Your team has servers in a private subnet in AWS. You need to devise a secure mechanism to connect to a private subnet from an external network. How could you accomplish this?

Answer options:

A.Change the Route tables for the subnet to add the Internet gateway.
B.Change the Route tables for the subnet to add the NAT gateway.
C.Add a bastion host in a private subnet.
D.Add a bastion host in a public subnet.

Correct Answer: D
In an Amazon Web Services (AWS) context, a bastion host is defined as a server whose purpose is to provide access to a private network from an external network, such as the Internet. Because of its exposure to potential attack, a bastion host must minimize the chances of penetration.
Option A is incorrect since this would expose the servers to the Internet.
Option B is incorrect since the NAT gateway is used for outward communication from the EC2 Instances only.
Option C is incorrect since the bastion host needs to be in a public subnet.
For more information on the bastion host, please refer to the below URL-
https://en.wikipedia.org/wiki/Bastion_host