Two subnets exist in the same VPC. Subnet X's route table sends 0.0.0.0/0 to an internet gateway. Subnet Y's route table sends 0.0.0.0/0 to a NAT gateway that itself lives in subnet X. How should these two subnets be classified?
- X and Y are both public subnets because both eventually reach the internet
- X is a public subnet and Y is a private subnet
- X is a private subnet and Y is a public subnet
- Classification depends only on whether instances in the subnet have public IPs
Correct answer: B. X is a public subnet and Y is a private subnet
A subnet is classified as public specifically when its own route table sends internet-bound traffic directly to an internet gateway, which is true of subnet X. Subnet Y's traffic instead goes to a NAT gateway, so its instances get outbound-only internet access without needing, or being reachable at, a public IP; that behavior is what defines a private subnet. Option A collapses this distinction by treating "eventually reaches the internet" as equivalent to "public," which ignores that only inbound-reachable subnets with a direct IGW route count as public. Option C simply reverses the correct labels. Option D is wrong because subnet classification is a routing property, not a property of individual instances; an instance could have a public IP assigned in a subnet that still lacks an IGW route, and it still would not be reachable from the internet.
Source: AWS VPC docs: Subnet routing — public and private subnets