ANS-C01 Practice Test 10 — 10 Questions

Question 1

A company has a VPC with public and private subnets in three Availability Zones. They have EC2 instances in private subnets that need to download patches from the internet. The company requires that all outbound traffic to the internet is logged and inspected. Which solution meets these requirements with the highest availability?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a centralized egress VPC with a NAT Gateway in each AZ. Peer the application VPCs to the egress VPC and route 0.0.0.0/0 traffic through a firewall appliance in the egress VPC.. It meets the requirements for logging and inspecting all outbound internet traffic by routing it through a centralized firewall appliance in an egress VPC, while also providing high availability through NAT Gateways deployed in each Availability Zone. This architecture ensures that traffic is inspected before reaching the internet, and the use of multiple NAT Gateways eliminates single points of failure, achieving the highest availability compared to single-instance or single-gateway solutions.

Answer

Launch a NAT instance in one public subnet and configure all private subnet route tables to send 0.0.0.0/0 to the NAT instance.

Answer

Place a single NAT Gateway in one public subnet and configure all private subnet route tables to send 0.0.0.0/0 to that NAT Gateway.

Answer

Attach an internet gateway to the VPC and add a route in the private subnet route tables to send 0.0.0.0/0 to the internet gateway.

Question 2

A company is using AWS Direct Connect with a private VIF to access their VPC. Users report intermittent connectivity issues. You check the Direct Connect console and see that the virtual interface state is 'down'. What is the MOST likely cause?

Accepted Answer

BGP session between the customer router and AWS is down.. A private VIF relies on a BGP session between the customer router and the AWS Direct Connect router to exchange routes and maintain the virtual interface state. When the BGP session goes down, the VIF state transitions to 'down' because no routing information is being exchanged, causing connectivity loss. This is the most direct and common cause of a VIF being in the 'down' state.

Answer

AWS Site-to-Site VPN is not established.

Answer

MACsec encryption is misconfigured on the customer router.

Answer

Jumbo frames are enabled on the VIF but not supported by the customer router.

Question 3

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They have subnets in three Availability Zones. They need to add IPv6 connectivity to the VPC and allow instances in private subnets to initiate outbound IPv6 connections to the internet, but not allow inbound connections from the internet. Which TWO actions must be taken?

Accepted Answer

Create an egress-only internet gateway and add a route for ::/0 to it in the private subnet route tables.. Option C is correct because before any IPv6 addressing or routing can exist in the VPC, you must associate an Amazon-provided or BYOIP IPv6 CIDR block with the VPC (and then assign IPv6 CIDR blocks to the subnets), which is the prerequisite for IPv6 connectivity. Option A is correct because an egress-only internet gateway is the AWS component purpose-built for IPv6-only outbound access: it is stateful and allows instances to initiate outbound IPv6 traffic to the internet while preventing the internet from initiating inbound IPv6 connections, and a ::/0 route in the private subnet route table pointing to that egress-only internet gateway enables the outbound path. Option B is not correct because an internet gateway provides bidirectional IPv6 connectivity, so routing ::/0 to it would allow inbound internet-initiated connections, violating the requirement. Option D is not correct because a NAT gateway only translates IPv4 traffic and does not provide IPv6 connectivity. Option E is not correct because security groups are stateful and, by default, allow all outbound traffic; a security group rule is not the mechanism that enables or restricts internet-initiated inbound IPv6 connectivity, and it is not a required action to add IPv6 egress.

Answer

Create an internet gateway and add a route for ::/0 to it in the private subnet route tables.

Answer

Create a NAT gateway in a public subnet.

Answer

Configure a security group that allows outbound IPv6 traffic.

Question 4

A company has a large AWS environment with hundreds of VPCs connected via Transit Gateway. They want to centrally manage network traffic flow and enforce security policies. Which service should they use to create a central network inspection architecture?

Accepted Answer

AWS Network Firewall. AWS Network Firewall provides managed firewall services that can be centrally deployed in a dedicated VPC and route traffic through it for inspection.

Answer

AWS WAF

Answer

Security groups

Answer

AWS Shield Advanced

Question 5

A company uses AWS Direct Connect with multiple virtual interfaces (VIFs) to connect to multiple VPCs. The network team wants to ensure high availability and failover. Which configuration provides the best resiliency?

Accepted Answer

Provision two Direct Connect connections from different providers and configure BGP. The most resilient Direct Connect design requires physically diverse connections from different providers so that a single provider outage, fiber cut, or location failure cannot take down both links. Configuring BGP on both connections enables automatic failover and dynamic path selection between the two diverse paths. AWS explicitly recommends this multi-provider, multi-location design for maximum Direct Connect resiliency.

Answer

Use a single Direct Connect connection with a VPN backup over the internet

Answer

Configure BGP with multiple AS paths on the same Direct Connect connection

Answer

Create multiple private VIFs on a single Direct Connect connection

Question 6

A company is designing a hybrid network connecting on-premises data centers to AWS via AWS Direct Connect. The company requires high availability with multiple connections. Which design ensures that a failure of a single Direct Connect location does not impact connectivity?

Accepted Answer

Provision two Direct Connect connections at two different Direct Connect locations.. Deploying two Direct Connect connections at two different Direct Connect locations ensures that a single location failure (e.g., power outage, fiber cut, or facility issue) does not affect connectivity. This design provides geographic redundancy, meeting the high availability requirement by eliminating a single point of failure at the Direct Connect location level.

Answer

Provision a single Direct Connect connection with a large bandwidth.

Answer

Provision two Direct Connect connections at the same AWS Direct Connect location.

Answer

Provision one Direct Connect connection and one AWS Site-to-Site VPN as backup.

Question 7

A network engineer is setting up a Direct Connect connection from an on-premises data center to AWS. The connection uses a private VIF to connect to a VPC via a Direct Connect gateway. The on-premises network is advertising a BGP prefix 10.0.0.0/16, which overlaps with the VPC CIDR 10.0.0.0/16. What is the expected behavior?

Accepted Answer

The BGP session will be established, but the overlapping prefix will be ignored and not programmed into the VPC route tables.. When a BGP prefix advertised over a Direct Connect private VIF overlaps with the VPC CIDR, the BGP session establishes successfully, but AWS ignores the overlapping prefix and does not install it into the VPC route tables. This is because AWS always prefers the local VPC route over any propagated BGP route for the same prefix, preventing traffic destined for the VPC from being blackholed or misrouted to on-premises.

Answer

The VPC will automatically reassign a new CIDR to avoid the conflict.

Answer

The BGP session will fail to establish due to the prefix conflict.

Answer

The on-premises prefix will take precedence and override the VPC route.

Question 8

A company has multiple VPCs connected via VPC peering. They want to simplify network management and reduce the number of peering connections. Which AWS service should they use?

Accepted Answer

AWS Transit Gateway. Transit Gateway acts as a hub to connect multiple VPCs and on-premises networks, reducing the need for full mesh peering.

Answer

AWS PrivateLink

Answer

AWS VPN CloudHub

Answer

AWS Direct Connect Gateway

Question 9

A company is building a serverless application using API Gateway, Lambda, and DynamoDB. The API must be accessible from the internet and be resilient to Regional failures. Which design provides the HIGHEST availability?

Accepted Answer

Deploy in two Regions with API Gateway, Lambda, and DynamoDB global tables. Use Route 53 failover routing with health checks.. It combines multi-Region deployment with Route 53 failover routing and health checks, ensuring that if one Region becomes unavailable, traffic is automatically redirected to the healthy Region. API Gateway, Lambda, and DynamoDB global tables provide the necessary cross-Region replication and stateless compute to maintain full functionality during a Regional outage, offering the highest availability.

Answer

Deploy API Gateway, Lambda, and DynamoDB in a single Region with multi-AZ.

Answer

Deploy API Gateway in two Regions behind a Global Accelerator accelerator.

Answer

Use a single API Gateway with CloudFront distribution in front, and Lambda@Edge for compute.

Question 10

A company wants to encrypt all data in transit between its on-premises data center and AWS. Which two services or features can provide encryption for data in transit?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN (C) is correct because it creates IPsec tunnels over the public internet between the on-premises customer gateway and an AWS virtual private gateway or transit gateway, encrypting all traffic in transit with IPsec. AWS Direct Connect with MACsec (E) is correct because MACsec (IEEE 802.1AE) provides layer-2 encryption on the dedicated Direct Connect link between the customer's router and the AWS Direct Connect endpoint, protecting data in transit. AWS PrivateLink (A) is not correct here because it privately connects VPCs and services over the AWS backbone without providing encryption of the traffic itself. VPC peering (B) is not correct because it only routes traffic privately between VPCs and does not encrypt it. AWS Transit Gateway (D) is not correct because it is a network transit hub for connecting VPCs and on-premises networks, not an encryption mechanism.

Answer

AWS PrivateLink

Answer

VPC peering

Answer

AWS Transit Gateway