The correct combination is a NAT Gateway in a public subnet and a default route (0.0.0.0/0) in the private subnet’s route table pointing to that NAT Gateway. This works because the NAT Gateway, residing in a public subnet with an Internet Gateway attached, performs source network address translation, allowing private instances to initiate outbound internet traffic while blocking inbound connections. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this concept tests your understanding of how private subnet internet access is achieved through proper route configuration and component placement, often appearing as a distractor where candidates confuse NAT Gateways with Internet Gateways or VPC Endpoints. A common trap is assuming an Internet Gateway alone suffices for private subnets, but it requires a public route table association. Memory tip: think of the NAT Gateway as the “private subnet’s proxy” — it lives in the public zone but serves the private zone, and the route table is its invitation to the party.
ANS-C01 Network Design Practice Question
This ANS-C01 practice question tests your understanding of network design. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company has a VPC with public and private subnets. They launch an EC2 instance in a private subnet and need it to access the internet. Which combination of components is required?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A NAT Gateway in a public subnet and a default route (0.0.0.0/0) in the private subnet's route table pointing to the NAT Gateway
Option D is correct because a NATGateway in a public subnet with a route in the private subnet's route table pointing to the NAT Gateway provides internet access. Option A is wrong because an Internet Gateway alone is not enough; it must be attached to the VPC and the route table must point to it. Option B is wrong because a NAT Instance is also a solution but the question asks for a combination. Option C is wrong because a VPC endpoint is for accessing AWS services, not the internet.
Key principle: Count usable hosts — not total addresses — and remember that the network and broadcast addresses are not available to hosts in standard IPv4 subnets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
A NAT Gateway in a public subnet and a default route (0.0.0.0/0) in the private subnet's route table pointing to the NAT Gateway
Why this is correct
This allows instances in private subnets to initiate outbound internet traffic through the NATGateway.
A NAT instance in the private subnet with a route to an Internet Gateway
Why it's wrong here
A NAT instance should be in a public subnet, not private.
✗
A VPC Gateway Endpoint for S3 in the private subnet
Why it's wrong here
Gateway Endpoints only provide access to specific AWS services, not general internet.
✗
An Internet Gateway (IGW) attached to the VPC and a default route (0.0.0.0/0) in the private subnet's route table pointing to the IGW
Why it's wrong here
Private subnets should not have a direct route to an IGW; that would make them public.
Common exam traps
Common exam trap: usable hosts are not the same as total addresses
Subnetting questions often tempt you into counting all addresses. In normal IPv4 subnets, the network and broadcast addresses are not usable host addresses.
Detailed technical explanation
How to think about this question
Subnetting questions test whether you can identify the network, broadcast address, usable range, mask and correct subnet. Slow down enough to calculate the block size correctly.
KKey Concepts to Remember
CIDR notation defines the prefix length.
Block size helps identify subnet boundaries.
Network and broadcast addresses are not usable hosts in normal IPv4 subnets.
The required host count determines the smallest suitable subnet.
TExam Day Tips
→Write the block size before choosing the subnet.
→Check whether the question asks for hosts, subnets or a specific address range.
→Do not confuse /24, /25, /26 and /27 host counts.
Key takeaway
Count usable hosts — not total addresses — and remember that the network and broadcast addresses are not available to hosts in standard IPv4 subnets.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
What to study next
Got this wrong? Here's your next step.
Review block sizes, usable host formulas (2^n − 2), and how to find network and broadcast addresses for /24 through /30. Then practise related ANS-C01 subnetting questions on CIDR, address ranges, and subnet selection.
Network Design — This question tests Network Design — CIDR notation defines the prefix length..
What is the correct answer to this question?
The correct answer is: A NAT Gateway in a public subnet and a default route (0.0.0.0/0) in the private subnet's route table pointing to the NAT Gateway — Option D is correct because a NAT Gateway in a public subnet with a route in the private subnet's route table pointing to the NAT Gateway provides internet access. Option A is wrong because an Internet Gateway alone is not enough; it must be attached to the VPC and the route table must point to it. Option B is wrong because a NAT Instance is also a solution but the question asks for a combination. Option C is wrong because a VPC endpoint is for accessing AWS services, not the internet.
What should I do if I get this ANS-C01 question wrong?
Review block sizes, usable host formulas (2^n − 2), and how to find network and broadcast addresses for /24 through /30. Then practise related ANS-C01 subnetting questions on CIDR, address ranges, and subnet selection.
What is the key concept behind this question?
CIDR notation defines the prefix length.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance is behind a NAT Gateway in the public subnet. The download is failing. Which configuration should the network engineer check FIRST?
medium
A.The network ACL for the private subnet allows inbound HTTP/HTTPS traffic.
B.The EC2 instance has a public IP address assigned.
C.The Internet Gateway is attached to the private subnet.
✓ D.The route table associated with the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway.
Why D: Option D is correct because for an EC2 instance in a private subnet to reach the internet via a NAT Gateway, the private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway. Without this route, traffic from the instance destined for the internet has no path to the NAT Gateway, causing the download to fail.
Variation 2. A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company does not want to assign public IP addresses to the instance. Which combination of resources is required? (Choose TWO.)
medium
A.VPN connection to the on-premises data center
✓ B.NAT Gateway in a public subnet
C.VPC endpoint for Amazon S3
✓ D.Internet Gateway attached to the VPC
Why B: A NAT Gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway. An Internet Gateway is needed for the NAT Gateway to reach the internet, but the question asks for resources; the IGW is already implied. A VPC endpoint is for AWS services, not internet. A VPN connection is for on-premises connectivity.
Variation 3. A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download updates from the internet. The company wants to minimize costs and avoid exposing the instance to inbound internet traffic. Which solution should the engineer choose?
medium
A.Deploy a NAT instance in the private subnet and route traffic through it.
✓ B.Deploy a NAT Gateway in the public subnet and add a route in the private subnet route table pointing to the NAT Gateway.
C.Configure a forward proxy on the EC2 instance itself.
D.Attach an internet gateway to the VPC and add a route to the internet gateway in the private subnet's route table.
Why B: Option C is correct because a NAT Gateway in the public subnet allows outbound internet access from private instances while blocking inbound traffic. Option A is wrong because a NAT instance is more expensive and less managed. Option B is wrong because an internet gateway alone does not allow private instances to reach the internet. Option D is wrong because a proxy would need to be managed and adds latency.
Variation 4. A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company has created a NAT gateway in the public subnet and added a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway. However, the EC2 instance cannot reach the internet. The network engineer verifies that the NAT gateway has an Elastic IP address, the security group and network ACLs allow outbound traffic, and the route table for the public subnet has a route to an internet gateway. What is the most likely cause of the issue?
easy
A.The security group for the EC2 instance does not allow outbound traffic.
✓ B.The route table associated with the NAT gateway's subnet does not have a route to an internet gateway.
C.The route table for the private subnet does not have a route to the NAT gateway.
D.The NAT gateway does not have an Elastic IP address assigned.
Why B: Option D is correct. The NAT gateway must be in a public subnet with a route to an internet gateway. The question states the public subnet has that route, so that's fine. However, the NAT gateway itself needs to be associated with a route table that has a route to the internet gateway. The most likely cause is that the NAT gateway's route table does not have a default route to the internet gateway. Option A is incorrect because the NAT gateway has an Elastic IP. Option B is incorrect because the security group is not the issue. Option C is incorrect because the private subnet's route is correct.
Variation 5. A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download patches from the internet. Which configuration will allow this without exposing the instance to inbound internet traffic?
medium
A.Use VPC Gateway Endpoints for S3 and DynamoDB.
B.Attach an Internet Gateway to the VPC and assign a public IP to the instance.
✓ C.Deploy a NAT Gateway in a public subnet and update the private subnet's route table to point default route to the NAT Gateway.
D.Configure a VPN connection from the VPC to an on-premises network that has internet access.
Why C: Option B is correct. A NAT Gateway in a public subnet allows outbound internet traffic from private instances while preventing inbound traffic from the internet. Option A is wrong because an Internet Gateway alone does not provide outbound-only access; it would require a public IP and could allow inbound traffic. Option C is wrong because a VPN does not provide internet access. Option D is wrong because VPC endpoints are for AWS services, not general internet.
Last reviewed: Jun 20, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.