ANS-C01 NAT Gateway Practice Question
A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They have two subnets: a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). They launch an EC2 instance in the private subnet that needs to download software updates from the internet. The company configures a NAT gateway in the public subnet and adds a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway. The NAT gateway is assigned an Elastic IP address. However, the EC2 instance cannot reach the internet. The security group for the EC2 instance allows all outbound traffic. What is the MOST likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The public subnet's route table does not have a route to an internet gateway.
The NAT gateway is in the public subnet, but the public subnet's route table must have a route to an internet gateway (0.0.0.0/0 -> IGW) for the NAT gateway to forward traffic to the internet. Without that route, the NAT gateway cannot communicate with the internet. Option A is incorrect because NAT gateways do not use security groups. Option B is incorrect because the NAT gateway has an Elastic IP and is properly allocated; the issue is not with the Elastic IP. Option D is incorrect because the private subnet's route table already has a route to the NAT gateway (0.0.0.0/0 -> NAT), which is correctly configured.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The NAT gateway is not associated with a security group that allows outbound traffic.
Why it's wrong here
Incorrect. NAT gateways do not require or support security groups. They rely on route tables and network ACLs.
- ✗
The NAT gateway's Elastic IP address is not properly allocated.
Why it's wrong here
Incorrect. The NAT gateway has an Elastic IP assigned and is properly allocated. The Elastic IP being assigned does not cause the issue.
- ✓
The public subnet's route table does not have a route to an internet gateway.
Why this is correct
Correct. The public subnet's route table must have a route to an internet gateway (IGW) for the NAT gateway to send traffic to the internet. Without this route, the NAT gateway is unable to forward packets from the private subnet to the internet.
- ✗
The private subnet's route table does not have a route to the NAT gateway.
Why it's wrong here
Incorrect. The private subnet's route table already has a route to the NAT gateway (0.0.0.0/0 pointing to the NAT gateway), so this is not the problem.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.