ANS-C01 NAT Gateway Practice Question
A company is experiencing intermittent SSH connection failures to their EC2 instances in a VPC. The instances are in a private subnet with a NAT gateway. The security group allows inbound SSH from the corporate CIDR. The network ACL is set to default allow all. The route table has a route to the NAT gateway for 0.0.0.0/0. What is the most likely cause of the intermittent failures?
⚠ Common exam trap
Many candidates overlook the requirement for a NAT gateway to have an Elastic IP, assuming it works without one. This traps those who focus solely on security group and NACL rules.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The NAT gateway does not have an Elastic IP associated.
The NAT gateway requires an associated Elastic IP to function correctly. Without it, the NAT gateway cannot be created or fails to operate, leading to intermittent connectivity issues for instances in the private subnet. Since the instances rely on the NAT gateway for outbound traffic (e.g., to reach configuration endpoints or DNS), any failure in the NAT gateway can disrupt SSH sessions that depend on such outbound communication. Option A is incorrect because the network ACL is set to default allow all, so it does not block ephemeral ports. Option B is incorrect because a proxy is not typically required for SSH connections in this setup. Option C is incorrect because security groups are stateful, meaning outbound rules do not block return traffic from allowed inbound connections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The network ACL inbound rule is blocking ephemeral ports.
Why it's wrong here
Incorrect because the network ACL is configured to allow all inbound and outbound traffic, so it does not block ephemeral ports.
- ✗
The instances are behind a proxy that is not configured.
Why it's wrong here
Incorrect because the use of a proxy is not indicated in this scenario and is not necessary for SSH connectivity from the corporate network.
- ✗
The security group outbound rules are not allowing return traffic.
Why it's wrong here
Incorrect because security groups are stateful; if inbound SSH is allowed, the return traffic is automatically permitted regardless of outbound rules.
- ✓
The NAT gateway does not have an Elastic IP associated.
Why this is correct
Correct. A NAT gateway must have an Elastic IP associated to function properly. Without it, the NAT gateway cannot translate addresses, causing connectivity issues for instances that require outbound access.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.