An application server running on an Amazon EC2 instance in a private subnet in a VPC must connect to the internet to download software updates.
How can this be achieved?

Answer options:

A.Create a NAT gateway and update the route table.
B.Assign an Elastic IP address to the EC2 instance.
C.Update the security group for the EC2 instance to allow Port 80 from 0.0.0.0/0
D.Update the rule for the inbound network access control list for the subnet containing the EC2 instance.

Correct Answer: A
The AWS Documentation mentions the following.
You can use a network address translation (NAT) gateway to enable instances in a private subnet to connect to the internet or other AWS services. But you prevent the internet from initiating a connection with those instances. 
All other options are implementation schemes for allowing access to the Internet via a public subnet. And here we have a private subnet.
For more information on the NAT gateway, please visit the below URL-
https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html