ANS-C01 Network Implementation Practice Question
A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download software patches from the internet. Which AWS service should be used to provide outbound internet access without allowing inbound traffic?
⚠ Common exam trap
Many candidates confuse a NAT gateway with an internet gateway, thinking an internet gateway can be configured to block inbound traffic, but an internet gateway is a stateful device that inherently allows bidirectional traffic once attached to a subnet, whereas a NAT gateway explicitly prevents unsolicited inbound connections.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NAT gateway
A NAT gateway enables EC2 instances in a private subnet to initiate outbound IPv4 traffic to the internet (e.g., to download patches) while preventing any unsolicited inbound traffic from the internet. It resides in a public subnet with an Elastic IP and performs source network address translation (SNAT), replacing the private source IP with the gateway's public IP. This satisfies the requirement of outbound-only internet access without exposing the private instances to inbound connections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Site-to-Site VPN connection
Why it's wrong here
VPN is for connecting to on-premises networks, not the internet.
- ✗
VPC endpoint
Why it's wrong here
VPC endpoints provide private access to AWS services, not the internet.
- ✓
NAT gateway
Why this is correct
A NAT gateway, deployed in the public subnet with an Elastic IP, enables EC2 instances in the private subnet to initiate outbound connections to the internet for patch downloads while its stateful translation drops all unsolicited inbound traffic, satisfying the requirement for outbound-only internet access.
- ✗
Internet gateway
Why it's wrong here
Internet gateway is for public subnets and allows inbound traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.