ANS-C01 Network Design Practice Question
A company is designing a VPC with a public subnet for a web server and a private subnet for a database. The web server needs to download patches from the internet. The database should not have direct internet access. Which architecture meets these requirements?
⚠ Common exam trap
It's easy for candidates to assume a private subnet must have zero internet access, forgetting that outbound-only access via a NAT Gateway is allowed and commonly required for patching or updates, while a public subnet with an IGW is for bidirectional internet access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place the web server in the public subnet with an Internet Gateway, and the database in the private subnet with a route to a NAT Gateway in the public subnet for outbound access only.
It places the web server in a public subnet with a route to an Internet Gateway (IGW) for direct outbound internet access to download patches, while the database resides in a private subnet with a route to a NAT Gateway in the public subnet. The NAT Gateway enables outbound-only internet access for the database (e.g., for license validation or updates) without exposing it to unsolicited inbound connections, meeting the requirement that the database should not have direct internet access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place the web server in the public subnet with an Internet Gateway, and the database in the private subnet without any internet access.
Why it's wrong here
The database cannot download patches if needed; also web server can access internet via IGW.
- ✗
Place both instances in the public subnet and use security groups to restrict inbound access to the database.
Why it's wrong here
Database would have direct internet access if in public subnet.
- ✓
Place the web server in the public subnet with an Internet Gateway, and the database in the private subnet with a route to a NAT Gateway in the public subnet for outbound access only.
Why this is correct
Web server gets internet via IGW; database can initiate outbound traffic via NAT Gateway without being directly reachable.
- ✗
Place the web server in the private subnet with a NAT Gateway, and the database in the public subnet with an Internet Gateway.
Why it's wrong here
Web server in private subnet would need NAT for internet, but database in public subnet would have direct internet access.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.