ANS-C01 Network Implementation Practice Question
A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company wants to ensure that traffic can only go out to the internet and not be initiated from the internet. Which configuration should be used?
⚠ Common exam trap
Watch out — candidates often confuse an Internet Gateway with a NAT Gateway, assuming both provide outbound-only access, but an Internet Gateway enables bidirectional traffic and requires public IPs on instances, while a NAT Gateway specifically allows outbound-only initiation from private instances.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a NAT Gateway in a public subnet and update the private subnet route table
A NAT Gateway deployed in a public subnet with an Elastic IP allows private subnet instances to initiate outbound traffic to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. The private subnet’s route table must include a default route (0.0.0.0/0) pointing to the NAT Gateway, which translates the private source IP to the gateway’s Elastic IP for return traffic. This meets the requirement of outbound-only internet access without exposing private instances to inbound initiation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attach an Internet Gateway to the private subnets
Why it's wrong here
Internet Gateway allows bidirectional traffic, which is not desired.
- ✓
Deploy a NAT Gateway in a public subnet and update the private subnet route table
Why this is correct
A NAT Gateway deployed in a public subnet with an Elastic IP enables outbound-only internet access for instances in private subnets, because the gateway translates private source IPs to the public IP and drops unsolicited inbound traffic. This satisfies the constraint that traffic can only be initiated from the private subnets, not from the internet.
- ✗
Set up a VPN connection to an on-premises network
Why it's wrong here
VPN is for private connectivity, not internet access.
- ✗
Create a VPC endpoint for S3
Why it's wrong here
VPC endpoints are for AWS services, not general internet access.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download software patches from the internet. Which AWS service should be used to provide outbound internet access without allowing inbound traffic?
easy- A.Site-to-Site VPN connection
- B.VPC endpoint
- ✓ C.NAT gateway
- D.Internet gateway
Why C: A NAT gateway enables EC2 instances in a private subnet to initiate outbound IPv4 traffic to the internet (e.g., to download patches) while preventing any unsolicited inbound traffic from the internet. It resides in a public subnet with an Elastic IP and performs source network address translation (SNAT), replacing the private source IP with the gateway's public IP. This satisfies the requirement of outbound-only internet access without exposing the private instances to inbound connections.
Variation 2. A company has a VPC with a public subnet and a private subnet. They launch an EC2 instance in the private subnet with a private IP only. The instance needs to download patches from the internet. Which configuration is required?
medium- A.Launch a NAT instance in the private subnet and configure source/destination check.
- B.Create a VPC endpoint for the patch service.
- ✓ C.Create a NAT gateway in the public subnet and add a default route to the NAT gateway in the private subnet's route table.
- D.Attach an internet gateway to the VPC and add a default route to it in the private subnet's route table.
Why C: A NAT gateway in the public subnet provides outbound internet access for instances in the private subnet while preventing inbound connections from the internet. By adding a default route (0.0.0.0/0) in the private subnet's route table pointing to the NAT gateway, traffic from the EC2 instance destined for the internet is forwarded to the NAT gateway, which then uses its Elastic IP to communicate with the internet. This allows the instance to download patches without requiring a public IP or direct internet gateway access.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.