ANS-C01 Network Management and Operations Practice Question
A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company has a NAT Gateway in the public subnet. The network team notices that instances in the private subnets cannot reach the internet. The route table for the private subnets has a default route (0.0.0.0/0) pointing to the NAT Gateway. What could be the issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The NAT Gateway is in a private subnet
The NAT Gateway must be in a public subnet with an internet gateway route to function. Option A is wrong because the NAT Gateway itself does not have a route; the route table of the subnet where it resides needs a route to the internet gateway. Option C is wrong because security groups are for instances, not NAT Gateways. Option D is wrong because VPC endpoints are for specific AWS services, not general internet access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The NAT Gateway does not have a route to the internet gateway
Why it's wrong here
NAT Gateway is not a routing entity; the subnet's route table must have a route to IGW.
- ✓
The NAT Gateway is in a private subnet
Why this is correct
For a NAT Gateway to route traffic from private subnets to the internet, it must reside in a public subnet with an associated route table that includes a default route (0.0.0.0/0) pointing to an internet gateway. Placing the NAT Gateway in a private subnet breaks this requirement, as the gateway itself has no path to the internet, so it cannot forward outbound traffic from the private instances.
- ✗
The VPC does not have a VPC endpoint for the software update service
Why it's wrong here
VPC endpoints are for specific services, not general internet.
- ✗
The security group attached to the NAT Gateway is blocking traffic
Why it's wrong here
NAT Gateways do not have security groups.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a VPC with public and private subnets. An EC2 instance in the private subnet needs to access the internet. The instance has a route table with a default route to a NAT gateway. However, the instance cannot reach the internet. What is the most likely cause?
easy- ✓ A.The NAT gateway is placed in a private subnet.
- B.The instance does not have a public IP address assigned.
- C.The security group attached to the instance does not allow outbound HTTPS traffic.
- D.The network ACL on the private subnet blocks outbound HTTP traffic.
Why A: The most likely cause is that the NAT gateway is placed in a private subnet (Option A). A NAT gateway must be deployed in a public subnet with an associated Internet Gateway to route traffic to the internet. If it is in a private subnet, it cannot access the internet, thus the instance in the private subnet cannot reach the internet. Option B is incorrect because an instance in a private subnet does not need a public IP address to access the internet through a NAT gateway; it uses the NAT gateway's public IP. Option C is incorrect because security groups are stateful and allow outbound traffic by default; the security group would not block HTTPS outbound unless explicitly configured. Option D is incorrect because the default network ACL allows all outbound traffic; even if modified, the question says the route table points to the NAT gateway, so the issue is the NAT gateway's placement.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.