QuestionInstances in a private subnet can't reach the internet to pull package updates. How would you troubleshoot it?
AnswerI'd start with the private subnet's route table and check that 0.0.0.0/0 points at a NAT gateway.1 Then I'd confirm the NAT gateway is available and has an Elastic IP.2 After that I'd check the instance's security group allows outbound traffic, and run curl from the instance to see where the request stops.
Addressed. Default route to the NAT gateway. Right place to start.
Partially. Say where the NAT gateway lives: a public subnet with a route to an internet gateway.
Missed. Network ACLs. They're stateless, so return traffic on ephemeral ports has to be allowed too.
- Technical accuracy
- 3/5
- Problem-solving approach
- 4/5
- Communication
- 4/5
Reviewer's noteClear order of checks, and testing from the instance itself is a good habit. Next time, place the NAT gateway and mention NACLs.

