ANS-C01 Practice Test 15 — 15 Questions

Question 1

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Direct Connect. The network team wants to monitor BGP session status for all Transit Gateway attachments. Which AWS service should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Transit Gateway Network Manager. AWS Transit Gateway Network Manager is the purpose-built service for monitoring and managing Transit Gateway attachments, including BGP session status, tunnel status, and on-premises connectivity via Direct Connect and VPN. It provides a global view of the network topology and surfaces BGP peering state for each attachment. CloudWatch metrics and VPC Flow Logs do not expose BGP session state, and AWS Config tracks resource configuration changes rather than live routing protocol status.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon CloudWatch with Transit Gateway metrics

Question 2

A network engineer is reviewing VPC Flow Logs for a VPC. The logs show that traffic from 10.0.1.5 to 10.0.2.10 on port 443 is being accepted and rejected intermittently. Both instances are in the same VPC. What is the most likely cause?

Accepted Answer

The network ACL is blocking traffic.. VPC Flow Logs show intermittent ACCEPT and REJECT for traffic from 10.0.1.5 to 10.0.2.10 on port 443. Since the traffic is within the same VPC, the route table is not involved (Option C is unlikely). Security groups are stateful, so even if the destination security group denies outbound traffic, return traffic for the established inbound connection is still allowed; thus Option A is incorrect. The intermittent behavior is characteristic of a stateless network ACL (NACL). A NACL is applied at the subnet level and evaluates inbound and outbound rules independently. If the NACL allows inbound traffic but blocks outbound response traffic (or vice versa), the flow will be partially accepted (initial packets) and then rejected when return packets hit the blocking rule. This matches the logs showing both ACCEPT and REJECT for the same flow. Therefore, the most likely cause is a misconfigured NACL (Option B).

Answer

The security group on the destination instance is configured to allow inbound HTTPS but deny outbound traffic.

Answer

The route table is misconfigured.

Answer

The source instance's security group is denying outbound traffic.

Question 3

A company wants to connect its VPC to an on-premises data center using AWS Direct Connect. The company has two Direct Connect locations in the same AWS region. For high availability, they plan to establish two separate connections. Which configuration ensures that if one connection fails, traffic automatically fails over to the other?

Accepted Answer

Establish two Direct Connect connections from different Direct Connect locations to the same VPC, each with a private VIF attached to the same virtual private gateway.. It provides true high availability by using two Direct Connect connections from different geographic locations, each with a private virtual interface (VIF) attached to the same virtual private gateway (VGW). This configuration ensures that if one connection fails, BGP sessions automatically withdraw the affected routes, and traffic is rerouted over the remaining connection via the VGW's active/active or active/passive routing behavior.

Answer

Establish one Direct Connect connection and one AWS Site-to-Site VPN connection as backup.

Answer

Establish two Direct Connect connections from the same Direct Connect location to the same VPC.

Answer

Establish a single Direct Connect connection with two virtual interfaces (VIFs) to the same VPC.

Question 4

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Direct Connect. The network team wants to monitor BGP session status for all Transit Gateway attachments. Which AWS service should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the Transit Gateway route tables. When traffic from a specific VPC to on-premises is dropped while other VPCs can reach on-premises, the most likely cause is a misconfiguration in the Transit Gateway route tables. Transit Gateway route tables control which VPCs can route to which attachments (e.g., VPN, Direct Connect). The issue is isolated to one VPC, so checking the TGW route table for that VPC's attachment is the first step. Other options like on-premises firewall, security groups, or NACLs could be factors but are less likely given the specific VPC isolation.

Answer

Check the on-premises firewall rules

Answer

Check the VPC's security groups

Answer

Check the VPC's network ACLs

Question 5

A company has a VPC with a public subnet containing a NAT gateway and a private subnet containing Amazon EC2 instances. The instances in the private subnet need to download patches from the internet. The NAT gateway is in the public subnet and has an Elastic IP address. The private subnet's route table has a default route pointing to the NAT gateway. However, the instances cannot reach the internet. What is the MOST likely cause?

Accepted Answer

The public subnet's route table does not have a route to an internet gateway.. The NAT gateway resides in the public subnet, but for it to route traffic to the internet, the public subnet's route table must have a default route (0.0.0.0/0) pointing to an internet gateway (IGW). Without this route, the NAT gateway cannot forward traffic from the private subnet to the internet, even though the private subnet's route table correctly points to the NAT gateway. The missing IGW route in the public subnet breaks the outbound path.

Answer

The NAT gateway does not have a route back to the private subnet.

Answer

The NAT gateway is not associated with a security group that allows inbound internet traffic.

Answer

The security group attached to the EC2 instances does not allow outbound traffic to the internet.

Question 6

A company wants to allow a specific IP address range to access an EC2 instance in a private subnet using a bastion host. The bastion host is in a public subnet. Which security group configuration is correct?

Accepted Answer

Bastion security group: inbound SSH from the IP range. Private instance security group: inbound SSH from the bastion security group.. The bastion host in the public subnet must accept SSH from the specific external IP range, and the private instance must only accept SSH from the bastion's security group. This creates a two-hop chain where the private instance trusts the bastion as its source, not the original client IP. Referencing the bastion's security group as the source is the AWS-recommended pattern because it survives IP changes and enforces least privilege.

Answer

Bastion security group: inbound SSH from the private instance security group. Private instance security group: inbound SSH from the bastion security group.

Answer

Bastion security group: inbound SSH from the private instance security group. Private instance security group: inbound SSH from the IP range.

Answer

Bastion security group: inbound SSH from the IP range. Private instance security group: inbound SSH from the IP range.

Question 7

A company has deployed a web application on EC2 instances behind an Application Load Balancer (ALB). The application is experiencing intermittent timeouts. CloudWatch metrics show that the ALB's RequestCount is within normal limits, but TargetResponseTime occasionally spikes to 10 seconds. What is the most likely cause?

Accepted Answer

The EC2 instances are experiencing high CPU utilization during peak periods.. TargetResponseTime spikes to 10 seconds while RequestCount is normal point to the backend targets being slow, not the ALB itself. High CPU utilization on the EC2 instances during peak periods is the classic cause of increased processing time and intermittent timeouts.

Answer

The ALB is configured with an incorrect idle timeout value.

Answer

The ALB's cross-zone load balancing is disabled.

Answer

The security group for the EC2 instances is blocking traffic from the ALB.

Question 8

A company has a VPC with a CIDR of 10.0.0.0/16. They have two Availability Zones, each with a public and a private subnet. They want to connect their on-premises network (192.168.0.0/16) to the VPC using a site-to-site VPN. Which THREE resources are needed to establish the VPN connection? (Choose THREE.)

Accepted Answer

Customer Gateway. To build an AWS Site-to-Site VPN, you must create a Customer Gateway (A), which represents the on-premises VPN device and holds its public IP address and BGP ASN so AWS knows the remote endpoint. You also need a Virtual Private Gateway (E), the AWS-side VPN concentrator that attaches to the VPC and terminates the tunnels. Finally, the VPN Connection (C) is the actual resource that binds the Customer Gateway to the Virtual Private Gateway and provisions the two IPsec tunnels. AWS Direct Connect (B) is a dedicated private circuit, not an IPsec VPN over the internet, so it is not required here. AWS Transit Gateway (D) is a hub for connecting many VPCs and on-premises networks and is optional, not a prerequisite for a single VPC site-to-site VPN.

Answer

AWS Direct Connect

Answer

AWS Transit Gateway

Question 9

A company has a VPC with public and private subnets in three Availability Zones. They have an Application Load Balancer (ALB) in the public subnets and a fleet of EC2 instances in the private subnets. The ALB needs to send traffic to the instances on port 443. What is the most secure way to configure the security groups?

Accepted Answer

ALB SG: inbound from 0.0.0.0/0 on port 443. Instance SG: inbound from ALB SG on port 443.. It follows the principle of least privilege by restricting the ALB security group to only allow inbound traffic on port 443 from the internet (0.0.0.0/0) and the instance security group to only allow inbound traffic on port 443 from the ALB security group. This ensures that only the ALB can communicate with the instances on the required port, preventing direct access from other sources and reducing the attack surface.

Answer

ALB SG: inbound from 0.0.0.0/0 on all ports. Instance SG: inbound from ALB SG on all ports.

Answer

ALB SG: inbound from 0.0.0.0/0 on port 443. Instance SG: inbound from 0.0.0.0/0 on port 443.

Answer

ALB SG: inbound from 0.0.0.0/0 on port 443. Instance SG: inbound from ALB SG on all ports.

Question 10

A company has a Direct Connect connection and wants to use it for both private and public resources. Which TWO components are required to achieve this?

Accepted Answer

Public virtual interface (VIF). To use a single Direct Connect connection for both private and public AWS resources, you must provision two separate virtual interfaces on that connection. Option D, the public virtual interface (VIF), is required because it is the only VIF type that lets you reach AWS public services such as S3, DynamoDB, and other public endpoints over the Direct Connect link using public IP addresses. Option E, the private virtual interface (VIF), is required because it provides private connectivity to resources inside your VPC (for example, EC2 instances) using private IPv4 or IPv6 addresses and a VLAN. A Transit Gateway (A) is only needed when you want to centralize and scale connectivity across many VPCs or on-premises networks, not as a mandatory component for private plus public access over one Direct Connect. An Internet gateway (B) is for VPC internet access over the public AWS network, not for Direct Connect traffic, and a VPN connection to the VPC (C) is a separate IPsec-based path over the internet and is not required to use Direct Connect for private and public resources.

Answer

Transit Gateway

Answer

Internet gateway

Answer

VPN connection to the VPC

Question 11

A company is running a multi-tier web application across two AWS Regions (us-east-1 and eu-west-1) for disaster recovery. The application uses an Application Load Balancer (ALB) in each Region. The company uses Amazon Route 53 with latency-based routing to direct traffic to the closest Region. Recently, during a regional failure in us-east-1, users experienced timeouts instead of being redirected to eu-west-1. The DNS TTL is set to 60 seconds. The Route 53 health checks for the us-east-1 ALB are configured to check the HTTP endpoint every 30 seconds with 3 consecutive failures required to mark it unhealthy. The eu-west-1 ALB is healthy. The company's network design includes a VPC in each Region with public and private subnets. The ALBs are internet-facing and have proper security groups. The Route 53 records are configured correctly. What is the MOST likely cause of the timeout?

Accepted Answer

The health check interval and failure threshold cause a delay in detecting the failure, and DNS caching causes clients to still resolve to the unhealthy endpoint.. The most likely cause of the timeout is that the health check interval and failure threshold cause a delay in detecting the failure, and DNS caching causes clients to still resolve to the unhealthy endpoint. With a 30-second interval and 3 consecutive failures, it takes up to 90 seconds to mark the ALB unhealthy. During this time, Route 53 continues to return the unhealthy IP, and clients with cached DNS (TTL 60 seconds) may still attempt connections, leading to timeouts.

Answer

The latency-based routing policy does not fail over to the other region when a health check fails.

Answer

The ALB in us-east-1 is not configured to be cross-zone load balancing, causing it to fail.

Answer

The Route 53 health check is not able to reach the ALB in us-east-1 from eu-west-1 due to network ACLs.

Question 12

A financial services company has a VPC with a public subnet and a private subnet. EC2 instances in the private subnet need to download patches from the internet. The company has a NAT gateway in the public subnet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT gateway. However, instances cannot reach the internet. The NAT gateway is in an 'available' state and has an Elastic IP attached. The security group for the NAT gateway allows all outbound traffic. What is the most likely cause of the issue?

Accepted Answer

The route table for the public subnet does not have a default route (0.0.0.0/0) pointing to an internet gateway. A NAT gateway itself does not provide internet connectivity — it only translates addresses. For traffic to actually reach the internet, the public subnet hosting the NAT gateway must have its own route table with a 0.0.0.0/0 route pointing to an Internet Gateway. Without that IGW route in the public subnet's route table, the NAT gateway has no path to forward translated traffic to the internet, so private instances fail to reach external endpoints even though the NAT gateway is 'available' and has an EIP.

Answer

The security group for the NAT gateway is blocking inbound traffic from private instances

Answer

The NAT gateway is not provisioned with sufficient bandwidth

Answer

The NAT gateway does not have an IAM role to access the internet

Question 13

A company is deploying a multi-tier application in a VPC. The web servers must be accessible from the internet, but the database servers must not be. Which architecture meets these requirements?

Accepted Answer

Place web servers in public subnets with an internet gateway, and databases in private subnets with no direct internet access.. Placing web servers in public subnets with an internet gateway and database servers in private subnets with no direct internet access ensures only the web tier is accessible from the internet. Option A is incorrect because a NAT gateway is used for outbound internet access from private subnets, not for allowing inbound traffic to the database servers. Option C is incorrect because an AWS Site-to-Site VPN is used to connect on-premises networks to a VPC, not to provide internet access to private subnets. Option D is incorrect because placing database servers in public subnets directly exposes them to the internet; security groups alone do not prevent internet routability, and best practice is to place databases in private subnets.

Answer

Use a NAT gateway for the database servers to allow inbound traffic.

Answer

Place all servers in private subnets and use an AWS Site-to-Site VPN for internet access.

Answer

Place both web and database servers in public subnets and use security groups to restrict database access.

Question 14

A company runs a web application on EC2 instances behind an Application Load Balancer. The security team requires that all traffic to the application be inspected by a third-party firewall appliance for compliance. The firewall appliance must be deployed in a separate VPC and must inspect traffic without introducing a single point of failure. Which architecture meets these requirements?

Accepted Answer

Deploy Gateway Load Balancer endpoints in the application VPC and attach them to the firewall appliance in the inspection VPC across multiple Availability Zones.. Gateway Load Balancer endpoints in the application VPC allow traffic to be sent to a third-party firewall appliance deployed in a separate inspection VPC across multiple Availability Zones, providing high availability and traffic inspection. Option A is incorrect because Proxy Protocol v2, while used for preserving client IP, does not enable traffic inspection by a firewall. Option B is incorrect because AWS Direct Connect is a dedicated network connection to on-premises, not a mechanism for traffic inspection. Option C is incorrect because AWS Network Firewall is a managed service that can inspect traffic, but it cannot be used to route traffic to a third-party firewall appliance in a separate VPC; it is itself the firewall.

Answer

Configure the Application Load Balancer to send all traffic to the firewall appliance using Proxy Protocol v2.

Answer

Use AWS Direct Connect to route all traffic through the firewall appliance.

Answer

Use AWS Network Firewall to inspect traffic.

Question 15

A company uses AWS Site-to-Site VPN to connect its on-premises network to a VPC. The VPN tunnel is up, but traffic from on-premises cannot reach EC2 instances in the VPC. The EC2 instances have a security group that allows inbound ICMP from the on-premises CIDR. What is the most likely cause?

Accepted Answer

The subnet route table does not have a route for the on-premises CIDR pointing to the virtual private gateway.. For traffic from on-premises to reach EC2 instances in the VPC via Site-to-Site VPN, the subnet route table must include a route for the on-premises CIDR block with the virtual private gateway (VGW) as the target. Option A is incorrect because ICMP is allowed. Option B is incorrect because static routes are not required on the VPN connection itself; routes are needed in the route table. Option D is incorrect because subnet association with the main route table is not necessary; any custom route table works.

Answer

The security group rule is using the wrong protocol.

Answer

The VPN connection does not have static routes configured.

Answer

The subnet is not associated with the main route table.