ANS-C01 Network Management and Operations Practice Question

A company has a VPC with a NAT Gateway in a public subnet. The network team notices that instances in private subnets cannot access the internet. Reviewing the route tables, the private subnet route table has a default route (0.0.0.0/0) pointing to the NAT Gateway. What is the most likely cause of the issue?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The NAT Gateway's subnet route table does not have a default route pointing to an Internet Gateway.

The NAT Gateway must have a route to an Internet Gateway. If the NAT Gateway's subnet route table does not have a default route pointing to an IGW, it cannot route traffic to the internet. Security groups, NACLs, or EIP are less likely to be the issue.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The network ACL in the private subnet blocks outbound traffic.
Why it's wrong here
NACLs are stateless; if outbound were blocked, inbound responses would also be affected, but the symptom is no internet access. It's less likely than a missing route.
✓
The NAT Gateway's subnet route table does not have a default route pointing to an Internet Gateway.
Why this is correct
Without a route to IGW, NAT Gateway cannot forward traffic to the internet.
✗
The NAT Gateway does not have an Elastic IP address attached.
Why it's wrong here
NAT Gateway requires an EIP, but if missing, it would be non-functional from the start.
✗
The security group attached to the NAT Gateway blocks outbound traffic.
Why it's wrong here
NAT Gateway does not use security groups.

Visual reference

Go deeper

ANS-C01 Network Management and Operations Practice Question

Why each option matters

Option-by-option breakdown

Related to this question