Troubleshooting NAT Gateway Internet Access
A company has a VPC with public and private subnets. A NAT Gateway is deployed in the public subnet to allow instances in the private subnet to access the internet. However, private instances cannot reach an external service at 203.0.113.50:443. What should be checked first?
Quick Answer
The answer is to first check the route table for the private subnet, ensuring it has a 0.0.0.0/0 route pointing to the NAT Gateway. This is the most common failure point when troubleshooting NAT Gateway internet access from a private subnet, because without that default route, traffic from private instances has no path to the NAT Gateway and cannot reach external services like 203.0.113.50:443. On the AWS Certified SysOps Administrator Associate SOA-C02 exam, this scenario tests your understanding of VPC routing fundamentals—many candidates mistakenly check security groups or the NAT Gateway’s public IP first, but those are secondary; the route table is the immediate suspect. A common trap is forgetting that NACLs and security groups are stateful for NAT traffic, so they rarely cause outbound-only failures. Memory tip: “Route before rules”—always verify the private subnet’s route table before diving into firewall configurations.
⚠ Common exam trap
SOA-C02 often tests the order of troubleshooting steps: candidates may jump to checking the NAT Gateway's Elastic IP or security groups, but the most common and first thing to verify is the private subnet's route table.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The route table for the private subnet has a route 0.0.0.0/0 pointing to the NAT Gateway.
The most common cause of private instances failing to reach the internet via a NAT Gateway is a missing or incorrect route in the private subnet's route table. The private subnet must have a route for 0.0.0.0/0 pointing to the NAT Gateway; otherwise, traffic has no path out. This is the first thing to verify because it is the fundamental routing requirement for NAT Gateway functionality.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The route table for the private subnet has a route 0.0.0.0/0 pointing to the NAT Gateway.
Why this is correct
Private-subnet instances reach the internet only if their route table has 0.0.0.0/0 targeting the NAT Gateway. Verifying this route first confirms whether traffic can leave the subnet at all before investigating security groups, NACLs or the NAT Gateway itself.
- ✗
The NAT Gateway has an Elastic IP assigned.
Why it's wrong here
A NAT Gateway cannot be created without an Elastic IP, so this is guaranteed present and cannot be the fault. It is tempting because an Elastic IP is genuinely required for a NAT Gateway to translate private addresses to a public source address.
- ✗
The security group for the NAT Gateway allows inbound traffic from the private subnet.
Why it's wrong here
NAT Gateways have no security group; they are not associated with one, so inbound rules cannot exist for them. It is tempting because security groups commonly block traffic, but the correct first check is the private subnet's route table pointing 0.0.0.0/0 to the NAT Gateway.
- ✗
The internet gateway is attached to the VPC.
Why it's wrong here
An internet gateway only enables public subnet traffic; private instances route through the NAT Gateway, so its state does not explain this failure. It is tempting because a missing internet gateway does break outbound access for instances that sit directly in a public subnet.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SOA-C02 question from scratch — 1,169 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SOA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a VPC with public and private subnets. A NAT Gateway is deployed in the public subnet. Private EC2 instances need to download patches from the internet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway. However, the instances cannot reach the internet. What is the most likely cause?
hard- A.The private subnet’s network ACL is blocking outbound traffic.
- ✓ B.The NAT Gateway is not placed in a public subnet with a route to an internet gateway.
- C.The security group for the private instances does not allow outbound HTTPS.
- D.The NAT Gateway does not have an Elastic IP address assigned.
Why B: A NAT Gateway must be deployed in a public subnet that has a route to an internet gateway. Although the private subnet's route table points to the NAT Gateway for default traffic, if the NAT Gateway's subnet lacks a route to an internet gateway, the NAT Gateway cannot forward traffic to the internet. Option A is incorrect because network ACLs could block traffic, but the stated issue—instances cannot reach the internet via a properly configured route—points to the NAT Gateway's subnet configuration as the most likely cause. Option C is incorrect because even if the private instances' security group allows outbound HTTPS, the NAT Gateway still needs internet connectivity. Option D is incorrect because while a NAT Gateway requires an Elastic IP address, the scenario assumes the NAT Gateway is deployed; typically, an Elastic IP is assigned during creation, so the missing route to the internet gateway is the more probable cause.
Variation 2. A company has a VPC with public and private subnets. A NAT Gateway is in the public subnet, and a private EC2 instance needs to download patches from the internet. The instance can reach the internet after a reboot. Which action should the SysOps administrator take to make the internet access persistent?
hard- ✓ A.Update the route table of the private subnet to point 0.0.0.0/0 to the NAT Gateway.
- B.Attach an internet gateway to the private subnet.
- C.Associate an Elastic IP with the NAT Gateway.
- D.Enable DNS resolution in the VPC.
Why A: Route tables must be manually updated after adding a NAT Gateway. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.