What is the primary function of a NAT gateway in cloud networking?

What is the primary function of a NAT gateway in cloud networking?

• A. Handles outbound traffic from private subnets to the internet
• B. Provides a secure SSH tunnel to on-premises networks
• C. Connects VPCs for cross-account routing
• D. Manages internal DNS resolution

Answer: (A)

A NAT gateway is used to give resources in private subnets outbound internet access without exposing those resources with public IP addresses. When instances in private subnets initiate connections to the internet, the NAT gateway translates their private source IPs to a public IP (often a shared one) so responses can make their way back. This lets you install updates, pull software, and reach external services while keeping the private addresses hidden and inbound connections from the internet blocked by default. The NAT gateway is a managed service that scales and provides high availability, and routing is set so the private subnets send internet-bound traffic through the gateway. Other options describe different services: a secure SSH tunnel to on-prem networks is a VPN gateway (or similar), which isn’t about translating addresses for general outbound internet access. Connecting VPCs for cross-account routing is handled by VPC peering or Transit Gateway, not NAT. Managing internal DNS resolution is the role of DNS services (like Route 53 or in-VPC DNS), not a NAT gateway.

A NAT gateway is used to give resources in private subnets outbound internet access without exposing those resources with public IP addresses. When instances in private subnets initiate connections to the internet, the NAT gateway translates their private source IPs to a public IP (often a shared one) so responses can make their way back. This lets you install updates, pull software, and reach external services while keeping the private addresses hidden and inbound connections from the internet blocked by default. The NAT gateway is a managed service that scales and provides high availability, and routing is set so the private subnets send internet-bound traffic through the gateway.

Other options describe different services: a secure SSH tunnel to on-prem networks is a VPN gateway (or similar), which isn’t about translating addresses for general outbound internet access. Connecting VPCs for cross-account routing is handled by VPC peering or Transit Gateway, not NAT. Managing internal DNS resolution is the role of DNS services (like Route 53 or in-VPC DNS), not a NAT gateway.