ANS-C01 Network Design Practice Question
A company has a VPC with public and private subnets in two Availability Zones. The private subnets need to access the internet for software updates. Which configuration meets this requirement securely?
⚠ Common exam trap
The ANS-C01 exam often tests the misconception that a route to an Internet Gateway in a private subnet route table provides secure outbound-only internet access, but in reality, an Internet Gateway enables bidirectional traffic, making private subnets publicly routable and insecure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a NAT Gateway in a public subnet and update the private subnet route tables to point 0.0.0.0/0 to the NAT Gateway.
A NAT Gateway placed in a public subnet with an Elastic IP allows instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections. The private subnet route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway's elastic network interface, which translates source private IPs to the NAT Gateway's Elastic IP using SNAT (Source Network Address Translation). This meets the requirement securely by maintaining the private subnets' isolation from direct internet exposure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deploy a NAT Gateway in a public subnet and update the private subnet route tables to point 0.0.0.0/0 to the NAT Gateway.
Why this is correct
Correct: NAT Gateway enables outbound internet access for private subnets.
- ✗
Attach an Internet Gateway to the VPC and add a route to 0.0.0.0/0 in the private subnet route tables pointing to the Internet Gateway.
Why it's wrong here
Wrong: Internet Gateway requires a public IP on the instance; private subnets cannot route directly to it.
- ✗
Create a VPC Peering connection to a second VPC that has an Internet Gateway and route all traffic through it.
Why it's wrong here
Wrong: VPC Peering does not support transitive internet access via an Internet Gateway.
- ✗
Configure a Virtual Private Gateway and use an AWS Direct Connect connection to the internet.
Why it's wrong here
Wrong: Virtual Private Gateway is for VPN connections, not for internet access.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.