ANS-C01 Network Security, Compliance and Governance Practice Question
A company is designing a VPC with private subnets for databases and public subnets for web servers. They need to allow the web servers to make outbound internet requests for software updates but prevent inbound traffic from the internet. Which configuration should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a NAT Gateway in a public subnet and add a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT Gateway.
Deploying a NAT Gateway in a public subnet allows instances in private subnets to initiate outbound internet traffic (e.g., for software updates) while blocking unsolicited inbound traffic from the internet. Option B is incorrect because a NAT Gateway must be in a public subnet to access the internet. Option C is incorrect because an Internet Gateway allows both inbound and outbound traffic, which would expose the private subnets to inbound internet traffic. Option D is incorrect because while a proxy server could work, it is more complex and not the simplest or recommended AWS solution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deploy a NAT Gateway in a public subnet and add a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT Gateway.
Why this is correct
This allows outbound internet traffic from the private subnet while blocking inbound unsolicited traffic.
- ✗
Deploy a NAT Gateway in the private subnet and route the private subnet traffic through it.
Why it's wrong here
A NAT Gateway in a private subnet cannot communicate with the internet; it must be in a public subnet.
- ✗
Attach an Internet Gateway to the VPC and route the private subnet traffic through it.
Why it's wrong here
An Internet Gateway would allow inbound traffic from the internet, which is not desired.
- ✗
Deploy a proxy server in the private subnet and configure the web servers to use it.
Why it's wrong here
Deploying a proxy server is unsuitable because web servers in public subnets already possess outbound internet connectivity via the Internet Gateway, and a proxy does not inherently prevent unsolicited inbound traffic to these public-facing instances. This configuration adds unnecessary complexity without addressing the requirement to block inbound internet connections to the web servers themselves. A proxy server is typically used to centralise and control outbound internet access for instances located in *private* subnets, where direct internet access is not available.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
5 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has deployed a VPC with public and private subnets. They have an Internet Gateway attached to the VPC and a NAT Gateway in the public subnet. The private subnet instances need to download patches from the internet. Which configuration ensures that the private instances can reach the internet while preventing inbound traffic from the internet?
easy- A.Add a VPC Gateway Endpoint for Amazon S3 to the private subnet route table.
- B.Add a route in the private subnet route table pointing 0.0.0.0/0 to the Internet Gateway.
- ✓ C.Add a route in the private subnet route table pointing 0.0.0.0/0 to the NAT Gateway.
- D.Create a VPC Peering connection to a public VPC and route traffic through it.
Why C: Adding a route in the private subnet route table pointing 0.0.0.0/0 to the NAT Gateway allows private instances to initiate outbound traffic to the internet while preventing inbound connections from the internet. Option A is incorrect because a VPC Gateway Endpoint only provides access to specific AWS services (e.g., S3, DynamoDB), not general internet traffic. Option B is incorrect because routing 0.0.0.0/0 to the Internet Gateway would expose the private instances to inbound traffic from the internet (assuming the route is in the private subnet route table, it would still allow inbound traffic if the instances have public IPs, but more importantly, it bypasses the NAT Gateway's security). Option D is incorrect because VPC Peering does not provide internet access; it only connects two VPCs.
Variation 2. A security engineer is designing a VPC with public and private subnets. The company requires that instances in the private subnet can initiate outbound connections to the internet but cannot receive inbound connections from the internet. Which TWO components are necessary? (Choose 2)
hard- A.VPC Gateway Endpoint for S3
- B.Security group allowing inbound traffic from 0.0.0.0/0
- ✓ C.NAT Gateway in the public subnet
- D.Internet Gateway attached to the private subnet
- ✓ E.Route in the private subnet route table pointing to the NAT Gateway
Why C: To allow instances in a private subnet to initiate outbound internet connections while preventing inbound connections, a NAT Gateway placed in a public subnet is required. The NAT Gateway translates private IPs to its own public IP. Additionally, the private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway to direct outbound traffic. Option A (VPC Gateway Endpoint for S3) is for private access to S3, not general internet. Option B (security group allowing inbound from 0.0.0.0/0) would allow inbound connections, violating the requirement. Option D (Internet Gateway attached to private subnet) is incorrect because an Internet Gateway is attached to the VPC, not a subnet, and would allow inbound traffic if used in a route table.
Variation 3. A security engineer is designing a VPC with public and private subnets. The company requires that all outbound traffic from private subnets to the internet must go through a single IP address for logging and compliance. Which service should be used?
easy- A.Transit Gateway
- B.Internet Gateway
- ✓ C.NAT Gateway
- D.VPC Endpoint
Why C: NAT Gateway. A NAT Gateway provides outbound internet access from private subnets, and it uses a single Elastic IP address, meeting the requirement for a single IP for logging and compliance. Option A is wrong because a Transit Gateway is used for connecting multiple VPCs and on-premises networks, not for outbound internet from private subnets. Option B is wrong because an Internet Gateway allows inbound and outbound traffic from public subnets, not private subnets. Option D is wrong because a VPC Endpoint is for accessing AWS services privately without traversing the internet.
Variation 4. A company is designing a VPC with public and private subnets. They need to allow instances in the private subnet to access the internet for software updates while preventing inbound internet traffic. Which AWS service should they use?
medium- ✓ A.NAT Gateway
- B.AWS Direct Connect
- C.VPC Peering
- D.Internet Gateway
Why A: (NAT Gateway) is correct because a NAT Gateway allows instances in a private subnet to initiate outbound internet traffic (e.g., for software updates) while preventing any inbound traffic from the internet. Option B (AWS Direct Connect) is a dedicated private connection between on-premises and AWS, not for internet access. Option C (VPC Peering) connects VPCs privately, not providing internet access. Option D (Internet Gateway) allows both inbound and outbound traffic, which would expose private instances to inbound internet traffic, violating the requirement.
Variation 5. A company is designing a VPC with a public subnet for web servers and a private subnet for database servers. The web servers must be able to access the internet for software updates, but the database servers must not have direct internet access. Which solution meets these requirements?
easy- A.Use a VPC endpoint for Amazon S3 to provide internet access to the database servers.
- ✓ B.Deploy a NAT gateway in the public subnet and add a route to it in the private subnet's route table.
- C.Set up a VPN connection to an on-premises data center and route traffic through it.
- D.Attach an internet gateway to the VPC and add a route to it in the private subnet's route table.
Why B: A NAT gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet while preventing inbound traffic from the internet. Option A is incorrect because a VPC endpoint for Amazon S3 only provides private access to S3, not general internet access. Option C is incorrect because a VPN connection to an on-premises data center does not provide internet access; it connects to the on-premises network. Option D is incorrect because attaching an internet gateway to a private subnet's route table would allow direct inbound internet traffic, violating the requirement that database servers must not have direct internet access.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.