ANS-C01 Network Design Practice Question
A company has a VPC with public and private subnets in two Availability Zones. The private subnets host EC2 instances that need to access the internet for software updates. The company must ensure that traffic from the private instances uses a single, predictable public IP address. What is the MOST cost-effective solution?
⚠ Common exam trap
A common mix-up: candidates choose Option D (NAT instance) thinking it is cheaper, but they overlook the operational overhead and the fact that a NAT Gateway is fully managed and more cost-effective when factoring in maintenance and availability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a NAT Gateway in a public subnet in one Availability Zone, and route private subnet traffic to it.
A NAT Gateway in a public subnet provides outbound-only internet access for private instances, and it uses a single Elastic IP address, ensuring a predictable public IP. This is the most cost-effective managed solution, as NAT Gateways are highly available within an Availability Zone and require no manual instance management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attach an Internet Gateway to the VPC and update the private subnet route table with a default route to the Internet Gateway.
Why it's wrong here
Private subnets cannot route directly to an IGW; they need a NAT device.
- ✗
Create a Transit Gateway with a VPC attachment and route traffic through a central egress VPC.
Why it's wrong here
Overly complex and costly for this simple requirement.
- ✓
Deploy a NAT Gateway in a public subnet in one Availability Zone, and route private subnet traffic to it.
Why this is correct
Correct: A single NAT Gateway provides outbound internet with a predictable IP, and is cost-effective.
- ✗
Launch a NAT instance in a public subnet and configure source/destination check.
Why it's wrong here
NAT instances are less available and require manual management.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.