NAT Gateway Missing Route to Internet Gateway — Troubleshooting

A SysOps administrator is configuring a VPC with a public subnet and a private subnet. The private subnet needs to access the internet to download patches. The administrator creates a NAT Gateway in the public subnet and updates the private subnet route table. However, instances in the private subnet cannot reach the internet. What is the most likely cause?

Quick Answer

The answer is that the route table for the public subnet lacks a route to an Internet Gateway. This is the most likely cause because a NAT Gateway must reside in a public subnet that has a direct route to an Internet Gateway (0.0.0.0/0 pointing to an IGW) in order to translate private IPs and forward traffic to the internet; without that route, the NAT Gateway itself cannot send or receive internet-bound packets, even if the private subnet’s route table correctly points to the NAT Gateway. On the AWS Certified SysOps Administrator Associate SOA-C02 exam, this question tests your understanding of VPC routing dependencies and the layered connectivity model—a common trap is to focus only on the private subnet’s route table while overlooking the public subnet’s missing IGW route. Remember the memory tip: “NAT needs a path to the IGW first, or it’s just an expensive paperweight.”

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The route table for the public subnet does not have a route to an Internet Gateway.

The most likely cause is that the route table associated with the public subnet does not have a route to an Internet Gateway. A NAT Gateway must be placed in a public subnet, and that subnet's route table must have a default route (0.0.0.0/0) pointing to an Internet Gateway for the NAT Gateway to connect to the internet. Without this route, the NAT Gateway cannot send traffic to the internet. Options A, C, and D are incorrect: (A) While network ACLs can impact traffic, the scenario suggests the issue is routing, not ACLs; (C) NAT Gateways do require an Elastic IP, but if the administrator created the NAT Gateway, they likely attached one; (D) Security groups do not apply to NAT Gateways, as they are managed AWS services.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The network ACL for the private subnet blocks outbound traffic.
Why it's wrong here
While a network ACL could block traffic, the most likely cause is missing Internet Gateway route, not NACL configuration.
✓
The route table for the public subnet does not have a route to an Internet Gateway.
Why this is correct
This is correct: the public subnet's route table must have a route to an Internet Gateway for the NAT Gateway to send traffic to the internet.
✗
The NAT Gateway does not have an Elastic IP address attached.
Why it's wrong here
A NAT Gateway does need an Elastic IP, but the problem states the administrator created the NAT Gateway; the missing IGW route is the more common oversight.
✗
The security group associated with the NAT Gateway blocks outbound traffic.
Why it's wrong here
Security groups do not apply to NAT Gateways; they apply to instances. This is not the cause.

Visual reference

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more way this is tested on SOA-C02

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Refer to the exhibit. A SysOps administrator is troubleshooting internet connectivity for an EC2 instance in subnet subnet-0a1b2c3d4e5f6g7h8. The instance can reach other instances in the VPC but cannot access the internet. Based on the route table output, what is the most likely cause?

hard

A.The default route (0.0.0.0/0) is missing
B.The route table is not associated with the subnet
✓ C.The NAT gateway does not have a route to an internet gateway
D.The VPC CIDR route is misconfigured

Why C: The route table has a default route to a NAT gateway, but the exhibit does not show that the NAT gateway is in a public subnet with an internet gateway route. If the NAT gateway lacks internet access, private instances cannot reach the internet. Option A is wrong because the default route (0.0.0.0/0) exists and points to the NAT gateway. Option B is wrong because the route table is associated with the subnet (the exhibit shows the route table for that subnet). Option D is wrong because the VPC CIDR route is local, which is fine.

Last reviewed: Jun 20, 2026

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.