ANS-C01 NAT instance Practice Question
A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to initiate outbound connections to the internet for software updates. The company wants to ensure that all outbound traffic goes through a single, highly available IP address for whitelisting purposes. Which solution should be used?
⚠ Common exam trap
The question asks for a 'single, highly available IP address' for whitelisting. While NAT gateways offer high availability, they do not support sharing the same Elastic IP across multiple gateways. A NAT instance, though not fully highly available by default, can still serve as a single IP solution and may be improved with Auto Scaling.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Launch a NAT instance in a public subnet and assign an Elastic IP. Configure the private subnet route table to point to the NAT instance.
A NAT instance in a public subnet with an Elastic IP provides a single, stable IP address for outbound traffic from the private subnet. By configuring the private subnet route table to point to the NAT instance, all outbound internet traffic goes through that instance. While not inherently highly available across Availability Zones, the solution meets the core requirement of a single IP for whitelisting and can be made more resilient using Auto Scaling and instance recovery.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Launch a NAT instance in a public subnet and assign an Elastic IP. Configure the private subnet route table to point to the NAT instance.
Why this is correct
Correct. A NAT instance with an Elastic IP provides a single IP for outbound traffic. It can be placed in a public subnet and configured as a route target for the private subnet, allowing instances to initiate outbound connections to the internet.
- ✗
Create an internet gateway and attach it to the private subnet, then configure the route table.
Why it's wrong here
Incorrect. An internet gateway is attached to the VPC, not to a subnet. A private subnet cannot have a direct route to an internet gateway; routes to the internet gateway are only used for public subnets.
- ✗
Create a VPC endpoint for Amazon S3 and route software update traffic through that endpoint.
Why it's wrong here
Incorrect. A VPC endpoint for Amazon S3 provides private connectivity to S3 only. Software updates often come from external repositories (e.g., yum, apt) that are not on S3, so this does not meet the general internet access requirement.
- ✗
Create a NAT gateway in each Availability Zone and assign the same Elastic IP to both.
Why it's wrong here
Incorrect. Each NAT gateway requires a unique Elastic IP; you cannot assign the same Elastic IP to multiple NAT gateways. Therefore, this configuration is not supported.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.