Courseiva
Network Security, Compliance and GovernancehardMultiple SelectObjective-mapped

ANS-C01 Network Security, Compliance and Governance Practice Question

A company has a VPC with multiple subnets and is using Network Access Analyzer to identify unintended network access. It reports that an EC2 instance in a private subnet has a route to an internet gateway. Which two actions should be taken to remediate this?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Ensure the EC2 instance does not have a public IP address

The Network Access Analyzer report indicates that the EC2 instance in a private subnet has an unintended route to an internet gateway. To remediate this, two actions are needed: (1) Remove the route to the internet gateway from the subnet's route table, which eliminates the direct path to the internet. (2) Ensure the EC2 instance does not have a public IP address, because even without a route, a public IP could allow direct internet access via the internet gateway. Option A directly addresses the public IP, and option B fixes the route table. Options C (assigning a public IP) would worsen the issue. Option D (updating security group to deny outbound 0.0.0.0/0) does not affect routing and would not remove the internet gateway route. Option E (attaching a NAT gateway) would add another internet route, not remove the existing one.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Ensure the EC2 instance does not have a public IP address

    Why this is correct

    Without a public IP, internet traffic is not possible even with route.

  • Remove the route to the internet gateway from the subnet's route table

    Why this is correct

    This removes the direct path to the internet.

  • Assign a public IP address to the instance

    Why it's wrong here

    This would increase exposure.

  • Update the security group to deny outbound traffic to 0.0.0.0/0

    Why it's wrong here

    Security groups do not control routing.

  • Attach a NAT gateway to the private subnet

    Why it's wrong here

    A NAT gateway would still provide internet access.

Visual reference

Inside (Private) PC-A 10.0.0.1 PC-B 10.0.0.2 NAT Router Outside (Public) 203.0.113.1 Inside Global Server PAT: many private IPs share one public IP via unique port numbers

About these practice questions

This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.