ANS-C01 Network Implementation Practice Question

Exhibit

Refer to the exhibit.

```
<AWS CloudFormation snippet>
Resources:
  MyVPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref MyVPC
      CidrBlock: 10.0.1.0/24
  PrivateSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref MyVPC
      CidrBlock: 10.0.2.0/24
  InternetGateway:
    Type: AWS::EC2::InternetGateway
  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref MyVPC
      InternetGatewayId: !Ref InternetGateway
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref MyVPC
  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn: AttachGateway
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway
  PublicSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet
      RouteTableId: !Ref PublicRouteTable
```

Refer to the exhibit. A CloudFormation template creates a VPC with public and private subnets. The template includes an Internet Gateway and a route table with a default route to the IGW, associated with the public subnet. An EC2 instance launched in the public subnet cannot be reached from the internet. The security group allows inbound HTTP from 0.0.0.0/0. What is the MOST likely missing resource?

⚠ Common exam trap

The ANS-C01 exam often tests the misconception that a route to an IGW and a permissive security group are sufficient for internet access, but candidates overlook the mandatory requirement for a public IP address on the instance or subnet for inbound connectivity.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

An Elastic IP address assigned to the instance or auto-assign public IP enabled on the subnet

The EC2 instance in the public subnet cannot be reached from the internet because it lacks a publicly routable IP address. Even though the subnet has a default route to the Internet Gateway (IGW) and the security group allows inbound HTTP from 0.0.0.0/0, the instance must have either an Elastic IP address assigned directly or the subnet must have the 'Auto-assign public IPv4 address' attribute enabled. Without a public IP, the IGW cannot perform 1-to-1 NAT to translate the instance's private IP to a public IP, making it unreachable from the internet.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
A VPN connection to the VPC
Why it's wrong here
Not needed for internet access.
✗
A NAT Gateway in the public subnet
Why it's wrong here
NAT Gateway is for private subnets.
✓
An Elastic IP address assigned to the instance or auto-assign public IP enabled on the subnet
Why this is correct
Public instances need a public IP to be reachable.
✗
A route table for the private subnet
Why it's wrong here
Private subnet not relevant to public instance.

Visual reference

Go deeper

ANS-C01 Network Implementation Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question