Outbound Internet for Private Subnets — NAT Gateway Configuration
A security engineer is designing a VPC with public and private subnets. The private subnets will host databases that should not have direct internet access. Which three components are required to provide outbound internet access for these databases? (Choose THREE.)
Quick Answer
The answer is a NAT gateway in a public subnet, an internet gateway, and a route table in the private subnet with a default route pointing to the NAT gateway. This combination works because the NAT gateway, residing in a public subnet with an internet gateway attached, translates private IP addresses to its own public IP for outbound traffic, while the private subnet’s route table ensures all non-local traffic is forwarded to the NAT device. On the AWS Certified Security Specialty SCS-C02 exam, this scenario tests your understanding of how to enable outbound internet for private subnets without granting direct inbound access—a common requirement for secure database tiers. A frequent trap is confusing a VPC gateway endpoint (for S3 or DynamoDB) with general internet access, or assuming a NAT gateway alone suffices without the internet gateway. Remember the three-part chain: internet gateway → NAT gateway → private route table default route.
⚠ Common exam trap
Many candidates think a NAT gateway alone provides internet access, forgetting that the NAT gateway must be placed in a public subnet with a route to an internet gateway, and that the private subnet’s default route must point to the NAT gateway, not the IGW.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An internet gateway attached to the VPC.
An internet gateway (IGW) is required to enable outbound internet access for resources in a VPC. The NAT gateway, which resides in a public subnet, uses the IGW to translate private IP addresses to the public IP of the NAT gateway, allowing instances in private subnets to initiate outbound traffic to the internet while preventing inbound connections from the internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS WAF attached to the NAT gateway.
Why it's wrong here
WAF is a web application firewall.
- ✓
An internet gateway attached to the VPC.
Why this is correct
The internet gateway provides internet access for the public subnet where the NAT gateway resides.
- ✓
Route tables in the private subnets with a default route (0.0.0.0/0) pointing to the NAT gateway.
Why this is correct
Routes direct traffic to the NAT gateway.
- ✗
A VPC gateway endpoint for S3.
Why it's wrong here
Gateway endpoints only provide access to S3 and DynamoDB.
- ✓
A NAT gateway in a public subnet.
Why this is correct
NAT gateways enable outbound internet from private subnets.
Visual reference
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security engineer is designing a VPC with public and private subnets. The private subnets must be able to download software updates from the internet. Which TWO components can provide this functionality without exposing the private instances to inbound internet traffic?
medium- ✓ A.NAT gateway
- B.Internet gateway
- C.VPC endpoint
- D.Egress-only internet gateway
- ✓ E.NAT instance
Why A: A NAT gateway is a managed AWS service that enables instances in a private subnet to initiate outbound traffic to the internet (e.g., for downloading software updates) while preventing the internet from initiating inbound connections to those instances. It translates the private IP addresses of the instances to the NAT gateway's Elastic IP address, allowing return traffic to be routed back correctly. This meets the requirement of outbound-only internet access without exposing private instances to inbound traffic.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.