ANS-C01 Network Design Practice Question
A company has a VPC with public and private subnets. They want to implement a bastion host to allow secure SSH access to instances in private subnets. Which TWO components are required for this design?
⚠ Common exam trap
AWS often tests the misconception that a NAT gateway is required for inbound SSH access to private instances, when in fact it only provides outbound internet access and cannot initiate inbound connections from the internet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A bastion host deployed in a public subnet
A bastion host must be deployed in a public subnet because it needs direct internet access via an Internet Gateway (IGW) to allow administrators to initiate SSH connections from the internet. The bastion then acts as a jump box, forwarding SSH traffic to private instances. Security group rules on the private instances must explicitly allow inbound SSH (TCP port 22) from the bastion host's private IP or security group, ensuring that only the bastion can reach them, not the internet directly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A bastion host deployed in a public subnet
Why this is correct
Bastion must be publicly accessible.
- ✗
A NAT gateway in the public subnet
Why it's wrong here
Not needed for inbound SSH via bastion.
- ✗
An Internet Gateway attached to the VPC
Why it's wrong here
Already needed for public subnet, but not a specific component for bastion design.
- ✓
Security group rules allowing SSH from the bastion to private instances
Why this is correct
Controls access to private instances.
- ✗
A Site-to-Site VPN connection to the VPC
Why it's wrong here
Not required; bastion provides secure access.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.