ANS-C01 Network Implementation Practice Question
A company has a VPC with two subnets: a public subnet with a NAT Gateway and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance has a security group that allows all outbound traffic. The private subnet's route table has a default route (0.0.0.0/0) pointing to the NAT Gateway. However, the instance cannot reach the internet. What is the most likely issue?
⚠ Common exam trap
The ANS-C01 exam often tests the misconception that a NAT Gateway can be placed in any subnet as long as the private subnet's route table points to it, but the trap is that the NAT Gateway must be in a public subnet with an IGW route to function.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The NAT Gateway is deployed in a private subnet.
The NAT Gateway must be deployed in a public subnet with an Internet Gateway (IGW) attached to its route table to translate private IP addresses to the IGW's public IP. If the NAT Gateway is in a private subnet, it has no route to the internet, so traffic from the private EC2 instance reaches the NAT Gateway but cannot be forwarded to the internet. This is the most likely issue because the route table correctly points to the NAT Gateway, but the gateway itself lacks internet connectivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security group does not allow inbound traffic from the internet.
Why it's wrong here
The instance is initiating outbound traffic; inbound is not needed.
- ✓
The NAT Gateway is deployed in a private subnet.
Why this is correct
NAT Gateway requires a public subnet with an Internet Gateway to function.
- ✗
The network ACL on the private subnet blocks outbound traffic.
Why it's wrong here
Default NACL allows all outbound traffic.
- ✗
The instance's DNS resolution is not configured correctly.
Why it's wrong here
DNS resolution would affect name resolution, not basic IP connectivity.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.