ANS-C01 Network Security, Compliance and Governance Practice Question
A company has a VPC with public and private subnets. They have an EC2 instance in a private subnet that needs to access the internet for software updates. Which solution provides internet access while keeping the instance private?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a NAT gateway in a public subnet, and update the private subnet's route table to point 0.0.0.0/0 to the NAT gateway.
A NAT gateway in a public subnet allows instances in private subnets to initiate outbound internet traffic while preventing inbound traffic from the internet. Option B is correct. Option A (internet gateway) would expose the instance to inbound traffic if assigned a public IP. Option C (VPC peering) does not provide internet access. Option D (VPC endpoint) only provides access to specific AWS services, not general internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attach an internet gateway to the VPC and assign a public IP to the EC2 instance.
Why it's wrong here
This would make the instance publicly accessible, violating the private subnet requirement.
- ✓
Create a NAT gateway in a public subnet, and update the private subnet's route table to point 0.0.0.0/0 to the NAT gateway.
Why this is correct
The NAT gateway enables outbound internet traffic while keeping the instance private.
- ✗
Use an AWS PrivateLink VPC endpoint for the software update service.
Why it's wrong here
VPC endpoints only provide connectivity to specific AWS services, not general internet access.
- ✗
Set up a VPC peering connection with another VPC that has internet access.
Why it's wrong here
A VPC peering connection does not provide a default route to the internet for the peered instance; it only enables private IP routing between two VPCs. The instance in the private subnet would still lack a route to an internet gateway unless the peer VPC’s NAT gateway or internet gateway is explicitly configured as a next hop, which is not a standard peering behaviour. This option is tempting because VPC peering is commonly used to share resources across VPCs, and it would be correct if the goal were to access services in the peer VPC, not the public internet.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.