ANS-C01 Network Implementation Practice Question
A company is migrating a legacy application that requires static IP addresses for its clients' firewall whitelisting. The application will be hosted on EC2 instances behind a Network Load Balancer (NLB) in a private subnet. Which approach should the company use to provide static IP addresses for outbound traffic?
⚠ Common exam trap
Watch out — candidates often confuse inbound static IPs (NLB with Elastic IPs) with outbound static IPs, or mistakenly think Elastic IPs on instances work in private subnets without a NAT device.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a NAT Gateway in a public subnet with an Elastic IP
A NAT Gateway in a public subnet with an Elastic IP provides a static source IP address for outbound traffic from private subnets. Since the EC2 instances are in a private subnet behind an NLB, they cannot directly reach the internet; the NAT Gateway translates their private IPs to the Elastic IP, which clients can whitelist. This ensures consistent outbound IPs without exposing the instances to inbound traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign Elastic IPs to the EC2 instances
Why it's wrong here
Elastic IPs are for inbound access, but instances in private subnets cannot be assigned EIPs directly.
- ✗
Use an internet-facing NLB with Elastic IPs
Why it's wrong here
Internet-facing NLB is for inbound traffic, not outbound.
- ✗
Use a VPC endpoint for the application
Why it's wrong here
VPC endpoints provide private connectivity to AWS services, not static IPs for outbound traffic.
- ✓
Deploy a NAT Gateway in a public subnet with an Elastic IP
Why this is correct
NAT Gateway with an Elastic IP provides a static source IP for outbound traffic from private subnets.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.