ANS-C01 Network Implementation Practice Question
A company has a VPC with a public subnet and a private subnet. They launch an EC2 instance in the private subnet with a private IP only. The instance needs to download patches from the internet. Which configuration is required?
⚠ Common exam trap
The ANS-C01 exam often tests the misconception that a NAT instance or gateway can be placed in a private subnet, but the key trap is that NAT devices must reside in a public subnet with an internet gateway route to function correctly for outbound internet access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a NAT gateway in the public subnet and add a default route to the NAT gateway in the private subnet's route table.
A NAT gateway in the public subnet provides outbound internet access for instances in the private subnet while preventing inbound connections from the internet. By adding a default route (0.0.0.0/0) in the private subnet's route table pointing to the NAT gateway, traffic from the EC2 instance destined for the internet is forwarded to the NAT gateway, which then uses its Elastic IP to communicate with the internet. This allows the instance to download patches without requiring a public IP or direct internet gateway access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Launch a NAT instance in the private subnet and configure source/destination check.
Why it's wrong here
NAT instance should be in a public subnet to access the internet.
- ✗
Create a VPC endpoint for the patch service.
Why it's wrong here
VPC endpoints are for private access to specific AWS services, not general internet downloads.
- ✓
Create a NAT gateway in the public subnet and add a default route to the NAT gateway in the private subnet's route table.
Why this is correct
NAT gateway enables outbound internet access for private instances while preventing inbound traffic.
- ✗
Attach an internet gateway to the VPC and add a default route to it in the private subnet's route table.
Why it's wrong here
Private instances need a NAT device to translate their private IPs; an internet gateway alone does not provide outbound connectivity.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.