ANS-C01 Network Design Practice Question
A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download patches from the internet. Which configuration will allow this without exposing the instance to inbound internet traffic?
⚠ Common exam trap
Many candidates confuse NAT Gateways with NAT Instances or assume that a VPC Gateway Endpoint (Option A) provides general internet access, when in fact it only works for specific AWS services like S3 and DynamoDB.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a NAT Gateway in a public subnet and update the private subnet's route table to point default route to the NAT Gateway.
A NAT Gateway, deployed in a public subnet with an Internet Gateway, allows outbound IPv4 traffic from private subnets to the internet while preventing unsolicited inbound connections. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway, enabling the EC2 instance to download patches without being directly exposed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use VPC Gateway Endpoints for S3 and DynamoDB.
Why it's wrong here
Gateway Endpoints provide access only to specific AWS services, not the internet.
- ✗
Attach an Internet Gateway to the VPC and assign a public IP to the instance.
Why it's wrong here
Assigning a public IP exposes the instance to inbound traffic.
- ✓
Deploy a NAT Gateway in a public subnet and update the private subnet's route table to point default route to the NAT Gateway.
Why this is correct
NAT Gateway provides outbound internet access without inbound access.
- ✗
Configure a VPN connection from the VPC to an on-premises network that has internet access.
Why it's wrong here
This does not provide direct internet access for the instance.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.