Question 134 of 1,621
ANS-C01 NAT Gateway Practice Question
A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company has created a NAT gateway in the public subnet and added a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway. However, the EC2 instance cannot reach the internet. The network engineer verifies that the NAT gateway has an Elastic IP address, the security group and network ACLs allow outbound traffic, and the route table for the public subnet has a route to an internet gateway. What is the most likely cause of the issue?
⚠ Common exam trap
The engineer verified that the public subnet's route table has a route to the IGW, but the problem might be that the private subnet's route table is missing the route to the NAT gateway, or the route is misconfigured. Always check that the route table associated with the private subnet has a default route pointing to the NAT gateway's ID.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The route table for the private subnet does not have a route to the NAT gateway.
The scenario states that a route pointing 0.0.0.0/0 to the NAT gateway was added to the private subnet's route table, but if that route table is not properly associated with the private subnet, or if the route was added but the target is incorrect (e.g., pointing to the wrong NAT gateway ID), the EC2 instance will not be able to send traffic through the NAT gateway. The verification that the route exists might have been insufficient. Option C points out that the route table for the private subnet does not have a route to the NAT gateway, which would directly cause the issue. The other options are contradicted by the verification steps performed by the engineer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security group for the EC2 instance does not allow outbound traffic.
Why it's wrong here
Incorrect: The engineer verified that security groups allow outbound traffic, so this is not the issue.
- ✗
The route table associated with the NAT gateway's subnet does not have a route to an internet gateway.
Why it's wrong here
Incorrect: The engineer verified that the public subnet's route table has a route to the internet gateway, so this is not the issue.
- ✓
The route table for the private subnet does not have a route to the NAT gateway.
Why this is correct
Correct: If the private subnet's route table does not have a route pointing 0.0.0.0/0 to the NAT gateway, traffic from the EC2 instance cannot reach the NAT gateway. Despite the engineer adding a route, it may not be correctly associated or configured.
- ✗
The NAT gateway does not have an Elastic IP address assigned.
Why it's wrong here
Incorrect: The engineer verified that the NAT gateway has an Elastic IP address, so this is not the issue.
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 20, 2026
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.