ANS-C01 Network Design Practice Question
A company has a VPC with public and private subnets. They want to provide outbound internet access to instances in private subnets while preventing inbound internet traffic. The solution must be highly available and scale automatically. Which combination of services should be used?
⚠ Common exam trap
The ANS-C01 exam often tests the misconception that a single NAT Gateway in one Availability Zone provides high availability, but the trap is that high availability requires a NAT Gateway in each Availability Zone to survive an AZ failure, as a single NAT Gateway is a single point of failure within its zone.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NAT Gateway in each Availability Zone with route tables pointing to the NAT Gateway
D is correct because a NAT Gateway in each Availability Zone provides highly available, automatically scaling outbound internet access for private subnets while blocking unsolicited inbound traffic. NAT Gateways are managed by AWS, scale up to 45 Gbps, and are redundant per AZ, meeting the requirements for high availability and automatic scaling without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
NAT instances in each Availability Zone
Why it's wrong here
NAT instances are not highly available by default and require manual scaling and failover.
- ✗
VPC endpoint for S3 and DynamoDB
Why it's wrong here
VPC endpoints provide private access to specific AWS services, not general internet access.
- ✗
Internet Gateway attached to the VPC with route tables pointing to the Internet Gateway
Why it's wrong here
Internet Gateway allows inbound traffic from the internet, which is not desired. Also, private instances need a NAT device to initiate outbound traffic.
- ✓
NAT Gateway in each Availability Zone with route tables pointing to the NAT Gateway
Why this is correct
NAT Gateways are managed, highly available within an AZ, and scale automatically. Using one per AZ provides AZ-level redundancy.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.