ANS-C01 Network Security, Compliance and Governance Practice Question
A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance is behind a NAT gateway in the public subnet. The security team wants to allow only outbound HTTPS traffic from the instance. Which configuration should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Security group on the instance with outbound rule allowing HTTPS
A security group on the EC2 instance with an outbound rule allowing HTTPS (port 443) is the correct configuration. Security groups are stateful, so the outbound rule automatically permits the return traffic, requiring no explicit inbound rule. This ensures only outbound HTTPS is allowed from the instance. Option C is incorrect because network ACLs are stateless and would require explicit inbound rules for return traffic, but more importantly, NACLs are subnet‑level controls and are not the best practice for restricting traffic from a single instance. Option B is incorrect because VPC gateway endpoints are for private connectivity to AWS services, not for internet access. Option D is incorrect because a security group on the NAT gateway would control the NAT gateway's own traffic, not the instance behind it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Security group on the instance with outbound rule allowing HTTPS
Why this is correct
A security group outbound rule permitting HTTPS only controls traffic at the instance level, but a NAT gateway in the public subnet requires a corresponding inbound security group rule on the NAT gateway itself to allow return traffic from the internet; without this, the NAT gateway drops the response packets, breaking the connection. This option is tempting because security groups are the standard mechanism for restricting instance-level egress, and in a scenario where the instance communicates directly with an internet-facing endpoint without a NAT gateway—such as through an internet gateway with a public IP—this single outbound rule would suffice.
- ✗
VPC gateway endpoint for S3
Why it's wrong here
Gateway endpoints are for accessing S3 and DynamoDB, not for general internet access.
- ✗
Network ACL on the private subnet with outbound rule allowing HTTPS and inbound rule allowing return traffic
Why it's wrong here
NACLs are stateless and require explicit inbound rules for return traffic.
- ✗
Security group on the NAT gateway with outbound rule allowing HTTPS
Why it's wrong here
NAT gateways do not have security groups.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.