ANS-C01 Practice Test 13 — 15 Questions

Question 1

An organization has multiple VPCs connected to a common Transit Gateway. The network team wants to centrally manage and enforce routing policies, such as allowing or denying traffic between specific VPCs based on tags. Which AWS feature should be used to implement this requirement?

Accepted Answer

AWS Transit Gateway Network Manager. AWS Transit Gateway Network Manager provides a central dashboard to manage and monitor transit gateways, on-premises networks, and attached VPCs. It supports defining and enforcing routing policies based on tags, enabling the network team to centrally allow or deny traffic between specific VPCs without manually managing individual route tables.

Answer

AWS Direct Connect Gateway

Answer

Amazon Route 53 Resolver

Answer

VPC Peering with route tables

Question 2

A company has a VPC with a CIDR block of 10.0.0.0/16. They have two subnets: a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). The public subnet has an internet gateway attached, and the private subnet has a NAT Gateway in the public subnet for outbound internet access. The company is deploying an Amazon RDS for MySQL database in a Multi-AZ configuration. The database should be accessible only from the application servers running in the private subnet. The company wants to ensure that the database is highly available and that failover does not require any changes to the application. Which networking configuration should they use?

Accepted Answer

Create a DB subnet group with subnets in two Availability Zones, launch the RDS instance with Multi-AZ enabled, and configure the application to connect to the RDS endpoint DNS name. Option D is correct because creating a DB subnet group with subnets in two Availability Zones and enabling Multi-AZ on the RDS instance ensures automatic failover to a standby in another AZ. The application connects to the RDS endpoint DNS name, which automatically points to the current primary instance, so no application changes are needed during failover. This satisfies the high availability and access requirements while keeping the database in private subnets.

Answer

Place the RDS instances behind an internal Network Load Balancer and configure the application to connect to the NLB's DNS name

Answer

Create the RDS instance in the public subnet and restrict access using a security group that allows traffic from the private subnet

Answer

Configure the application to use the IP address of the primary RDS instance and update the application when failover occurs

Question 3

A company is designing a hybrid network connecting on-premises data centers to AWS via AWS Direct Connect. The company requires high availability with multiple connections. Which design ensures that a failure of a single Direct Connect location does not impact connectivity?

Accepted Answer

Provision two Direct Connect connections at two different Direct Connect locations.. Option B is correct because deploying two Direct Connect connections at two different Direct Connect locations ensures that a single location failure (e.g., power outage, fiber cut, or facility issue) does not affect connectivity. This design provides geographic redundancy, meeting the high availability requirement by eliminating a single point of failure at the Direct Connect location level.

Answer

Provision a single Direct Connect connection with a large bandwidth.

Answer

Provision two Direct Connect connections at the same AWS Direct Connect location.

Answer

Provision one Direct Connect connection and one AWS Site-to-Site VPN as backup.

Question 4

A company has an existing VPC with a public subnet and a private subnet. The company launches an EC2 instance in the private subnet. The instance needs to access an S3 bucket to download software updates. The company does not want the instance to have a public IP address. The company creates a VPC endpoint for S3 (Gateway type) in the VPC, and associates it with the private subnet route table by adding a route for the S3 prefix list. However, the instance still cannot access the S3 bucket. The security group for the instance allows all outbound traffic. The network ACL for the private subnet allows all inbound and outbound traffic. What is the MOST likely reason for the connectivity failure?

Accepted Answer

The VPC endpoint policy does not grant access to the S3 bucket. The most likely reason is that the VPC endpoint policy does not grant access to the S3 bucket. Even though the Gateway VPC Endpoint is created and associated with the private subnet route table, the endpoint's policy controls which S3 buckets and actions are allowed. If the policy is too restrictive (e.g., default deny or does not explicitly allow access to the specific bucket), traffic will be dropped at the endpoint, preventing the instance from downloading updates. The security group and network ACL are already permissive, and internet access is not required because the Gateway endpoint uses AWS's private network.

Answer

The network ACL is blocking the traffic

Answer

The security group does not allow outbound HTTPS traffic

Answer

The instance does not have a route to the internet

Question 5

A company is designing a network for a containerized microservices application running on Amazon ECS. The application consists of several microservices that need to communicate with each other. The company wants to use service discovery so that services can find each other by name. They also want to ensure that traffic between services is encrypted in transit. The microservices are deployed across multiple Availability Zones. Which combination of services should the company use?

Accepted Answer

Use AWS Cloud Map for service discovery and AWS App Mesh for encryption in transit. AWS Cloud Map provides service discovery by registering microservices with DNS names and health checks, allowing ECS tasks to resolve each other by name. AWS App Mesh uses Envoy sidecar proxies to enforce mutual TLS (mTLS) encryption between services, ensuring traffic is encrypted in transit without requiring changes to application code. This combination meets the requirements for name-based discovery and encrypted inter-service communication across multiple Availability Zones.

Answer

Use an Application Load Balancer for each service and configure HTTPS listeners

Answer

Use VPC peering between each service's VPC

Answer

Use Amazon Route 53 private hosted zones for service discovery and enable encryption at the application layer

Question 6

A company has multiple VPCs in the same AWS region that need to communicate with each other. The network team wants to minimize the number of connections and simplify management. The solution must support transitive routing between all VPCs. Which AWS service should be used?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway (TGW) is a network transit hub that enables transitive routing between multiple VPCs and on-premises networks through a single gateway. It uses a hub-and-spoke architecture, which inherently supports transitive routing (e.g., VPC A can reach VPC C via the TGW without requiring direct peering between A and C). This minimizes the number of connections (N VPCs require only N attachments instead of N*(N-1)/2 VPC peering connections) and simplifies management with a central routing table.

Answer

VPC Peering

Answer

AWS Direct Connect Gateway

Answer

VPC Endpoints

Question 7

A company has a VPC with a CIDR block of 172.16.0.0/16. They have a public subnet (172.16.1.0/24) and a private subnet (172.16.2.0/24). They have an internet gateway attached to the public subnet. They launch an EC2 instance in the public subnet with a public IP address. The instance is running a web server on port 80. They also launch an EC2 instance in the private subnet that needs to download updates from the internet. The private subnet does not have a route to the internet. The company wants to provide internet access to the private instance in a secure and cost-effective manner. Which solution should they implement?

Accepted Answer

Create a NAT Gateway in the public subnet and add a route in the private subnet's route table pointing to the NAT Gateway. A NAT Gateway in the public subnet allows instances in the private subnet to initiate outbound connections to the internet (e.g., for downloading updates) while preventing inbound connections from the internet. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway. This is secure because the NAT Gateway uses Elastic IPs and does not accept unsolicited inbound traffic, and it is cost-effective as it is a managed service with no maintenance overhead.

Answer

Create a VPC Gateway Endpoint for S3 and configure the private instance to use it

Answer

Create a forward proxy server in the public subnet and configure the private instance to use it

Answer

Create a NAT instance in the public subnet and configure the private instance to use it

Question 8

A company is designing a hybrid network with AWS Direct Connect and a VPN backup. They have two on-premises sites connected via MPLS. They want to ensure that if the Direct Connect fails, traffic automatically fails over to the VPN without manual intervention. Which routing configuration should they use?

Accepted Answer

Use BGP and set a higher local preference for routes learned via Direct Connect, and enable BGP graceful shutdown on the Direct Connect router. Option B is correct because using BGP with a higher local preference for routes learned via Direct Connect ensures that the Direct Connect path is preferred over the VPN backup. If the Direct Connect fails, the BGP session goes down, the routes are withdrawn, and traffic automatically fails over to the VPN without manual intervention. BGP graceful shutdown is not required for failover but can be used to gracefully drain traffic before maintenance.

Answer

Configure static routes with equal cost pointing to Direct Connect and VPN

Answer

Use BGP and advertise the same prefixes with a lower MED on the VPN connection

Answer

Create a VPC peering connection between the VPC and on-premises network

Question 9

A company has multiple VPCs connected via a Transit Gateway. Each VPC has its own CIDR block. The company wants to isolate network traffic between specific VPCs. What is the most scalable way to achieve this?

Accepted Answer

Create separate Transit Gateway route tables and associate VPC attachments to the appropriate route tables.. Option C is correct. Transit Gateway supports route tables that can be used to control which VPCs can communicate. By creating separate route tables and associating them with the appropriate attachments, you can isolate traffic without complex routing. Option A is wrong because VPC Peering requires many connections and manual routing; it is not scalable. Option B is wrong because Security Groups cannot filter traffic between VPCs. Option D is wrong because AWS Network Firewall is not the most scalable solution for simple isolation.

Answer

Deploy AWS Network Firewall in each VPC.

Answer

Use Security Groups in each VPC to filter traffic.

Answer

Use VPC Peering connections and modify route tables.

Question 10

A company is designing a network architecture for a multi-tier web application. The application consists of web servers, application servers, and database servers. The web servers must be accessible from the internet. The application servers should only be accessible from the web servers. The database servers should only be accessible from the application servers. Which TWO actions should the company take to meet these requirements? (Choose two.)

Accepted Answer

Place the web servers in a public subnet and the application and database servers in private subnets. Options B and D are correct. Option B: Placing web servers in a public subnet with internet gateway allows internet access. Option D: Using security groups to restrict traffic between tiers is a best practice. Option A is wrong because placing all servers in public subnets exposes them. Option C is wrong because NACLs are stateless and less granular; security groups are preferred for stateful filtering. Option E is wrong because NAT gateway is for outbound traffic, not inbound.

Answer

Use a NAT gateway to allow the web servers to access the internet

Answer

Use network ACLs to restrict traffic between the tiers

Answer

Place all servers in public subnets and use security groups to restrict traffic

Question 11

A company is designing a Direct Connect solution for high availability. Which TWO actions meet the requirement for diverse physical paths?

Accepted Answer

Provision two Direct Connect connections at two different Direct Connect locations.. Option B is correct because provisioning two Direct Connect connections at two different Direct Connect locations ensures that the physical paths are geographically diverse, eliminating a single point of failure. Option C is correct because using a Transit Gateway with attachments to multiple Direct Connect gateways allows traffic to be routed over separate connections, providing path diversity even if the connections are at the same location, as long as they are associated with different gateways and virtual interfaces.

Answer

Provision two Direct Connect connections at the same Direct Connect location.

Answer

Provision a single Direct Connect connection and use link aggregation (LAG).

Answer

Use a single Direct Connect connection with a VPN backup.

Question 12

A company has a VPC with a CIDR block of 192.168.0.0/16. They have two subnets: Subnet A (192.168.1.0/24) and Subnet B (192.168.2.0/24). They launch an EC2 instance in Subnet A and another EC2 instance in Subnet B. They want to ensure that both instances can communicate with each other. The instances are in the same VPC. What is the simplest way to enable communication between these instances?

Accepted Answer

No additional configuration is needed; instances in the same VPC can communicate by default. By default, all instances within the same VPC can communicate with each other using private IP addresses, regardless of which subnet they reside in. The VPC's implicit router enables this layer-3 connectivity as long as the subnets' route tables do not explicitly block traffic and the instances' security groups or network ACLs permit the traffic. Since both subnets are within the same VPC (192.168.0.0/16), no additional configuration is required for basic IP-level communication.

Answer

Create a VPC Peering connection between Subnet A and Subnet B

Answer

Create a NAT Gateway in each subnet

Answer

Attach an internet gateway to the VPC

Question 13

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to an on-premises network with CIDR 10.0.0.0/8. The company wants to use AWS Site-to-Site VPN. What configuration change is required to avoid routing conflicts?

Accepted Answer

Change the VPC CIDR to a non-overlapping range, such as 172.16.0.0/16.. The VPC CIDR 10.0.0.0/16 is a subset of the on-premises CIDR 10.0.0.0/8. AWS Site-to-Site VPN cannot route traffic correctly when the VPC and on-premises networks have overlapping IP ranges because the VPN connection relies on distinct destination prefixes. The only way to eliminate the conflict is to change the VPC CIDR to a non-overlapping range, such as 172.16.0.0/16, ensuring no IP address overlap between the two networks.

Answer

Create a more specific route in the VPC route table for the on-premises CIDR.

Answer

Enable route propagation on the VPC route tables.

Answer

Use a VPN connection with static routes instead of BGP.

Question 14

A company has a VPC with a CIDR block of 172.16.0.0/16. They have two subnets: 172.16.1.0/24 (public) and 172.16.2.0/24 (private). They launch an EC2 instance in the private subnet and an Application Load Balancer (ALB) in the public subnet. The ALB needs to forward traffic to the EC2 instance on port 80. The security group for the EC2 instance allows inbound traffic on port 80 from the security group of the ALB. The ALB health checks are failing. What is the most likely cause?

Accepted Answer

The security group for the EC2 instance does not allow inbound traffic from the ALB's security group. Option D is correct because the EC2 instance's security group must have an inbound rule allowing traffic from the ALB's security group. If this rule is missing or misconfigured, the ALB's health check requests (which originate from the ALB's private IP addresses) will be blocked, causing health checks to fail. The scenario states the rule 'allows inbound traffic on port 80 from the security group of the ALB,' but if the rule is not properly associated or the ALB's security group ID is incorrect, traffic will be denied.

Answer

The ALB cannot route traffic to a private subnet

Answer

The private subnet does not have a route to a NAT gateway

Answer

The ALB is in a different VPC than the EC2 instance

Question 15

A company is designing a network for a critical application that requires low latency and high throughput between EC2 instances in the same AWS Region. Which network design should the company use?

Accepted Answer

Launch the instances in a Cluster Placement Group.. A Cluster Placement Group is the correct choice because it provides the lowest possible latency and highest throughput between EC2 instances by placing them in a single Availability Zone with non-blocking, high-bandwidth networking. This design is ideal for tightly coupled, high-performance computing (HPC) or latency-sensitive applications that require consistent, low-latency communication within the same AWS Region.

Answer

Launch the instances in a Spread Placement Group.

Answer

Launch the instances as larger instance types with enhanced networking.

Answer

Launch the instances in different Availability Zones.