PAS-C01 Technology Practice Question
A company runs SAP on EC2 instances in a private subnet. The instances need to download patches from the internet but must not be directly accessible from the internet. Which configuration meets these requirements?
⚠ Common exam trap
Watch out — candidates often confuse a NAT Gateway with an Internet Gateway, mistakenly thinking that an Internet Gateway can be used for outbound-only access from a private subnet, when in fact an Internet Gateway enables bidirectional traffic and requires instances to have public IPs to be reachable from the internet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a NAT Gateway in a public subnet and route traffic from the private subnet to it
A NAT Gateway, deployed in a public subnet with an Elastic IP, allows instances in a private subnet to initiate outbound connections to the internet (e.g., to download patches) while preventing any unsolicited inbound connections from the internet. The private subnet's route table directs 0.0.0.0/0 traffic to the NAT Gateway, which performs source network address translation (SNAT) on the outbound traffic and drops unsolicited inbound packets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place a proxy server on a bastion host in a public subnet
Why it's wrong here
This adds complexity and the bastion host could be a security risk.
- ✗
Attach an Internet Gateway to the VPC and add a route to the private subnet
Why it's wrong here
An Internet Gateway allows inbound connections, violating the requirement.
- ✗
Use a VPN connection to the on-premises network and route internet traffic through it
Why it's wrong here
VPN provides access to on-premises, not direct internet access.
- ✓
Deploy a NAT Gateway in a public subnet and route traffic from the private subnet to it
Why this is correct
NAT Gateway enables outbound internet traffic while blocking inbound.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PAS-C01 question from scratch — 1,616 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.