ANS-C01 Practice Test 14 — 15 Questions

Question 1

A solutions architect needs to design a VPC with both IPv4 and IPv6 support. The VPC will have public and private subnets. Resources in private subnets need outbound IPv6 access to the internet. Which combination of resources should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Internet gateway for public subnets and egress-only internet gateway for private subnets. An egress-only internet gateway (EIGW) is the AWS-managed service designed specifically to provide outbound-only IPv6 access from private subnets to the internet, while an internet gateway (IGW) handles both inbound and outbound IPv4/IPv6 traffic for public subnets. Unlike a NAT gateway, which only supports IPv4, the EIGW works with IPv6 and prevents any inbound IPv6 connections from the internet, meeting the requirement for outbound-only IPv6 access.

Answer

Internet gateway for public subnets and VPC gateway endpoints for private subnets

Answer

Internet gateway for public subnets and NAT gateway for private subnets

Answer

Internet gateway for both public and private subnets using route tables

Question 2

A company is using Amazon S3 to store sensitive data. The security team wants to ensure that all data is encrypted at rest. Which S3 bucket property should be enabled?

Accepted Answer

Default encryption. Default encryption on an S3 bucket automatically encrypts all objects at rest using either SSE-S3 (AES-256) or SSE-KMS, without requiring the uploader to specify encryption headers. This directly satisfies the requirement that all data be encrypted at rest. Since it applies at the bucket level, any object PUT into the bucket is encrypted by default, ensuring consistent enforcement.

Answer

Versioning

Answer

MFA Delete

Answer

Server access logging

Question 3

Which TWO statements about AWS Transit Gateway are correct? (Choose two.)

Accepted Answer

It supports transitive routing between attached VPCs. Option B is correct because AWS Transit Gateway acts as a regional hub that supports transitive routing, meaning a VPC attached to the transit gateway can reach other attached VPCs without needing a full mesh of VPC peering connections. Option C is correct because Transit Gateway supports cross-account sharing through AWS Resource Access Manager (RAM), allowing an owner account to share a transit gateway with other accounts or an AWS Organization. Option A is not correct because a Transit Gateway does not itself provide internet access; internet egress requires an attached VPC with an internet gateway or a NAT gateway, or a separate egress VPC architecture. Option D is not correct because Direct Connect is a dedicated physical network connection to AWS, while Transit Gateway is a routing hub that can attach to Direct Connect gateways but does not replace the Direct Connect service. Option E is not correct because Transit Gateway supports multiple attachment types, including VPC attachments, VPN attachments, Direct Connect gateway attachments, and peering attachments, not only VPN attachments.

Answer

It provides internet access for attached VPCs

Answer

It can replace AWS Direct Connect for on-premises connectivity

Answer

It only supports VPN attachments

Question 4

A company is setting up a VPC with both public and private subnets. The private subnets need outbound internet access for software updates. Which component is required to enable this?

Accepted Answer

A NAT gateway in a public subnet.. A NAT gateway in a public subnet is required to enable outbound internet access for private subnets. The NAT gateway resides in a public subnet with an Internet Gateway (IGW) route, and private subnet route tables direct default traffic (0.0.0.0/0) to the NAT gateway's elastic network interface. This allows instances in private subnets to initiate outbound connections (e.g., for software updates) while preventing unsolicited inbound traffic from the internet.

Answer

A VPN connection to an on-premises network that has internet access.

Answer

A VPC peering connection to a VPC that has internet access.

Answer

An internet gateway attached to the VPC with a route in the private subnet's route table pointing to the internet gateway.

Question 5

A company is planning to connect multiple VPCs in different AWS accounts using AWS Transit Gateway. The VPCs must be able to communicate with each other, but the company wants to centralize egress traffic to the internet through a single VPC that has a NAT gateway. Which configuration meets these requirements?

Accepted Answer

Attach all VPCs to a Transit Gateway, create a central egress VPC with a NAT gateway, and configure Transit Gateway route tables to send default traffic to the central VPC.. AWS Transit Gateway allows you to attach multiple VPCs from different accounts and centrally manage routing. By configuring the Transit Gateway route tables to send default traffic (0.0.0.0/0) to a central egress VPC that contains a NAT gateway, all other VPCs can route internet-bound traffic through that single NAT gateway, centralizing egress while maintaining inter-VPC communication.

Answer

Use AWS Site-to-Site VPN to connect the VPCs and route traffic through a central VPN endpoint.

Answer

Use VPC peering to connect all VPCs and configure a NAT gateway in one VPC.

Answer

Attach each VPC to a Transit Gateway and configure a NAT gateway in each VPC.

Question 6

A company has an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The ALB is configured with a target group that has a health check path of /health. Some instances are failing health checks and being marked unhealthy, but the application logs show the instances are healthy. What is the most likely cause?

Accepted Answer

The security group for the instances does not allow inbound traffic from the ALB's security group on the health check port. The most likely cause is that the security group for the EC2 instances does not allow inbound traffic from the ALB's security group on the health check port. ALB health checks originate from the ALB's private IP addresses, and if the instance security group lacks an inbound rule permitting traffic from the ALB's security group (or its CIDR) on the health check port, the health check requests are dropped, causing the target to be marked unhealthy even though the application itself is running fine.

Answer

The health check path is incorrect

Answer

The target group's slow start duration is too long

Answer

The ALB's stickiness is preventing health checks

Question 7

A company uses AWS Network Firewall to inspect traffic between VPCs in a transit gateway setup. They have a rule group that allows HTTP and HTTPS traffic to a web server in a production VPC. Recently, the security team added a new Suricata IPS rule to block traffic from a specific IP address. After deploying the updated rule group, they notice that all traffic to the web server is being dropped, even from allowed IPs. The firewall logs show the new rule is triggering for all traffic, not just the specific IP. What is the most likely cause?

Accepted Answer

The new rule is placed before the allow rules in the rule group, and due to the order of evaluation, the drop rule matches first and drops all traffic because the rule's source IP is set to 'any' instead of the specific IP.. AWS Network Firewall evaluates rules in a rule group in order, and a Suricata rule with action 'drop' and source 'any' will match all traffic before the allow rules are reached. If the new rule was inserted above the allow rules and its source was mistakenly set to 'any' instead of the specific IP, every packet to the web server matches the drop rule and is discarded. The fix is to correct the source IP and/or reorder the rule below the allow rules.

Answer

The web server's security group is blocking traffic from the firewall's IP range after the firewall adds its source IP.

Answer

The new Suricata rule uses the 'drop' action instead of 'reject', causing all packets to be dropped.

Answer

The rule group is attached to the firewall policy in the wrong direction (e.g., outbound instead of inbound).

Question 8

A company has an AWS Site-to-Site VPN connection between their on-premises network and a VPC. The VPN tunnel status shows 'UP'. However, instances in the VPC cannot ping an on-premises server at 192.168.1.10. Which step should be taken to troubleshoot?

Accepted Answer

Verify that the VPC route table has a route to the on-premises network via the virtual private gateway. Even though the VPN tunnel is 'UP', traffic from the VPC to the on-premises network must be routed through the virtual private gateway (VGW). If the VPC route table does not contain a route for the on-premises CIDR (e.g., 192.168.1.0/24) pointing to the VGW, the instances have no path to reach the on-premises server, regardless of tunnel status.

Answer

Verify that the internet gateway is attached to the VPC

Answer

Verify that the security group for the instances allows outbound ICMP

Answer

Verify that the VPN tunnel is up on both ends

Question 9

A company is using AWS Secrets Manager to store database credentials. They want to ensure that the credentials are automatically rotated every 30 days. Which configuration is required?

Accepted Answer

Enable automatic rotation in the secret configuration and provide a Lambda rotation function.. AWS Secrets Manager provides built-in automatic rotation using a Lambda function. Option B is incorrect because AWS Systems Manager Parameter Store does not support automatic rotation of secrets; it is designed for configuration management. Option C is incorrect because AWS CloudHSM is a hardware security module for storing cryptographic keys, not for automating credential rotation. Option D is incorrect because IAM Access Analyzer analyzes resource policies to identify unintended access, not to rotate credentials.

Answer

Store the secret in AWS Systems Manager Parameter Store and configure a rotation schedule.

Answer

Store the secret in AWS CloudHSM and use a scheduled Lambda to rotate.

Answer

Use IAM Access Analyzer to rotate the credentials periodically.

Question 10

A company has an AWS Transit Gateway with multiple VPC attachments. They need to inspect traffic between VPCs using a third-party firewall appliance. What is the best approach?

Accepted Answer

Create a firewall VPC with the appliance and use Transit Gateway route tables to direct traffic through it. The best approach is to create a dedicated firewall VPC that hosts the third-party firewall appliance and use Transit Gateway (TGW) route tables to steer inter-VPC traffic through that VPC. By attaching the firewall VPC to the TGW and configuring route tables with static routes pointing to the firewall VPC attachment, all traffic between other VPCs can be forced to traverse the firewall for inspection. This provides centralized, scalable traffic inspection without requiring changes to individual VPC routing or security group configurations.

Answer

Use VPC security groups across VPCs

Answer

Use AWS Network Firewall directly in each VPC

Answer

Use network ACLs on each VPC subnet

Question 11

A company runs a web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB) across multiple Availability Zones. The application uses a MySQL database on an RDS instance in a private subnet. Security compliance requires that all traffic between the ALB and EC2 instances must be encrypted. The security team finds that the ALB currently sends traffic to the EC2 instances using HTTP on port 80. The EC2 security group allows inbound HTTP traffic from the ALB security group. The team needs to implement encryption with minimal changes and without disrupting the application. Which solution meets these requirements?

Accepted Answer

Modify the ALB listener to use HTTPS on port 443. Create a new target group with protocol HTTPS on port 443. Install a valid SSL/TLS certificate on each EC2 instance. Update the EC2 security group to allow inbound HTTPS from the ALB security group.. It directly modifies the existing ALB to use an HTTPS listener on port 443, creates a new target group with HTTPS on port 443, and requires installing a valid SSL/TLS certificate on each EC2 instance. This ensures all traffic between the ALB and EC2 instances is encrypted with TLS, meeting the security requirement with minimal changes and no disruption to the application. The EC2 security group update to allow inbound HTTPS from the ALB security group completes the configuration.

Answer

Set up an AWS Client VPN endpoint and have the ALB send traffic through the VPN to the EC2 instances.

Answer

Deploy an internal ALB in front of the EC2 instances and configure it with an HTTPS listener. Route traffic from the public ALB to the internal ALB.

Answer

Replace the ALB with a Network Load Balancer (NLB) and use TLS listeners to the EC2 instances.

Question 12

A company needs to ensure that all API calls to AWS services are logged and monitored for suspicious activity. Additionally, any API call that creates a security group rule should trigger an immediate notification. Which combination of services should be used?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Events. AWS CloudTrail records all API calls made to AWS services, including those that create or modify security group rules. Amazon CloudWatch Events (now Amazon EventBridge) can match specific API events, such as AuthorizeSecurityGroupIngress, and trigger immediate notifications via SNS or Lambda. Together, they provide comprehensive logging and real-time alerting for suspicious activity.

Answer

VPC Flow Logs and Amazon CloudWatch

Answer

AWS Config and Amazon SNS

Answer

AWS Shield and AWS WAF

Question 13

A company is deploying a web application in a VPC and wants to protect it from common web exploits like cross-site scripting (XSS). Which AWS service should be used to filter and monitor HTTP requests?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that inspects HTTP/HTTPS requests at Layer 7 and can block or monitor common web exploits such as XSS and SQL injection using managed or custom rules. It integrates with ALB, CloudFront, API Gateway, and AppSync, making it the correct tool for filtering and monitoring HTTP traffic. Security groups and NACLs operate at Layers 3/4 and cannot inspect HTTP payloads, and Shield Advanced only mitigates DDoS attacks.

Answer

Security Group

Answer

Network ACL

Answer

AWS Shield Advanced

Question 14

A company is deploying a web application that will be accessed over the internet. They want to use an Application Load Balancer (ALB) to distribute traffic across EC2 instances in multiple Availability Zones. Which TWO configurations are required to make the ALB internet-facing? (Choose TWO.)

Accepted Answer

Associate the ALB with public subnets that have a route to an Internet Gateway.. Option E is correct because when you create an ALB you must explicitly set the Scheme to 'internet-facing' (as opposed to 'internal'); this makes the load balancer's nodes publicly resolvable and reachable from the internet. Option D is correct because an internet-facing ALB must be associated with public subnets, and those subnets require a route in their route table pointing to an Internet Gateway (0.0.0.0/0 → igw-xxxxxxxx) so that traffic can flow to and from the internet. Option A is not required: a security group allowing 0.0.0.0/0 is a common practice for the ALB's listener ports, but it is not a configuration requirement for making the ALB internet-facing, and the question asks for required configurations. Option B is incorrect because Elastic IP addresses are not assigned to ALBs; AWS automatically provides public IPs to internet-facing ALB nodes. Option C is incorrect because associating the ALB only with private subnets would make it internal, not internet-facing.

Answer

Configure a security group that allows inbound traffic from 0.0.0.0/0.

Answer

Assign an Elastic IP address to the ALB.

Answer

Associate the ALB with private subnets only.

Question 15

A company is migrating its on-premises data center to AWS using Direct Connect and a VPN connection as backup. The company has multiple VPCs connected via a Transit Gateway. They want to ensure high availability for the Direct Connect connection. Which TWO actions should be taken? (Choose TWO.)

Accepted Answer

Configure BGP with multiple virtual interfaces on the Direct Connect connections. Option E is correct because provisioning a second Direct Connect connection at a different Direct Connect location provides physical path diversity, so a failure at one location or its provider equipment does not take down all dedicated connectivity. Option D is correct because configuring BGP with multiple virtual interfaces (for example, a private VIF on each connection) enables dynamic routing and failover between the redundant Direct Connect links, allowing traffic to shift automatically when one path degrades. Together, a second connection at a different location plus BGP on multiple VIFs delivers the high availability the company requires for its Direct Connect connection. Option A is not appropriate because replacing the VPN backup with a second Direct Connect connection removes the diverse VPN backup path rather than adding Direct Connect redundancy. Option B is unrelated to availability, since jumbo frames only affect MTU and packet efficiency, not resiliency. Option C is incorrect because a single higher-bandwidth connection remains a single point of failure and does not provide high availability.

Answer

Replace the VPN backup with a second Direct Connect connection

Answer

Enable jumbo frames on the Direct Connect connection

Answer

Use a single Direct Connect connection but with higher bandwidth