ANS-C01 Network Management and Operations Practice Question
A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance has a NAT Gateway in the public subnet. However, the instance cannot reach the internet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The NAT Gateway does not have an Elastic IP address attached.
A NAT Gateway requires an Elastic IP address to translate private IP addresses to a public IP for internet access. Without it, outbound traffic cannot be routed to the internet. Option B is incorrect because the private subnet route table correctly has a default route pointing to the NAT Gateway. Option C is incorrect because the security group is stateful and allows return traffic; outbound traffic would only be blocked if explicitly denied. Option D is incorrect because network ACLs are stateless but the question does not indicate any blocking rules; the default NACL allows all outbound traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The NAT Gateway does not have an Elastic IP address attached.
Why this is correct
Without EIP, NAT Gateway cannot communicate with internet.
- ✗
The security group for the EC2 instance blocks outbound traffic.
Why it's wrong here
Security groups are stateful and allow outbound by default.
- ✗
The network ACL for the private subnet blocks outbound traffic.
Why it's wrong here
NACL would need to be checked but is less likely.
- ✗
The private subnet route table does not have a route to the internet gateway.
Why it's wrong here
Private subnet should not have IGW route; NAT is correct.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.