NAT Gateway in Public Subnet for Private Subnet Internet Access
Instances in a private subnet need outbound internet access for software updates. The route table sends 0.0.0.0/0 to a NAT gateway, but updates fail. Which condition should you check first?
Quick Answer
The answer is to first confirm the NAT gateway is in a public subnet whose route table has a 0.0.0.0/0 route pointing to an internet gateway. This is correct because a NAT gateway must reside in a public subnet to access the internet gateway (IGW) for address translation; without that route, the NAT gateway cannot forward traffic from private instances to the IGW, so outbound internet access fails. On the AWS Certified SysOps Administrator Associate SOA-C02 exam, this scenario tests your understanding of how NAT gateways depend on proper subnet routing—a common trap is assuming any subnet with a NAT gateway is automatically public, when in fact the subnet’s route table must explicitly direct 0.0.0.0/0 to an IGW. Remember the memory tip: “NAT needs a path to the IGW—check the public subnet’s route table first.”
⚠ Common exam trap
A common mix-up: candidates assume any subnet with a NAT gateway automatically has internet access, overlooking the requirement that the NAT gateway itself must be in a public subnet with a default route to an internet gateway.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Confirm the NAT gateway is in a public subnet whose route table has 0.0.0.0/0 to an internet gateway.
A NAT gateway must reside in a public subnet with a route table entry directing 0.0.0.0/0 to an internet gateway (IGW). Without this, the NAT gateway cannot translate private IPs to the IGW's public IP, so outbound traffic from private instances fails. This is the most common root cause for failed internet access through a NAT gateway.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Confirm the NAT gateway is in a public subnet whose route table has 0.0.0.0/0 to an internet gateway.
Why this is correct
A NAT gateway only provides outbound internet access when placed in a public subnet whose route table points 0.0.0.0/0 to an internet gateway. If it sits in a private subnet, traffic never reaches the internet, so updates fail.
- ✗
Attach an internet gateway directly to the private subnet instances.
Why it's wrong here
An internet gateway attaches to a VPC, not to instances or subnets, and placing instances in a private subnet with a NAT gateway route is the intended design. It is tempting because an internet gateway does provide outbound internet access, but only for instances in public subnets with public IP addresses.
- ✗
Replace all security groups with network ACLs.
Why it's wrong here
Network ACLs and security groups are complementary filters, not interchangeable; replacing security groups removes stateful instance-level rules without fixing the NAT gateway's subnet placement, route table association, or elastic IP. NACLs are tempting because they also control traffic, but they govern stateless subnet-level filtering.
- ✗
Enable VPC peering to another account.
Why it's wrong here
VPC peering connects two VPCs privately and provides no path to the internet; the failing updates require NAT gateway egress, so peering cannot resolve them. It is tempting because peering is used for cross-account private connectivity, but that scenario involves reaching resources in another VPC, not public software repositories.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,169 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SOA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company runs a web application on Amazon EC2 instances in private subnets across multiple Availability Zones. The instances need to download software patches from the internet. The SysOps administrator requires a highly available, fully managed solution for outbound internet connectivity. Which solution should be implemented?
medium- ✓ A.Deploy a NAT gateway in each Availability Zone and update the route tables for each private subnet to point to the NAT gateway in the same Availability Zone.
- B.Attach an Internet Gateway to the VPC and add a default route (0.0.0.0/0) to the Internet Gateway in the private subnet route tables.
- C.Create a VPC endpoint for Amazon S3 and route traffic through it.
- D.Set up an AWS Direct Connect connection and route all internet-bound traffic through it.
Why A: A NAT gateway in each Availability Zone provides highly available outbound internet connectivity for instances in private subnets. By placing a NAT gateway in each AZ and routing private subnet traffic to the NAT gateway in the same AZ, you eliminate a single point of failure and ensure that internet-bound traffic remains within the same AZ for low latency and fault tolerance. This is a fully managed AWS service that handles scaling and failover automatically.
Variation 2. A company runs an application across multiple Availability Zones. The application servers are in private subnets and need outbound internet access to download software updates and patches. The SysOps administrator needs a highly available, fully managed solution to provide this outbound connectivity. Which solution should be used?
medium- A.Deploy a NAT instance in each private subnet
- B.Deploy a single NAT Gateway in one public subnet
- ✓ C.Deploy a NAT Gateway in each public subnet
- D.Attach an Internet Gateway directly to the private subnets
Why C: Deploying a NAT Gateway in each public subnet provides a highly available, fully managed solution for outbound internet access from private subnets. NAT Gateways are managed by AWS, automatically scale, and are resilient within an Availability Zone; using one per AZ ensures that if one AZ fails, the others continue to provide outbound connectivity. This meets the requirement for high availability without the operational overhead of managing NAT instances.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.