ANS-C01 Network Security, Compliance and Governance Practice Question
A company has a VPC with a public subnet containing a NAT gateway and a private subnet containing EC2 instances. The EC2 instances need to download patches from the internet. The security team wants to ensure that the EC2 instances cannot initiate outbound connections to any other internet destinations. What should the network engineer do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign a security group to the EC2 instances that allows outbound HTTPS traffic only to the patch server's IP address.
Security groups act as a virtual firewall for EC2 instances, allowing you to specify outbound rules that restrict traffic to only the necessary destinations, such as the patch server's IP address on HTTPS. This provides granular control over outbound traffic. Option A is incorrect because removing the NAT gateway and attaching an internet gateway to the private subnet would give instances direct internet access, violating the restriction. Option B is incorrect because an egress-only internet gateway is used for IPv6 traffic only, not IPv4. Option C is incorrect because network ACLs are stateless and apply to the subnet as a whole, making them less suitable for per-instance granular control; they also require rules for return traffic, complicating the configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Remove the NAT gateway and attach an Internet Gateway to the private subnet route table.
Why it's wrong here
Wrong: This would allow all outbound traffic without restriction.
- ✗
Attach an egress-only Internet Gateway to the VPC and route private subnet traffic to it.
Why it's wrong here
Wrong: Egress-only IGW is for IPv6 only.
- ✗
Configure a network ACL on the private subnet to allow outbound traffic only to the patch server's IP address.
Why it's wrong here
Wrong: NACLs are stateless and require return traffic rules; also not as flexible as security groups.
- ✓
Assign a security group to the EC2 instances that allows outbound HTTPS traffic only to the patch server's IP address.
Why this is correct
Correct: Security groups can restrict outbound traffic to specific destinations.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.