Troubleshooting NAT Gateway Security Group Outbound Rules
A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance is associated with a security group that allows outbound HTTPS (port 443) to 0.0.0.0/0. The private subnet route table has a default route (0.0.0.0/0) pointing to a NAT Gateway in the public subnet. The NAT Gateway's security group allows inbound HTTPS from the private subnet CIDR. However, the instance cannot download patches. What is the most likely cause?
Quick Answer
The answer is that the NAT Gateway’s security group is blocking outbound traffic to the internet. While the security group correctly allows inbound HTTPS from the private subnet CIDR, it must also permit outbound HTTPS to 0.0.0.0/0 for the return traffic from the internet to reach the NAT Gateway; without this outbound rule, the gateway drops the response packets, and the EC2 instance never receives the patches. On the AWS Certified Security Specialty SCS-C02 exam, this question tests your understanding that a NAT Gateway, like any resource in a VPC, requires both inbound and outbound security group rules to function—a common trap is focusing only on inbound rules and forgetting that stateful security groups still need explicit outbound rules for the gateway’s own traffic. Remember the mnemonic: “NAT needs out to get back in.”
⚠ Common exam trap
Candidates often assume the NAT Gateway only needs inbound rules from the private subnet, forgetting that outbound rules are required for return traffic, or they mistakenly think NAT Gateways cannot have security groups at all.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The NAT Gateway's security group is blocking outbound traffic to the internet
The NAT Gateway's security group must allow outbound traffic to the internet for the patches to be retrieved. Even though the NAT Gateway allows inbound HTTPS from the private subnet, it also needs an outbound rule permitting HTTPS traffic to 0.0.0.0/0 so that response packets from the internet can flow back through the NAT Gateway to the instance. Without this outbound rule, the NAT Gateway drops the return traffic, preventing the download.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The network ACL for the private subnet is blocking outbound traffic
Why it's wrong here
Default NACL allows all outbound; custom NACL would need explicit allow.
- ✓
The NAT Gateway's security group is blocking outbound traffic to the internet
Why this is correct
NAT Gateway's security group must allow outbound HTTPS to 0.0.0.0/0.
- ✗
The private subnet route table does not have a route to the NAT Gateway
Why it's wrong here
It has a default route to the NAT Gateway.
- ✗
The security group attached to the EC2 instance is blocking inbound traffic
Why it's wrong here
Security group is stateful; outbound rule allows return traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The security engineer has set up a NAT gateway in a public subnet and updated the route tables accordingly. However, instances in the private subnets cannot reach the internet. The engineer checks the security group for the NAT gateway and finds that it allows all outbound traffic. What is the most likely cause of the issue?
hard- ✓ A.The route table for the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT gateway.
- B.The NAT gateway does not have an Elastic IP address assigned.
- C.The security group for the NAT gateway does not allow inbound traffic from the private subnets.
- D.The network ACL for the private subnet does not allow inbound HTTP/HTTPS traffic.
Why A: The most likely cause is that the route table for the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT gateway. Without this route, traffic from private instances cannot reach the NAT gateway, and thus cannot access the internet. Option B is incorrect because a NAT gateway must have an Elastic IP assigned during creation, so it would not be missing. Option C is incorrect because NAT gateways do not have security groups; they are managed by AWS and the security group concept does not apply. Option D is incorrect because network ACLs are stateless and must allow both inbound and outbound traffic, but the issue here is more likely with routing.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.