What is the primary purpose of a NAT gateway in cloud networking?

• A. To block all outbound traffic
• B. To assign public IP addresses automatically to all resources
• C. To route traffic between VPCs automatically
• D. To allow instances in a private subnet to access the Internet while keeping them inaccessible from the Internet

Answer: (D)

The key idea is that a NAT gateway enables private-subnet resources to reach the Internet without exposing those resources to inbound Internet traffic. It does this by having a public IP and performing network address translation: outbound requests from private instances are sent to the NAT, which rewrites the source IP to its own public IP and forwards the traffic to the Internet; responses come back to the NAT and are translated back to the original private IP inside the VPC. This setup lets updates, API calls, and other Internet access work while keeping the instances unreachable from the Internet directly.

This matches the described purpose: allowing private-subnet instances to access the Internet while remaining inaccessible from the Internet. It’s not about blocking all outbound traffic—that would defeat the need for Internet access. It doesn’t assign public IPs to every resource, since the NAT uses its own public IP for all outbound traffic. It also doesn’t route traffic between VPCs—that’s handled by VPC peering or a transit gateway, not a NAT gateway.