ANS-C01 Practice Test 1 — 10 Questions

Question 1

A company is designing a network security architecture for a multi-account environment using AWS Transit Gateway. The security team needs to centralize inspection of all traffic between VPCs using a third-party firewall appliance in a shared services VPC. What is the most scalable and highly available design?

Accepted Answer

Create a Transit Gateway with separate route tables for each VPC and a shared route table for the inspection VPC. Use Gateway Load Balancer to distribute traffic to a fleet of firewall instances.. Option B is correct because it combines AWS Transit Gateway with separate route tables per VPC and a shared inspection route table, enabling centralized traffic steering to a fleet of firewall instances behind a Gateway Load Balancer (GWLB). GWLB transparently distributes traffic across multiple firewall instances at the network layer (GENEVE protocol), providing both horizontal scalability and high availability without introducing a single point of failure or requiring complex VPC peering meshes.

Answer

Use VPC peering to connect all VPCs to the shared services VPC and route traffic through the firewall.

Answer

Attach all VPCs to a Transit Gateway and configure a Network Load Balancer in the shared services VPC to distribute traffic to firewall instances.

Answer

Attach all VPCs to a Transit Gateway and use a single firewall instance with elastic network interfaces in each VPC.

Question 2

A company is using AWS Direct Connect to connect its on-premises network to AWS. The company wants to encrypt all traffic between its on-premises network and AWS. Which solution meets this requirement?

Accepted Answer

Use a private VIF and establish an IPsec VPN tunnel over the Direct Connect connection.. Option B is correct because AWS Direct Connect does not natively encrypt traffic; it provides a private, dedicated network connection. To meet the encryption requirement, you can establish an IPsec VPN tunnel over the private VIF, which encrypts all traffic between the on-premises network and the VPC. This approach combines the low latency and reliability of Direct Connect with the security of IPsec encryption.

Answer

Use a public virtual interface (VIF) and route traffic through a NAT gateway.

Answer

Use a private virtual interface (VIF) and enable encryption on the Direct Connect connection.

Answer

Use a private VIF and enable TLS on all applications.

Question 3

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Site-to-Site VPN. The security team wants to inspect all traffic between VPCs using a centralized inspection VPC with third-party firewall appliances. Which architecture ensures that traffic from VPC A to VPC B is routed through the inspection VPC?

Accepted Answer

Attach all VPCs to a Transit Gateway. Create separate route tables: one for inspection VPC attachments and one for others. In VPC A's route table, route to VPC B via the inspection VPC attachment.. Option A is correct because it uses separate Transit Gateway route tables to isolate the inspection VPC and other VPCs. By configuring the route table for VPC A to point to VPC B's CIDR via the inspection VPC attachment, all inter-VPC traffic is forced through the centralized firewall appliances. This leverages Transit Gateway's ability to route traffic between attachments based on route table associations and propagations, ensuring traffic flows through the inspection VPC without requiring VPC peering or additional per-VPC firewalls.

Answer

Create a VPC peering connection between VPC A and VPC B, and attach firewall appliances in both VPCs.

Answer

Use AWS PrivateLink to create VPC endpoints in VPC A and VPC B, and route traffic through the firewall VPC.

Answer

Deploy AWS Network Firewall in each VPC and configure VPC route tables to send traffic to the firewall endpoint.

Question 4

A global e-commerce company uses a hub-and-spoke network topology with a transit VPC in us-east-1. Each spoke VPC has an AWS Site-to-Site VPN connection to its respective on-premises office. Users report intermittent connectivity issues when accessing a web application hosted in a spoke VPC in eu-west-1 from an on-premises office in ap-southeast-1. The network engineer checks the VPN connection and finds it is up. Which design change would MOST likely resolve the issue?

Accepted Answer

Enable jumbo frames on the transit VPC's EC2-based virtual appliances.. The issue is intermittent connectivity between an on-premises office in ap-southeast-1 and a spoke VPC in eu-west-1, traversing a transit VPC in us-east-1. The VPN is up, so the problem is likely packet fragmentation or MTU mismatch across the long-haul path. Enabling jumbo frames on the transit VPC's EC2-based virtual appliances (e.g., firewall or router instances) increases the maximum transmission unit, reducing fragmentation and improving performance for large packets, which is a common cause of intermittent issues in hub-and-spoke topologies.

Answer

Change the VPN connection from static to dynamic routing.

Answer

Enable BGP route propagation on the transit VPC's route tables.

Answer

Deploy a new transit VPC in eu-west-1.

Question 5

A company is designing a multi-VPC architecture in the same region. The VPCs need to communicate with each other using private IP addresses. The company must minimize cost and operational overhead. Which solution should the company use?

Accepted Answer

Create VPC peering connections between each pair of VPCs.. Option C is correct because VPC peering connections provide direct, private IP connectivity between VPCs using the AWS global network, with no bandwidth bottlenecks or single points of failure. It is the most cost-effective solution for a small number of VPCs (e.g., fewer than 10) as there are no hourly charges for the peering connection itself—only data transfer costs. This minimizes operational overhead compared to managing VPN tunnels or a Transit Gateway, as peering is a simple, one-to-one relationship that does not require additional appliances or complex routing policies.

Answer

Set up AWS Site-to-Site VPN connections between each VPC.

Answer

Use ClassicLink to connect the VPCs.

Answer

Create a Transit Gateway and attach all VPCs.

Question 6

A company is deploying an application that requires low-latency communication between EC2 instances in two different AWS Regions. The application traffic is latency-sensitive and the company wants to minimize jitter. Which network design provides the lowest and most consistent latency?

Accepted Answer

Deploy an AWS Global Accelerator with endpoints in both Regions and use the accelerator's static IP addresses for communication.. AWS Global Accelerator uses the AWS global network and Anycast static IP addresses to route traffic over optimized paths, providing lower and more consistent latency than VPC peering, internet transit, or VPNs. It minimizes jitter by avoiding the public internet and leveraging AWS's internal backbone, which is ideal for latency-sensitive inter-Region communication.

Answer

Create a VPC peering connection between the two VPCs and route traffic through the peering connection.

Answer

Use internet gateways and route traffic over the public internet between the instances.

Answer

Use a Site-to-Site VPN connection between the two VPCs over the internet.

Question 7

Which TWO of the following are valid components of an AWS Transit Gateway design for connecting multiple VPCs and on-premises networks?

Accepted Answer

Transit Gateway route table. Option D is correct because a Transit Gateway route table is a fundamental component that controls how traffic is routed between attachments (VPCs, VPNs, Direct Connect) within the Transit Gateway. Each attachment is associated with exactly one route table, and route propagation enables dynamic learning of routes across the network.

Answer

VPC Endpoint Gateway

Answer

Transit Gateway endpoint attached to a subnet in a VPC

Answer

Direct Connect Gateway associated with a Transit Gateway

Question 8

A solutions architect is designing a VPC with public and private subnets in two Availability Zones. The private subnets require outbound internet access for software updates, but inbound internet access must be blocked. Which solution meets these requirements?

Accepted Answer

Deploy a NAT Gateway in a public subnet and add a default route to the NAT Gateway in the private subnet route tables.. Option B is correct because a NAT Gateway, deployed in a public subnet with an Elastic IP and a route to an Internet Gateway, enables outbound traffic from private subnets to the internet while blocking unsolicited inbound connections. The private subnet route table directs default traffic (0.0.0.0/0) to the NAT Gateway, which performs source network address translation (SNAT) on outbound packets, ensuring responses return to the NAT Gateway without exposing private instances directly.

Answer

Attach an internet gateway to the VPC and add a default route to the internet gateway in the private subnet route tables.

Answer

Launch an EC2 instance in a public subnet with a proxy software and route private subnet traffic through it.

Answer

Create a VPC endpoint for Amazon S3 and add a route to the endpoint in the private subnet route tables.

Question 9

A company has a Direct Connect connection with a private VIF attached to a virtual private gateway. The VPC has multiple subnets in two Availability Zones. The on-premises network advertises a default route (0.0.0.0/0) via BGP. The company wants all internet-bound traffic from the VPC to go through the on-premises network. Which THREE actions are required to achieve this?

Accepted Answer

Add a default route pointing to the virtual private gateway in the private subnet route tables.. Option B is correct because adding a default route (0.0.0.0/0) pointing to the virtual private gateway in the private subnet route tables ensures that all internet-bound traffic from those subnets is forwarded over the Direct Connect private VIF to the on-premises network. This leverages the BGP-advertised default route from the on-premises network, allowing the company to enforce its security and routing policies for internet access.

Answer

Deploy a NAT Gateway in a public subnet.

Answer

Attach an internet gateway to the VPC.

Question 10

A company is designing a network for a three-tier web application on AWS. The web tier must be accessible from the internet, and the application and database tiers must be in private subnets. The company wants to use a single AWS Region and ensure high availability. Which TWO configurations should be implemented? (Choose two.)

Accepted Answer

Place an internet-facing Application Load Balancer (ALB) in public subnets across two Availability Zones.. Option A is correct because an internet-facing Application Load Balancer (ALB) in public subnets across two Availability Zones (AZs) provides both internet access to the web tier and high availability. The ALB distributes incoming HTTP/HTTPS traffic to web instances in private subnets, and deploying across two AZs ensures fault tolerance if one AZ fails.

Answer

Use a stateful network ACL for the web tier subnets to simplify security rules.

Answer

Deploy a NAT Gateway in a single Availability Zone for outbound traffic from private subnets.

Answer

Create the VPC with a single Availability Zone to simplify management.