ANS-C01 Network Management and Operations Practice Question
A company has deployed a web application in a VPC with public subnets for the web servers and private subnets for the database servers. The web servers need to access the internet for software updates. The network engineer configured a NAT Gateway in the public subnet and added a route in the private subnet route table pointing 0.0.0.0/0 to the NAT Gateway. However, the web servers cannot reach the internet. What is the most likely cause?
⚠ Common exam trap
Many exam-takers confuse the purpose of a NAT Gateway (for private subnets) with an Internet Gateway (for public subnets), and assume that placing a NAT Gateway in a public subnet automatically provides internet access to instances in that subnet, when in fact the route table must point to the IGW for public subnets.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The web servers are in a public subnet, but the route table for the public subnet points 0.0.0.0/0 to the NAT Gateway instead of the Internet Gateway.
The web servers are deployed in a public subnet, which requires a route table entry pointing 0.0.0.0/0 to an Internet Gateway (IGW) for direct internet access. Instead, the engineer configured the route to point to a NAT Gateway, which is intended for private subnets. A public subnet must have a direct IGW route; using a NAT Gateway in a public subnet breaks outbound connectivity because the NAT Gateway itself relies on the IGW for internet access, but the web servers' traffic is sent to the NAT Gateway instead of the IGW, causing a routing loop or failure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The private subnet route table does not have a route to the NAT Gateway for 0.0.0.0/0.
Why it's wrong here
The web servers are in the public subnet, so the private subnet route table is irrelevant.
- ✗
The security group of the web servers is blocking outbound traffic to the internet.
Why it's wrong here
Security groups are stateful and allow outbound traffic by default, so this is unlikely unless explicitly changed.
- ✓
The web servers are in a public subnet, but the route table for the public subnet points 0.0.0.0/0 to the NAT Gateway instead of the Internet Gateway.
Why this is correct
Public subnets should route internet traffic to an Internet Gateway, not a NAT Gateway. The NAT Gateway is for private subnets.
- ✗
The NAT Gateway does not have a route to the Internet Gateway in its route table.
Why it's wrong here
NAT Gateways are not associated with route tables; they are placed in a public subnet and automatically have a route to the IGW if the subnet route table directs 0.0.0.0/0 to the IGW.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS CloudFormation to deploy a multi-tier application. The template includes a VPC, public and private subnets, security groups, and an Application Load Balancer. The network team wants to ensure that the ALB can only accept traffic from a specific set of IP addresses. They add a security group rule that allows inbound traffic on port 443 from the allowed IP CIDR. However, after deployment, the ALB is not responding to requests from the allowed IPs. The team checks the security group and confirms the rule exists. They also verify that the ALB is in the public subnet and has a public DNS name. What is the MOST likely cause?
hard- A.The security group rule is blocking return traffic; security groups are stateful.
- B.The ALB listener is not configured to forward traffic to the target group.
- ✓ C.The public subnet does not have a route to an internet gateway.
- D.The ALB is using an internal scheme instead of internet-facing.
Why C: The most likely cause is that the public subnet does not have a route to an internet gateway. For an internet-facing ALB to receive traffic from the internet, the subnets where the ALB is deployed must have a default route (0.0.0.0/0) pointing to an internet gateway. Without this route, even if the security group allows the traffic, the ALB cannot be reached because the subnet is not routable from the internet. Option A is incorrect because security groups are stateful and automatically allow return traffic, so that would not block responses. Option B is incorrect because the listener configuration affects whether traffic is forwarded to targets, not whether the ALB itself accepts incoming connections from allowed IPs. Option D is incorrect because the ALB uses an internet-facing scheme; if it were internal, it would not have a public DNS name.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.