SOA-C02 Networking and Content Delivery Practice Question
A SysOps Administrator needs to allow an EC2 instance in a private subnet to access the internet for software updates. Which AWS service should be used?
⚠ Common exam trap
Test-takers frequently confuse an Internet Gateway with a NAT Gateway, not realizing that an Internet Gateway requires the instance to have a public IP and be in a public subnet, whereas a NAT Gateway is specifically designed for private subnets to access the internet outbound only.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NAT Gateway
A NAT Gateway enables EC2 instances in a private subnet to initiate outbound traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet. It translates the private IP of the instance to the NAT Gateway's Elastic IP using Source Network Address Translation (SNAT). This is the correct service because the instance is in a private subnet and requires internet access without being directly reachable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VPN Connection
Why it's wrong here
A VPN Connection establishes encrypted tunnels between a VPC and an on-premises network, but it does not provide outbound internet access for a private subnet instance. The correct service, a NAT Gateway or NAT Instance, translates the instance’s private IP to a public IP for internet-bound traffic. This option is tempting because VPNs are often used for hybrid connectivity, and one might assume any encrypted tunnel suffices for external access; however, a VPN only routes traffic to a specific remote network, not the general internet.
- ✓
NAT Gateway
Why this is correct
A NAT Gateway is a managed service that enables instances in a private subnet to initiate outbound IPv4 traffic to the internet while blocking unsolicited inbound connections. It performs source network address translation (SNAT), replacing the instance's private IP with the NAT Gateway's Elastic IP before forwarding traffic to an Internet Gateway. This is the correct architecture because the private subnet's route table points 0.0.0.0/0 to the NAT Gateway, and the NAT Gateway resides in a public subnet to reach the internet.
- ✗
Internet Gateway
Why it's wrong here
An Internet Gateway (IGW) is a redundant, horizontally scaled VPC component that provides a direct path for inbound and outbound internet traffic to instances with public IPs or Elastic IPs in public subnets. For a private subnet, you would not route 0.0.0.0/0 to an IGW; doing so would either fail because instances lack public IPs or expose them to unsolicited inbound traffic. While a NAT Gateway ultimately uses the IGW, the IGW itself does not provide the address translation required for private instances, so it is not the correct choice.
- ✗
VPC Peering
Why it's wrong here
VPC peering creates a private Layer 3 connection between two VPCs using RFC 1918 addresses, allowing instances in each VPC to communicate as if they are on the same network. However, VPC peering does not provide internet access, and it does not support transitive routing—you cannot use a peer VPC's Internet Gateway or VPN to reach the internet. Since the requirement is outbound internet access for an instance in a private subnet, VPC peering is irrelevant and incorrect for this use case.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,169 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.