ANS-C01 Practice Test 3 — 10 Questions

Question 1

A company is experiencing intermittent connectivity issues between two VPCs connected via a VPC peering connection. The VPCs are in different AWS regions. VPC A has CIDR 10.0.0.0/16 and VPC B has CIDR 10.1.0.0/16. The route tables in both VPCs have been updated to include routes pointing to the peering connection. Security groups and network ACLs are configured to allow all traffic for testing. However, traffic from VPC A to VPC B fails intermittently. Which of the following is the most likely cause of this intermittent failure?

Accepted Answer

The VPC peering connection does not support transitive routing. If any traffic is being routed through an intermediate device (e.g., a NAT instance or a VPN connection), the peering connection will not forward that traffic.. The intermittent failure is most likely due to VPC peering's lack of transitive routing. If traffic from VPC A to VPC B is routed through an intermediate device (e.g., a NAT instance, VPN connection, or another VPC), the VPC peering connection will not forward that traffic because it does not support transitive routing. This can cause intermittent failures when the intermediate device's route or state changes, even though direct routes and security groups are correctly configured.

Answer

The security group rules in VPC A are not allowing inbound traffic from VPC B's CIDR. The security group must reference the VPC B CIDR explicitly.

Answer

The route tables in both VPCs must include explicit routes for each other's CIDR blocks, but they should also include routes to the internet gateway for proper routing.

Answer

The VPCs are in different regions, and cross-region VPC peering is not supported. A transit gateway must be used instead.

Question 2

A network engineer is troubleshooting a Site-to-Site VPN connection between an on-premises network and AWS. The VPN tunnel is up, but traffic is not flowing from the on-premises network to a VPC. The VPC has a virtual private gateway attached, and the route table has a route pointing to the virtual private gateway for the on-premises CIDR (192.168.0.0/16). The on-premises firewall shows that traffic is being sent to the VPN tunnel. What should the engineer check next?

Accepted Answer

Verify that the on-premises route table has a route to the VPC CIDR via the VPN tunnel.. Since the VPN tunnel is up and the on-premises firewall confirms traffic is being sent to the tunnel, the issue is likely on the on-premises routing side. For traffic to flow from on-premises to the VPC, the on-premises router must have a route pointing to the VPC CIDR via the VPN tunnel interface. Without this route, packets will not be forwarded into the tunnel, even though the tunnel itself is operational.

Answer

Verify that the virtual private gateway is attached to the VPC.

Answer

Verify that the on-premises firewall is not blocking UDP port 500 for IKE.

Answer

Verify that the VPN tunnel's pre-shared key matches on both sides.

Question 3

Arrange the steps to configure an AWS Transit Gateway with attachments to multiple VPCs:

Question 4

Order the steps to set up a Network Load Balancer with a TCP listener in front of an Auto Scaling group:

Question 5

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The application must be accessible only from a specific AWS Client VPN endpoint. The security team has configured the ALB security group to allow inbound traffic from the Client VPN CIDR range, but users report that they can still access the application from outside the VPN. What is the MOST likely cause of this issue?

Accepted Answer

The ALB security group is not set as the source for inbound traffic; instead, traffic reaches the ALB directly from the internet.. Option A is correct because the ALB security group is configured to allow inbound traffic from the Client VPN CIDR range, but if the ALB itself is internet-facing (i.e., it has public IP addresses and is deployed in public subnets), traffic can bypass the security group rules if the security group is not actually applied to the ALB's network interfaces. The most likely cause is that the ALB security group is not set as the source for inbound traffic; instead, traffic reaches the ALB directly from the internet, meaning the security group rules are not being enforced on the ALB's listener. This allows users outside the VPN to access the application because the ALB accepts traffic from any source unless the security group explicitly restricts it.

Answer

The network ACL is stateless and requires separate inbound and outbound rules for return traffic.

Answer

The subnet's network ACL allows inbound HTTP/HTTPS traffic from 0.0.0.0/0.

Answer

The EC2 instances' security group allows inbound traffic from 0.0.0.0/0.

Question 6

Order the steps to migrate a VPC from using an Internet Gateway to a NAT gateway for outbound-only internet access:

Question 7

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to initiate outbound connections to the internet for software updates. The company wants to ensure that all outbound traffic goes through a single, highly available IP address for whitelisting purposes. Which solution should be used?

Answer

Launch a NAT instance in a public subnet and assign an Elastic IP. Configure the private subnet route table to point to the NAT instance.

Answer

Create an internet gateway and attach it to the private subnet, then configure the route table.

Answer

Create a VPC endpoint for Amazon S3 and route software update traffic through that endpoint.

Answer

Create a NAT gateway in each Availability Zone and assign the same Elastic IP to both.

Question 8

A company uses AWS Direct Connect to connect its on-premises network to a VPC. The security team wants to ensure that traffic between the on-premises network and the VPC is encrypted using IPSec. Which solution meets this requirement?

Accepted Answer

Establish an IPSec VPN connection over the Direct Connect public virtual interface using a customer gateway and a virtual private gateway.. Option A is correct because it establishes an IPSec VPN tunnel over a Direct Connect public virtual interface (VIF), which encrypts traffic between the on-premises network and the VPC. The customer gateway and virtual private gateway create a site-to-site VPN connection that uses IPSec to secure all data traversing the Direct Connect link, meeting the encryption requirement without relying on physical-layer security.

Answer

Use a private virtual interface (VIF) on the Direct Connect connection and enable encryption at the physical layer.

Answer

Use VPC endpoints (Gateway Endpoints) for all traffic between on-premises and the VPC.

Answer

Attach the Direct Connect virtual interface to a Transit Gateway and enable multicast.

Question 9

A company wants to audit all changes made to security groups and network ACLs in its AWS account. Which AWS service should be used to capture these API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including those that modify security groups and network ACLs. By enabling CloudTrail, you can capture CreateSecurityGroup, AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress, CreateNetworkAclEntry, and similar API calls, providing an audit trail of who made the change, when, and from which IP address.

Answer

Amazon GuardDuty

Answer

VPC Flow Logs

Answer

AWS Config

Question 10

A company is designing a network security architecture for a VPC that hosts a multi-tier application. The security team requires that the web tier can only be accessed from the internet, the application tier can only be accessed from the web tier, and the database tier can only be accessed from the application tier. Additionally, the team needs to ensure that no traffic can bypass these controls. Which THREE actions should the team take?

Accepted Answer

Use security group rules that reference other security groups as sources.. Security group rules can reference other security groups as sources, which allows the web tier security group to permit traffic only from the application tier security group, and the application tier security group to permit traffic only from the database tier security group. This creates a logical, stateful firewall that enforces the required traffic flow between tiers without relying on IP addresses, ensuring that no traffic can bypass the controls even if subnet configurations change.

Answer

Enable VPC Flow Logs on all subnets and send logs to Amazon S3.

Answer

Attach an internet gateway to the VPC and add a default route to the internet gateway in the web tier subnet's route table.