ANS-C01 Network Security, Compliance and Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  1. Create NAT gateway in a public subnet. 2. Update route tables to point default route to NAT gateway. 3. Remove the Internet Gateway route from route tables. 4. Adjust security group rules for outbound traffic. 5. Test outbound connectivity.

  Why this is correct

  This order ensures that the NAT gateway exists before routes are updated, preventing a loss of connectivity. Removing the IGW route after updating routes maintains outbound access through the NAT gateway. Security adjustments and testing finalize the migration.

• ✗

  1. Update route tables to point default route to NAT gateway. 2. Remove the Internet Gateway route. 3. Create NAT gateway in a public subnet. 4. Adjust security group rules. 5. Test outbound connectivity.

  Why it's wrong here

  Incorrect because you cannot update routes to point to a NAT gateway that does not yet exist. This would cause route update failure or point to an invalid target, breaking connectivity.

• ✗

  1. Remove the Internet Gateway route. 2. Create NAT gateway in a public subnet. 3. Update route tables to point default route to NAT gateway. 4. Adjust security group rules. 5. Test outbound connectivity.

  Why it's wrong here

  Incorrect because removing the IGW route first removes all outbound internet access until the NAT gateway is created and the new route is added, causing a temporary outage.

• ✗

  1. Adjust security group rules. 2. Create NAT gateway. 3. Update routes. 4. Remove IGW route. 5. Test outbound connectivity.

  Why it's wrong here

  Incorrect because adjusting security group rules before the NAT gateway is in place may not be effective and could allow unintended traffic. The correct order is to set up the network path first, then adjust security.