ANS-C01 Network Security, Compliance and Governance Practice Question
A company has a VPC with public and private subnets. They want to allow instances in the private subnet to download software updates from the internet while preventing inbound traffic from the internet. Which AWS service should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NAT Gateway
A NAT Gateway allows outbound internet traffic from private subnets while blocking inbound traffic, making it the correct choice. Option A (VPC Peering) is incorrect because it does not provide internet access. Option C (Internet Gateway) is incorrect because it allows inbound traffic from the internet. Option D (VPN Connection) is incorrect because it typically provides private connectivity to an on-premises network, not direct internet access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VPC Peering
Why it's wrong here
VPC Peering connects VPCs, not to the internet.
- ✓
NAT Gateway
Why this is correct
A NAT Gateway, deployed in a public subnet with an Elastic IP, enables outbound IPv4 traffic from private instances to the internet for software updates while its stateful translation drops any unsolicited inbound return traffic, satisfying the constraint of preventing inbound internet access.
- ✗
Internet Gateway
Why it's wrong here
An Internet Gateway allows bidirectional traffic.
- ✗
VPN Connection
Why it's wrong here
A VPN connection establishes an encrypted tunnel to a remote network, not a general internet gateway; it fails because instances in private subnets require a NAT gateway or NAT instance to initiate outbound internet traffic while blocking inbound connections. The option is tempting because VPNs are commonly used for secure outbound access to on-premises networks, and in a scenario requiring private connectivity to a corporate datacentre rather than public internet updates, a VPN would be correct.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.