ANS-C01 Network Management and Operations Practice Question
A company is using AWS CloudFormation to deploy a multi-tier application. The template includes an Amazon VPC with public and private subnets, NAT gateways, and route tables. After deployment, the EC2 instances in the private subnet cannot access the internet. The NAT gateway is in a public subnet with an Internet Gateway attached. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The route table of the private subnet does not have a default route pointing to the NAT Gateway
The most likely cause is that the route table of the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT Gateway. For EC2 instances in a private subnet to access the internet, the private subnet's route table must contain a route that directs internet-bound traffic to the NAT Gateway. Option B is incorrect because the Internet Gateway is already attached to the VPC as stated. Option C is incorrect because security groups are stateful and by default allow all outbound traffic; the question does not indicate any security group changes. Option D is incorrect because network ACLs are stateless and by default allow all outbound traffic; the scenario does not mention any NACL modifications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The route table of the private subnet does not have a default route pointing to the NAT Gateway
Why this is correct
Without a route to the NAT Gateway, traffic to the internet fails.
- ✗
The Internet Gateway is not attached to the VPC
Why it's wrong here
The Internet Gateway must be attached, but it is mentioned it is attached.
- ✗
The security group of the EC2 instances blocks outbound traffic to the internet
Why it's wrong here
Security groups are stateful and allow outbound traffic by default.
- ✗
The network ACL of the private subnet blocks outbound traffic
Why it's wrong here
NACLs are stateless and would need explicit rules, but the default NACL allows all traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.