The answer is that the NAT gateway’s Elastic IP is not associated with the NAT gateway. For a private instance to reach the internet through a NAT gateway, the NAT gateway itself must have a valid Elastic IP assigned and a route to an Internet Gateway in its public subnet’s route table. Even though the private subnet’s route table correctly points to the NAT gateway, if the NAT gateway lacks its own Elastic IP, it cannot translate private source addresses for outbound traffic, breaking connectivity. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this scenario tests your understanding of how NAT gateways differ from instances with public IPs—a common trap is assuming an instance’s Elastic IP bypasses the NAT gateway, but private subnet instances must always route through the NAT, which requires its own public IP. Remember the mnemonic: “NAT needs its own IP to translate—don’t let an instance’s public IP confuse the route.”
ANS-C01 Network Management and Operations Practice Question
This ANS-C01 practice question tests your understanding of network management and operations. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access the internet for software updates. The instance is associated with an Elastic IP address. The route table for the private subnet has a default route (0.0.0.0/0) pointing to a NAT gateway. The NAT gateway is in the public subnet and has an Elastic IP. Despite this, the instance cannot reach the internet. The security groups and NACLs are properly configured. What is the likely cause?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The NAT gateway's Elastic IP is not associated with the NAT gateway
If an instance has a public IP (Elastic IP) and is in a private subnet, the route to the internet must go through a NATgateway or Internet Gateway. The private subnet's route table points to NAT, which is correct. However, the NAT gateway itself must have a route to the internet via an Internet Gateway. Option C is correct. Options A, B, and D are common misconfigurations but not the most likely given the setup.
Key principle: Count usable hosts — not total addresses — and remember that the network and broadcast addresses are not available to hosts in standard IPv4 subnets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
The NAT gateway's Elastic IP is not associated with the NAT gateway
Why this is correct
If the NATgateway lacks an Elastic IP, it cannot communicate with the internet.
Common exam trap: usable hosts are not the same as total addresses
Subnetting questions often tempt you into counting all addresses. In normal IPv4 subnets, the network and broadcast addresses are not usable host addresses.
Detailed technical explanation
How to think about this question
Subnetting questions test whether you can identify the network, broadcast address, usable range, mask and correct subnet. Slow down enough to calculate the block size correctly.
KKey Concepts to Remember
CIDR notation defines the prefix length.
Block size helps identify subnet boundaries.
Network and broadcast addresses are not usable hosts in normal IPv4 subnets.
The required host count determines the smallest suitable subnet.
TExam Day Tips
→Write the block size before choosing the subnet.
→Check whether the question asks for hosts, subnets or a specific address range.
→Do not confuse /24, /25, /26 and /27 host counts.
Key takeaway
Count usable hosts — not total addresses — and remember that the network and broadcast addresses are not available to hosts in standard IPv4 subnets.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Review block sizes, usable host formulas (2^n − 2), and how to find network and broadcast addresses for /24 through /30. Then practise related ANS-C01 subnetting questions on CIDR, address ranges, and subnet selection.
Network Management and Operations — This question tests Network Management and Operations — CIDR notation defines the prefix length..
What is the correct answer to this question?
The correct answer is: The NAT gateway's Elastic IP is not associated with the NAT gateway — If an instance has a public IP (Elastic IP) and is in a private subnet, the route to the internet must go through a NAT gateway or Internet Gateway. The private subnet's route table points to NAT, which is correct. However, the NAT gateway itself must have a route to the internet via an Internet Gateway. Option C is correct. Options A, B, and D are common misconfigurations but not the most likely given the setup.
What should I do if I get this ANS-C01 question wrong?
Review block sizes, usable host formulas (2^n − 2), and how to find network and broadcast addresses for /24 through /30. Then practise related ANS-C01 subnetting questions on CIDR, address ranges, and subnet selection.
What is the key concept behind this question?
CIDR notation defines the prefix length.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access the internet for software updates. The instance has a route to a NAT Gateway in the public subnet. However, the instance cannot reach the internet. Which step should the network engineer take to troubleshoot?
easy
A.Move the NAT Gateway to a private subnet
B.Verify that the NAT Gateway is in the same subnet as the EC2 instance
✓ C.Verify that the NAT Gateway has an Elastic IP and the private subnet's route table has a route to the NAT Gateway
D.Attach an Internet Gateway to the private subnet
Why C: Option B is correct because the NAT Gateway's Elastic IP must be associated and the route table of the private subnet must point to the NAT Gateway. Option A is wrong because the NAT Gateway is in the public subnet. Option C is wrong because an Internet Gateway is attached to the VPC, not the subnet. Option D is wrong because the NAT Gateway is not in a public subnet if it has an EIP and route to IGW.
Variation 2. A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance has a NAT Gateway in the public subnet. However, the instance cannot reach the internet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway. What is the most likely cause?
hard
✓ A.The NAT Gateway does not have an Elastic IP address attached.
B.The security group for the EC2 instance blocks outbound traffic.
C.The network ACL for the private subnet blocks outbound traffic.
D.The private subnet route table does not have a route to the internet gateway.
Why A: Option B is correct. The NAT Gateway's Elastic IP must be associated, otherwise traffic cannot be translated. Option A is wrong because the route is already present. Option C is wrong because NACLs are stateless but would affect both directions if misconfigured. Option D is wrong because security groups are stateful and allow return traffic.
Variation 3. A company has a VPC with public and private subnets. An EC2 instance in the private subnet needs to access the internet. The instance has a route table with a default route to a NAT gateway. However, the instance cannot reach the internet. What is the most likely cause?
easy
✓ A.The NAT gateway is placed in a private subnet.
B.The instance does not have a public IP address assigned.
C.The security group attached to the instance does not allow outbound HTTPS traffic.
D.The network ACL on the private subnet blocks outbound HTTP traffic.
Why A: Option C is correct because the NAT gateway must be in a public subnet with an internet gateway to route traffic. Option A is wrong because security groups are stateful and allow outbound traffic by default. Option B is wrong because a public IP is not needed for outbound traffic through NAT. Option D is wrong because network ACLs are stateless and need explicit rules, but the default allows outbound traffic.
Variation 4. A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company has a NAT Gateway in the public subnet. The network team notices that instances in the private subnets cannot reach the internet. The route table for the private subnets has a default route (0.0.0.0/0) pointing to the NAT Gateway. What could be the issue?
medium
A.The NAT Gateway does not have a route to the internet gateway
✓ B.The NAT Gateway is in a private subnet
C.The VPC does not have a VPC endpoint for the software update service
D.The security group attached to the NAT Gateway is blocking traffic
Why B: Option B is correct because the NAT Gateway must be in a public subnet with an internet gateway route to function. Option A is wrong because the NAT Gateway itself does not have a route; the route table of the subnet where it resides needs a route to the internet gateway. Option C is wrong because security groups are for instances, not NAT Gateways. Option D is wrong because VPC endpoints are for specific AWS services, not general internet access.
Variation 5. A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company has set up a NAT gateway in the public subnet. However, instances in the private subnet cannot reach the internet. What is the most likely cause?
medium
A.The NAT gateway does not have a route to the internet gateway
B.The security group for the instances blocks outbound traffic
C.The NAT gateway is not associated with an Elastic IP
✓ D.The private subnet route table does not have a route to the NAT gateway
Why D: Option B is correct because the private subnet route table must have a default route (0.0.0.0/0) pointing to the NAT gateway. Option A is wrong because NAT gateway does not need an internet gateway route; it uses the internet gateway of the public subnet. Option C is wrong because security group rules for outbound traffic are usually allowed by default. Option D is wrong because the NAT gateway is in the public subnet, so it has internet access; the issue is routing from private subnet.
Last reviewed: Jun 20, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.