CV0-004 Cloud Architecture and Design Practice Question
A cloud architect is designing a VPC with public and private subnets. Which component is required to allow instances in the private subnet to access the internet for software updates?
⚠ Common exam trap
Many exam-takers confuse the Internet gateway with the NAT gateway, assuming that an Internet gateway can provide internet access to private subnets, but it only works for public subnets with instances that have public IP addresses.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NAT gateway
A NAT gateway is required to enable instances in a private subnet to initiate outbound connections to the internet (e.g., for software updates) while preventing the internet from initiating inbound connections to those instances. It translates the private IP addresses of the instances to the NAT gateway's Elastic IP address using source network address translation (SNAT). An Internet gateway alone cannot serve private subnets because it requires a route table entry pointing to a public subnet with a public IP address.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
NAT gateway
Why this is correct
NAT gateway allows outbound traffic from private subnets to the internet.
- ✗
Elastic IP
Why it's wrong here
An Elastic IP is a static public IP, but alone does not provide internet access; it must be attached to an instance or NAT.
- ✗
VPN connection
Why it's wrong here
VPN connects to on-premises, not necessarily the internet.
- ✗
Internet gateway
Why it's wrong here
An internet gateway allows inbound and outbound access, but is attached to public subnets; private subnets need NAT.
Visual reference
Go deeper
Related to this question
About these practice questions
This CV0-004 question is part of Courseiva's 977-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.