ANS-C01 Practice Test 12 — 15 Questions

Question 1

A company is designing a network for a real-time gaming application that requires extremely low latency between players. The application will be deployed on EC2 instances in multiple AWS regions. Which AWS service provides the best latency performance by using the AWS global network and anycast IPs?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator uses the AWS global network and anycast IPs to route traffic to the optimal edge location, then over the AWS backbone to the nearest healthy endpoint. This minimizes internet hops and latency, making it ideal for real-time gaming applications that require consistent low latency across multiple regions.

Answer

AWS Direct Connect

Answer

Amazon CloudFront

Answer

Amazon Route 53 Latency Routing

Question 2

A company is designing a VPC with subnets in multiple Availability Zones (AZs) for a web application. The application must be fault-tolerant and highly available. Which design should the network engineer implement?

Accepted Answer

Deploy application instances in two AZs behind an Application Load Balancer that spans both AZs.. Option C is correct because deploying application instances in two Availability Zones (AZs) behind an Application Load Balancer (ALB) that spans both AZs provides fault tolerance and high availability. If one AZ fails, the ALB automatically routes traffic to healthy instances in the remaining AZ, ensuring continuous service. This design leverages cross-zone load balancing, which is enabled by default for ALBs, to distribute traffic evenly across instances in multiple AZs.

Answer

Deploy all application instances in a single AZ behind an Application Load Balancer.

Answer

Place one instance in each of two AZs and use an internet gateway for load balancing.

Answer

Use a Network Load Balancer in a single AZ with instances in multiple AZs.

Question 3

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises data centers. They want to centralize internet traffic through a single VPC that has an internet gateway. Which Transit Gateway feature should they enable?

Accepted Answer

Transit Gateway route tables. To centralize internet traffic through a single VPC with an internet gateway, you need to control the routing of traffic from other VPCs and on-premises networks. Transit Gateway route tables allow you to isolate or share routes between attachments, enabling you to create a default route (0.0.0.0/0) pointing to the centralized VPC's attachment. This ensures all outbound internet traffic from other VPCs is forwarded to the egress VPC, which then uses its internet gateway.

Answer

VPN attachments

Answer

Multicast support

Answer

IPsec acceleration

Question 4

A company is designing a high-availability architecture for an application that will be deployed across multiple Availability Zones. Which THREE components are recommended for this design? (Choose three.)

Accepted Answer

Application Load Balancer across multiple AZs. An Application Load Balancer (ALB) distributes incoming traffic across multiple targets in different Availability Zones (AZs). By enabling cross-zone load balancing, the ALB can route requests to healthy instances in any AZ, ensuring that if one AZ fails, traffic is automatically redirected to instances in the remaining AZs. This is a foundational component for high availability because it eliminates a single point of failure at the traffic distribution layer.

Answer

One EC2 instance in each AZ

Answer

Single NAT Gateway in one AZ

Question 5

A company is deploying a critical application across multiple AWS accounts. The network team wants to simplify IP address management and ensure that VPCs in different accounts can communicate securely. The company has a centralized network account with a transit gateway. Which architecture should the company use?

Accepted Answer

Use AWS Resource Access Manager to share the transit gateway in the network account with other accounts and attach their VPCs.. Option A is correct because AWS Resource Access Manager (RAM) allows you to share a transit gateway from a centralized network account with other AWS accounts, enabling VPCs in those accounts to attach to the shared transit gateway. This simplifies IP address management by providing a single hub for inter-VPC routing and avoids the complexity of managing multiple VPC peering connections. The transit gateway supports transitive routing, so VPCs in different accounts can communicate securely through the centralized gateway without needing direct peering.

Answer

Create VPC peering connections between each VPC in different accounts.

Answer

Configure VPC endpoints in each account to communicate through the network account.

Answer

Set up AWS Direct Connect between accounts and route through the network account.

Question 6

A company is designing a hybrid network connecting an on-premises data center to AWS via AWS Direct Connect. The company requires high availability and wants to avoid a single point of failure. Which design meets these requirements?

Accepted Answer

Provision two Direct Connect connections at two different Direct Connect locations.. Option D is correct because provisioning two Direct Connect connections at two different Direct Connect locations eliminates any single point of failure. This design ensures that if one connection or location fails, traffic can automatically fail over to the other connection, meeting the high availability requirement. A single Direct Connect connection, regardless of the number of VIFs or VLANs, remains a single point of failure.

Answer

Provision a single Direct Connect connection with multiple virtual interfaces (VIFs).

Answer

Provision one Direct Connect connection with two VLANs to separate production and non-production traffic.

Answer

Use a single Direct Connect connection and a VPN backup over the internet.

Question 7

A company needs to monitor network traffic to and from EC2 instances for security analysis. Which AWS service should they use?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including metadata such as source/destination IPs, ports, protocols, and packet accept/reject decisions. This makes it the correct service for monitoring network traffic to and from EC2 instances for security analysis, as it provides detailed network-level logs without requiring any agent installation on the instances.

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 8

A company has a VPC with public and private subnets in two Availability Zones. The private subnets host EC2 instances that need to access the internet for software updates. The company must ensure that traffic from the private instances uses a single, predictable public IP address. What is the MOST cost-effective solution?

Accepted Answer

Deploy a NAT Gateway in a public subnet in one Availability Zone, and route private subnet traffic to it.. Option C is correct because a NAT Gateway in a public subnet provides outbound-only internet access for private instances, and it uses a single Elastic IP address, ensuring a predictable public IP. This is the most cost-effective managed solution, as NAT Gateways are highly available within an Availability Zone and require no manual instance management.

Answer

Attach an Internet Gateway to the VPC and update the private subnet route table with a default route to the Internet Gateway.

Answer

Create a Transit Gateway with a VPC attachment and route traffic through a central egress VPC.

Answer

Launch a NAT instance in a public subnet and configure source/destination check.

Question 9

A company is designing a VPC with a public subnet and a private subnet. The private subnet instances need to access the internet for software updates. Which TWO options allow outbound internet access while preventing inbound connections? (Choose two.)

Accepted Answer

NAT Gateway in the public subnet. A NAT Gateway in the public subnet allows instances in the private subnet to initiate outbound connections to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. The NAT Gateway translates the private IP addresses of the instances to its own Elastic IP address, and because it does not maintain state for inbound traffic that was not initiated from within the VPC, it blocks all inbound connection attempts.

Answer

Internet Gateway attached to the VPC

Answer

AWS Site-to-Site VPN connection to on-premises

Answer

VPC Peering connection to a VPC with internet access

Question 10

A company is designing a multi-Region application using Amazon Route 53 latency-based routing. The application must be highly available and failover automatically if an AWS Region becomes unavailable. What should the company do to meet these requirements?

Accepted Answer

Configure active-passive failover with latency-based routing and associate health checks with each record.. Option B is correct because it combines latency-based routing with health checks and active-passive failover, which allows Route 53 to route traffic to the region with the lowest latency under normal conditions and automatically fail over to the passive region if the active region's health check fails. This meets the high availability and automatic failover requirements by leveraging Route 53's DNS failover mechanism, which updates DNS responses based on health check status.

Answer

Configure latency-based routing with health checks and enable DNS failover.

Answer

Configure geolocation routing policies and associate health checks.

Answer

Configure weighted routing policies with equal weights for all regions.

Question 11

An enterprise is migrating a critical application to AWS. The application requires low latency (under 5 ms) between two EC2 instances that are in different VPCs in the same region. The company also needs to ensure that traffic is encrypted in transit and that the connection is highly available. Which design should be used?

Accepted Answer

Configure VPC Peering and use an AWS Transit Gateway with VPN attachments. Option B is correct because AWS Transit Gateway with VPN attachments provides encrypted transit (using IPsec) and high availability (via redundant VPN tunnels) between VPCs in the same region. VPC Peering alone does not encrypt traffic, but when combined with Transit Gateway VPN attachments, it meets the sub-5 ms latency requirement (since both VPCs are in the same region and traffic stays within the AWS backbone). This design also supports the required encryption and high availability without the complexity of Direct Connect or the latency overhead of internet-based VPNs.

Answer

Use an AWS Direct Connect connection between the VPCs

Answer

Use VPC endpoints with PrivateLink

Answer

Establish an AWS Site-to-Site VPN between the VPCs

Question 12

A company is designing a hybrid network architecture that requires a dedicated, private, and consistent connection between its on-premises data center and AWS. The connection must support multiple VLANs and provide a service-level agreement (SLA) of 99.99% availability. Which AWS service should be used to meet these requirements?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct choice because it provides a dedicated, private, and consistent network connection from an on-premises data center to AWS, bypassing the public internet. It supports multiple VLANs via 802.1Q tagging over a single physical connection, and offers a 99.99% service-level agreement (SLA) when configured with redundant connections at separate Direct Connect locations.

Answer

AWS Transit Gateway

Answer

AWS Client VPN

Answer

AWS Site-to-Site VPN

Question 13

An administrator needs to create an interface VPC endpoint for Amazon S3 in a VPC and attach an elastic network interface (ENI) to an EC2 instance. The administrator applies the IAM policy shown in the exhibit. Which action will be DENIED by this policy?

Answer

Attach the ENI to the EC2 instance

Answer

Create the VPC endpoint

Answer

Describe VPC endpoints

Answer

Modify the VPC endpoint

Question 14

A company is designing a network for a critical application that requires high availability across three Availability Zones in a single AWS Region. The application uses Network Load Balancers (NLBs) and Application Load Balancers (ALBs). The company must ensure that cross-zone load balancing is enabled for the NLBs and that the ALBs have a fixed response timeout. Which combination of settings meets these requirements?

Accepted Answer

Enable cross-zone load balancing on the NLB (default) and set the idle timeout on the ALB to a fixed value.. Option B is correct because cross-zone load balancing is enabled by default on Network Load Balancers (NLBs) and ensures traffic is distributed evenly across targets in all Availability Zones, which is critical for high availability across three AZs. The idle timeout on an Application Load Balancer (ALB) is a fixed value (default 60 seconds, configurable from 1 to 4000 seconds) that controls how long the ALB keeps a connection open without data transfer, meeting the requirement for a fixed response timeout. This combination satisfies both requirements without conflicting settings.

Answer

Disable cross-zone load balancing on the ALB and set the idle timeout on the NLB.

Answer

Disable cross-zone load balancing on the NLB and set the connection timeout on the ALB.

Answer

Enable cross-zone load balancing on the ALB and set the connection timeout on the NLB.

Question 15

A company has deployed a multi-tier application across three VPCs (VPC-A, VPC-B, VPC-C) in the us-east-1 region. Each VPC has its own CIDR block (10.0.0.0/16, 10.1.0.0/16, 10.2.0.0/16 respectively). All VPCs are attached to an AWS Transit Gateway. The web tier is in VPC-A, the application tier is in VPC-B, and the database tier is in VPC-C. The application servers in VPC-B need to connect to the database servers in VPC-C on TCP port 3306. The database servers are in a private subnet with a security group (sg-db) that allows inbound traffic from the application server security group (sg-app). The application servers have a security group (sg-app) that allows outbound traffic to the database servers. However, the application servers cannot connect to the database servers. The route tables in VPC-B and VPC-C have routes pointing to the Transit Gateway for the other VPC CIDRs. The Transit Gateway has attachments in all three VPCs and has a default route table with propagation enabled. What is the MOST likely cause of the connectivity failure?

Accepted Answer

The Transit Gateway attachments are not associated with the same route table. The most likely cause is that the Transit Gateway attachments are not associated with the same route table. In AWS Transit Gateway, for traffic to flow between VPCs, the attachments must be associated with a route table that contains routes for the destination VPC CIDRs. Even though propagation is enabled on the default route table, if the attachments are associated with different route tables (or the default route table is not shared), transitive routing will fail. Without a common route table association, the Transit Gateway cannot forward traffic between VPC-B and VPC-C.

Answer

The network ACLs in VPC-B or VPC-C are blocking the traffic

Answer

The Transit Gateway does not support transitive routing between VPCs

Answer

The security group sg-app does not allow outbound traffic to the database server's security group