ANS-C01 Network Implementation Practice Question
A company needs to provide internet access to a VPC that has both public and private subnets. They have already created an Internet Gateway and attached it to the VPC. What else must be configured for instances in the public subnet to be reachable from the internet?
⚠ Common exam trap
Candidates often confuse the purpose of a NAT Gateway (outbound-only) with the requirement for inbound internet reachability, mistakenly thinking a NAT Gateway is needed for public subnet instances, when in fact a route to the IGW is the only missing piece.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a route to the public subnet's route table pointing 0.0.0.0/0 to the Internet Gateway.
For instances in a public subnet to be reachable from the internet, the subnet's route table must include a default route (0.0.0.0/0) pointing to the Internet Gateway (IGW). The IGW itself is a horizontally scaled, redundant component that provides a target for internet-bound traffic, but without the route, traffic from the internet cannot reach the instances. This route enables bidirectional communication: the IGW performs NAT for instances with public IPs, translating their private IPs to the associated Elastic IP or public IP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Launch a NAT Gateway in the public subnet.
Why it's wrong here
NAT Gateway is for private subnets to access the internet outbound.
- ✓
Add a route to the public subnet's route table pointing 0.0.0.0/0 to the Internet Gateway.
Why this is correct
This enables traffic to flow between the subnet and the internet.
- ✗
Attach the VPC to an AWS Transit Gateway.
Why it's wrong here
Transit Gateway is for connecting multiple VPCs and on-premises networks.
- ✗
Establish a VPN connection to the Internet Gateway.
Why it's wrong here
VPN is not needed for internet access.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to provide internet access to instances in a public subnet. Which component must be attached to the VPC and have a route to it in the subnet's route table?
easy- A.Transit Gateway
- B.Virtual Private Gateway
- C.NAT Gateway
- ✓ D.Internet Gateway
Why D: An Internet Gateway (IGW) is a horizontally scaled, redundant component that allows communication between a VPC and the internet. For instances in a public subnet to have outbound internet access and be reachable from the internet, the IGW must be attached to the VPC, and the subnet's route table must include a default route (0.0.0.0/0) pointing to the IGW as the target.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.