SOA-C02 Networking and Content Delivery Practice Question
An organization has a VPC with public and private subnets. The private subnets need to access the internet for software updates. A NAT gateway is deployed in a public subnet and the private subnet route table has a route for 0.0.0.0/0 pointing to the NAT gateway. However, instances in the private subnet cannot reach the internet. What could be the issue?
⚠ Common exam trap
Many exam-takers assume placing a NAT gateway in a 'public subnet' automatically gives it internet access, but the subnet must have a route table entry pointing 0.0.0.0/0 to an internet gateway for the NAT gateway to function.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The NAT gateway's subnet does not have a route to an internet gateway
The NAT gateway must be in a public subnet with a route table that includes a default route (0.0.0.0/0) pointing to an internet gateway (IGW). Without this route, the NAT gateway cannot forward traffic from the private subnet to the internet, because the IGW is the only way to reach public IP addresses. The question states the NAT gateway is deployed in a public subnet, but if that subnet's route table lacks the IGW route, outbound traffic from the NAT gateway will fail.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The NAT gateway's subnet does not have a route to an internet gateway
Why this is correct
For the NAT gateway to successfully forward traffic from private subnets to the internet, the subnet where the NAT gateway resides must have a route to an internet gateway (IGW). Without a route to the IGW in that subnet's route table, the NAT gateway cannot send or receive traffic from the internet, even though it has a public Elastic IP. This is the most common reason for failed outbound internet access from private instances when a NAT gateway is present.
- ✗
The private subnet's network ACL blocks outbound HTTPS traffic
Why it's wrong here
While a private subnet's network ACL (NACL) blocking outbound HTTPS (destination port 443) would indeed prevent HTTPS traffic from leaving the subnet, this is a less likely cause because NACLs are stateless and often configured to allow outbound traffic on ephemeral ports as well. Moreover, if the NAT gateway itself lacks a route to the IGW, then even if the NACL permits outbound HTTPS, the traffic will never reach the internet. Thus, routing for the NAT gateway is the more fundamental issue.
- ✗
The security group attached to the NAT gateway does not allow outbound traffic
Why it's wrong here
Security groups are not applicable to NAT gateways; AWS does not allow you to attach a security group to a NAT gateway. NAT gateways are managed by AWS and are inherently controlled by the network ACLs of the subnet in which they are placed. If anything, you would verify the NACL settings for the subnet, not a security group, when diagnosing outbound connectivity through a NAT gateway.
- ✗
The private instances do not have a public IP address assigned
Why it's wrong here
Private instances in a private subnet intentionally do not have public IP addresses; they rely on the NAT gateway to provide outbound internet connectivity by translating their private source IP to the NAT gateway's Elastic IP. The absence of a public IP on these instances is expected and is not a cause of connectivity failure. If the NAT gateway's routing is properly configured, these instances can still access the internet.
Visual reference
Go deeper
Related to this question
About these practice questions
This SOA-C02 question is part of Courseiva's 247-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.