Troubleshooting NAT Gateway: Private Subnet Internet Access Fails
A company has a VPC with public and private subnets. The private subnets use a NAT gateway for outbound internet access. The security team notices that some EC2 instances in the private subnets are able to reach the internet, but others are not. All instances have the same security group and are in the same private subnet. What is the most likely cause?
⚠ Common exam trap
Candidates might assume that all subnet-level configurations (route tables, NACLs) affect all instances uniformly, but they overlook that the NAT gateway's security group can filter traffic from specific sources, causing differential access within the same subnet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The NAT gateway's security group is blocking traffic from some instances.
The most likely cause is that the NAT gateway's security group (attached to its elastic network interface) is blocking traffic from some instances. Although all EC2 instances are in the same private subnet and have the same security group, the NAT gateway's own security group can be configured to allow outbound traffic only from specific source IPs or security groups. If the NAT gateway's security group only permits traffic from certain instances' private IPs (or security groups) within the subnet, it would allow some instances to reach the internet while blocking others. Option A is incorrect because a missing route would affect all instances in that subnet equally. Option B is incorrect because a network ACL applies to the entire subnet and would block all instances. Option D is incorrect because the internet gateway is attached to the VPC, not directly to private subnets, and its absence would prevent all internet access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The route table associated with the private subnet is missing a default route to the NAT gateway.
Why it's wrong here
Incorrect. If the route table were missing the default route to the NAT gateway, every instance in that private subnet would be unable to reach the internet. The question states that some instances can reach the internet, so this cannot be the cause.
- ✗
The network ACL is blocking outbound traffic on ephemeral ports.
Why it's wrong here
Incorrect. Network ACLs are stateless and apply to all instances in the subnet equally. If the NACL blocked outbound ephemeral ports, all instances would be affected, not just some.
- ✓
The NAT gateway's security group is blocking traffic from some instances.
Why this is correct
Correct. The NAT gateway has an elastic network interface with a security group. If that security group is configured to allow traffic only from specific instances (e.g., based on private IP addresses or security group IDs), it can selectively permit or deny outbound internet access for instances in the same private subnet.
- ✗
The internet gateway is not attached to the VPC.
Why it's wrong here
Incorrect. The internet gateway is attached to the VPC, and its presence or absence does not affect individual subnets directly. If the IGW were not attached, no instances in any subnet (including public ones) would have internet access. Since some private instances can reach the internet, the IGW is working correctly.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company's VPC includes a public subnet with a NAT gateway and a private subnet with EC2 instances. The EC2 instances in the private subnet need to access the internet for software updates. The NAT gateway's Elastic IP is associated correctly, and the route tables are configured. However, the EC2 instances cannot reach the internet. What is the most likely cause?
medium- A.The NAT gateway is in the private subnet.
- ✓ B.The route table for the private subnet is missing a default route pointing to the NAT gateway.
- C.The network ACL for the private subnet is blocking outbound traffic.
- D.The security group for the EC2 instances does not allow outbound traffic.
Why B: The most common issue is that the route table for the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT gateway. Without this route, traffic from the private subnet cannot be directed to the NAT gateway, and thus cannot reach the internet.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.