← ANS-C01·Amazon Web Services

Question 1,433 of 1,705

Network Management and Operations →hardMultiple ChoiceObjective-mapped

Troubleshooting NAT Gateway: Private Subnet Internet Access Fails

This ANS-C01 practice question tests your understanding of network management and operations. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. A key principle to apply: nAT Gateway Security Group. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A company has a VPC with public and private subnets. The private subnets use a NAT gateway for outbound internet access. The security team notices that some EC2 instances in the private subnets are able to reach the internet, but others are not. All instances have the same security group and are in the same private subnet. What is the most likely cause?

Clue words in this question

Noticing these words before you look at the options changes how you read each choice.

Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.

A
The route table associated with the private subnet is missing a default route to the NAT gateway.
Why wrong: Incorrect. If the route table were missing the default route to the NAT gateway, every instance in that private subnet would be unable to reach the internet. The question states that some instances can reach the internet, so this cannot be the cause.
B
The network ACL is blocking outbound traffic on ephemeral ports.
Why wrong: Incorrect. Network ACLs are stateless and apply to all instances in the subnet equally. If the NACL blocked outbound ephemeral ports, all instances would be affected, not just some.
C
The NAT gateway's security group is blocking traffic from some instances.
Correct. The NAT gateway has an elastic network interface with a security group. If that security group is configured to allow traffic only from specific instances (e.g., based on private IP addresses or security group IDs), it can selectively permit or deny outbound internet access for instances in the same private subnet.
D
The internet gateway is not attached to the VPC.
Why wrong: Incorrect. The internet gateway is attached to the VPC, and its presence or absence does not affect individual subnets directly. If the IGW were not attached, no instances in any subnet (including public ones) would have internet access. Since some private instances can reach the internet, the IGW is working correctly.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The NAT gateway's security group is blocking traffic from some instances.

The most likely cause is that the NAT gateway's security group (attached to its elastic network interface) is blocking traffic from some instances. Although all EC2 instances are in the same private subnet and have the same security group, the NAT gateway's own security group can be configured to allow outbound traffic only from specific source IPs or security groups. If the NAT gateway's security group only permits traffic from certain instances' private IPs (or security groups) within the subnet, it would allow some instances to reach the internet while blocking others. Option A is incorrect because a missing route would affect all instances in that subnet equally. Option B is incorrect because a network ACL applies to the entire subnet and would block all instances. Option D is incorrect because the internet gateway is attached to the VPC, not directly to private subnets, and its absence would prevent all internet access.

Key principle: NAT Gateway Security Group

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The route table associated with the private subnet is missing a default route to the NAT gateway.
Why it's wrong here
Incorrect. If the route table were missing the default route to the NAT gateway, every instance in that private subnet would be unable to reach the internet. The question states that some instances can reach the internet, so this cannot be the cause.
✗
The network ACL is blocking outbound traffic on ephemeral ports.
Why it's wrong here
Incorrect. Network ACLs are stateless and apply to all instances in the subnet equally. If the NACL blocked outbound ephemeral ports, all instances would be affected, not just some.
✓
The NAT gateway's security group is blocking traffic from some instances.
Why this is correct
Correct. The NAT gateway has an elastic network interface with a security group. If that security group is configured to allow traffic only from specific instances (e.g., based on private IP addresses or security group IDs), it can selectively permit or deny outbound internet access for instances in the same private subnet.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
NAT Gateway Security Group
✗
The internet gateway is not attached to the VPC.
Why it's wrong here
Incorrect. The internet gateway is attached to the VPC, and its presence or absence does not affect individual subnets directly. If the IGW were not attached, no instances in any subnet (including public ones) would have internet access. Since some private instances can reach the internet, the IGW is working correctly.

Common exam traps

Common exam trap: answer the scenario, not the keyword

Candidates might assume that all subnet-level configurations (route tables, NACLs) affect all instances uniformly, but they overlook that the NAT gateway's security group can filter traffic from specific sources, causing differential access within the same subnet.

Detailed technical explanation

How to think about this question

Treat this as a scenario question. Identify the problem, the constraint, and the best action. Then compare each option against those facts.

KKey Concepts to Remember

NAT Gateway Security Group
Route Table
Network ACL

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

NAT Gateway Security Group

Real-world example

How this comes up in practice

A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.

Visual reference

What to study next

Got this wrong? Here's your next step.

Review nAT Gateway Security Group, then practise related ANS-C01 questions on the same topic to reinforce the concept.

Related ANS-C01 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Network Management and Operations practice questions

Practise ANS-C01 questions linked to Network Management and Operations.

Network Security, Compliance and Governance practice questions

Practise ANS-C01 questions linked to Network Security, Compliance and Governance.

Network Design practice questions

Practise ANS-C01 questions linked to Network Design.

Network Implementation practice questions

Practise ANS-C01 questions linked to Network Implementation.

ANS-C01 fundamentals practice questions

Practise ANS-C01 questions linked to ANS-C01 fundamentals.

ANS-C01 scenario practice questions

Practise ANS-C01 questions linked to ANS-C01 scenario.

ANS-C01 troubleshooting practice questions

Practise ANS-C01 questions linked to ANS-C01 troubleshooting.

Practice this exam

Start a free ANS-C01 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

ANS-C01 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this ANS-C01 question test?

Network Management and Operations — This question tests Network Management and Operations — NAT Gateway Security Group.

What is the correct answer to this question?

The correct answer is: The NAT gateway's security group is blocking traffic from some instances. — The most likely cause is that the NAT gateway's security group (attached to its elastic network interface) is blocking traffic from some instances. Although all EC2 instances are in the same private subnet and have the same security group, the NAT gateway's own security group can be configured to allow outbound traffic only from specific source IPs or security groups. If the NAT gateway's security group only permits traffic from certain instances' private IPs (or security groups) within the subnet, it would allow some instances to reach the internet while blocking others. Option A is incorrect because a missing route would affect all instances in that subnet equally. Option B is incorrect because a network ACL applies to the entire subnet and would block all instances. Option D is incorrect because the internet gateway is attached to the VPC, not directly to private subnets, and its absence would prevent all internet access.

What should I do if I get this ANS-C01 question wrong?

Review nAT Gateway Security Group, then practise related ANS-C01 questions on the same topic to reinforce the concept.

Are there clue words in this question I should notice?

Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.

What is the key concept behind this question?

NAT Gateway Security Group

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more ways this is tested on ANS-C01

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A company's VPC includes a public subnet with a NAT gateway and a private subnet with EC2 instances. The EC2 instances in the private subnet need to access the internet for software updates. The NAT gateway's Elastic IP is associated correctly, and the route tables are configured. However, the EC2 instances cannot reach the internet. What is the most likely cause?

medium

A.The NAT gateway is in the private subnet.
✓ B.The route table for the private subnet is missing a default route pointing to the NAT gateway.
C.The network ACL for the private subnet is blocking outbound traffic.
D.The security group for the EC2 instances does not allow outbound traffic.

Why B: The most common issue is that the route table for the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT gateway. Without this route, traffic from the private subnet cannot be directed to the NAT gateway, and thus cannot reach the internet.

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.