ANS-C01 Network Management and Operations Practice Question
A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access the internet for software updates. The instance has a route to a NAT Gateway in the public subnet. However, the instance cannot reach the internet. Which step should the network engineer take to troubleshoot?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify that the NAT Gateway has an Elastic IP and the private subnet's route table has a route to the NAT Gateway
For a NAT Gateway to provide internet access to instances in a private subnet, it must have an Elastic IP (EIP) attached, and the private subnet's route table must include a route pointing to the NAT Gateway as the target for 0.0.0.0/0. Option A is wrong because NAT Gateways must reside in a public subnet (with a route to an Internet Gateway) to work. Option B is wrong because the NAT Gateway must be in the same VPC but not necessarily the same subnet as the EC2 instance; it should be in a public subnet. Option D is wrong because an Internet Gateway is attached to the VPC, not to individual subnets; attaching an Internet Gateway directly to a private subnet is not a valid configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Move the NAT Gateway to a private subnet
Why it's wrong here
NAT Gateway must be in a public subnet.
- ✗
Verify that the NAT Gateway is in the same subnet as the EC2 instance
Why it's wrong here
NAT Gateway must be in a public subnet.
- ✓
Verify that the NAT Gateway has an Elastic IP and the private subnet's route table has a route to the NAT Gateway
Why this is correct
These are required for outbound internet access.
- ✗
Attach an Internet Gateway to the private subnet
Why it's wrong here
Internet Gateway attaches to VPC, not subnet.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.