ANS-C01 Network Implementation Practice Question
A company is deploying a VPC with public and private subnets in two Availability Zones. The public subnets contain NAT gateways for outbound internet access from the private subnets. The private subnets host web servers that need to make API calls to an external service over the internet. After implementation, the web servers cannot reach the internet. Which configuration is the most likely cause?
⚠ Common exam trap
Test-takers frequently assume a NAT gateway can be placed in any subnet and still function, but AWS explicitly requires the NAT gateway to reside in a public subnet with a route to an IGW for outbound connectivity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The NAT gateway is placed in a private subnet and does not have a route to the internet gateway.
A NAT gateway must be placed in a public subnet with a route to an internet gateway (IGW) to translate private IP addresses for outbound traffic. If the NAT gateway is in a private subnet, it cannot reach the IGW, so the private web servers' traffic destined for the internet (via the 0.0.0.0/0 route pointing to the NAT gateway) will fail, as the NAT gateway itself has no path to the internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The NAT gateway is placed in a private subnet and does not have a route to the internet gateway.
Why this is correct
NAT gateways must reside in a public subnet with a route to an internet gateway. If placed in a private subnet, outbound traffic cannot reach the internet.
- ✗
The route table for the private subnets is not associated with the VPC's main route table.
Why it's wrong here
Route table association is per subnet, not per VPC, and the main route table is used by default. Missing association would affect connectivity but is less likely than a misconfigured NAT gateway.
- ✗
The private subnets have a default route (0.0.0.0/0) pointing to an internet gateway instead of the NAT gateway.
Why it's wrong here
This would cause traffic to go directly to the internet gateway, but the private instances would still not have a return path because they lack public IPs. However, the issue is more likely a misconfiguration of the NAT gateway itself.
- ✗
The public subnets have a default route pointing to the NAT gateway instead of the internet gateway.
Why it's wrong here
Public subnets should have a default route to the internet gateway, not NAT gateway. This misconfiguration would break internet access for instances in public subnets, not private ones.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.