ANS-C01 Network Design Practice Question
A solutions architect is designing a VPC with public and private subnets in two Availability Zones. The private subnets require outbound internet access for software updates, but inbound internet access must be blocked. Which solution meets these requirements?
⚠ Common exam trap
Watch out — candidates often confuse a NAT Gateway with an Internet Gateway, thinking that a default route to an Internet Gateway in a private subnet is acceptable, but an Internet Gateway allows bidirectional traffic, which would expose private instances to inbound internet connections.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a NAT Gateway in a public subnet and add a default route to the NAT Gateway in the private subnet route tables.
A NAT Gateway, deployed in a public subnet with an Elastic IP and a route to an Internet Gateway, enables outbound traffic from private subnets to the internet while blocking unsolicited inbound connections. The private subnet route table directs default traffic (0.0.0.0/0) to the NAT Gateway, which performs source network address translation (SNAT) on outbound packets, ensuring responses return to the NAT Gateway without exposing private instances directly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attach an internet gateway to the VPC and add a default route to the internet gateway in the private subnet route tables.
Why it's wrong here
This allows inbound traffic as well.
- ✓
Deploy a NAT Gateway in a public subnet and add a default route to the NAT Gateway in the private subnet route tables.
Why this is correct
NAT Gateway provides outbound-only internet access.
- ✗
Launch an EC2 instance in a public subnet with a proxy software and route private subnet traffic through it.
Why it's wrong here
This is a valid but less optimal solution due to management overhead.
- ✗
Create a VPC endpoint for Amazon S3 and add a route to the endpoint in the private subnet route tables.
Why it's wrong here
A VPC endpoint for Amazon S3 only facilitates private connectivity to S3 buckets, not the general outbound internet access required for software updates from diverse internet sources. This option therefore fails to meet the broader connectivity requirement for the private subnets. It is tempting as VPC endpoints allow private subnets to securely access specific AWS services without an Internet Gateway, which is ideal when only service-specific communication, such as to S3, is needed, rather than full internet egress.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.