ANS-C01 Network Design Practice Question
A company has a VPC with multiple subnets. They want to ensure that all outbound traffic from EC2 instances in the VPC goes through a centralized NAT device for inspection. They have deployed a NAT instance in a public subnet and configured the route tables for private subnets to point to the NAT instance. However, traffic is not being routed through the NAT instance. What is the most likely cause?
⚠ Common exam trap
Many candidates assume the issue is a missing route or security group rule, overlooking the fact that EC2 instances by default cannot act as routers unless the source/destination check is explicitly disabled.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The source/destination check is enabled on the NAT instance.
The source/destination check is a security feature on EC2 instances that prevents them from forwarding traffic unless the instance is the source or destination of the packet. Since a NAT instance must forward traffic that it did not originate (e.g., from private instances to the internet), this check must be disabled. When enabled, the NAT instance drops packets that are not addressed to itself, breaking the routing of outbound traffic through it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The source/destination check is enabled on the NAT instance.
Why this is correct
By default, EC2 instances check that the source or destination of traffic matches their own IP. This must be disabled for NAT instances.
- ✗
The NAT instance does not have a public IP address.
Why it's wrong here
A NAT instance needs a public IP for internet access, but the question implies it is in a public subnet.
- ✗
The route table for the private subnets does not have a default route (0.0.0.0/0) pointing to the NAT instance.
Why it's wrong here
The description says the route tables are configured, so this is not the issue.
- ✗
The security group of the NAT instance blocks outbound traffic.
Why it's wrong here
While possible, the most common cause is source/destination check.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.