Troubleshooting NAT Gateway Internet Access
A company has a VPC with public and private subnets. A NAT Gateway is deployed in the public subnet to allow instances in the private subnet to access the internet. However, private instances cannot reach an external service at 203.0.113.50:443. What should be checked first?
Quick Answer
The answer is to first check the route table for the private subnet, ensuring it has a 0.0.0.0/0 route pointing to the NAT Gateway. This is the most common failure point when troubleshooting NAT Gateway internet access from a private subnet, because without that default route, traffic from private instances has no path to the NAT Gateway and cannot reach external services like 203.0.113.50:443. On the AWS Certified SysOps Administrator Associate SOA-C02 exam, this scenario tests your understanding of VPC routing fundamentals—many candidates mistakenly check security groups or the NAT Gateway’s public IP first, but those are secondary; the route table is the immediate suspect. A common trap is forgetting that NACLs and security groups are stateful for NAT traffic, so they rarely cause outbound-only failures. Memory tip: “Route before rules”—always verify the private subnet’s route table before diving into firewall configurations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The route table for the private subnet has a route 0.0.0.0/0 pointing to the NAT Gateway.
The first thing to check when private instances cannot reach an external service is the route table for the private subnet. The private subnet must have a route 0.0.0.0/0 pointing to the NAT Gateway to route internet-bound traffic through it. Option B is incorrect because the NAT Gateway must have an Elastic IP to be reachable from the internet, but the issue described is outbound access from private instances; the NAT Gateway's Elastic IP is necessary but not the first check. Option C is incorrect because security groups for NAT Gateways are not used; NAT Gateways do not have security groups; instead, network ACLs on the subnets control traffic. Option D is incorrect because the internet gateway must be attached to the VPC for the NAT Gateway to work, but if private instances cannot reach the external service, the routing from the private subnet to the NAT Gateway is the primary suspect.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The route table for the private subnet has a route 0.0.0.0/0 pointing to the NAT Gateway.
Why this is correct
Without this route, traffic from private instances cannot reach the NAT Gateway, so they cannot access the internet.
- ✗
The NAT Gateway has an Elastic IP assigned.
Why it's wrong here
The NAT Gateway must have an EIP, but that is typically configured at creation. Lack of EIP would prevent outbound traffic, but routing is checked first.
- ✗
The security group for the NAT Gateway allows inbound traffic from the private subnet.
Why it's wrong here
NAT Gateway security groups are not configurable; it uses security groups only for the ENI, but the default allows all traffic. NACLs may block, but routing is more likely.
- ✗
The internet gateway is attached to the VPC.
Why it's wrong here
If the NAT Gateway itself can't reach the internet, the IGW might be missing, but the immediate issue is routing from private subnet to NAT Gateway.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SOA-C02 question from scratch — 247 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SOA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a VPC with public and private subnets. A NAT Gateway is deployed in the public subnet. Private EC2 instances need to download patches from the internet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway. However, the instances cannot reach the internet. What is the most likely cause?
hard- A.The private subnet’s network ACL is blocking outbound traffic.
- ✓ B.The NAT Gateway is not placed in a public subnet with a route to an internet gateway.
- C.The security group for the private instances does not allow outbound HTTPS.
- D.The NAT Gateway does not have an Elastic IP address assigned.
Why B: A NAT Gateway must be deployed in a public subnet that has a route to an internet gateway. Although the private subnet's route table points to the NAT Gateway for default traffic, if the NAT Gateway's subnet lacks a route to an internet gateway, the NAT Gateway cannot forward traffic to the internet. Option A is incorrect because network ACLs could block traffic, but the stated issue—instances cannot reach the internet via a properly configured route—points to the NAT Gateway's subnet configuration as the most likely cause. Option C is incorrect because even if the private instances' security group allows outbound HTTPS, the NAT Gateway still needs internet connectivity. Option D is incorrect because while a NAT Gateway requires an Elastic IP address, the scenario assumes the NAT Gateway is deployed; typically, an Elastic IP is assigned during creation, so the missing route to the internet gateway is the more probable cause.
Variation 2. A company has a VPC with public and private subnets. A NAT Gateway is in the public subnet, and a private EC2 instance needs to download patches from the internet. The instance can reach the internet after a reboot. Which action should the SysOps administrator take to make the internet access persistent?
hard- ✓ A.Update the route table of the private subnet to point 0.0.0.0/0 to the NAT Gateway.
- B.Attach an internet gateway to the private subnet.
- C.Associate an Elastic IP with the NAT Gateway.
- D.Enable DNS resolution in the VPC.
Why A: Route tables must be manually updated after adding a NAT Gateway. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.