ExamPark
Course menuSOA-C03

Exams / SOA-C03 / Study guide / VPC subnets, routing and gateways

VPC subnets, routing and gateways: SOA-C03 study notes and practice questions

What to know about VPC subnets, routing and gateways for the SOA-C03 exam, from the Networking and Content Delivery domain (18% of the exam guide), then 2 free questions to test it. Part of the SOA-C03 study guide.

Last verified against current AWS documentation ·How we write our questions

What to know for the exam

VPC questions ask how to set up subnets and routing, or why an instance can or can’t reach the internet.

Building blocks

Piece Job
Subnet An IP range in one AZ
Route table Where traffic goes; each subnet uses one
Internet gateway Two-way internet access for resources with public IPs
NAT gateway Outbound-only IPv4 internet for private subnets; lives in a public subnet; zonal
Egress-only internet gateway Outbound-only for IPv6 (IPv6 addresses are public, so there’s no NAT)
Elastic IP A static public IPv4 address (charged, like all public IPv4 addresses)
DHCP options set DNS servers and domain name for the VPC

What makes internet access work

For an instance to reach the internet directly, it needs all of these:

  1. A route in its subnet’s route table: 0.0.0.0/0 → internet gateway.
  2. A public IPv4 address or Elastic IP (or IPv6 with a ::/0 route).
  3. Security group outbound rules that allow the traffic (and inbound for responses is automatic).
  4. Network ACL rules allowing both directions, including ephemeral ports.

For private instances, route 0.0.0.0/0 to a NAT gateway in a public subnet.

VPC settings

  • enableDnsSupport and enableDnsHostnames must be on for private DNS names and for interface endpoints’ private DNS.
  • Secondary CIDR blocks add address space; existing subnets can’t be resized.
  • IPAM plans and tracks IP addresses across accounts.
  • VPC Flow Logs capture traffic metadata for troubleshooting (ACCEPT/REJECT).

Common traps

  • A route to an internet gateway but no public IP: no internet access.
  • Using a NAT gateway for IPv6. Use an egress-only internet gateway.
  • A NAT gateway in a private subnet. It must be in a public subnet with a route to the internet gateway.

Try the 2 practice questions

Practice VPC subnets, routing and gatewaysTake the free practice exam

Question 1

Medium ·Link to this question (question 1)

A public library is adding IPv6 to its VPC.

Instances in a private subnet now have IPv6 addresses and must download updates from IPv6 internet repositories.

The security team requires that no host on the internet can start a connection to these instances over IPv6, even if someone later adds a permissive security group rule.

What should a CloudOps engineer add to the private subnet's route table?

Choose one answer.

  1. A. A ::/0 route to an egress-only internet gateway attached to the VPC.
  2. B. A ::/0 route to the VPC's internet gateway, with security groups that allow only outbound traffic.
  3. C. A ::/0 route to a NAT gateway in a public subnet, so that IPv6 traffic is translated to the NAT gateway's address.
  4. D. A ::/0 route to a gateway VPC endpoint, which keeps the IPv6 update traffic inside the AWS network.
Show the answer and explanation

Answer: A

Explanation

For IPv6, there is no NAT step to hide instances, because every address is public. The egress-only internet gateway fills that role: it is stateful, allows outbound connections and their replies, and drops connections started from outside. Routing ::/0 to it gives private subnets outbound-only IPv6 access.

Study

Question 2

Medium · choose 2 ·Link to this question (question 2)

A dental chain launched a new EC2 instance for a patient-reminder service in a subnet it believes is public.

The instance cannot reach the internet. The security group allows all outbound traffic, the network ACL is the default, and the VPC has an internet gateway attached.

The instance has only a private IPv4 address, and the subnet's route table contains only the local route.

Which TWO actions will give the instance internet access? (Choose two.)

Choose two answers.

  1. A. Associate an Elastic IP address with the instance so that it has a public IPv4 address.
  2. B. Add a 0.0.0.0/0 route that targets the internet gateway to the subnet's route table.
  3. C. Add an inbound rule to the security group that allows all traffic from 0.0.0.0/0.
  4. D. Turn on DNS hostnames for the VPC so that the instance can resolve and reach public domain names.
  5. E. Add a 0.0.0.0/0 route that targets a NAT gateway placed in the same subnet as the instance.
Show the answer and explanation

Answers: A, B

Explanation

Internet access through an internet gateway needs both a route and an address. The subnet's route table must send 0.0.0.0/0 to the internet gateway, and the instance needs a public IPv4 address, such as an Elastic IP address. Security group and DNS changes do not fix either missing piece.

Study

Want more on VPC subnets, routing and gateways? The 5 full-length practice sets have 10 more VPC subnets, routing and gateways questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets

Study VPC subnets, routing and gateways

More Networking and Content Delivery topics