NAT Gateway in Public Subnet for Private Subnet Internet Access
Instances in a private subnet need outbound internet access for software updates. The route table sends 0.0.0.0/0 to a NAT gateway, but updates fail. Which condition should you check first?
Quick Answer
The answer is to first confirm the NAT gateway is in a public subnet whose route table has a 0.0.0.0/0 route pointing to an internet gateway. This is correct because a NAT gateway must reside in a public subnet to access the internet gateway (IGW) for address translation; without that route, the NAT gateway cannot forward traffic from private instances to the IGW, so outbound internet access fails. On the AWS Certified SysOps Administrator Associate SOA-C02 exam, this scenario tests your understanding of how NAT gateways depend on proper subnet routing—a common trap is assuming any subnet with a NAT gateway is automatically public, when in fact the subnet’s route table must explicitly direct 0.0.0.0/0 to an IGW. Remember the memory tip: “NAT needs a path to the IGW—check the public subnet’s route table first.”
⚠ Common exam trap
A common mix-up: candidates assume any subnet with a NAT gateway automatically has internet access, overlooking the requirement that the NAT gateway itself must be in a public subnet with a default route to an internet gateway.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Confirm the NAT gateway is in a public subnet whose route table has 0.0.0.0/0 to an internet gateway.
A NAT gateway must reside in a public subnet with a route table entry directing 0.0.0.0/0 to an internet gateway (IGW). Without this, the NAT gateway cannot translate private IPs to the IGW's public IP, so outbound traffic from private instances fails. This is the most common root cause for failed internet access through a NAT gateway.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Confirm the NAT gateway is in a public subnet whose route table has 0.0.0.0/0 to an internet gateway.
Why this is correct
Without an IGW route from the NAT gateway subnet, outbound internet access fails.
- ✗
Attach an internet gateway directly to the private subnet instances.
Why it's wrong here
Instances in private subnets should not require public IPs or direct IGW routes for NAT egress.
- ✗
Replace all security groups with network ACLs.
Why it's wrong here
NACLs do not provide NAT functionality.
- ✗
Enable VPC peering to another account.
Why it's wrong here
VPC peering is unrelated to internet egress through NAT.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 247 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SOA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company runs a web application on Amazon EC2 instances in private subnets across multiple Availability Zones. The instances need to download software patches from the internet. The SysOps administrator requires a highly available, fully managed solution for outbound internet connectivity. Which solution should be implemented?
medium- ✓ A.Deploy a NAT gateway in each Availability Zone and update the route tables for each private subnet to point to the NAT gateway in the same Availability Zone.
- B.Attach an Internet Gateway to the VPC and add a default route (0.0.0.0/0) to the Internet Gateway in the private subnet route tables.
- C.Create a VPC endpoint for Amazon S3 and route traffic through it.
- D.Set up an AWS Direct Connect connection and route all internet-bound traffic through it.
Why A: A NAT gateway in each Availability Zone provides highly available outbound internet connectivity for instances in private subnets. By placing a NAT gateway in each AZ and routing private subnet traffic to the NAT gateway in the same AZ, you eliminate a single point of failure and ensure that internet-bound traffic remains within the same AZ for low latency and fault tolerance. This is a fully managed AWS service that handles scaling and failover automatically.
Variation 2. A company runs an application across multiple Availability Zones. The application servers are in private subnets and need outbound internet access to download software updates and patches. The SysOps administrator needs a highly available, fully managed solution to provide this outbound connectivity. Which solution should be used?
medium- A.Deploy a NAT instance in each private subnet
- B.Deploy a single NAT Gateway in one public subnet
- ✓ C.Deploy a NAT Gateway in each public subnet
- D.Attach an Internet Gateway directly to the private subnets
Why C: Deploying a NAT Gateway in each public subnet provides a highly available, fully managed solution for outbound internet access from private subnets. NAT Gateways are managed by AWS, automatically scale, and are resilient within an Availability Zone; using one per AZ ensures that if one AZ fails, the others continue to provide outbound connectivity. This meets the requirement for high availability without the operational overhead of managing NAT instances.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.