ANS-C01 Practice Test 12 — 15 Questions

Question 1

A CloudFormation stack was created with the above snippet. An administrator notices that the EC2 instance can receive HTTP traffic from the internet, but cannot access the internet itself (e.g., to download updates). What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The instance is in a private subnet without a NAT gateway or route to an internet gateway.. The instance can receive inbound HTTP traffic because the security group ingress rule allows HTTP. However, it cannot initiate outbound traffic to the internet. The security group egress rule allows all traffic, so outbound is not restricted. The most likely cause is that the instance is in a private subnet without a NAT gateway or route to an internet gateway. Private subnets cannot directly access the internet without a NAT device. Therefore, Option B is correct. Option A is incorrect because the egress rule is permissive. Option C is incorrect because the security group is properly attached (inbound works). Option D is incorrect because the ingress rule is not the issue.

Answer

The security group egress rule restricts outbound traffic to only HTTP.

Answer

The security group is not attached to the instance properly.

Answer

The security group ingress rule only allows HTTP from the internet, but not other protocols needed for updates.

Question 2

A company needs to monitor network traffic to and from EC2 instances for security analysis. Which AWS service should they use?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including metadata such as source/destination IPs, ports, protocols, and packet accept/reject decisions. This makes it the correct service for monitoring network traffic to and from EC2 instances for security analysis, as it provides detailed network-level logs without requiring any agent installation on the instances.

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 3

A company is deploying a VPC with public and private subnets in two Availability Zones. The public subnets host NAT gateways for outbound internet access from the private subnets. Which configuration ensures that EC2 instances in the private subnets can route traffic to the internet through the NAT gateways?

Accepted Answer

Add a route in the private subnet route table with destination 0.0.0.0/0 targeting the NAT gateway.. For EC2 instances in private subnets to reach the internet via a NAT gateway, the private subnet route table must include a default route (0.0.0.0/0) pointing to the NAT gateway as the next hop. The NAT gateway resides in a public subnet and translates the private IPs to its own Elastic IP, forwarding traffic to the internet gateway. Without this route, traffic from private instances has no path to the NAT gateway.

Answer

Add a route in the public subnet route table pointing to the internet gateway.

Answer

Attach an egress-only internet gateway to the private subnets.

Answer

Create a VPC peering connection between the VPC and the NAT gateway.

Question 4

A company is designing a multi-account AWS environment using AWS Organizations. They need to centralize VPC flow logs and network traffic inspection across all accounts. Which architecture meets these requirements with minimal operational overhead?

Accepted Answer

Deploy a central inspection VPC with AWS Network Firewall and use Transit Gateway to route traffic from all VPCs through it.. It uses a central inspection VPC with AWS Network Firewall and Transit Gateway to route traffic from all VPCs through a single inspection point. This architecture centralizes both VPC flow logs and traffic inspection with minimal operational overhead, as Transit Gateway simplifies network connectivity and AWS Network Firewall provides managed, scalable inspection without per-account firewall management.

Answer

Use AWS Network Firewall in each VPC and aggregate logs centrally.

Answer

Enable VPC flow logs in each account and send them to a central S3 bucket. Use Network Access Analyzer for inspection.

Answer

Create VPC peering connections between all VPCs and deploy a third-party firewall in one VPC.

Question 5

A company has multiple VPCs connected via a Transit Gateway. The security team wants to centrally inspect all traffic between VPCs using a third-party firewall appliance. The appliance must be deployed in a single VPC and all inter-VPC traffic must be routed through it. Which architecture should be used?

Accepted Answer

Configure the Transit Gateway with a central inspection VPC that hosts the firewall appliance. A Transit Gateway supports centralised inspection by attaching a dedicated inspection VPC that hosts the third‑party firewall appliance. By adjusting the Transit Gateway route tables, all inter‑VPC traffic can be forced through the inspection VPC using static routes or a default route pointing to the firewall’s elastic network interface, enabling full traffic inspection without modifying individual VPC route tables.

Answer

Create a Network Load Balancer in each VPC and point to the firewall

Answer

Deploy AWS Network Firewall in each VPC

Answer

Use VPC peering connections between all VPCs and route traffic through the inspection VPC

Question 6

A company needs to ensure that all outbound traffic from a VPC goes through a centralized inspection appliance in a different VPC. Which TWO actions must be taken to achieve this?

Accepted Answer

Use AWS Transit Gateway with appropriate route tables to direct traffic to the inspection VPC.. Option D is correct because AWS Transit Gateway acts as a regional hub that connects multiple VPCs and, by associating VPC attachments with the appropriate TGW route tables, you can force all outbound traffic from spoke VPCs to route to the inspection VPC attachment rather than directly to an internet or NAT gateway. Option E is correct because the inspection VPC must actually forward the inspected traffic onward to its final destination—typically via a NAT gateway or internet gateway—after the appliance inspects it; otherwise traffic would be dropped and connectivity would fail. Option A is incorrect because VPC endpoints only provide private access to specific AWS services and do not centralize or inspect general outbound internet traffic. Option B is incorrect because AWS Direct Connect Gateway connects VPCs to on-premises networks over Direct Connect, not for steering VPC-to-VPC outbound traffic through an inspection VPC. Option C is incorrect because VPC peering creates direct one-to-one connectivity between VPCs and does not provide the centralized route-table control needed to force all traffic through a single inspection appliance.

Answer

Deploy VPC endpoints for all AWS services used.

Answer

Use AWS Direct Connect Gateway to route traffic between VPCs.

Answer

Create VPC peering connections between all VPCs.

Question 7

A company is designing a VPC with public and private subnets for a three-tier web application. The web tier must be accessible from the internet, the application tier must only be accessible from the web tier, and the database tier must only be accessible from the application tier. Which combination of route tables and security groups achieves this?

Accepted Answer

Public subnet route table: 0.0.0.0/0 -> Internet Gateway. Web SG: allow 0.0.0.0/0 on port 443. App SG: allow from Web SG. DB SG: allow from App SG.. It uses an Internet Gateway (IGW) in the public subnet route table to enable inbound internet traffic to the web tier, and security groups (SGs) are referenced by logical ID (Web SG, App SG, DB SG) to enforce strict, stateful traffic flow: Web SG allows HTTPS from 0.0.0.0/0, App SG allows traffic only from Web SG, and DB SG allows traffic only from App SG. This layered SG approach ensures that each tier can only be reached from the preceding tier, meeting the access requirements without relying on network ACLs or routing.

Answer

Public subnet route table: 0.0.0.0/0 -> NAT Gateway. Web SG: allow 0.0.0.0/0 on port 443. App SG: allow from Web SG. DB SG: allow from App SG.

Answer

Private subnet route table: 0.0.0.0/0 -> Internet Gateway. Web SG: allow 0.0.0.0/0 on port 443. App SG: allow from Web SG. DB SG: allow from App SG.

Answer

Public subnet route table: 0.0.0.0/0 -> Internet Gateway. Web SG: allow 0.0.0.0/0 on port 443. App SG: allow from Web SG. DB SG: allow from 0.0.0.0/0 on port 3306.

Question 8

A network engineer is troubleshooting connectivity to a VPC endpoint service. The engineer runs the CLI command shown in the exhibit. The output shows two service names. Which statement is correct based on this output?

Accepted Answer

The engineer can create an interface VPC endpoint to the services. The CLI command `aws ec2 describe-vpc-endpoint-services` returns a list of AWS services that support VPC endpoints. The output shows two service names, which are AWS-managed services (e.g., `com.amazonaws.vpce.us-east-1.s3`). These services can be accessed via interface VPC endpoints, which use Elastic Network Interfaces (ENIs) with private IP addresses to route traffic privately within the VPC. Therefore, the engineer can create an interface VPC endpoint to these services.

Answer

The services are Gateway VPC endpoints

Answer

The services are VPC peering connections

Answer

The services are Gateway Load Balancer endpoint services

Question 9

A company is designing a multi-region application with active-active configuration. They need a global DNS service that can route users to the nearest healthy endpoint and automatically failover to another region if an endpoint becomes unhealthy. Which AWS service should be used?

Accepted Answer

Amazon Route 53 with latency-based routing and health checks. Amazon Route 53 with latency-based routing and health checks is the correct choice because it provides global DNS resolution that directs users to the endpoint with the lowest latency, while health checks automatically detect endpoint failures and trigger failover to a healthy region. This satisfies the active-active multi-region requirement by distributing traffic across multiple regions and ensuring automatic failover without manual intervention.

Answer

Amazon CloudFront

Answer

Elastic Load Balancer

Answer

AWS Global Accelerator

Question 10

A company is deploying a multi-region application using two AWS Regions. They want to use an AWS Transit Gateway to interconnect VPCs within each region, and they need to interconnect the Transit Gateways across regions. Which is the most scalable and reliable approach?

Accepted Answer

Use Transit Gateway peering attachments between the Transit Gateways in each region.. AWS Transit Gateway supports inter-region peering, which is the recommended method for connecting Transit Gateways across regions. Option A is correct. Option B is incorrect because VPC peering does not natively interconnect Transit Gateways. Option C is incorrect because using AWS Site-to-Site VPN connections adds complexity, reduces bandwidth, and is less reliable compared to Transit Gateway peering. Option D is incorrect because a Direct Connect gateway is designed for connecting on-premises networks to AWS, not for interconnecting Transit Gateways across regions.

Answer

Create a VPC peering connection between VPCs in different regions and attach them to the Transit Gateways.

Answer

Use AWS Site-to-Site VPN connections between the Transit Gateways in each region.

Answer

Set up a Direct Connect gateway with virtual interfaces in each region and propagate routes.

Question 11

A company uses AWS Transit Gateway to connect multiple VPCs and an on-premises network via Direct Connect. The on-premises network can reach some VPCs but not others. All VPCs are attached to the same Transit Gateway. What should the engineer check first?

Accepted Answer

The Transit Gateway route tables and associations.. With AWS Transit Gateway, reachability between attachments is controlled by Transit Gateway route tables and their associations and propagations. If some VPCs are reachable and others are not, the most likely cause is that the unreachable VPCs are associated with a different TGW route table or their routes are not propagated into the route table used by the on-premises attachment.

Answer

The VPC flow logs for the unreachable VPCs.

Answer

The Direct Connect virtual interface status.

Answer

The BGP session between the on-premises router and the Direct Connect router.

Question 12

A company has multiple VPCs in the same AWS region that need to communicate with each other. The network team wants to minimize the number of connections and simplify management. The solution must support transitive routing between all VPCs. Which AWS service should be used?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway (TGW) is a network transit hub that enables transitive routing between multiple VPCs and on-premises networks through a single gateway. It uses a hub-and-spoke architecture, which inherently supports transitive routing (e.g., VPC A can reach VPC C via the TGW without requiring direct peering between A and C). This minimizes the number of connections (N VPCs require only N attachments instead of N*(N-1)/2 VPC peering connections) and simplifies management with a central routing table.

Answer

VPC Peering

Answer

AWS Direct Connect Gateway

Answer

VPC Endpoints

Question 13

A network engineer is troubleshooting intermittent connectivity issues between an on-premises data center and AWS over a Direct Connect connection. The issue occurs only during peak business hours. CloudWatch metrics show increased latency and packet loss at the Direct Connect virtual interface. What is the MOST likely cause?

Accepted Answer

Insufficient bandwidth on the Direct Connect connection. The intermittent nature of the issue, occurring only during peak business hours, combined with increased latency and packet loss at the Direct Connect virtual interface, strongly points to bandwidth saturation. Direct Connect connections have a fixed capacity (e.g., 1 Gbps, 10 Gbps), and when traffic exceeds that capacity during peak periods, packets are dropped, causing retransmissions and increased latency. This is a classic symptom of insufficient bandwidth, not a configuration error or routing issue.

Answer

VPN tunnel misconfiguration over Direct Connect

Answer

Asymmetric routing between on-premises and AWS

Answer

BGP peering session flapping

Question 14

A company has a global application deployed across multiple AWS Regions. The application uses Amazon Route 53 latency-based routing. The network team wants to monitor the health of the application endpoints. They configure Route 53 health checks with fast interval (10 seconds) for each endpoint. After a few days, they notice an increase in costs. Which change will reduce costs while maintaining adequate health monitoring?

Accepted Answer

Change the health check interval to standard (30 seconds).. Route 53 health checks with fast interval (10 seconds) cost more than standard interval (30 seconds). Changing to standard interval reduces cost while still providing adequate monitoring for most applications. Standard interval is the default and is sufficient unless sub-30-second failover is required.

Answer

Disable health checks and rely on Route 53 latency measurements.

Answer

Use CloudWatch alarms instead of Route 53 health checks.

Answer

Remove health checks for endpoints that are in the same Region.

Question 15

A company has a Direct Connect connection with a private virtual interface (VIF) attached to a Virtual Private Gateway (VGW) that is associated with a single VPC (10.0.0.0/16). The on-premises network uses BGP to exchange routes. The company has recently acquired another company and needs to connect to their VPC (172.16.0.0/16) in the same region. They want to use the existing Direct Connect connection to access both VPCs. The network engineer creates a Transit Gateway, attaches both VPCs, and creates a transit virtual interface (VIF) to the Transit Gateway. The engineer also deletes the private VIF. However, after the change, on-premises users cannot reach either VPC. What should the engineer do to restore connectivity?

Accepted Answer

Configure BGP on the on-premises router to peer with the Transit Gateway over the transit VIF.. When you migrate from a private VIF to a transit VIF, the BGP peering session that previously existed between the on-premises router and the VGW is torn down. The transit VIF terminates on the Transit Gateway, so the on-premises router must establish a new BGP session with the Transit Gateway's BGP peer IP (from the transit VIF's /30 or /29 address range) using the customer-side IP as the neighbor. Without reconfiguring BGP on the on-premises router to peer with the TGW, no routes are exchanged and both VPCs become unreachable.

Answer

Attach the VPCs to the Transit Gateway with different route tables.

Answer

Create a new private VIF to each VPC.

Answer

Enable route propagation on the Transit Gateway route tables.