ANS-C01 Network Design Practice Question

Exhibit

Refer to the exhibit.

CloudFormation snippet:
Resources:
  MyVPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
  MySubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref MyVPC
      CidrBlock: 10.0.1.0/24
      AvailabilityZone: us-east-1a
  MyIGW:
    Type: AWS::EC2::InternetGateway
  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref MyVPC
      InternetGatewayId: !Ref MyIGW
  MyRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref MyVPC
  MyRoute:
    Type: AWS::EC2::Route
    DependsOn: AttachGateway
    Properties:
      RouteTableId: !Ref MyRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref MyIGW
  MySubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref MySubnet
      RouteTableId: !Ref MyRouteTable

Refer to the exhibit. A developer created this CloudFormation template to create a public subnet. However, instances in the subnet cannot access the internet. What is the MOST likely cause?

⚠ Common exam trap

AWS often tests the misconception that a default route to an IGW alone guarantees internet access, but the trap here is that the instance must have a public IP address for the IGW to perform source NAT, and auto-assign public IP is disabled by default in CloudFormation unless explicitly enabled.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The subnet does not have auto-assign public IP enabled

The CloudFormation template creates a public subnet but does not set the 'MapPublicIpOnLaunch' property to 'true'. Without this setting, EC2 instances launched in the subnet do not automatically receive a public IPv4 address, which is required for internet-bound traffic to be routed through the Internet Gateway (IGW). Even if the route table has a default route (0.0.0.0/0) pointing to the IGW, the instance lacks a public IP, so the IGW cannot perform source NAT for outbound traffic, making internet access impossible.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The subnet does not have auto-assign public IP enabled
Why this is correct
Instances need public IPs for internet access; template does not enable it.
✗
The route to the internet gateway is missing
Why it's wrong here
The template has a route to 0.0.0.0/0 via IGW.
✗
The route table is not associated with the subnet
Why it's wrong here
The template has a SubnetRouteTableAssociation.
✗
The internet gateway is not attached to the VPC
Why it's wrong here
The template has VPCGatewayAttachment.

Visual reference

Go deeper

ANS-C01 Network Design Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question