ANS-C01 Network Implementation Practice Question
A company has a VPC with a CIDR of 10.0.0.0/16. They have two subnets: 10.0.1.0/24 (public) and 10.0.2.0/24 (private). They launch a NAT Gateway in the public subnet and add a route in the private subnet route table: destination 0.0.0.0/0, target nat-gateway-id. An EC2 instance in the private subnet can ping an external server, but cannot connect to it via SSH. The security group allows outbound SSH (port 22), and the NACL allows outbound ephemeral ports. What is the likely cause?
⚠ Common exam trap
Watch out — candidates often assume SSH failure must be due to a missing route or security group misconfiguration, but the real issue is that the external server's firewall is blocking return traffic from the NAT Gateway's Elastic IP, which is a common real-world scenario when the external server has IP-based allowlists.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The external server's firewall is blocking traffic from the NAT Gateway's Elastic IP address.
The NAT Gateway translates the private instance's source IP to its own Elastic IP address for outbound traffic. SSH connections require bidirectional communication: the external server must send SYN-ACK packets back to the source IP. If the external server's firewall blocks traffic from the NAT Gateway's Elastic IP, the TCP handshake fails, preventing SSH while ICMP (ping) may still work because ICMP echo requests and replies are stateless and often allowed by default.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The NACL on the private subnet is blocking outbound ephemeral ports.
Why it's wrong here
Ping works, so outbound is allowed.
- ✗
The route table in the private subnet does not have a route to the NAT Gateway.
Why it's wrong here
Ping works, so routing is correct.
- ✓
The external server's firewall is blocking traffic from the NAT Gateway's Elastic IP address.
Why this is correct
The external server must allow the NAT Gateway's public IP on port 22.
- ✗
The NAT Gateway is not configured to allow SSH traffic.
Why it's wrong here
NAT Gateway is transparent to protocols; it forwards any TCP/UDP traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.