ANS-C01 Practice Test 15 — 15 Questions

Question 1

A company is designing a global network with multiple AWS Regions. The company needs to connect VPCs in different Regions with low latency and high throughput. Which THREE services should the company consider? (Choose three.)

Accepted Answer

AWS Transit Gateway inter-Region peering. Options A, C, and D are correct. AWS Transit Gateway supports cross-region peering. AWS Direct Connect can be used with Direct Connect Gateway to connect multiple Regions. AWS Global Accelerator improves performance by routing traffic over the AWS global network. Option B is wrong because VPC Peering can be cross-region but is limited. Option E is wrong because CloudFront is a CDN, not for VPC connectivity.

Answer

Amazon CloudFront

Answer

VPC Peering

Question 2

A company has a multi-tier web application running on EC2 instances in a VPC. The web tier must be accessible from the internet, but the application tier should only be accessible from the web tier. Which network design configuration meets these requirements?

Accepted Answer

Place web servers in a public subnet with an internet gateway, and application servers in a private subnet with a route to the web subnet via a VPC peering connection.. Option A is correct because public subnets with internet gateways allow internet access, and private subnets without direct internet access ensure the application tier is only reachable from the web tier via internal routing. Option B is wrong because NAT gateways are for outbound internet access from private subnets, not for inbound. Option C is wrong because VPC peering does not provide internet access. Option D is wrong because a VPN connection is for on-premises connectivity, not internet access.

Answer

Use a VPN connection from the web tier to the application tier, and place both tiers in private subnets.

Answer

Place both tiers in public subnets and use security groups to restrict traffic from the web tier to the application tier.

Answer

Place web servers in a public subnet with a NAT gateway, and application servers in a private subnet with a default route to the NAT gateway.

Question 3

A company is designing a VPC with a CIDR block of 10.0.0.0/16. The VPC will host multiple environments (dev, test, prod) and requires subnets in three Availability Zones. The network engineer must allocate subnets efficiently while reserving at least 25% of the address space for future growth. What is the minimum subnet size that should be used for each environment?

Accepted Answer

/20. Option B is correct. The total /16 has 65536 addresses. Reserving 25% leaves 49152 addresses for use. With 3 environments × 3 AZs = 9 subnets, each subnet gets 5461 addresses on average. A /19 subnet provides 8191 addresses per subnet, totaling 9×8191=73719, which exceeds the available 49152. A /20 provides 4095 addresses per subnet (9×4095=36855), which is within the available 49152 and allows efficient use. The smallest subnet that fits the requirement is /20. Option A (/18) is too large, C (/21) provides too few addresses per subnet, D (/22) also insufficient.

Answer

/18

Answer

/22

Answer

/21

Question 4

A company is designing a VPC with a CIDR block of 10.0.0.0/16. The VPC must support IPv6 and have subnets in three Availability Zones. The company plans to use an AWS Transit Gateway to connect multiple VPCs. Which TWO actions are required to enable IPv6 communication between VPCs through the Transit Gateway?

Accepted Answer

Associate an IPv6 CIDR block with the VPC and enable IPv6 on subnets.. Option A is correct: IPv6 must be enabled on the VPC and subnets. Option C is correct: The Transit Gateway must be configured with IPv6 support. Option B is wrong because NAT gateways do not support IPv6. Option D is wrong because egress-only internet gateways are for internet access, not inter-VPC traffic. Option E is wrong because VPC endpoints do not provide transit routing.

Answer

Use VPC endpoints to route IPv6 traffic between VPCs.

Answer

Attach an egress-only internet gateway to the Transit Gateway.

Answer

Create a NAT gateway and attach it to the Transit Gateway.

Question 5

A company has a VPC with public and private subnets. The private subnets must access an S3 bucket without traversing the internet. Which TWO methods can achieve this? (Choose TWO.)

Accepted Answer

Create a VPC gateway endpoint for S3 and associate it with the private subnet route tables.. Option A is correct: A VPC gateway endpoint for S3 allows private subnet instances to access S3 privately. Option B is correct: AWS PrivateLink (VPC endpoint services) can also provide private access to S3 if the bucket is configured as an endpoint service. Option C is wrong because NAT gateway routes through the internet. Option D is wrong because a VPN does not provide private S3 access. Option E is wrong because an internet gateway exposes traffic to the internet.

Answer

Attach an internet gateway to the VPC and route traffic through it.

Answer

Set up a VPN connection to the on-premises network and access S3 from there.

Answer

Place a NAT gateway in the public subnet and route traffic through it.

Question 6

A company is designing a VPC for a web application that requires high availability. The application will be deployed across multiple Availability Zones. Which THREE components are essential for a highly available network design? (Choose THREE.)

Accepted Answer

Subnets in at least two Availability Zones. Option A is correct: Multiple AZs ensure availability if one AZ fails. Option B is correct: An internet gateway provides internet access. Option D is correct: A NAT gateway in each AZ ensures outbound internet access even if one AZ fails. Option C is wrong because a single VPN connection is a single point of failure. Option E is wrong because VPC peering is for connecting VPCs, not for high availability within a VPC.

Answer

A single VPN connection to on-premises

Answer

VPC peering with a backup VPC

Question 7

Refer to the exhibit. An EC2 instance launched in subnet-1a is unable to access the internet. Which is the most likely cause?

Accepted Answer

Subnet-1a does not assign public IP addresses automatically.. Option C is correct. Subnet-1a is associated with route table rtb-main which has a default route to an internet gateway, but the subnet does not have MapPublicIpOnLaunch set to true (it is false). For a subnet to have internet access via an internet gateway, instances must have public IP addresses. Option A is wrong because the route table has a default route to the internet gateway. Option B is wrong because the route table is associated with the subnet. Option D is wrong because the VPC has DNS hostnames enabled, but that does not affect internet access.

Answer

The route table rtb-main does not have a default route to the internet gateway.

Answer

The VPC does not have DNS hostnames enabled.

Answer

Subnet-1a is not associated with any route table.

Question 8

A company is designing a VPC for a three-tier application. The web tier must be accessible from the internet, the application tier must only be accessible from the web tier, and the database tier must only be accessible from the application tier. Which THREE design elements are required? (Choose THREE.)

Accepted Answer

A public subnet for the web tier with an internet gateway. Option A is correct: Public subnet for web servers. Option B is correct: Private subnet for application servers. Option D is correct: Private subnet for database servers. Option C is wrong because a NAT gateway is not required for inbound access; outbound access for private subnets may be needed but is not specified. Option E is wrong because a VPN is not required.

Answer

A NAT gateway in the public subnet for outbound traffic from private subnets

Answer

A VPN connection to on-premises

Question 9

A company is designing a network for a three-tier application that must be PCI DSS compliant. The web tier must be accessible from the internet, the application tier must only be accessible from the web tier, and the database tier must only be accessible from the application tier. All tiers are in the same VPC. What is the MOST secure way to implement this?

Accepted Answer

Place web tier in public subnets, application and database tiers in private subnets. Use security groups to allow only necessary traffic between tiers.. Option A is correct because separate public and private subnets with security groups restricting traffic between tiers provide the required isolation. Option B is wrong because network ACLs are stateless and harder to manage for this use case. Option C is wrong because a single subnet does not provide isolation. Option D is wrong because a VPN is unnecessary for intra-VPC traffic.

Answer

Use a VPN between the web and application tiers and between application and database tiers.

Answer

Place all tiers in the same private subnet and use security groups for isolation.

Answer

Place all tiers in public subnets and use network ACLs to restrict traffic.

Question 10

A company is designing a hybrid network with multiple AWS Direct Connect connections to multiple on-premises data centers. They want to maximize availability and use all available bandwidth. They have two Direct Connect connections terminated at two different Direct Connect locations. They plan to use a single Virtual Private Gateway (VGW) for each VPC. Which configuration should be used to meet these requirements?

Accepted Answer

Create a Direct Connect Gateway. Attach both Direct Connect connections to the Direct Connect Gateway. Associate the Direct Connect Gateway with the VGW. Configure the on-premises routers to use BGP with equal-cost multipath (ECMP).. Option A is correct because using a Direct Connect Gateway with multiple virtual interfaces (VIFs) to the same VGW enables active-active traffic and failover across the two connections. Option B is wrong because two separate VGWs cannot be associated with the same VPC. Option C is wrong because a single VIF cannot use multiple connections. Option D is wrong because two separate VGWs are not supported for a single VPC.

Answer

Create two VGWs and attach each to a separate Direct Connect connection. Use a Transit Gateway to connect the VGWs to the VPC.

Answer

Create two Virtual Private Gateways, one for each Direct Connect connection. Attach each VGW to the VPC. Configure BGP on both connections for active-active.

Answer

Create a single virtual interface and associate it with both Direct Connect connections. Attach the virtual interface to the VGW.

Question 11

A company is designing a multi-region application with an Application Load Balancer (ALB) in us-east-1 and us-west-2. They want to route traffic to the nearest region using latency-based routing. Which AWS service should they use to achieve this?

Accepted Answer

Amazon Route 53 with latency routing policy. Amazon Route 53 latency-based routing directs traffic to the region with the lowest latency for the end user. AWS Global Accelerator provides static IP and traffic management but not latency-based routing to specific load balancers in multiple regions. CloudFront is a CDN, not for routing to ALBs. Direct Connect is for dedicated network connections. Transit Gateway is for VPC connectivity.

Answer

AWS Global Accelerator

Answer

AWS Transit Gateway

Answer

Amazon CloudFront with multiple origins

Question 12

A company has a Direct Connect connection with a private VIF to a VPC. They want to add redundant connectivity using a second Direct Connect connection from a different provider. They need to ensure that if the primary connection fails, traffic automatically fails over to the secondary. Which THREE components are required?

Accepted Answer

A second Direct Connect connection from a different provider. To achieve automatic failover, BGP is required to advertise the same prefixes over both connections. A Direct Connect Gateway aggregates the VIFs and propagates routes to the VPC. A Transit Gateway can be used to manage multiple VIFs, but is not strictly required if using Direct Connect Gateway. VPN is not involved. A second VIF on the same connection does not provide provider diversity.

Answer

An AWS Site-to-Site VPN as a backup

Answer

A second private VIF on the same Direct Connect connection

Question 13

A company has a VPC with a CIDR block of 10.0.0.0/16 and needs to connect to a partner's VPC with CIDR 10.0.0.0/16. The VPCs are in the same Region. What is the best solution?

Accepted Answer

Use an AWS Transit Gateway with a transit gateway attachment and configure NAT on the transit gateway to translate IPs. Since the CIDRs overlap, VPC peering cannot be used because overlapping CIDRs are not allowed for peering. The best solution is to use a transit gateway with network address translation (NAT) to handle the overlapping IPs. Option C is correct. Option A (VPC peering) is not possible. Option B (VPN) would also have overlapping issues. Option D (Direct Connect) does not solve overlapping.

Answer

Use an AWS Site-to-Site VPN connection

Answer

Establish VPC peering between the two VPCs

Answer

Use an AWS Direct Connect private virtual interface

Question 14

Refer to the exhibit. An EC2 instance in the PrivateSubnet is unable to download patches from the internet. What is the most likely cause?

Accepted Answer

The PrivateRoute resource references the NAT gateway before it is created.. Option C is correct. The PrivateRoute uses a NatGatewayId but the NAT gateway is defined after the route in the template, and the route has no DependsOn to ensure the NAT gateway is created first. This can cause a dependency error or the route to reference a non-existent resource. Option A is wrong because the private subnet does not need MapPublicIpOnLaunch. Option B is wrong because NAT gateways do not support IPv6, but the question is about internet access (IPv4). Option D is wrong because the route table is associated with the private subnet.

Answer

The private subnet is not associated with any route table.

Answer

The NAT gateway does not support IPv6 traffic.

Answer

The private subnet does not have MapPublicIpOnLaunch set to true.

Question 15

A company has a VPC with public and private subnets in three Availability Zones. An internet-facing Network Load Balancer (NLB) is deployed in the public subnets, and a fleet of EC2 instances is in the private subnets. The application logs show intermittent connection timeouts. The security group for the EC2 instances allows traffic from the NLB's security group. What is the MOST likely cause?

Accepted Answer

The EC2 instances' security group allows traffic from the NLB's security group, but the NLB preserves client IP, so the security group must allow client IPs directly.. Option C is correct because NLB's source IP preservation by default sends traffic with client IP, not NLB's private IP, so security group must allow client IPs. Option A is wrong because subnet ACLs are stateless and need ephemeral ports open. Option B is wrong because NLB does not have a security group. Option D is wrong because cross-zone load balancing is enabled by default for NLB.

Answer

Cross-zone load balancing is disabled on the NLB.

Answer

The NLB's security group is not allowing traffic from the EC2 instances.

Answer

The network ACLs in the private subnets are blocking return traffic.