ANS-C01 Network Design Practice Question

Exhibit

Refer to the exhibit.

CloudFormation template snippet:
Resources:
  MyVPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: "10.0.0.0/16"
  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref MyVPC
      CidrBlock: "10.0.1.0/24"
      MapPublicIpOnLaunch: true
  PublicSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref MyVPC
      CidrBlock: "10.0.2.0/24"
      MapPublicIpOnLaunch: true
  InternetGateway:
    Type: AWS::EC2::InternetGateway
  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref MyVPC
      InternetGatewayId: !Ref InternetGateway
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref MyVPC
  PublicRoute:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: "0.0.0.0/0"
      GatewayId: !Ref InternetGateway
  PublicSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet1
      RouteTableId: !Ref PublicRouteTable
  PublicSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet2
      RouteTableId: !Ref PublicRouteTable

A network engineer deploys this CloudFormation template. After deployment, an EC2 instance launched in PublicSubnet1 cannot reach the internet. What is the most likely cause?

⚠ Common exam trap

AWS often tests the distinction between having an Internet Gateway attached to the VPC (which is necessary but not sufficient) and having a proper route table association with a default route to that IGW, leading candidates to mistakenly select Option A when the real issue is the missing subnet-to-route-table linkage.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The subnet does not have a route to the Internet Gateway because the route table is not associated with the subnet.

The most likely cause is that the route table containing the default route (0.0.0.0/0) pointing to the Internet Gateway is not associated with PublicSubnet1. Without this association, traffic from the subnet has no path to the Internet Gateway, even if the IGW is attached to the VPC. CloudFormation templates often create separate route tables and subnets, and a missing subnet-to-route-table association is a common misconfiguration.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The Internet Gateway is not attached to the VPC.
Why it's wrong here
The AttachGateway resource attaches it.
✓
The subnet does not have a route to the Internet Gateway because the route table is not associated with the subnet.
Why this is correct
The template does not associate the custom route table with PublicSubnet1; it uses the main route table which lacks the IGW route.
✗
The subnet does not have MapPublicIpOnLaunch set to true.
Why it's wrong here
It is set to true.
✗
The security group is blocking outbound traffic.
Why it's wrong here
Security groups allow all outbound by default.

Visual reference

Go deeper

ANS-C01 Network Design Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question