How to Route Outbound Internet Traffic from Private Subnets Using a NAT Gateway
A company needs to ensure that all outbound internet traffic from a VPC goes through a centralized inspection appliance. The VPC has multiple subnets. Which THREE steps are required to implement this?
Quick Answer
The answer is to configure route tables in each private subnet to send 0.0.0.0/0 traffic to a NAT gateway in a public subnet. This works because a NAT gateway, placed in a public subnet with an associated Elastic IP, translates private IPv4 addresses to the gateway’s public IP, enabling outbound internet traffic while preventing inbound connections from the internet. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this scenario tests your understanding of centralized outbound traffic inspection—a common trap is confusing NAT gateways with egress-only internet gateways (which only handle IPv6) or VPC endpoints (which are for AWS services, not general internet access). The key is remembering that for IPv4 outbound traffic from private subnets, the default route must point to a NAT gateway, not an internet gateway, which is used for inbound traffic. Memory tip: “NAT for out, IGW for in, egress-only for IPv6.”
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure security groups to allow outbound traffic from the instances
To ensure all outbound internet traffic goes through a centralized inspection appliance, the required steps are: configure security groups to allow outbound traffic (Option A) and launch a NAT gateway in a public subnet with an Elastic IP (Option B) to provide outbound connectivity. The third step, which is not listed among the options, is to route private subnet traffic to the inspection appliance rather than directly to the NAT gateway. Option E is incorrect because routing 0.0.0.0/0 to a NAT gateway would bypass the inspection appliance, failing the requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure security groups to allow outbound traffic from the instances
Why this is correct
Correct: Security groups must allow outbound traffic from instances so that traffic can exit.
- ✓
Launch a NAT gateway in a public subnet and associate it with an Elastic IP
Why this is correct
Correct: A NAT gateway in a public subnet with an Elastic IP provides outbound connectivity, which is necessary for internet access.
- ✗
Attach an Internet Gateway to the VPC and route all traffic to it
Why it's wrong here
Incorrect: Attaching an Internet Gateway and routing all traffic to it would send traffic directly to the internet, bypassing the inspection appliance.
- ✗
Create VPC endpoints for all required AWS services
Why it's wrong here
Incorrect: VPC endpoints are for private connectivity to AWS services, not for general internet traffic.
- ✗
Configure route tables in each private subnet to send 0.0.0.0/0 traffic to a NAT gateway in a public subnet
Why it's wrong here
Incorrect: Routing 0.0.0.0/0 to a NAT gateway would route traffic directly to the internet, bypassing the centralized inspection appliance.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a VPC with public and private subnets. They have an EC2 instance in a private subnet that needs to access the internet for software updates. Which solution provides internet access while keeping the instance private?
medium- A.Attach an internet gateway to the VPC and assign a public IP to the EC2 instance.
- ✓ B.Create a NAT gateway in a public subnet, and update the private subnet's route table to point 0.0.0.0/0 to the NAT gateway.
- C.Use an AWS PrivateLink VPC endpoint for the software update service.
- D.Set up a VPC peering connection with another VPC that has internet access.
Why B: A NAT gateway in a public subnet allows instances in private subnets to initiate outbound internet traffic while preventing inbound traffic from the internet. Option B is correct. Option A (internet gateway) would expose the instance to inbound traffic if assigned a public IP. Option C (VPC peering) does not provide internet access. Option D (VPC endpoint) only provides access to specific AWS services, not general internet.
Variation 2. A company has a VPC with public and private subnets. The public subnet hosts a NAT gateway. The private subnet hosts EC2 instances that need to download patches from the internet. The EC2 instances have a security group that allows outbound HTTPS to 0.0.0.0/0. What additional configuration is required?
medium- A.Attach an internet gateway to the private subnet.
- B.Move the NAT gateway to the private subnet.
- ✓ C.Add a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway.
- D.Create a VPC endpoint for S3.
Why C: EC2 instances in a private subnet need a route in their route table that directs internet traffic (0.0.0.0/0) to the NAT gateway to access the internet for patch downloads. Option A is incorrect because an internet gateway is attached to the VPC, not a subnet, and private subnets should not have direct internet access. Option B is incorrect because the NAT gateway must be in a public subnet to have internet access via the internet gateway. Option D is incorrect because a VPC endpoint for S3 is used for private connectivity to S3, not for general internet access.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.