ANS-C01 Network Design Practice Question
A company has a VPC with public and private subnets in two Availability Zones. The private subnets host EC2 instances that need to access the internet for software updates but must not be accessible from the internet. Which combination of resources meets these requirements with the least operational overhead?
⚠ Common exam trap
The ANS-C01 exam often tests the misconception that a VPC endpoint can replace a NAT Gateway for general internet access, but VPC endpoints only work for specific AWS services (like S3 or DynamoDB) and cannot reach arbitrary internet hosts for software updates.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A NAT Gateway in each public subnet, with a route in the private route tables pointing to the NAT Gateway
A NAT Gateway in each public subnet provides outbound-only internet access for instances in private subnets, with no inbound accessibility from the internet. This solution requires minimal operational overhead because NAT Gateways are fully managed by AWS, automatically handle failover across Availability Zones, and scale up to 45 Gbps without manual intervention. The private route table simply needs a default route (0.0.0.0/0) pointing to the NAT Gateway, which forwards traffic to the Internet Gateway attached to the VPC.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A VPC endpoint for Amazon S3 in each private subnet
Why it's wrong here
A VPC endpoint for Amazon S3 provides private connectivity to S3 only, not general internet access for software updates from arbitrary external repositories. It is tempting because it securely connects to a specific AWS service without an internet gateway, but the requirement is for outbound internet access to any host, which demands a NAT gateway or instance instead.
- ✓
A NAT Gateway in each public subnet, with a route in the private route tables pointing to the NAT Gateway
Why this is correct
NAT Gateway is managed and provides outbound internet access.
- ✗
A NAT instance in each public subnet, with a route in the private route tables pointing to the NAT instance
Why it's wrong here
NAT instances require manual patching and management.
- ✗
An Internet Gateway attached to the VPC with a route in the private route tables pointing to the Internet Gateway
Why it's wrong here
An Internet Gateway alone would not allow private instances to access the internet; they need a NAT device.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
5 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is designing a VPC with public and private subnets in two Availability Zones. The private subnets host databases that must be accessible only from the application servers in the public subnets. Which VPC feature should be used to allow the application servers to access the databases while preventing direct internet access to the databases?
easy- A.Create a VPC Peering connection between the public and private subnets.
- ✓ B.Attach a NAT Gateway in a public subnet and update the route table of the private subnets to point to the NAT Gateway for outbound traffic.
- C.Attach an Internet Gateway to the VPC and update the route table of the private subnets to point to the Internet Gateway.
- D.Attach a Virtual Private Gateway to the VPC and update the route table of the private subnets.
Why B: Although application servers in public subnets can reach databases in private subnets using private IPs within the VPC, a NAT Gateway enables instances in private subnets to initiate outbound connections to the internet (e.g., for software updates) while blocking inbound traffic from the internet. This meets the requirement to prevent direct internet access to the databases. The private subnet route table is updated to direct 0.0.0.0/0 traffic to the NAT Gateway, and because there is no route to an Internet Gateway, the databases remain inaccessible from the internet.
Variation 2. A company has a VPC with public and private subnets in two Availability Zones. The private subnets host EC2 instances that need to access the internet for software updates. The company must ensure that traffic from the private instances uses a single, predictable public IP address. What is the MOST cost-effective solution?
medium- A.Attach an Internet Gateway to the VPC and update the private subnet route table with a default route to the Internet Gateway.
- B.Create a Transit Gateway with a VPC attachment and route traffic through a central egress VPC.
- ✓ C.Deploy a NAT Gateway in a public subnet in one Availability Zone, and route private subnet traffic to it.
- D.Launch a NAT instance in a public subnet and configure source/destination check.
Why C: A NAT Gateway in a public subnet provides outbound-only internet access for private instances, and it uses a single Elastic IP address, ensuring a predictable public IP. This is the most cost-effective managed solution, as NAT Gateways are highly available within an Availability Zone and require no manual instance management.
Variation 3. A company has a VPC with public and private subnets in two Availability Zones. The private subnets need to access the internet for software updates. Which configuration meets this requirement securely?
easy- ✓ A.Deploy a NAT Gateway in a public subnet and update the private subnet route tables to point 0.0.0.0/0 to the NAT Gateway.
- B.Attach an Internet Gateway to the VPC and add a route to 0.0.0.0/0 in the private subnet route tables pointing to the Internet Gateway.
- C.Create a VPC Peering connection to a second VPC that has an Internet Gateway and route all traffic through it.
- D.Configure a Virtual Private Gateway and use an AWS Direct Connect connection to the internet.
Why A: A NAT Gateway placed in a public subnet with an Elastic IP allows instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections. The private subnet route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway's elastic network interface, which translates source private IPs to the NAT Gateway's Elastic IP using SNAT (Source Network Address Translation). This meets the requirement securely by maintaining the private subnets' isolation from direct internet exposure.
Variation 4. A company has a VPC with public and private subnets in three Availability Zones. They want to provide outbound internet access to instances in private subnets while preventing inbound traffic from the internet. Which solution meets these requirements with the least operational overhead?
medium- A.Deploy a NAT instance in a public subnet and configure the private subnet route table to point to it.
- B.Attach an Internet Gateway to the VPC and add a default route to it in the private subnet route table.
- ✓ C.Create a NAT Gateway in a public subnet and add a default route in the private subnet route table pointing to the NAT Gateway.
- D.Create a VPC Gateway Endpoint for Amazon S3 and route outbound traffic through it.
Why C: A NAT Gateway is a fully managed AWS service that provides outbound internet access for instances in private subnets while blocking unsolicited inbound connections. By placing the NAT Gateway in a public subnet and adding a default route (0.0.0.0/0) in the private subnet route table pointing to the NAT Gateway, traffic from private instances is source NATed to the NAT Gateway's Elastic IP, ensuring inbound traffic from the internet cannot reach the private instances. This solution offers the least operational overhead as AWS handles scaling, patching, and availability, unlike a self-managed NAT instance.
Variation 5. A company has a VPC with public and private subnets in three Availability Zones. The company hosts a web application on Amazon EC2 instances in the private subnets. The instances need to download security patches from the internet but must not be directly accessible from the internet. Which solution meets these requirements with the least operational overhead?
easy- A.Deploy a NAT instance in a public subnet and configure the private subnet route tables to point to the NAT instance.
- B.Attach an internet gateway to the VPC and add a default route to the internet gateway in the private subnet route tables.
- C.Create a VPC endpoint for Amazon S3 and configure the instances to use the endpoint.
- ✓ D.Deploy a NAT gateway in each public subnet and configure the private subnet route tables to point to the respective NAT gateway.
Why D: A NAT gateway is a fully managed AWS service that provides outbound internet connectivity for instances in private subnets while preventing inbound internet access. Deploying a NAT gateway in each public subnet across three Availability Zones ensures high availability and fault tolerance, and configuring private subnet route tables with a default route (0.0.0.0/0) pointing to the respective NAT gateway meets the requirement with minimal operational overhead, as AWS handles patching and scaling.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.