ANS-C01 Network Design Practice Question
A company is deploying a containerized application on Amazon ECS using the Fargate launch type. The application requires outbound internet access to download updates, but the company does not want to assign public IP addresses to the tasks. Which TWO actions should the company take to provide internet access to the tasks? (Choose two.)
⚠ Common exam trap
AWS often tests the misconception that a security group rule allowing outbound traffic to 0.0.0.0/0 alone is sufficient for internet access, when in fact the subnet's route table must direct traffic to a NAT gateway or Internet Gateway.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Launch the tasks in private subnets that do not have a route to an Internet Gateway
Tasks in private subnets without a route to an Internet Gateway cannot directly access the internet, which is the desired behavior to avoid public IP addresses. Option C is correct because a NAT gateway in a public subnet provides outbound internet access for tasks in private subnets by translating their private IP addresses to the NAT gateway's public IP, allowing them to reach the internet without assigning public IPs to the tasks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a security group that allows outbound traffic to 0.0.0.0/0
Why it's wrong here
Security groups control traffic but do not provide a route to the internet; a NAT gateway or similar is needed.
- ✓
Launch the tasks in private subnets that do not have a route to an Internet Gateway
Why this is correct
Private subnets ensure no public IPs are assigned; outbound traffic goes through the NAT gateway.
- ✓
Create a NAT gateway in a public subnet and update the route tables for the task subnets to route 0.0.0.0/0 traffic to the NAT gateway
Why this is correct
The NAT gateway provides outbound internet access, and tasks remain in private subnets without public IPs.
- ✗
Launch the tasks in public subnets with auto-assign public IP enabled
Why it's wrong here
This would assign public IPs to tasks, which the company wants to avoid.
- ✗
Create a VPC Gateway Endpoint for Amazon ECR
Why it's wrong here
A Gateway Endpoint provides private access to ECR and S3, but not general internet access.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.