← ANS-C01·Amazon Web Services

Question 265 of 1,705

Network Design →hardMultiple ChoiceObjective-mapped

Quick Answer

The correct solution is to deploy a NAT Gateway in each of two Availability Zones, us-east-1a and us-east-1b, with separate private subnets and route tables pointing to the local NAT Gateway. This design achieves NAT Gateway high availability across multiple AZs by eliminating the single point of failure; if one AZ fails, the other NAT Gateway continues to route outbound traffic for instances in its private subnet, while the application retains private IP addresses for outbound traffic as required. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this scenario tests your understanding of resilient VPC architectures and the trade-off between cost and availability—a common trap is assuming a single NAT Gateway in a multi-AZ setup is sufficient, but route tables are AZ-specific, so traffic from a failed AZ would still be blackholed. Remember the memory tip: “One NAT per AZ keeps the packets at play”—each Availability Zone needs its own NAT Gateway to maintain independent fault isolation.

ANS-C01 Network Design Practice Question

This ANS-C01 practice question tests your understanding of network design. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A company runs a critical application on EC2 instances in a VPC with a single private subnet (10.0.1.0/24) in us-east-1a. The instances need to download security updates from the internet. The company currently uses a NAT Gateway in a public subnet (10.0.0.0/24) in us-east-1a. Recently, an Availability Zone failure caused us-east-1a to become unavailable, and the application could not reach the internet. The company wants to redesign the network to be highly available across multiple AZs for internet access. The application must continue to use private IP addresses for outbound traffic. The company has a limited budget and wants to minimize costs while meeting high availability. Which solution should the company implement?

Clue words in this question

Noticing these words before you look at the options changes how you read each choice.

Clue: "minimum / minimize"
Why it matters: Asks for the least resource use — fewest addresses, smallest subnet, lowest overhead. Eliminate over-provisioned options even if they would technically work.

Question 1hardmultiple choice

Read the full NAT/PAT explanation →

A
Deploy one NAT Gateway in a new public subnet in us-east-1b and update the private subnet route table to use it.
Why wrong: This still has a single NAT Gateway; if us-east-1b fails, internet access is lost.
B
Remove the NAT Gateway and attach an internet gateway to the VPC. Add a route in the private subnet route table pointing 0.0.0.0/0 to the internet gateway.
Why wrong: Instances in private subnets cannot directly use an internet gateway for outbound traffic; they would need public IPs.
C
Deploy a NAT Gateway in each of two AZs (us-east-1a and us-east-1b) in public subnets. Create private subnets in both AZs with separate route tables pointing to the local NAT Gateway.
Multi-AZ NAT Gateways provide high availability with automatic failover.
D
Replace the NAT Gateway with a NAT instance in a public subnet in us-east-1a and configure a secondary ENI in us-east-1b for failover.
Why wrong: NAT instances require manual configuration and are not fully managed; they are less reliable than NAT Gateways.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Deploy a NAT Gateway in each of two AZs (us-east-1a and us-east-1b) in public subnets. Create private subnets in both AZs with separate route tables pointing to the local NAT Gateway.

Option C is correct because it ensures high availability for outbound internet traffic by deploying a NAT Gateway in each of two Availability Zones (us-east-1a and us-east-1b) with separate private subnets and route tables. This design eliminates the single point of failure; if one AZ fails, the other NAT Gateway continues to route traffic. The application retains private IP addresses for outbound traffic, and the cost is minimized by using only two NAT Gateways (one per AZ) rather than a more expensive multi-AZ architecture like a transit gateway or VPN.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Deploy one NAT Gateway in a new public subnet in us-east-1b and update the private subnet route table to use it.
Why it's wrong here
This still has a single NAT Gateway; if us-east-1b fails, internet access is lost.
✗
Remove the NAT Gateway and attach an internet gateway to the VPC. Add a route in the private subnet route table pointing 0.0.0.0/0 to the internet gateway.
Why it's wrong here
Instances in private subnets cannot directly use an internet gateway for outbound traffic; they would need public IPs.
✓
Deploy a NAT Gateway in each of two AZs (us-east-1a and us-east-1b) in public subnets. Create private subnets in both AZs with separate route tables pointing to the local NAT Gateway.
Why this is correct
Multi-AZ NAT Gateways provide high availability with automatic failover.
Clue confirmation
The clue word "minimum / minimize" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Replace the NAT Gateway with a NAT instance in a public subnet in us-east-1a and configure a secondary ENI in us-east-1b for failover.
Why it's wrong here
NAT instances require manual configuration and are not fully managed; they are less reliable than NAT Gateways.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates often think a single NAT Gateway in a different AZ (Option A) provides high availability, but they miss that a NAT Gateway is AZ-scoped and cannot fail over to another AZ automatically, so a single NAT Gateway remains a single point of failure.

Detailed technical explanation

How to think about this question

NAT Gateways are managed by AWS and automatically scale up to 45 Gbps, but they are AZ-resilient only within their own AZ; cross-AZ failover is not supported. By placing a NAT Gateway in each AZ and configuring separate route tables for each private subnet (pointing 0.0.0.0/0 to the local NAT Gateway), traffic remains within the same AZ, avoiding cross-AZ data transfer costs. This design aligns with the AWS Well-Architected Framework's high availability pillar, ensuring that an AZ failure does not disrupt outbound internet connectivity.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A startup's cloud architect reviews their monthly bill and notices costs are higher than expected for a long-running batch job. Switching from on-demand instances to Reserved Instances — or using Spot/Preemptible VMs — can reduce compute costs by up to 72 %. Questions like this test whether you understand the tradeoffs between commitment, flexibility, and cost across cloud pricing models.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related ANS-C01 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Network Management and Operations practice questions

Practise ANS-C01 questions linked to Network Management and Operations.

Network Security, Compliance and Governance practice questions

Practise ANS-C01 questions linked to Network Security, Compliance and Governance.

Network Design practice questions

Practise ANS-C01 questions linked to Network Design.

Network Implementation practice questions

Practise ANS-C01 questions linked to Network Implementation.

ANS-C01 fundamentals practice questions

Practise ANS-C01 questions linked to ANS-C01 fundamentals.

ANS-C01 scenario practice questions

Practise ANS-C01 questions linked to ANS-C01 scenario.

ANS-C01 troubleshooting practice questions

Practise ANS-C01 questions linked to ANS-C01 troubleshooting.

Practice this exam

Start a free ANS-C01 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

ANS-C01 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this ANS-C01 question test?

Network Design — This question tests Network Design — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: Deploy a NAT Gateway in each of two AZs (us-east-1a and us-east-1b) in public subnets. Create private subnets in both AZs with separate route tables pointing to the local NAT Gateway. — Option C is correct because it ensures high availability for outbound internet traffic by deploying a NAT Gateway in each of two Availability Zones (us-east-1a and us-east-1b) with separate private subnets and route tables. This design eliminates the single point of failure; if one AZ fails, the other NAT Gateway continues to route traffic. The application retains private IP addresses for outbound traffic, and the cost is minimized by using only two NAT Gateways (one per AZ) rather than a more expensive multi-AZ architecture like a transit gateway or VPN.

What should I do if I get this ANS-C01 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Are there clue words in this question I should notice?

Yes — watch for: "minimum / minimize". Asks for the least resource use — fewest addresses, smallest subnet, lowest overhead. Eliminate over-provisioned options even if they would technically work.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.