Configuring Private Subnet Internet Access with NAT Gateway
A company is designing a VPC with public and private subnets. The private subnets need internet access for patching, but must not be directly reachable from the internet. Which TWO components should be used together?
Quick Answer
The answer is a NAT Gateway in a public subnet paired with a private route table that routes 0.0.0.0/0 traffic to that NAT Gateway. This design works because the NAT Gateway, residing in a public subnet with an Internet Gateway, translates private IPs to its own Elastic IP for outbound traffic, while the private subnet’s route table ensures return traffic flows back through the NAT Gateway, preventing any direct inbound connections. On the AWS Certified SysOps Administrator Associate SOA-C02 exam, this scenario tests your understanding of how to provide private subnet internet access using NAT Gateway design without exposing resources—a common trap is confusing a NAT Gateway with an Internet Gateway, which would make the subnet public. Remember the key distinction: an Internet Gateway enables bidirectional access, while a NAT Gateway only allows outbound-initiated traffic. For a quick memory tip, think “NAT in public, route in private” to keep the architecture straight.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Private subnet route table with a route to the NAT Gateway
The correct answers are D and E. A NAT Gateway placed in a public subnet (E) provides outbound internet access for instances in private subnets. The private subnet's route table must have a route pointing to the NAT Gateway (D) for internet-bound traffic. VPC Peering (A) connects VPCs but does not provide internet access. An Internet Gateway (C) attached to the VPC enables internet access for public subnets, but private subnets should not have a direct route to it. Option B (private route to IGW) would make the subnet public, violating the requirement. Therefore, D and E together provide the desired outbound-only internet access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VPC Peering connection
Why it's wrong here
VPC Peering does not provide internet access.
- ✗
Private subnet route table with a route to the Internet Gateway
Why it's wrong here
This would make the subnet public.
- ✗
Internet Gateway attached to the VPC
Why it's wrong here
Internet Gateway alone makes subnets public if routes exist.
- ✓
Private subnet route table with a route to the NAT Gateway
Why this is correct
This route directs traffic from private subnets to the NAT Gateway.
- ✓
NAT Gateway in a public subnet
Why this is correct
NAT Gateway enables outbound internet from private subnets.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 247 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SOA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a VPC with an Internet Gateway and a NAT Gateway. They launch an EC2 instance in a private subnet. The instance needs to download updates from the internet, but the security team wants to prevent any inbound traffic from the internet. Which route table configuration is correct for the private subnet?
medium- A.10.0.0.0/16 -> local; 0.0.0.0/0 -> VPC Peering
- B.0.0.0.0/0 -> Internet Gateway
- ✓ C.0.0.0.0/0 -> NAT Gateway
- D.No default route; only local routes.
Why C: A private subnet requires a default route (0.0.0.0/0) to a NAT Gateway for outbound internet access while blocking inbound traffic. Option A is incorrect because a route to a VPC Peering connection does not provide internet access and is not relevant for internet updates. Option B is incorrect because a default route to an Internet Gateway would allow both inbound and outbound internet traffic, violating the security requirement. Option D is incorrect because without a default route, instances cannot reach the internet at all.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.