CLF-C02 Cloud Technology and Services Practice Question
A company runs database servers in private subnets with no direct internet access for security. However, these servers need to download OS updates from the internet. Which VPC component allows the private instances to make outbound internet connections while remaining unreachable from the internet?
⚠ Common exam trap
Watch out — candidates often confuse a NAT Gateway with an Internet Gateway, assuming both provide internet access, but the key differentiator is that a NAT Gateway only allows outbound-initiated traffic and blocks unsolicited inbound connections, which is exactly what the question requires.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NAT Gateway
A NAT Gateway enables instances in a private subnet to initiate outbound IPv4 traffic to the internet (e.g., for OS updates) while preventing the internet from initiating inbound connections to those instances. It resides in a public subnet with an Elastic IP and uses Source Network Address Translation (SNAT) to replace the private source IP with the gateway's public IP, making the response traffic routable back without exposing the private instances.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Internet Gateway
Why it's wrong here
An Internet Gateway is a horizontally scaled, redundant VPC component that enables two-way communication with the internet, but it only works for resources with public IP addresses (public IPv4 or Elastic IP) and a route table entry pointing to the IGW. Instances in a private subnet do not have public IPs, and their route table typically sends 0.0.0.0/0 to a NAT Gateway instead. Moreover, an IGW would expose the instances to unsolicited inbound traffic, defeating the entire purpose of a private subnet, so it cannot be used alone for outbound-only access.
- ✓
NAT Gateway
Why this is correct
A NAT Gateway placed in a public subnet translates private instance IP addresses for outbound internet traffic. Return traffic is allowed back through the NAT, but no inbound connections initiated from the internet can reach the private instances.
- ✗
VPN Gateway
Why it's wrong here
A Virtual Private Gateway is the AWS-side endpoint for an IPsec VPN connection to an on-premises network or remote site. It is designed to route encrypted traffic between the VPC and your corporate network via BGP or static routes, not to provide internet access. The VGW does not perform network address translation, does not assign public IPs, and has no path to the public internet; it simply encrypts and forwards packets over the tunnel. Therefore, private instances cannot use it to reach public resources like OS update repositories.
- ✗
VPC Endpoint
Why it's wrong here
A VPC Endpoint provides private connectivity between your VPC and supported AWS services (e.g., S3, DynamoDB) over the AWS backbone, without traversing the public internet. Gateway endpoints are route-table entries for specific service prefix lists, and interface endpoints attach an ENI to your subnet, but neither performs address translation nor forwards general internet-bound traffic. Because they only work for the specific AWS service they target, they cannot provide the broad outbound internet access needed for downloading from third-party repositories or accessing non-AWS public endpoints.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 993 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.