Private Subnet Internet Access via NAT Gateway — Route Table Association
A company has a VPC with a public subnet and a private subnet. The private subnet hosts a web application that needs to access an external API over the internet. The private subnet uses a NAT Gateway in the public subnet for outbound internet access. The web application is failing to reach the external API. The engineer has verified the following: the NAT Gateway has an Elastic IP attached, the route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway, the security group for the web application allows outbound HTTPS (TCP 443) to 0.0.0.0/0, the network ACL for the private subnet allows inbound and outbound TCP ephemeral ports (1024-65535) from and to 0.0.0.0/0, and the IAM role attached to the EC2 instance allows outbound HTTPS. The engineer also confirmed that the NAT Gateway is in the public subnet which has a route to an Internet Gateway. Despite all these checks, the web application still cannot reach the external API. What should the engineer do next?
Quick Answer
The answer is to verify that the route table is correctly associated with the private subnet. Even when a route table contains a default route (0.0.0.0/0) pointing to a NAT Gateway, that route only applies if the route table is actually attached to the subnet hosting the web application. A common misconfiguration is creating the correct route table but failing to associate it with the target private subnet, leaving the subnet using the VPC’s default route table, which typically lacks the NAT Gateway path. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this scenario tests your understanding of route table association as a distinct step from route creation—a frequent trap where engineers assume a route exists in the VPC and forget to link it to the specific subnet. The exam emphasizes that private subnet internet access via NAT gateway route table association requires both the correct route entry and the explicit subnet attachment. Memory tip: “A route without a subnet is just a map without a destination—associate it to make the connection.”
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify that the route table is correctly associated with the private subnet.
Even though the route table contains a default route to the NAT Gateway, it may not be associated with the private subnet. If the route table is not associated, the private subnet uses the main route table, which might not have the default route. The engineer should verify that the correct route table is associated with the private subnet. Option A is incorrect because the security group already allows outbound HTTPS. Option B is incorrect because the NAT Gateway must be in a public subnet. Option D is incorrect because a specific route is unnecessary when a default route already exists.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add an inbound rule to the security group for the external API's IP address.
Why it's wrong here
Outbound traffic is already allowed.
- ✗
Move the NAT Gateway to the private subnet.
Why it's wrong here
NAT Gateways must be in a public subnet.
- ✓
Verify that the route table is correctly associated with the private subnet.
Why this is correct
Misassociation is a common issue.
- ✗
Add a specific route for the external API's IP address to the route table.
Why it's wrong here
The default route should suffice.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a VPC with a public subnet and a private subnet. The private subnet instances need to make outbound internet requests. A NAT Gateway is deployed in the public subnet. The network engineer notices that instances in the private subnet cannot reach the internet, but the NAT Gateway's Elastic IP is reachable from the internet. Which of the following is the most likely cause?
hard- A.The network ACL on the private subnet blocks outbound traffic.
- ✓ B.The route table for the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT Gateway.
- C.The NAT Gateway is not associated with an Elastic IP.
- D.The security group attached to the NAT Gateway blocks outbound traffic.
Why B: The private subnet instances cannot reach the internet because the route table for the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT Gateway. Without this route, traffic destined for the internet has no path. Option A is incorrect because a NACL blocking outbound traffic would cause a different symptom, but the stem indicates the NAT Gateway's EIP is reachable, suggesting routing is the issue. Option C is incorrect because the NAT Gateway is already associated with an Elastic IP. Option D is incorrect because security groups are not applied to NAT Gateways; they are applied to instances.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.