SCS-C02 NAT Gateway Practice Question
A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The security engineer has set up a NAT gateway in a public subnet and updated the route tables accordingly. However, instances in the private subnets cannot reach the internet. The engineer checks the security group for the NAT gateway and finds that it allows all outbound traffic. What is the most likely cause of the issue?
⚠ Common exam trap
The trap is that the engineer focuses on a non-existent security group for the NAT gateway, while the real issue is the missing default route in the private subnet's route table. Candidates may incorrectly assume security groups apply to NAT gateways or overlook the route table configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The route table for the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT gateway.
The most likely cause is that the route table for the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT gateway. Without this route, traffic from private instances cannot reach the NAT gateway, and thus cannot access the internet. Option B is incorrect because a NAT gateway must have an Elastic IP assigned during creation, so it would not be missing. Option C is incorrect because NAT gateways do not have security groups; they are managed by AWS and the security group concept does not apply. Option D is incorrect because network ACLs are stateless and must allow both inbound and outbound traffic, but the issue here is more likely with routing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The route table for the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT gateway.
Why this is correct
For instances in a private subnet to reach the internet through a NAT gateway, the subnet's route table must have a default route (0.0.0.0/0) with the NAT gateway as the target. If this route is missing, any outbound internet-bound traffic has no valid next hop and is dropped, causing the connectivity failure. After adding this route, ensure the NAT gateway itself is in a public subnet with an associated Elastic IP and that the public subnet's route table points 0.0.0.0/0 to an internet gateway. This is the most direct and common cause when private instances cannot access the internet.
- ✗
The NAT gateway does not have an Elastic IP address assigned.
Why it's wrong here
Incorrect. A NAT gateway requires an Elastic IP to be assigned at creation; if it were missing, the NAT gateway would not have been successfully created. The engineer would have seen an error during creation.
- ✗
The security group for the NAT gateway does not allow inbound traffic from the private subnets.
Why it's wrong here
NAT gateways are a managed AWS service and do not have security groups associated with them; security groups only apply to Elastic Network Interfaces (ENIs) of EC2 instances or other resources like RDS. Therefore, checking a NAT gateway's security group is not a valid troubleshooting step, and the absence of such a security group is not the root cause. The actual issue is that the private subnet's route table must contain a 0.0.0.0/0 route pointing to the NAT gateway ID.
- ✗
The network ACL for the private subnet does not allow inbound HTTP/HTTPS traffic.
Why it's wrong here
Incorrect. While network ACLs could potentially block traffic, the most likely cause given the scenario (route tables updated, security group check) is a missing default route. Network ACLs are stateless and would need to allow both inbound and outbound traffic, but this is less common than a routing issue.
Visual reference
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.