NAT Gateway Placement for Private Subnet Internet Access
A company has a VPC with public and private subnets. The public subnet has a NAT Gateway. The private subnet has an EC2 instance that needs to download patches from the internet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway. However, the instance cannot reach the internet. What is the most likely cause?
Quick Answer
The answer is that the NAT Gateway is deployed in a private subnet. For a NAT Gateway to provide internet access to instances in a private subnet, it must be placed in a public subnet that has a route to an Internet Gateway. Without that public-facing placement, the NAT Gateway cannot translate private IP addresses to a public one, and the default route of 0.0.0.0/0 in the private subnet’s route table becomes a dead end. On the AWS Certified SysOps Administrator Associate SOA-C02 exam, this question tests your understanding of VPC routing fundamentals and the critical distinction between public and private subnet configurations. A common trap is assuming that simply pointing a route to the NAT Gateway is enough, but the gateway itself must be internet-reachable. Remember the memory tip: “NATs need a public spot to connect the private lot.”
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The NAT Gateway is deployed in a private subnet.
A NAT Gateway must be deployed in a public subnet with a route to an Internet Gateway. If the NAT Gateway is in a private subnet, it cannot access the internet, and thus the instances in the private subnet cannot reach the internet via it. Option A is incorrect because network ACLs by default allow all outbound traffic; even if they block HTTP, the instance might still reach other services, but the core issue is the NAT Gateway placement. Option B is incorrect because security groups by default allow all outbound traffic; unless explicitly modified, outbound is not blocked. Option D is incorrect because while a NAT Gateway does require an Elastic IP to communicate with the internet, the more fundamental and likely cause is that the NAT Gateway is in a private subnet, which renders it non-functional regardless of Elastic IP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The network ACL for the private subnet blocks outbound HTTP traffic.
Why it's wrong here
The network ACL for the private subnet by default allows all outbound traffic. Even if outbound HTTP were blocked, the instance might still reach other services, but the core issue here is the NAT Gateway placement.
- ✗
The security group of the EC2 instance blocks outbound traffic.
Why it's wrong here
Security groups by default allow all outbound traffic. Unless the outbound rule was explicitly removed, this is not the cause.
- ✓
The NAT Gateway is deployed in a private subnet.
Why this is correct
Correct. A NAT Gateway must be deployed in a public subnet with a route to an Internet Gateway. If it is in a private subnet, it cannot access the internet, breaking the connectivity for instances using it.
- ✗
The NAT Gateway does not have an Elastic IP address.
Why it's wrong here
Incorrect. While a NAT Gateway does require an Elastic IP address to communicate with the internet, the more fundamental and likely cause is that the NAT Gateway is deployed in a private subnet, which renders it non-functional regardless of having an Elastic IP.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 247 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on SOA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company has a NAT gateway in the public subnet. Which of the following route table configurations is required for the private subnet to enable internet access through the NAT gateway?
hard- A.Add a route to 0.0.0.0/0 pointing to the internet gateway in the private subnet route table
- ✓ B.Add a route to 0.0.0.0/0 pointing to the NAT gateway in the private subnet route table
- C.Add a route to 0.0.0.0/0 pointing to the NAT gateway in the public subnet route table
- D.Add a route to the NAT gateway's private IP in the private subnet route table
Why B: A private subnet route table must have a default route (0.0.0.0/0) pointing to the NAT gateway's elastic network interface (ENI) to forward outbound internet traffic from private instances through the NAT gateway. The NAT gateway, residing in the public subnet, then uses its own route table with a route to the internet gateway (IGW) to reach the internet. Without this route, traffic from the private subnet would have no path to the internet.
Variation 2. A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download software patches from the internet. Which component should be used to provide internet access to the instance?
medium- ✓ A.NAT Gateway in a public subnet
- B.AWS Site-to-Site VPN
- C.Internet Gateway attached to the VPC
- D.VPC Endpoint for Amazon S3
Why A: A NAT Gateway in a public subnet allows EC2 instances in private subnets to initiate outbound traffic to the internet (e.g., to download patches) while preventing unsolicited inbound connections. The NAT Gateway uses an Elastic IP and routes traffic from the private subnet through the internet gateway attached to the VPC, translating the private IP to the public IP of the NAT Gateway.
Variation 3. A company has a VPC with a public subnet and a private subnet. The private subnet contains an EC2 instance that must access the internet for software updates. Which TWO actions are required to enable this? (Choose TWO.)
medium- A.Add an Internet Gateway to the private subnet's route table.
- ✓ B.Deploy a NAT Gateway in a public subnet.
- C.Assign a public IP address to the EC2 instance.
- D.Attach an Internet Gateway to the NAT Gateway.
- ✓ E.Add a route in the private subnet's route table pointing to the NAT Gateway for 0.0.0.0/0.
Why B: A NAT Gateway in a public subnet provides outbound internet access for private instances while preventing inbound connections. The private subnet's route table must include a default route (0.0.0.0/0) pointing to the NAT Gateway, enabling traffic to be forwarded to the internet via the Internet Gateway attached to the VPC.
Variation 4. Which THREE configurations are required to enable an EC2 instance in a private subnet to access the internet for software updates while preventing inbound internet traffic?
hard- ✓ A.Attach an Internet Gateway to the VPC.
- B.Assign an Elastic IP address to the EC2 instance.
- ✓ C.Add a route to the private subnet's route table with destination 0.0.0.0/0 pointing to the NAT Gateway.
- D.Deploy a bastion host in the private subnet.
- ✓ E.Place a NAT Gateway in a public subnet.
Why A: An Internet Gateway (IGW) is required for any VPC to enable internet connectivity. Without an IGW, traffic cannot leave or enter the VPC from the internet. For a private subnet EC2 instance to reach the internet for software updates, the VPC must have an IGW attached, and the NAT Gateway (placed in a public subnet) uses the IGW to forward outbound traffic while blocking inbound connections.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.