ANS-C01 Practice Test 10 — 10 Questions

Question 1

A company wants to connect its on-premises data center to AWS using AWS Direct Connect and wants to use the same connection to access multiple VPCs in the same AWS region. The company also needs to maintain private IP connectivity between the VPCs. Which THREE components should the company use to meet these requirements? (Choose three.)

Accepted Answer

Transit Gateway VPC attachments. Transit Gateway VPC attachments allow multiple VPCs to connect to a central transit gateway, enabling private IP connectivity between them. When combined with an AWS Direct Connect gateway, the on-premises data center can use a single Direct Connect connection to reach all attached VPCs via the transit gateway, meeting both requirements efficiently.

Answer

VPC peering connections between each VPC

Answer

AWS Site-to-Site VPN connection

Question 2

A company has a VPC with a CIDR of 172.16.0.0/16. They have a subnet 172.16.1.0/24 for web servers and another subnet 172.16.2.0/24 for database servers. The web servers need to access the database servers on port 3306. Which configuration is required?

Accepted Answer

Web SG: outbound to DB SG on port 3306. DB SG: inbound from web SG on port 3306.. Option C is correct because security groups are stateful and control traffic at the instance level. The web server security group needs an outbound rule allowing traffic to the database security group on port 3306, and the database security group needs an inbound rule allowing traffic from the web security group on port 3306. This ensures that only the web servers can initiate connections to the database servers on the required port.

Answer

Configure network ACLs to allow inbound on port 3306 from web subnet.

Answer

Web SG: inbound from 0.0.0.0/0 on port 3306. DB SG: outbound to web SG on port 3306.

Answer

Web SG: outbound to DB SG on all ports. DB SG: inbound from web SG on all ports.

Question 3

A company has multiple VPCs that need to communicate with each other and with an on-premises network. They want to minimize operational overhead and avoid peering mesh complexity. Which AWS service should be used?

Accepted Answer

AWS Transit Gateway.. AWS Transit Gateway acts as a central hub to interconnect multiple VPCs and on-premises networks using a single gateway, eliminating the need for a full mesh of VPC peering connections. It simplifies network management by providing transitive routing between all attached networks, which directly addresses the requirement to minimize operational overhead and avoid peering mesh complexity.

Answer

AWS PrivateLink.

Answer

AWS VPN CloudHub.

Answer

VPC Peering.

Question 4

A company is migrating a legacy application to AWS. The application requires a fixed IP address for outbound traffic to a partner's firewall. The application will run on Amazon EC2 instances in a private subnet. Which design meets the requirement without exposing the instances to inbound internet traffic?

Accepted Answer

Deploy a NAT gateway with an Elastic IP and route outbound traffic through it. A NAT gateway with an Elastic IP provides a fixed public IP address for outbound traffic from instances in a private subnet while preventing any unsolicited inbound connections from the internet. The NAT gateway translates the private source IPs of the instances to its own Elastic IP, meeting the partner firewall's requirement for a fixed source IP without exposing the EC2 instances directly.

Answer

Attach an Internet Gateway to the VPC and assign public IPs to the instances

Answer

Place the instances behind an Application Load Balancer

Answer

Create a VPC Gateway Endpoint for the partner's service

Question 5

A company is deploying a VPC with a public and private subnet in each of three Availability Zones. They need to provide internet access to instances in the private subnets while ensuring that all outbound traffic is logged and that traffic to a particular on-premises CIDR (10.0.0.0/8) is routed via an AWS Direct Connect Virtual Private Gateway. The company has a VPN connection as a backup. Which design should they use?

Accepted Answer

Create a centralized egress VPC with NAT Gateways in each AZ. Peer the application VPCs to the egress VPC. Configure route tables in the application VPCs to send 0.0.0.0/0 to the egress VPC and 10.0.0.0/8 to the Direct Connect Virtual Private Gateway.. Option A is correct because it uses a centralized egress VPC with NAT Gateways in each AZ to provide internet access to private subnets while logging all outbound traffic. By peering the application VPCs to the egress VPC, the route tables can direct 0.0.0.0/0 traffic to the egress VPC for NAT, and 10.0.0.0/8 traffic to the Direct Connect Virtual Private Gateway, ensuring on-premises traffic uses the dedicated connection with VPN backup. This design meets all requirements: internet access, logging, and specific routing for on-premises CIDR.

Answer

Place a NAT Gateway in each AZ in the application VPC. Configure route tables to send 0.0.0.0/0 to the NAT Gateway. Use a VPN connection for on-premises traffic.

Answer

Use a Transit Gateway to connect all VPCs and on-premises. Attach a NAT Gateway in one AZ to the Transit Gateway. Configure route tables to send 0.0.0.0/0 to the NAT Gateway and 10.0.0.0/8 to the Direct Connect Virtual Private Gateway.

Answer

Create a NAT instance in each private subnet and configure each instance's route table to send 0.0.0.0/0 to the NAT instance. For on-premises traffic, use a VPC peering connection to an on-premises network.

Question 6

A financial services company must meet PCI DSS compliance for its VPC design. It requires that all traffic between application tiers be encrypted in transit and that no traffic can bypass the encryption. The architecture includes a public-facing Application Load Balancer (ALB), a web tier in public subnets, an app tier in private subnets, and a database tier in isolated subnets. Which design meets these requirements?

Accepted Answer

Terminate TLS at the ALB. Use HTTPS between ALB and web tier. Use TLS mutual authentication between web and app tier. Use TLS between app and database tier.. Option C is correct because it ensures encryption in transit for all traffic between application tiers, meeting PCI DSS requirements. The ALB terminates TLS from clients, then uses HTTPS (TLS) to the web tier, mutual TLS between web and app tiers for strong authentication and encryption, and TLS between app and database tiers. This design prevents any unencrypted traffic from bypassing encryption, as every hop uses TLS.

Answer

Terminate TLS at the ALB. Use HTTP between ALB and web tier. Use HTTPS between web and app tier. Use TLS between app and database tier.

Answer

Terminate TLS at the ALB. Use HTTP between ALB and web tier. Use HTTPS between web and app tier. Use TLS between app and database tier.

Answer

Terminate TLS at the ALB. Use HTTPS between ALB and web tier. Use HTTP between web and app tier. Use TLS between app and database tier.

Question 7

A company is deploying a containerized application on Amazon ECS using the Fargate launch type. The application requires outbound internet access to download updates, but the company does not want to assign public IP addresses to the tasks. Which TWO actions should the company take to provide internet access to the tasks? (Choose two.)

Accepted Answer

Launch the tasks in private subnets that do not have a route to an Internet Gateway. Option B is correct because tasks in private subnets without a route to an Internet Gateway cannot directly access the internet, which is the desired behavior to avoid public IP addresses. Option C is correct because a NAT gateway in a public subnet provides outbound internet access for tasks in private subnets by translating their private IP addresses to the NAT gateway's public IP, allowing them to reach the internet without assigning public IPs to the tasks.

Answer

Configure a security group that allows outbound traffic to 0.0.0.0/0

Answer

Launch the tasks in public subnets with auto-assign public IP enabled

Answer

Create a VPC Gateway Endpoint for Amazon ECR

Question 8

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. They need to ensure that traffic between VPCs is inspected by a network virtual appliance. Which architecture should they use?

Accepted Answer

Create an inspection VPC with the appliance. Configure Transit Gateway route tables to send inter-VPC traffic to the inspection VPC attachment.. Option C is correct because it uses an inspection VPC as a central point for traffic inspection. By attaching the network virtual appliance to a dedicated inspection VPC and configuring Transit Gateway route tables to route inter-VPC traffic to that attachment, all traffic between VPCs is forced through the appliance for inspection. This leverages Transit Gateway's ability to route traffic between attachments based on route table entries, enabling centralized security enforcement without complex peering or per-VPC appliance deployments.

Answer

Use a Network Load Balancer in each VPC to forward traffic to the appliance.

Answer

Attach the appliance directly to each VPC using VPC Peering.

Answer

Place the appliance in each VPC and configure VPC Peering.

Question 9

A company has a VPC with a public subnet and a private subnet. The private subnet hosts Amazon RDS instances. The security team wants to ensure that the RDS instances are not accessible from the internet. Which TWO actions should be taken?

Accepted Answer

Remove the route to an internet gateway from the private subnet's route table.. Options A and D are correct because removing internet gateway routes and not assigning public IPs prevent internet access. Option B is wrong because restricting security group inbound rules is important, but alone it may not prevent internet access if there is a public IP. Option C is wrong because network ACLs are stateless and can be used, but they are not as precise as security groups for this purpose. Option E is wrong because RDS can have public accessibility disabled, but that is not a VPC-level action.

Answer

Disable the 'Publicly accessible' option for the RDS instances.

Answer

Create a network ACL that denies all inbound traffic from 0.0.0.0/0.

Answer

Configure the security group for the RDS instances to deny all inbound traffic.

Question 10

A financial services company must meet PCI DSS compliance requirements. The company's VPC contains a web server in a public subnet and an application server in a private subnet. The application server must communicate with a third-party payment gateway over the internet, but the security team prohibits using an Elastic IP address or a NAT gateway due to auditing concerns. Which solution satisfies these requirements?

Accepted Answer

Use AWS PrivateLink to connect to the payment gateway via a VPC Endpoint Service. AWS PrivateLink allows the application server in the private subnet to connect to the third-party payment gateway via a VPC Endpoint Service without traversing the internet, using private IP addresses. This eliminates the need for an Elastic IP address or a NAT gateway, satisfying the security team's auditing concerns while meeting PCI DSS compliance requirements.

Answer

Deploy a NAT instance in the public subnet and route traffic through it

Answer

Configure a proxy server in the public subnet and have the application server use the proxy

Answer

Attach an Internet Gateway to the VPC and use a default route to 0.0.0.0/0 in the private subnet