ANS-C01 Network Design Practice Question
A company is designing a VPC with public and private subnets. The private subnets must have outbound internet access for software updates, but must not be directly reachable from the internet. Which two components are required for this design? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NAT Gateway in a public subnet
A NAT Gateway in a public subnet (A) provides outbound internet access for instances in private subnets while preventing inbound connections from the internet. A route table for the private subnets with a 0.0.0.0/0 route pointing to the NAT Gateway (E) directs outbound traffic to the NAT Gateway. Option B (Security Group allowing outbound HTTPS) is not a component; security groups control traffic but don't provide routing or internet access. Option C (Internet Gateway attached to the VPC) is required for public subnets but alone does not enable private subnet outbound access. Option D (Site-to-Site VPN) is for hybrid connectivity, not internet access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
NAT Gateway in a public subnet
Why this is correct
NAT Gateway enables outbound internet access for private instances.
- ✗
Security Group allowing outbound HTTPS
Why it's wrong here
Security Group is for traffic control, not for providing internet access.
- ✗
Internet Gateway attached to the VPC
Why it's wrong here
Internet Gateway allows both inbound and outbound; alone it would require public IPs on private instances.
- ✗
AWS Site-to-Site VPN connection
Why it's wrong here
VPN is for private connectivity to on-premises, not internet.
- ✓
Route table for private subnets with 0.0.0.0/0 pointing to the NAT Gateway
Why this is correct
This route directs outbound internet traffic from private subnets to the NAT Gateway.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is designing a VPC with public and private subnets. The private subnets need to access the internet for software updates but must not be directly accessible from the internet. Which AWS service should be used to provide internet access to instances in the private subnets?
easy- A.Internet gateway
- ✓ B.NAT gateway
- C.VPC endpoint
- D.Transit gateway
Why B: A NAT gateway enables instances in a private subnet to initiate outbound traffic to the internet (e.g., for software updates) while preventing any unsolicited inbound traffic from the internet. It translates the private IP addresses of the instances to the NAT gateway's Elastic IP address using source network address translation (SNAT), and it does not maintain state for inbound connections that were not initiated from within the VPC.
Variation 2. A company is designing a VPC with a public subnet for a web server and a private subnet for a database. The web server needs to download patches from the internet. The database should not have direct internet access. Which architecture meets these requirements?
easy- A.Place the web server in the public subnet with an Internet Gateway, and the database in the private subnet without any internet access.
- B.Place both instances in the public subnet and use security groups to restrict inbound access to the database.
- ✓ C.Place the web server in the public subnet with an Internet Gateway, and the database in the private subnet with a route to a NAT Gateway in the public subnet for outbound access only.
- D.Place the web server in the private subnet with a NAT Gateway, and the database in the public subnet with an Internet Gateway.
Why C: It places the web server in a public subnet with a route to an Internet Gateway (IGW) for direct outbound internet access to download patches, while the database resides in a private subnet with a route to a NAT Gateway in the public subnet. The NAT Gateway enables outbound-only internet access for the database (e.g., for license validation or updates) without exposing it to unsolicited inbound connections, meeting the requirement that the database should not have direct internet access.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.