All IP addresses within a 10.0.0.0/16 VPC are fully utilized with application servers across two Availability Zones. The application servers need to…

A NAT gateway uses Port Address Translation (PAT) to map private source IP addresses and ports to its public IP address and a unique source port. AWS NAT gateways have a limit of 55,000 concurrent connections to a single unique destination (defined by destination IP, destination port, and protocol). In this scenario, a very large number of servers (~65,000) are sending frequent UDP probes to a single internet server. This high volume of traffic to the same destination endpoint will exhaust the available source ports on the single NAT gateway, causing new connection attempts from some servers to fail.

A. NAT gateways fully support both TCP and UDP traffic. If UDP were unsupported, no servers would be able to communicate, which contradicts the scenario.

B. If the authentication server were unavailable, all application servers would fail to communicate, not just "a few" as stated in the problem.

D. A NAT gateway must be placed in a public subnet (one with a route to an Internet Gateway) to function. If it were in a private subnet, no servers could reach the internet.

1. AWS Documentation: NAT gateways - Quotas for your NAT gateways. This document explicitly states: "A NAT gateway can support up to 55,000 simultaneous connections for each unique destination. A unique destination is a unique combination of destination IP address, destination port, and protocol (TCP/UDP/ICMP)." This directly supports the reasoning for port exhaustion (Answer C).

2. AWS Documentation: NAT gateways - NAT gateway basics. This page confirms that "NAT gateways support TCP, UDP, and ICMP," which invalidates option A.

3. AWS Documentation: NAT gateways - NAT gateway basics. Under the "Basics" section, it is specified that to create a NAT gateway, "You must also specify a public subnet in which to create the NAT gateway." This makes option D an impossible and incorrect configuration.