ANS-C01 Network Design Practice Question
A company has a VPC with public and private subnets in three Availability Zones. The company hosts a web application on Amazon EC2 instances in the private subnets. The instances need to download security patches from the internet but must not be directly accessible from the internet. Which solution meets these requirements with the least operational overhead?
⚠ Common exam trap
AWS often tests the distinction between managed NAT gateways and self-managed NAT instances, where candidates may choose the NAT instance option (A) due to lower cost, overlooking the 'least operational overhead' requirement, or they may incorrectly select the VPC endpoint option (C) thinking it provides general internet access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a NAT gateway in each public subnet and configure the private subnet route tables to point to the respective NAT gateway.
A NAT gateway is a fully managed AWS service that provides outbound internet connectivity for instances in private subnets while preventing inbound internet access. Deploying a NAT gateway in each public subnet across three Availability Zones ensures high availability and fault tolerance, and configuring private subnet route tables with a default route (0.0.0.0/0) pointing to the respective NAT gateway meets the requirement with minimal operational overhead, as AWS handles patching and scaling.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy a NAT instance in a public subnet and configure the private subnet route tables to point to the NAT instance.
Why it's wrong here
NAT instances require manual patching and failover.
- ✗
Attach an internet gateway to the VPC and add a default route to the internet gateway in the private subnet route tables.
Why it's wrong here
Private subnets would be directly accessible from the internet.
- ✗
Create a VPC endpoint for Amazon S3 and configure the instances to use the endpoint.
Why it's wrong here
VPC endpoints only provide access to AWS services, not general internet.
- ✓
Deploy a NAT gateway in each public subnet and configure the private subnet route tables to point to the respective NAT gateway.
Why this is correct
Managed service, highly available, minimal operational overhead.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.