Internet Gateway

5 minutes 5 Questions

An Internet Gateway (IGW) is a horizontally scalable, redundant, and highly available VPC component that allows communication between instances in your VPC and the internet. It serves two purposes: to provide a target in your VPC route tables for internet-routable traffic and to perform network add…

Test mode:

Exam (Timed)

Practice (With explanations)

Start practice test

Question 1

A web application runs on an EC2 instance in a subnet intended to be public and should be reachable from the internet. As the first VPC-level check when troubleshooting why users cannot access it, what should you verify?

Check if the Internet Gateway is attached to the VPC Check if the application's security group allows only VPC traffic Check if a NAT gateway is attached to the VPC Check if the VPC peering connection is established

Correct Answer: Check if the Internet Gateway is attached to the VPC

For any resource in a public subnet to be reachable from the internet, the VPC must have an Internet Gateway (IGW) attached. The IGW provides a target for the subnet route table's default route (0.0.0.0/0) so that inbound and outbound internet traffic can traverse the VPC edge. Without an attached IGW, no amount of security group, NACL, or instance-level configuration will make the application reachable from the internet. A NAT gateway is for outbound-only internet access from private subnets, and VPC peering does not provide internet connectivity. While security group rules also need to allow inbound traffic, the question asks for the first VPC-level check, which is confirming the IGW is attached.

Question 2

In AWS, you must design a new VPC that has zero internet connectivity (no inbound or outbound access to the public internet over IPv4 or IPv6). Private access to AWS services via VPC endpoints is allowed. Which action best ensures this requirement is met by design?

Create a VPC and attach a NAT Gateway only Create a VPC and disable default VPC routing Create a VPC without attaching an Internet Gateway Create a VPC with an Internet Gateway but deny all traffic

Correct Answer: Create a VPC without attaching an Internet Gateway

Not attaching an Internet Gateway (and not adding an egress-only Internet Gateway) ensures there is no route to or from the public internet for either IPv4 or IPv6. This design-level control prevents both inbound and outbound internet connectivity by default while still allowing private connectivity to AWS services via VPC endpoints. A NAT Gateway is intended for outbound internet access and in practice requires an Internet Gateway, so it is inappropriate for a no-internet VPC. Attaching an Internet Gateway and then relying on security groups or network ACLs to deny traffic is error-prone and can be inadvertently changed. There is no single "disable default VPC routing" feature in AWS; routing is controlled via route tables.

Question 3

You have created a VPC with an attached Internet Gateway, and you deployed two subnets, one public and one private. However, EC2 instances within a private subnet cannot access the internet. What is the cause?

You need to add more routes to the route table Instances in a private subnet are incorrectly launched Private subnet instances should be moved to the public subnet Private subnet instances need NAT Gateway for internet access

Correct Answer: Private subnet instances need NAT Gateway for internet access

Private subnet instances cannot access the Internet directly through the Internet Gateway. You need a NAT Gateway in the public subnet to enable internet access for instances in the private subnet.

🎓 Unlock Premium Access

AWS Certified Solutions Architect - Associate + ALL Certifications

Internet Gateway

Guide: Understanding and Answering Questions on Amazon VPC's Internet Gateway

AWS Certified Solutions Architect - Internet Gateway Example Questions

Question 1

Question 2

Question 3

🎓 Unlock Premium Access