ANS-C01 Network Implementation Practice Question
A company wants to provide internet access to instances in a private subnet while ensuring that traffic is logged and inspected. The solution must be highly available within a single AWS Region. Which approach should the company use?
⚠ Common exam trap
Many candidates confuse a Gateway Load Balancer endpoint with a VPC Gateway endpoint (for S3/DynamoDB) or assume a single NAT Gateway is sufficient for high availability, overlooking the need for per-AZ deployment and the specific role of the Gateway Load Balancer in traffic inspection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a NAT Gateway in each Availability Zone and configure the private subnet route tables to point to the NAT Gateway in the same AZ. Use Gateway Load Balancer endpoint for traffic inspection.
It combines NAT Gateways (one per AZ) for highly available outbound internet access from private subnets with a Gateway Load Balancer endpoint for traffic inspection. NAT Gateways are managed, scale automatically, and are AZ-resilient when deployed in each AZ, while the Gateway Load Balancer endpoint allows traffic to be routed through third-party inspection appliances without disrupting the NAT path. This meets the requirements for high availability within a single Region and ensures all egress traffic is logged and inspected.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deploy a NAT Gateway in each Availability Zone and configure the private subnet route tables to point to the NAT Gateway in the same AZ. Use Gateway Load Balancer endpoint for traffic inspection.
Why this is correct
NAT Gateways are highly available per AZ, and using one per AZ ensures availability. Gateway Load Balancer can inspect traffic.
- ✗
Launch a NAT instance in a public subnet and configure it as the default route for the private subnet.
Why it's wrong here
A single NAT instance is a single point of failure and not highly available.
- ✗
Create a VPC endpoint for the internet and attach it to the private subnet.
Why it's wrong here
VPC endpoints provide private connectivity to AWS services, not to the internet.
- ✗
Attach an Internet Gateway to the VPC and add a default route to it in the private subnet's route table.
Why it's wrong here
An Internet Gateway allows inbound traffic to instances with public IPs, but private subnet instances do not have public IPs and would be directly accessible if they did.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.