ANS-C01 Network Implementation Practice Question
A company has deployed a VPC with public and private subnets. The private subnets need outbound internet access for software updates. Which service should be used to provide this access without exposing the instances to inbound traffic?
⚠ Common exam trap
Candidates often confuse an Internet Gateway (which allows bidirectional traffic) with a NAT Gateway (which allows only outbound traffic), leading them to select Option A despite the requirement to block inbound traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a NAT Gateway in a public subnet and add a default route to it from the private subnets.
A NAT Gateway, deployed in a public subnet with an Elastic IP, allows instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. The private subnet’s route table directs default traffic (0.0.0.0/0) to the NAT Gateway, which performs source network address translation (SNAT) to the gateway’s Elastic IP, enabling outbound-only access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attach an Internet Gateway to the VPC and add a default route to it from the private subnets.
Why it's wrong here
This would expose private instances to inbound traffic.
- ✗
Set up a VPN connection to an on-premises network that has internet access.
Why it's wrong here
This is for private connectivity, not direct internet access.
- ✗
Use a Direct Connect connection to route traffic through an on-premises internet gateway.
Why it's wrong here
This is a dedicated private connection, not for direct internet access.
- ✓
Deploy a NAT Gateway in a public subnet and add a default route to it from the private subnets.
Why this is correct
NAT Gateway provides outbound-only internet access.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.