ANS-C01 Network Implementation Practice Question
A company is deploying a fleet of EC2 instances in private subnets. The instances need to download patches from the internet. The company wants to minimize cost and avoid managing NAT instances. The VPC has an internet gateway (IGW) attached. What should the company do?
⚠ Common exam trap
Candidates often confuse an Internet Gateway with a NAT Gateway, assuming that simply attaching an IGW to a private subnet route table will provide internet access, but an IGW alone cannot perform SNAT for private IP addresses.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a NAT Gateway in a public subnet and update the private subnet route tables.
A NAT Gateway, deployed in a public subnet with an Elastic IP, allows instances in private subnets to initiate outbound traffic to the internet (e.g., for patch downloads) while preventing inbound connections from the internet. This solution is fully managed by AWS, eliminating the need to manage a NAT instance, and it is cost-effective compared to maintaining a dedicated instance. The private subnet route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway ID.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attach the IGW to the private subnet route table.
Why it's wrong here
Private subnets cannot have IGW as route; it only works for public subnets.
- ✓
Deploy a NAT Gateway in a public subnet and update the private subnet route tables.
Why this is correct
Managed, cost-effective, provides internet access to private instances.
- ✗
Create a VPC endpoint for internet access.
Why it's wrong here
VPC endpoints are for AWS services, not general internet.
- ✗
Launch a NAT instance and configure routing.
Why it's wrong here
NAT instance is less cost-effective and requires management.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.