ANS-C01 Network Design Practice Question
A company runs a critical application on EC2 instances in a VPC with a single private subnet (10.0.1.0/24) in us-east-1a. The instances need to download security updates from the internet. The company currently uses a NAT Gateway in a public subnet (10.0.0.0/24) in us-east-1a. Recently, an Availability Zone failure caused us-east-1a to become unavailable, and the application could not reach the internet. The company wants to redesign the network to be highly available across multiple AZs for internet access. The application must continue to use private IP addresses for outbound traffic. The company has a limited budget and wants to minimize costs while meeting high availability. Which solution should the company implement?
⚠ Common exam trap
Test-takers frequently think a single NAT Gateway in a different AZ (Option A) provides high availability, but they miss that a NAT Gateway is AZ-scoped and cannot fail over to another AZ automatically, so a single NAT Gateway remains a single point of failure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a NAT Gateway in each of two AZs (us-east-1a and us-east-1b) in public subnets. Create private subnets in both AZs with separate route tables pointing to the local NAT Gateway.
It ensures high availability for outbound internet traffic by deploying a NAT Gateway in each of two Availability Zones (us-east-1a and us-east-1b) with separate private subnets and route tables. This design eliminates the single point of failure; if one AZ fails, the other NAT Gateway continues to route traffic. The application retains private IP addresses for outbound traffic, and the cost is minimized by using only two NAT Gateways (one per AZ) rather than a more expensive multi-AZ architecture like a transit gateway or VPN.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy one NAT Gateway in a new public subnet in us-east-1b and update the private subnet route table to use it.
Why it's wrong here
This still has a single NAT Gateway; if us-east-1b fails, internet access is lost.
- ✗
Remove the NAT Gateway and attach an internet gateway to the VPC. Add a route in the private subnet route table pointing 0.0.0.0/0 to the internet gateway.
Why it's wrong here
Instances in private subnets cannot directly use an internet gateway for outbound traffic; they would need public IPs.
- ✓
Deploy a NAT Gateway in each of two AZs (us-east-1a and us-east-1b) in public subnets. Create private subnets in both AZs with separate route tables pointing to the local NAT Gateway.
Why this is correct
Multi-AZ NAT Gateways provide high availability with automatic failover.
- ✗
Replace the NAT Gateway with a NAT instance in a public subnet in us-east-1a and configure a secondary ENI in us-east-1b for failover.
Why it's wrong here
NAT instances require manual configuration and are not fully managed; they are less reliable than NAT Gateways.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.