How to implement highly available NAT gateways across multiple Availability Zones?

ANS-C01 By islever Editorial Last updated

Short answer

D Set up two NAT gateways. Place each NAT gateway in a different public subnet in separate Availability Zones (AZ2 and AZ3). Configure a route table to point the AZ2 private subnets to the NAT gateway in AZ2. Configure a second route table to point the AZ3 private subnets to the NAT gateway in AZ3.

Question

A company has set up a NAT gateway in a single Availability Zone (AZ1) in a VPC (VPC1) to access the internet from Amazon EC2 workloads in the VPC. The EC2 workloads are running in private subnets in three Availability Zones (AZ1, AZ2, AZ3). The route table for each subnet is configured to use the NAT gateway to access the internet. Recently during an outage, internet access stopped working for the EC2 workloads because of the NAT gateway's unavailability. A network engineer must implement a solution to remove the single point of failure from the architecture and provide built-in redundancy. Which solution will meet these requirements?
  1. Set up two NAT gateways. Place each NAT gateway in a different public subnet in separate Availability Zones (AZ2 and AZ3). Configure a route table for private subnets to route traffic to the virtual IP addresses of the two NAT gateways.
  2. Set up two NAT gateways. Place each NAT gateway in a different public subnet in separate Availability Zones (AZ2 and AZ3). Configure a route table to point the AZ2 private subnets to the NAT gateway in AZ2. Configure the same route table to point the AZ3 private subnets to the NAT gateway in AZ3.
  3. Create a second VPC (VPC2). Set up two NAT gateways. Place each NAT gateway in a different VPC (VPC1 and VPC2) and in the same Availability Zone (AZ2). Configure a route table in VPC1 to point the AZ2 private subnets to one NAT gateway. Configure a route table in VPC2 to point the AZ2 private subnets to the second NAT gateway.
  4. Set up two NAT gateways. Place each NAT gateway in a different public subnet in separate Availability Zones (AZ2 and AZ3). Configure a route table to point the AZ2 private subnets to the NAT gateway in AZ2. Configure a second route table to point the AZ3 private subnets to the NAT gateway in AZ3. Correct Answer

Key Takeaways

This question tests whether candidates know that NAT gateways do not support virtual IPs or cross-AZ failover, and that high availability is achieved by creating one NAT gateway per AZ with AZ-specific route tables.

AWS NAT gateways are redundant within a single Availability Zone but not across AZs. To remove the single point of failure, deploy one NAT gateway per AZ in separate public subnets and associate each private subnet's route table with the NAT gateway in its own AZ.

Common mistake: Candidates often choose option B, assuming a single route table can route different subnets to different NAT gateways. In AWS, a single route table cannot have two routes for the same destination (0.0.0.0/0); each AZ's private subnets need their own route table pointing to their local NAT gateway.

Expert Analysis

The scenario describes a single NAT gateway in AZ1 serving private subnets across three AZs. When AZ1 experiences an outage, all internet-bound traffic from every AZ fails because the NAT gateway is a single point of failure.

Why Option D is Correct

Option D correctly implements the AWS best practice for highly available NAT gateways:
  • Deploy one NAT gateway per AZ in separate public subnets (AZ2 and AZ3 in this case).
  • Create separate route tables for each AZ's private subnets.
  • Each route table points its 0.0.0.0/0 route to the NAT gateway in the same AZ.
This design ensures that if one AZ fails, only the workloads in that AZ lose internet access (which is acceptable since those EC2 instances are also down). Workloads in the surviving AZ continue using their local NAT gateway.

Why Option A is Wrong

Option A mentions routing traffic to the virtual IP addresses of NAT gateways. AWS NAT gateways do not support virtual IPs or any form of cross-AZ failover mechanism. Each NAT gateway has a fixed Elastic IP within its AZ.

Why Option B is Wrong

Option B suggests using a single route table to point different subnets to different NAT gateways. This is impossible in AWS routing: a route table can only have one route per destination prefix. You cannot have two 0.0.0.0/0 routes in the same route table pointing to different targets.

Why Option C is Wrong

Option C introduces an unnecessary second VPC. Cross-VPC NAT routing adds complexity without benefit. The requirement is simply to eliminate the single point of failure within the existing VPC, which is achieved by multi-AZ NAT gateway deployment.

Community Consensus

All community voters (100%) selected D. Commentators correctly noted that NAT gateways lack VIP functionality (eliminating A), that a new VPC is unnecessary (eliminating C), and that a single route table cannot serve multiple NAT gateways for the same destination (eliminating B). One insightful comment pointed out that if an AZ goes down, the EC2 instances in that AZ are also down, so cross-AZ NAT redundancy for failed AZ workloads is pointless.

Official Reference

https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When you see 'remove single point of failure' for NAT gateways, immediately think 'one NAT gateway per AZ with separate route tables.' Eliminate any option mentioning virtual IPs, single route tables with multiple NAT targets, or unnecessary multi-VPC architectures.

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. tromyunpak 👍 3
    D is correct - as you will have 1 NAT per AZ with each subnet has its own route table A is wrong since you cannot use virtual IP of the NAT gateway (feature not available) C is wrong due to the fact that a new vpc is not required B is wrong since AZ2 & AZ3 are sharing the same nat gatweway
  2. [Removed] 👍 1
    The catch here is, if an AZ goes down not only the NAT of that AZ goes down but also the EC2s in that AZ so there is no need to have a redundant NAT for the EC2 in the outage AZ. Just create one NAT per AZ and Bob's your uncle.
  3. woorkim 👍 1
    D is correct. no VIP in NAT GW!
  4. backspace0900 👍 5 Answered D
    D NAT2-AZ2 NAT3-AZ3

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to make one AWS Direct Connect connection primary and the other failover-only?

S-grade

How to Copy On-Premises Application Logs to Amazon S3 Over AWS Direct Connect?

S-grade

Why Does VPC Traffic Mirroring Randomly Drop Traffic?

S-grade

What is the most secure way to expose cross-account microservices with API Gateway?

S-grade

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide