they will not get whitelisted.
Option C is incorrect because the outbound traffic cannot be routed through an ELB.Option D is incorrect because the ASG will have 6 servers during the peak load, and the payment service only allows 4 to be whitelisted. So, it will exceed the allowed 4 IP addresses.