SAP-C02 Design for New Solutions Practice Question
A company is designing a new VPC with public and private subnets. The company wants to ensure that instances in the private subnets can download updates from the internet, but cannot be directly accessed from the internet. Which THREE components are required to meet these requirements? (Choose THREE.)
⚠ Common exam trap
Many exam-takers confuse a Virtual Private Gateway (VGW) with a NAT Gateway, mistakenly thinking a VGW can provide internet access, or they assume a VPC endpoint for S3 is sufficient for general internet downloads, when it only covers S3 traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A route table for private subnets with a default route pointing to the NAT Gateway.
A route table for private subnets with a default route (0.0.0.0/0) pointing to a NAT Gateway ensures that outbound traffic from instances in private subnets is forwarded to the NAT Gateway for internet access, while the NAT Gateway does not allow inbound connections initiated from the internet. This satisfies the requirement that instances can download updates but cannot be directly accessed from the internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A route table for private subnets with a default route pointing to the NAT Gateway.
Why this is correct
This route ensures that outbound traffic from private subnets is directed to the NAT Gateway.
- ✓
An Internet Gateway attached to the VPC.
Why this is correct
An Internet Gateway is required for any internet traffic, inbound or outbound, to and from the VPC.
- ✗
A Virtual Private Gateway (VGW).
Why it's wrong here
A VGW is used for VPN connections to on-premises networks, not for internet access.
- ✓
A NAT Gateway in a public subnet.
Why this is correct
A NAT Gateway enables instances in private subnets to initiate outbound traffic to the internet and receive responses, but prevents inbound connections from the internet.
- ✗
A VPC endpoint for S3.
Why it's wrong here
VPC endpoints provide private access to AWS services like S3, but do not provide general internet access.
Visual reference
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.