A developer creates a brand-new AWS account and, without configuring any VPC resources, launches an EC2 instance into the account's default VPC. The instance turns out to be reachable from the internet immediately. Which combination of default VPC characteristics explains this?
- The default VPC has no subnets at all, so every instance is launched directly onto the public internet
- The default VPC already includes a public subnet in every Availability Zone, an attached internet gateway, DNS resolution enabled, and default subnets that auto-assign public IPv4 addresses to launched instances
- The default VPC includes a pre-configured NAT gateway in every subnet
- Default VPCs disable security groups entirely, so no inbound traffic is ever blocked
Why B? And why not the others?
Correct answer: B. The default VPC already includes a public subnet in every Availability Zone, an attached internet gateway, DNS resolution enabled, and default subnets that auto-assign public IPv4 addresses to launched instances
AWS provisions a default VPC per Region with a public subnet already created in each Availability Zone, an internet gateway already attached and routed from those subnets, and DNS resolution already enabled; default subnets also auto-assign a public IPv4 address to any instance launched into them, so no manual networking setup is required to get a reachable instance. Option A is wrong because a default VPC is pre-populated with default subnets, not empty. Option C is wrong because no NAT gateway is created by default — the internet gateway route, not NAT, is what makes the public subnets reachable. Option D is wrong because security groups are never disabled; the instance still gets a default security group, which allows all outbound traffic and inbound traffic only from other resources in the same security group, so any additional inbound access still has to be explicitly authorized.
Source: AWS VPC docs: Default VPCs