Question 414 of 1,621
ANS-C01 Network Security, Compliance and Governance Practice Question
A company has a VPC with a public subnet and a private subnet. The public subnet contains a NAT gateway and a bastion host. The private subnet contains several EC2 instances that need to download software updates from the internet. The security team has configured the following: - A security group on the EC2 instances allows outbound traffic to 0.0.0.0/0 on ports 443 and 80. - The private subnet's route table has a default route (0.0.0.0/0) pointing to the NAT gateway. - The NAT gateway is in the public subnet with an Elastic IP and its security group allows inbound traffic from the private subnet CIDR on ports 443 and 80, and outbound to 0.0.0.0/0 on all ports. Despite this, the EC2 instances cannot reach the internet. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The NAT gateway's security group inbound rule is too restrictive
The most likely cause is that the NAT gateway's security group inbound rule is too restrictive. NAT gateways are managed services and do not have security groups; if one were hypothetically attached, its inbound rule allowing only ports 443 and 80 would block return traffic on ephemeral ports. More critically, security groups are stateful—if outbound traffic is allowed, return traffic is automatically permitted regardless of inbound rules. Therefore, option D is incorrect. Option B is incorrect because the NAT gateway has an Elastic IP, and option C is incorrect because the private subnet route table has a default route to the NAT gateway.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The NAT gateway's security group inbound rule is too restrictive
Why this is correct
Incorrect. NAT gateways are managed services and do not support security group associations. The premise of a security group on the NAT gateway is invalid.
- ✗
The NAT gateway does not have an Elastic IP associated
Why it's wrong here
Incorrect. The question states that the NAT gateway has an Elastic IP associated, so this is not the issue.
- ✗
The route table of the private subnet does not have a route to the NAT gateway
Why it's wrong here
Incorrect. The route table of the private subnet does have a default route pointing to the NAT gateway.
- ✗
The EC2 instances' security group does not allow inbound traffic from the NAT gateway
Why it's wrong here
Correct. The EC2 instances' security group only allows outbound traffic. For return traffic from the internet (via the NAT gateway), inbound rules on the instances' security group may be required. While security groups are stateful, if an inbound rule explicitly denies traffic or if the security group is misconfigured, traffic can be blocked.
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 20, 2026
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.