ANS-C01 Network Design Practice Question
A company has a VPC with public and private subnets. They launch an EC2 instance in a private subnet and need it to access the internet. Which combination of components is required?
⚠ Common exam trap
Watch out — candidates often confuse a NAT Gateway with a NAT instance, assuming both can be placed in any subnet, or they incorrectly think a default route to an IGW in a private subnet provides outbound-only access, not realizing the IGW enables bidirectional traffic and thus exposes the instance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A NAT Gateway in a public subnet and a default route (0.0.0.0/0) in the private subnet's route table pointing to the NAT Gateway
A NAT Gateway in a public subnet provides outbound-only internet access for instances in private subnets. A default route (0.0.0.0/0) in the private subnet's route table pointing to the NAT Gateway ensures traffic destined for the internet is forwarded to the NAT Gateway, which then translates the source IP to its own Elastic IP and sends the traffic through the Internet Gateway (IGW) attached to the public subnet. This combination allows the EC2 instance to initiate outbound connections (e.g., for software updates) while remaining unreachable from the internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A NAT Gateway in a public subnet and a default route (0.0.0.0/0) in the private subnet's route table pointing to the NAT Gateway
Why this is correct
This allows instances in private subnets to initiate outbound internet traffic through the NAT Gateway.
- ✗
A NAT instance in the private subnet with a route to an Internet Gateway
Why it's wrong here
A NAT instance should be in a public subnet, not private.
- ✗
A VPC Gateway Endpoint for S3 in the private subnet
Why it's wrong here
Gateway Endpoints only provide access to specific AWS services, not general internet.
- ✗
An Internet Gateway (IGW) attached to the VPC and a default route (0.0.0.0/0) in the private subnet's route table pointing to the IGW
Why it's wrong here
Private subnets should not have a direct route to an IGW; that would make them public.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
5 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance is behind a NAT Gateway in the public subnet. The download is failing. Which configuration should the network engineer check FIRST?
medium- A.The network ACL for the private subnet allows inbound HTTP/HTTPS traffic.
- B.The EC2 instance has a public IP address assigned.
- C.The Internet Gateway is attached to the private subnet.
- ✓ D.The route table associated with the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway.
Why D: For an EC2 instance in a private subnet to reach the internet via a NAT Gateway, the private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway. Without this route, traffic from the instance destined for the internet has no path to the NAT Gateway, causing the download to fail.
Variation 2. A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company does not want to assign public IP addresses to the instance. Which combination of resources is required? (Choose TWO.)
medium- A.VPN connection to the on-premises data center
- ✓ B.NAT Gateway in a public subnet
- C.VPC endpoint for Amazon S3
- ✓ D.Internet Gateway attached to the VPC
Why B: A NAT Gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway. An Internet Gateway is needed for the NAT Gateway to reach the internet, but the question asks for resources; the IGW is already implied. A VPC endpoint is for AWS services, not internet. A VPN connection is for on-premises connectivity.
Variation 3. A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download updates from the internet. The company wants to minimize costs and avoid exposing the instance to inbound internet traffic. Which solution should the engineer choose?
medium- A.Deploy a NAT instance in the private subnet and route traffic through it.
- ✓ B.Deploy a NAT Gateway in the public subnet and add a route in the private subnet route table pointing to the NAT Gateway.
- C.Configure a forward proxy on the EC2 instance itself.
- D.Attach an internet gateway to the VPC and add a route to the internet gateway in the private subnet's route table.
Why B: A NAT Gateway in the public subnet allows instances in the private subnet to initiate outbound connections to the internet (e.g., for updates) while remaining unreachable from inbound internet traffic. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway, which then uses the Internet Gateway for outbound traffic. This is the most cost-effective and fully managed solution compared to a NAT instance, as it avoids per-instance management and scales automatically.
Variation 4. A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company has created a NAT gateway in the public subnet and added a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway. However, the EC2 instance cannot reach the internet. The network engineer verifies that the NAT gateway has an Elastic IP address, the security group and network ACLs allow outbound traffic, and the route table for the public subnet has a route to an internet gateway. What is the most likely cause of the issue?
easy- A.The security group for the EC2 instance does not allow outbound traffic.
- B.The route table associated with the NAT gateway's subnet does not have a route to an internet gateway.
- ✓ C.The route table for the private subnet does not have a route to the NAT gateway.
- D.The NAT gateway does not have an Elastic IP address assigned.
Why C: The scenario states that a route pointing 0.0.0.0/0 to the NAT gateway was added to the private subnet's route table, but if that route table is not properly associated with the private subnet, or if the route was added but the target is incorrect (e.g., pointing to the wrong NAT gateway ID), the EC2 instance will not be able to send traffic through the NAT gateway. The verification that the route exists might have been insufficient. Option C points out that the route table for the private subnet does not have a route to the NAT gateway, which would directly cause the issue. The other options are contradicted by the verification steps performed by the engineer.
Variation 5. A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download patches from the internet. Which configuration will allow this without exposing the instance to inbound internet traffic?
medium- A.Use VPC Gateway Endpoints for S3 and DynamoDB.
- B.Attach an Internet Gateway to the VPC and assign a public IP to the instance.
- ✓ C.Deploy a NAT Gateway in a public subnet and update the private subnet's route table to point default route to the NAT Gateway.
- D.Configure a VPN connection from the VPC to an on-premises network that has internet access.
Why C: A NAT Gateway, deployed in a public subnet with an Internet Gateway, allows outbound IPv4 traffic from private subnets to the internet while preventing unsolicited inbound connections. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway, enabling the EC2 instance to download patches without being directly exposed.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.