ANS-C01 Network Security, Compliance and Governance Practice Question
A company has a VPC with multiple subnets and is using Network Access Analyzer to identify unintended network access. It reports that an EC2 instance in a private subnet has a route to an internet gateway. Which two actions should be taken to remediate this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ensure the EC2 instance does not have a public IP address
The Network Access Analyzer report indicates that the EC2 instance in a private subnet has an unintended route to an internet gateway. To remediate this, two actions are needed: (1) Remove the route to the internet gateway from the subnet's route table, which eliminates the direct path to the internet. (2) Ensure the EC2 instance does not have a public IP address, because even without a route, a public IP could allow direct internet access via the internet gateway. Option A directly addresses the public IP, and option B fixes the route table. Options C (assigning a public IP) would worsen the issue. Option D (updating security group to deny outbound 0.0.0.0/0) does not affect routing and would not remove the internet gateway route. Option E (attaching a NAT gateway) would add another internet route, not remove the existing one.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Ensure the EC2 instance does not have a public IP address
Why this is correct
Without a public IP, internet traffic is not possible even with route.
- ✓
Remove the route to the internet gateway from the subnet's route table
Why this is correct
This removes the direct path to the internet.
- ✗
Assign a public IP address to the instance
Why it's wrong here
This would increase exposure.
- ✗
Update the security group to deny outbound traffic to 0.0.0.0/0
Why it's wrong here
Security groups do not control routing.
- ✗
Attach a NAT gateway to the private subnet
Why it's wrong here
A NAT gateway would still provide internet access.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.