ANS-C01 Network Design Practice Question
A company is using AWS CloudFormation to deploy a VPC with public and private subnets across multiple Availability Zones. The template includes a NAT gateway in each public subnet. The company wants to ensure that the private subnet route tables automatically update when the NAT gateway ID changes. Which feature should be used?
⚠ Common exam trap
Test-takers frequently confuse `Ref` (which returns the logical resource name or a default attribute like the AZ) with `Fn::GetAtt` (which returns a specific physical attribute like the NAT gateway ID), leading them to choose Option B incorrectly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the 'Fn::GetAtt' intrinsic function to retrieve the NAT gateway ID and pass it to the route.
The `Fn::GetAtt` intrinsic function can retrieve the NAT gateway ID (e.g., `Fn::GetAtt: [NatGateway, NatGatewayId]`) and pass it as the `GatewayId` property of an `AWS::EC2::Route` resource. This ensures that when the NAT gateway is replaced (e.g., due to an update or failure), the route automatically updates to reference the new NAT gateway ID, maintaining connectivity for private subnets without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the 'DependsOn' attribute to ensure the route is created after the NAT gateway.
Why it's wrong here
DependsOn only ensures order, not dynamic updates.
- ✗
Use the 'AWS::EC2::Route' resource with a 'GatewayId' property that references the NAT gateway using 'Ref'.
Why it's wrong here
'Ref' returns the logical ID, not the physical ID; and the route would not automatically update if the NAT gateway is replaced.
- ✓
Use the 'Fn::GetAtt' intrinsic function to retrieve the NAT gateway ID and pass it to the route.
Why this is correct
Fn::GetAtt can retrieve the physical ID of the NAT gateway, and if the NAT gateway is replaced, CloudFormation updates the route automatically.
- ✗
Use an AWS Lambda custom resource to update the route table when the NAT gateway changes.
Why it's wrong here
Custom resource could work but is not the simplest or most automatic.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.