ANS-C01 Practice Test 11 — 15 Questions

Question 1

A company is designing a multi-region active-active application using Amazon Route 53 and Application Load Balancers (ALBs). The application must be highly available and route traffic to the closest healthy endpoint. Which TWO configurations should the company use? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Route 53 with latency-based routing. Latency-based routing (B) is correct because it directs users to the AWS Region that provides the lowest latency, which matches the requirement to route traffic to the closest healthy endpoint in a multi-region active-active design. Associating health checks with each Route 53 record (C) is correct because health checks let Route 53 remove unhealthy regional endpoints from DNS responses, ensuring traffic only goes to healthy ALBs and supporting high availability. Failover routing (A) is not appropriate here because it is designed for active-passive configurations with a primary and secondary endpoint, not active-active closest-endpoint routing. Weighted routing (D) distributes traffic by assigned proportions and does not inherently select the lowest-latency or closest healthy endpoint. Geoproximity routing (E) routes based on geographic location and bias, not actual measured latency, so it does not meet the closest healthy endpoint requirement.

Answer

Configure Route 53 with failover routing

Answer

Configure Route 53 with weighted routing

Answer

Configure Route 53 with geoproximity routing

Question 2

Which TWO actions should be taken to secure an EC2 instance that is used as a bastion host? (Choose 2)

Accepted Answer

Use a security group that only allows necessary inbound ports. A bastion host should only expose necessary inbound ports (typically TCP 22 for SSH) to minimize the attack surface. By using a security group that restricts inbound traffic to only required ports, you enforce the principle of least privilege at the network layer, preventing unauthorized access to other services that might be running on the instance.

Answer

Use HTTPS instead of SSH for administration

Answer

Place the bastion host in a private subnet

Answer

Allow all inbound traffic on port 22 in the network ACL

Question 3

A company needs to log all network traffic to and from EC2 instances for security analysis. Which TWO services can capture this data? (Choose 2)

Accepted Answer

VPC Flow Logs. VPC Flow Logs (B) is correct because it captures IP traffic metadata (source/destination IP, ports, protocol, packets, bytes, accept/reject) for traffic to and from network interfaces in a VPC, including EC2 instances, and publishes it to CloudWatch Logs or S3 for security analysis. Traffic Mirroring (D) is correct because it copies the actual packet payloads from an EC2 instance's elastic network interface to a target (another ENI or Network Load Balancer) for deep inspection and analysis, providing full content capture that Flow Logs cannot. AWS Config (A) only records resource configuration changes and compliance state, not network traffic. AWS CloudTrail (C) logs AWS API activity and management events, not packet-level network traffic. Amazon CloudWatch Logs (E) is merely a log storage/analysis destination, not a service that itself captures VPC or EC2 network traffic.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Question 4

A company needs to provide internet access to instances in a private subnet. The instances must not be directly accessible from the internet. Which AWS service should be used?

Accepted Answer

NAT Gateway. A NAT Gateway enables instances in a private subnet to initiate outbound IPv4 traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet. It resides in a public subnet with an Elastic IP and uses source network address translation (SNAT) to translate the private IPs of the instances to the gateway's public IP, ensuring the instances remain inaccessible from the outside.

Answer

VPC Peering

Answer

AWS Direct Connect

Answer

Internet Gateway

Question 5

A company wants to ensure that traffic between two VPCs in the same region is encrypted in transit. The VPCs are connected via a VPC peering connection. What should the network engineer do to meet this requirement?

Accepted Answer

Use TLS or IPsec at the application layer between instances.. VPC peering connections do not support native encryption of traffic. To meet the requirement for encryption in transit between two VPCs connected via a VPC peering connection, you must implement encryption at the application layer using TLS or IPsec between the instances. This ensures that traffic is encrypted end-to-end, independent of the underlying network path.

Answer

Create an AWS Site-to-Site VPN between the VPCs and disable the VPC peering connection.

Answer

Replace the VPC peering connection with a Transit Gateway and enable VPN encryption.

Answer

Enable encryption on the VPC peering connection.

Question 6

A company has a VPC with a CIDR block of 10.0.0.0/16. They have two subnets: a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). The public subnet has an internet gateway attached, and the private subnet has a NAT Gateway in the public subnet for outbound internet access. The company is deploying an Amazon RDS for MySQL database in a Multi-AZ configuration. The database should be accessible only from the application servers running in the private subnet. The company wants to ensure that the database is highly available and that failover does not require any changes to the application. Which networking configuration should they use?

Accepted Answer

Create a DB subnet group with subnets in two Availability Zones, launch the RDS instance with Multi-AZ enabled, and configure the application to connect to the RDS endpoint DNS name. Creating a DB subnet group with subnets in two Availability Zones and enabling Multi-AZ on the RDS instance ensures automatic failover to a standby in another AZ. The application connects to the RDS endpoint DNS name, which automatically points to the current primary instance, so no application changes are needed during failover. This satisfies the high availability and access requirements while keeping the database in private subnets.

Answer

Place the RDS instances behind an internal Network Load Balancer and configure the application to connect to the NLB's DNS name

Answer

Create the RDS instance in the public subnet and restrict access using a security group that allows traffic from the private subnet

Answer

Configure the application to use the IP address of the primary RDS instance and update the application when failover occurs

Question 7

A security engineer must ensure that all traffic between an application running on Amazon EC2 and an Amazon RDS database is encrypted in transit. The VPC has a public subnet for the EC2 instance and a private subnet for the RDS database. What is the MOST secure way to enforce encryption for this traffic?

Accepted Answer

Configure the RDS DB instance to require SSL/TLS connections and configure the application to connect using SSL.. To enforce encryption in transit between an EC2 instance and an RDS database, the most secure method is to configure the RDS instance to require SSL/TLS connections and ensure the application connects using SSL. This ensures that all data transmitted is encrypted and that the database rejects unencrypted connections. Other options do not enforce encryption or are ineffective.

Answer

Enable IAM database authentication for the RDS instance.

Answer

Use a security group rule that allows traffic only on port 443.

Answer

Place both the EC2 instance and the RDS database in the same subnet and use a network ACL to enforce encryption.

Question 8

A company has a VPC with an Application Load Balancer (ALB) that distributes traffic to EC2 instances in private subnets. The ALB needs to be accessible from the internet. The security team requires that all traffic to the ALB be inspected by AWS WAF. Which configuration meets these requirements?

Accepted Answer

Associate AWS WAF with the ALB and make the ALB internet-facing. AWS WAF can be directly associated with an Application Load Balancer (ALB) to inspect HTTP/HTTPS traffic before it reaches the ALB. Making the ALB internet-facing allows it to receive traffic directly from the internet while WAF provides the required traffic inspection. This combination meets both the accessibility and security requirements without additional components.

Answer

Use a Network Load Balancer with AWS WAF attached

Answer

Place the ALB behind a Security Group that inspects traffic

Answer

Use Amazon CloudFront in front of the ALB with AWS WAF

Question 9

A company is deploying an AWS Client VPN endpoint to provide remote access to its VPC resources. The company wants to allow clients to access resources in multiple subnets within the VPC. Which TWO configurations are necessary?

Accepted Answer

Associate the Client VPN endpoint with subnets in the VPC.. Associating the Client VPN endpoint with subnets in the VPC is required to establish the network connectivity between the VPN clients and the VPC. The Client VPN endpoint uses elastic network interfaces in the associated subnets to route traffic from clients into the VPC. Without this association, the endpoint cannot forward traffic to VPC resources.

Answer

Configure route tables in the VPC to direct traffic to the Client VPN endpoint.

Answer

Attach the VPC to a transit gateway.

Answer

Configure security groups on the target subnets.

Question 10

A company wants to restrict access to an Amazon S3 bucket so that only requests from a specific VPC endpoint are allowed. Which policy element should be used?

Accepted Answer

aws:SourceVpce. (aws:SourceVpce) is correct because the aws:SourceVpce condition key allows restricting requests to a specific VPC endpoint. Option A (ec2:Vpc) is wrong because ec2:Vpc is an EC2-specific condition key and not applicable to S3. Option B (aws:SourceVpc) is wrong because it restricts to a VPC, not a specific VPC endpoint. Option C (aws:SourceIp) is wrong because it restricts based on IP address, not a VPC endpoint.

Answer

ec2:Vpc

Answer

aws:SourceVpc

Answer

aws:SourceIp

Question 11

A network engineer is troubleshooting connectivity issues between an on-premises network and a VPC over a Direct Connect private VIF. The on-premises network can reach EC2 instances in the VPC, but cannot reach an RDS database in the same VPC. The VPC has a single subnet. What is the MOST likely cause?

Accepted Answer

The RDS database security group is not allowing inbound traffic from the on-premises CIDR. Since the on-premises network can reach EC2 instances but not the RDS database, the issue is likely at the security group level, not the network ACL or routing. Security groups are stateful and act as a virtual firewall for instances; by default, they deny all inbound traffic unless explicitly allowed. The RDS database's security group must have an inbound rule permitting traffic from the on-premises CIDR range, and its absence would block the connection while leaving EC2 access unaffected.

Answer

The VPC network ACL is blocking inbound traffic from on-premises

Answer

The direct connect virtual interface is configured for a different VLAN

Answer

The VPC route table does not have a route to the on-premises network

Question 12

A company has multiple VPCs that need to communicate with each other. They want to use a hub-and-spoke model with centralized network management. Which AWS service should they use?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway (D) is the correct choice because it acts as a central hub that interconnects multiple VPCs and on-premises networks using a hub-and-spoke topology. It simplifies network management by providing a single point of connectivity and supports transitive routing between all attached VPCs, which is exactly what the company needs for centralized network management.

Answer

AWS Direct Connect

Answer

VPN CloudHub

Answer

VPC Peering

Question 13

A company has multiple VPCs connected via a transit gateway. Each VPC has a security group that allows traffic from the other VPCs' CIDR blocks. The security group rules are getting complex. How can the company simplify security group management while maintaining the same level of security?

Accepted Answer

Use managed prefix lists in security group rules.. Managed prefix lists let you group CIDR blocks into a single named list and reference that list in security group rules, so instead of maintaining dozens of individual CIDR entries across many security groups, you update the prefix list once and all referencing rules update automatically. This simplifies management while maintaining the same security posture because the rules still enforce the same CIDR-based access.

Answer

Use VPC endpoints for inter-VPC communication.

Answer

Deploy AWS Network Firewall to centralize rules.

Answer

Replace security groups with network ACLs.

Question 14

A company is designing a multi-region architecture using AWS Global Accelerator and Application Load Balancers (ALBs) in two AWS Regions. They want to route traffic to the closest healthy endpoint and minimize latency. Which configuration best meets these requirements?

Accepted Answer

Create a Global Accelerator with endpoint groups in each region, each pointing to the regional ALB.. AWS Global Accelerator uses the Anycast IP address to route traffic to the nearest edge location, then forwards it over the AWS global network to the closest healthy endpoint group. By configuring endpoint groups in each region, each pointing to the regional ALB, Global Accelerator provides both low-latency routing and automatic failover, meeting the requirement for multi-region traffic distribution to the closest healthy endpoint.

Answer

Deploy a single ALB in one region and use Route 53 geolocation routing to direct traffic.

Answer

Use Amazon Route 53 latency-based routing with ALBs in each region.

Answer

Use an Application Load Balancer in one region and a Network Load Balancer in another with cross-zone load balancing.

Question 15

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to add IPv6 connectivity for their internet-facing applications. The VPC currently has an internet gateway attached. What is the MOST efficient way to enable IPv6?

Accepted Answer

Assign an Amazon-provided IPv6 CIDR block to the VPC and subnets, and update route tables to use an internet gateway for IPv6. The most efficient way to enable IPv6 for an existing VPC with an internet gateway is to request an Amazon-provided IPv6 CIDR block (a /56 block) for the VPC, assign a /64 IPv6 CIDR to each subnet, and then update the route tables to direct ::/0 traffic to the internet gateway. The internet gateway is a dual-stack resource that inherently supports both IPv4 and IPv6 traffic, so no additional gateway is needed for outbound-only or inbound IPv6 connectivity.

Answer

Create a transit gateway and attach the VPC, then route IPv6 traffic through a VPN

Answer

Create a NAT Gateway in a public subnet and route IPv6 traffic through it

Answer

Assign an IPv6 CIDR to the VPC and subnets, and add an egress-only internet gateway