ANS-C01 Network Implementation Practice Question
A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download patches from the internet. The company has a NAT gateway in a public subnet. The EC2 instance can connect to other instances in the VPC but cannot reach the internet. What is the most likely cause?
⚠ Common exam trap
The ANS-C01 exam often tests the distinction between security groups, network ACLs, and route tables, and the trap here is that candidates assume a connectivity issue must be a firewall or ACL block, overlooking the fundamental requirement of a correct default route in the subnet's route table.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The route table in the private subnet does not have a default route to the NAT gateway.
For an EC2 instance in a private subnet to reach the internet via a NAT gateway, the private subnet's route table must include a default route (0.0.0.0/0) pointing to the NAT gateway as the target. Without this route, traffic destined for the internet has no path to the NAT gateway, so the instance can communicate within the VPC but cannot reach external hosts. Option D correctly identifies this missing route as the most likely cause.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security group of the EC2 instance blocks outbound HTTPS traffic.
Why it's wrong here
Security groups are stateful and allow outbound by default.
- ✗
The NAT gateway does not have an Elastic IP address.
Why it's wrong here
A NAT gateway fundamentally requires an Elastic IP address for its successful provisioning and operation, acting as the public, internet-routable IP for outbound connections. Therefore, if the company 'has' a NAT gateway, it must already possess an Elastic IP; its absence would prevent the gateway from existing in a functional state, not merely restrict internet access. This option is tempting because an Elastic IP is indeed crucial for a NAT gateway to function, and its omission would be a critical setup error if the question concerned initial deployment or a non-functional gateway.
- ✗
The network ACL of the private subnet blocks inbound traffic from the NAT gateway.
Why it's wrong here
NACLs are stateless; outbound rule is needed but route is primary issue.
- ✓
The route table in the private subnet does not have a default route to the NAT gateway.
Why this is correct
Missing default route prevents internet access.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.