ANS-C01 Network Design Practice Question
A company has a VPC with public and private subnets. An Amazon EC2 instance in a private subnet needs to download patches from the internet. The company wants to ensure that the instance cannot be directly initiated from the internet. Which design should be used?
⚠ Common exam trap
The ANS-C01 exam often tests the misconception that a NAT instance is equivalent to a NAT Gateway, but the exam emphasizes that a NAT Gateway is a managed service with automatic scaling and higher availability, making it the preferred design for production workloads.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach a NAT Gateway to the public subnet and add a route to the NAT Gateway in the private subnet's route table
A NAT Gateway in a public subnet allows outbound internet traffic from private subnets while preventing unsolicited inbound connections. Adding a route in the private subnet's route table pointing to the NAT Gateway enables the EC2 instance to download patches without being directly reachable from the internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Attach a NAT Gateway to the public subnet and add a route to the NAT Gateway in the private subnet's route table
Why this is correct
NAT Gateway enables outbound internet access from private subnets and does not allow inbound connections.
- ✗
Launch a NAT instance in the public subnet and add a route in the private subnet's route table
Why it's wrong here
A NAT instance can work but is less reliable and more effort to manage than a NAT Gateway.
- ✗
Use a VPC endpoint for Amazon S3 and route patch traffic through it
Why it's wrong here
VPC endpoints only provide access to AWS services, not to general internet resources.
- ✗
Add a route to the internet gateway in the private subnet's route table
Why it's wrong here
Instances in private subnets do not have public IPs, so traffic to the internet gateway would fail.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.