ANS-C01 Network Design Practice Question
A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They have subnets in three Availability Zones. They need to add IPv6 connectivity to the VPC and allow instances in private subnets to initiate outbound IPv6 connections to the internet, but not allow inbound connections from the internet. Which TWO actions must be taken?
⚠ Common exam trap
The ANS-C01 exam often tests the distinction between an egress-only internet gateway (for outbound-only IPv6) and an internet gateway (for bidirectional IPv6), and the trap here is that candidates assume a NAT gateway or security group rules can substitute for the correct gateway type, ignoring that NAT gateways are IPv4-only and security groups are stateful and do not control inbound internet access at the routing layer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an egress-only internet gateway and add a route for ::/0 to it in the private subnet route tables.
An egress-only internet gateway (EIGW) is a horizontally scaled, redundant component that allows outbound IPv6 traffic from instances in private subnets to the internet, while preventing inbound connections initiated from the internet. Adding a route for ::/0 to the EIGW in the private subnet route tables enables this outbound-only IPv6 connectivity. Option C is correct because the VPC must have an associated IPv6 CIDR block (allocated from Amazon's pool or a BYOIP range) before any IPv6 routing or gateway functionality can be used.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an egress-only internet gateway and add a route for ::/0 to it in the private subnet route tables.
Why this is correct
An egress-only internet gateway allows outbound-only IPv6 traffic.
- ✗
Create an internet gateway and add a route for ::/0 to it in the private subnet route tables.
Why it's wrong here
An internet gateway allows inbound IPv6 traffic, which violates the requirement.
- ✓
Allocate an IPv6 CIDR block to the VPC.
Why this is correct
The VPC must have an IPv6 CIDR block to enable IPv6 communication.
- ✗
Create a NAT gateway in a public subnet.
Why it's wrong here
NAT gateways only support IPv4 traffic.
- ✗
Configure a security group that allows outbound IPv6 traffic.
Why it's wrong here
Security groups control traffic but are not a substitute for a gateway.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.