A subnet is public because its route table sends traffic to an internet gateway, not because of its name. This writeup works through route table evaluation, NAT gateway placement and the availability implications of putting a NAT gateway in a single zone, which is a recurring SAA-C03 trade-off.