DOP-C02 Configuration Management and IaC Practice Question
A DevOps engineer is writing an AWS CloudFormation template to create a VPC with public and private subnets. The engineer wants to ensure that the private subnets can access the internet through a NAT gateway. Which resources must be included in the template? (Choose TWO.)
⚠ Common exam trap
A common mix-up: candidates think an Internet Gateway is required for private subnet internet access, but the NAT gateway itself uses the internet gateway; the template only needs the NAT gateway and a route table for the private subnets, not the internet gateway resource directly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS::EC2::RouteTable
A is correct because an AWS::EC2::RouteTable resource is required to define the routing rules for the private subnets. Specifically, you must create a route table for the private subnets and add a default route (0.0.0.0/0) that points to the NAT gateway, enabling outbound internet traffic from instances in the private subnets while blocking inbound traffic from the internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS::EC2::RouteTable
Why this is correct
An AWS::EC2::RouteTable is correct because a private subnet cannot reach the internet on its own; you must create a route table and explicitly associate it with the private subnet. Within that route table, a route with destination 0.0.0.0/0 pointing to the NAT gateway is required, and the association between the route table and the subnet is what makes the NAT gateway the effective next hop for all outbound internet traffic.
- ✗
AWS::EC2::VPNGateway
Why it's wrong here
An AWS::EC2::VPNGateway is incorrect here because its purpose is to create a site-to-site VPN connection between your on-premises network and the VPC. It establishes encrypted IPsec tunnels over the public internet to your corporate network, and it does not provide outbound internet access for private subnet instances.
- ✗
AWS::EC2::InternetGateway
Why it's wrong here
An AWS::EC2::InternetGateway is incorrect because an internet gateway enables bidirectional communication between a VPC and the internet, but it is only used with public subnets that have route table entries directing 0.0.0.0/0 to the internet gateway. Private subnet instances cannot route directly to an internet gateway; they need a NAT gateway as an intermediary because the internet gateway does not perform NAT for private IP addresses.
- ✓
AWS::EC2::NatGateway
Why this is correct
An AWS::EC2::NatGateway is a correct component because it is a fully managed service that allows instances in private subnets to initiate outbound traffic to the internet while preventing unsolicited inbound connections. The NAT gateway must be deployed in a public subnet with an Elastic IP address, and private subnets use a route table entry with 0.0.0.0/0 pointing to the NAT gateway's ID.
- ✗
AWS::EC2::VPCEndpoint
Why it's wrong here
An AWS::EC2::VPCEndpoint is incorrect because it provides private connectivity between your VPC and specific AWS services, such as S3 or DynamoDB, without traversing the public internet. It uses either gateway or interface endpoints based on PrivateLink, and it is not a general-purpose mechanism for enabling internet access from private subnets; it cannot serve as a route target for 0.0.0.0/0 traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,298 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.