A NAT gateway supports outbound connections from private IPv4 resources without accepting unsolicited inbound connections to those resources. Its placement and routes matter: a public NAT gateway needs a suitable public subnet and an Elastic IP, and the private subnet needs a route to it. A NAT gateway isn't an inbound web server.
An Elastic IP is a stable public IPv4 address resource. Assigning one doesn't open a security group, add a route, or make the application listen. The reachability tool in this course traces the modeled path and identifies the first blocking control. Treat a successful path result as network evidence, not proof that the application's authentication or business logic works. Those need their own tests.