ANS-C01 Network Design Practice Question
Exhibit
Refer to the exhibit. CLI output from an EC2 instance: [ec2-user@ip-10-0-1-5 ~]$ traceroute 8.8.8.8 traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets 1 10.0.1.1 (10.0.1.1) 1.123 ms 1.089 ms 1.045 ms 2 10.0.0.1 (10.0.0.1) 1.234 ms 1.198 ms 1.167 ms 3 * * * 4 * * * ...
The EC2 instance has a private IP 10.0.1.5. The first two hops are 10.0.1.1 (the subnet's default gateway) and 10.0.0.1. Based on the traceroute, what is the most likely configuration of the VPC?
⚠ Common exam trap
Many candidates assume a private subnet must have a NAT Gateway or NAT instance for outbound traffic, but the traceroute's lack of a third hop indicates that either no NAT device exists or the default route is missing entirely, not that a NAT device is present but unresponsive.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The subnet is a private subnet with no route to an Internet Gateway, and the default route points to a NAT instance or is missing
The traceroute shows the first hop as 10.0.1.1 (the subnet's default gateway) and the second hop as 10.0.0.1 (the VPC router's IP for the main route table). The absence of a third hop to a public IP or NAT device indicates that the instance's traffic is not being forwarded beyond the VPC router. This is consistent with a private subnet that has no route to an Internet Gateway and either has no default route or a default route pointing to a NAT instance that is not responding or is missing, causing the traceroute to stop at the VPC router.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The subnet is a public subnet with a route to an Internet Gateway
Why it's wrong here
If public, traceroute would show the IGW.
- ✓
The subnet is a private subnet with no route to an Internet Gateway, and the default route points to a NAT instance or is missing
Why this is correct
Traffic stops at VPC router, indicating no internet path.
- ✗
The subnet is a private subnet with a route to a NAT Gateway
Why it's wrong here
NAT Gateway would likely appear as a hop.
- ✗
The subnet is connected to a VPN
Why it's wrong here
VPN would show different hops.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.