ANS-C01 Practice Test 15 — 15 Questions

Question 1

A company needs to connect two VPCs in the same AWS account and region. They want to use private IP addresses and avoid any single point of failure. Which solution should they use?

Accepted Answer

VPC peering connection. VPC peering is the correct solution because it allows direct connectivity between two VPCs using private IP addresses, with no single point of failure since traffic flows directly between the VPCs without any intermediate device or bandwidth bottleneck. AWS handles the underlying routing and redundancy, and there is no additional cost for data transfer within the same Availability Zone or region when using private IPs.

Answer

AWS Transit Gateway

Answer

Internet Gateway and public IPs

Answer

AWS Site-to-Site VPN between the VPCs

Question 2

Order the steps to set up a Network Load Balancer with a TCP listener in front of an Auto Scaling group:

Accepted Answer

Create target group → Create load balancer → Register targets → Associate target group with listener → Configure health checks. First create the target group, then the load balancer, register targets, associate the target group with the listener, and configure health checks.

Answer

Create load balancer → Create target group → Register targets → Associate target group with listener → Configure health checks

Answer

Create target group → Create load balancer → Configure health checks → Register targets → Associate target group with listener

Answer

Create target group → Register targets → Create load balancer → Associate target group with listener → Configure health checks

Question 3

A company has a VPC with public and private subnets. They launch an Amazon RDS for MySQL DB instance in a private subnet. The DB instance needs to be accessible from an on-premises application that connects via an AWS Site-to-Site VPN. What is the MOST secure way to allow the on-premises application to connect to the DB instance?

Accepted Answer

Place the DB instance in a private subnet and configure a security group to allow inbound traffic from the on-premises CIDR.. Placing the RDS DB instance in a private subnet ensures it has no public IP address, and configuring a security group to allow inbound traffic from the on-premises CIDR over the Site-to-Site VPN provides a secure, direct connection without exposing the database to the internet. Security groups act as a stateful firewall at the instance level, allowing only specified traffic from the on-premises network through the VPN tunnel.

Answer

Assign a public IP address to the DB instance and restrict access using a security group.

Answer

Place the DB instance in a private subnet and use a NAT gateway to allow inbound traffic.

Answer

Place the DB instance in a public subnet and configure a network ACL to allow traffic from the on-premises CIDR.

Question 4

Which THREE components are required to establish a site-to-site VPN connection between an on-premises network and AWS? (Choose 3)

Accepted Answer

A VPN tunnel between the customer gateway and the virtual private gateway. Options A, D, E are correct. A site-to-site VPN requires a VPN tunnel between the on-premises customer gateway and the AWS virtual private gateway (or transit gateway). The customer gateway device (hardware or software) is deployed on-premises to terminate the VPN tunnel. Option B is incorrect because VPC endpoints are used for private access to AWS services, not for VPN connections. Option C is incorrect because AWS Direct Connect is a dedicated physical connection, not a requirement for a VPN connection.

Answer

A VPC endpoint for the VPN service

Answer

An AWS Direct Connect dedicated line

Question 5

A company has a VPC with multiple subnets across three Availability Zones. The company wants to deploy a Network Load Balancer (NLB) to distribute TCP traffic to a fleet of EC2 instances. The NLB must preserve the source IP address of the client. Which configuration is required?

Accepted Answer

Create the NLB with a TCP listener and register the EC2 instances as targets in a target group.. Network Load Balancers (NLBs) preserve the source IP address of clients by default when using a TCP listener. No additional configuration is required to enable this behavior; the NLB forwards packets with the original source IP intact. Therefore, simply creating the NLB with a TCP listener and registering EC2 instances as targets is sufficient.

Answer

Enable Proxy Protocol v2 on the NLB target group.

Answer

Enable cross-zone load balancing on the NLB.

Answer

Attach a security group to the NLB that allows inbound traffic from the client IP range.

Question 6

A company is deploying a new application across multiple Availability Zones in a VPC. The application needs to be highly available and must handle traffic from both internal users and external customers. Which TWO options should the network team implement to meet these requirements? (Choose two.)

Accepted Answer

Provision a NAT Gateway in each AZ for outbound connectivity from private subnets.. Provisioning a NAT Gateway in each AZ allows instances in private subnets to initiate outbound traffic to the internet without relying on a single AZ, thus providing high availability and fault tolerance. Option E is correct because deploying an Application Load Balancer in each public subnet across multiple AZs ensures that the ALB can route traffic to healthy targets across AZs, providing high availability and fault tolerance for incoming client traffic. Option A is incorrect because an Internet Gateway is a VPC-level component that allows communication between the VPC and the internet; it is not something that needs to be 'attached' per se (it's already attached to the VPC), and it does not handle traffic distribution across AZs. Option B is incorrect because a Network Load Balancer is suitable for TCP/UDP traffic, but the question does not specify protocol requirements; however, the primary reason it is not the best choice is that the requirement for high availability is better met with an Application Load Balancer for HTTP/HTTPS traffic, and the option says 'use a Network Load Balancer to distribute traffic across AZs' which is not the best fit for typical web applications. Option D is incorrect because a single NAT Gateway in one AZ creates a single point of failure; if that AZ goes down, outbound connectivity is lost.

Answer

Attach an Internet Gateway to the VPC.

Answer

Use a Network Load Balancer to distribute traffic across AZs.

Answer

Create a single NAT Gateway in one AZ for outbound traffic.

Question 7

A company has a VPC with public and private subnets. They want to implement a bastion host to allow secure SSH access to instances in private subnets. Which TWO components are required for this design?

Accepted Answer

A bastion host deployed in a public subnet. A bastion host must be deployed in a public subnet because it needs direct internet access via an Internet Gateway (IGW) to allow administrators to initiate SSH connections from the internet. The bastion then acts as a jump box, forwarding SSH traffic to private instances. Security group rules on the private instances must explicitly allow inbound SSH (TCP port 22) from the bastion host's private IP or security group, ensuring that only the bastion can reach them, not the internet directly.

Answer

A NAT gateway in the public subnet

Answer

An Internet Gateway attached to the VPC

Answer

A Site-to-Site VPN connection to the VPC

Question 8

A company wants to connect its on-premises data center to AWS using AWS Direct Connect and wants to use the same connection to access multiple VPCs in the same AWS region. The company also needs to maintain private IP connectivity between the VPCs. Which THREE components should the company use to meet these requirements? (Choose three.)

Accepted Answer

Transit Gateway VPC attachments. Transit Gateway VPC attachments allow multiple VPCs to connect to a central transit gateway, enabling private IP connectivity between them. When combined with an AWS Direct Connect gateway, the on-premises data center can use a single Direct Connect connection to reach all attached VPCs via the transit gateway, meeting both requirements efficiently.

Answer

VPC peering connections between each VPC

Answer

AWS Site-to-Site VPN connection

Question 9

A network engineer needs to analyze network traffic between EC2 instances in the same VPC to troubleshoot a performance issue. Which AWS feature should they use?

Accepted Answer

VPC Flow Logs.. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet/byte counts) for network interfaces in a VPC, making them the correct tool for analyzing network traffic between EC2 instances to troubleshoot performance issues. Unlike other options, Flow Logs operate at the network layer (Layer 3/4) and can be published to CloudWatch Logs or S3 for detailed traffic analysis.

Answer

AWS Config.

Answer

AWS CloudTrail.

Answer

AWS X-Ray.

Question 10

A network engineer is designing a hybrid network using AWS Transit Gateway with multiple VPCs and an on-premises data center connected via AWS Direct Connect. The VPCs need to communicate with each other and with on-premises, but must isolate development VPCs from production VPCs. What is the MOST scalable and cost-effective approach?

Accepted Answer

Use a single Transit Gateway with separate route tables for development and production VPCs, and a shared route table for on-premises attachment.. A single Transit Gateway with separate route tables allows you to isolate development and production VPCs from each other while sharing a common route table for the Direct Connect attachment to reach on-premises. This design is highly scalable (no mesh of peering connections) and cost-effective (no per-VPN-tunnel charges), leveraging Transit Gateway’s native segmentation and centralized routing.

Answer

Use a single Transit Gateway with one route table for all VPCs and on-premises, and use network ACLs for isolation.

Answer

Create VPC peering connections between all VPCs and a Direct Connect gateway for on-premises connectivity.

Answer

Use a VPN connection from each VPC to on-premises over Direct Connect, and allow VPC communication via VPN.

Question 11

A company is implementing a hybrid network with AWS Direct Connect and a VPN connection as backup. They have a Direct Connect gateway (DXGW) attached to a private VIF and a virtual private gateway (VGW) attached to a VPN connection. The VPC is attached to the VGW. They want to use the Direct Connect connection for all traffic when available. The on-premises router advertises the same prefix over both connections. However, traffic from on-premises to the VPC is using the VPN connection. BGP is configured correctly on both connections. What should the company do to prefer the Direct Connect path?

Accepted Answer

Configure a lower MED (Multi-Exit Discriminator) on the Direct Connect VIF.. The Multi-Exit Discriminator (MED) is a BGP attribute used to influence inbound traffic from an AS to the local AS. By setting a lower MED on the Direct Connect VIF, the on-premises router will prefer the Direct Connect path over the VPN path when both advertise the same prefix, assuming all other BGP path selection criteria are equal. This directly addresses the requirement to prefer the Direct Connect connection for all traffic.

Answer

Set a higher weight on the Direct Connect BGP session.

Answer

Set a higher local preference on the Direct Connect VIF.

Answer

Change the BGP timers on the Direct Connect VIF to have a lower hold time.

Answer

Configure AS_PATH prepending on the VPN BGP session.

Question 12

A company is designing a network architecture for a critical application that requires high availability across multiple AWS regions. The application uses an Application Load Balancer (ALB) in each region. Which TWO services can provide global routing and failover between the two ALBs?

Accepted Answer

Amazon Route 53 with failover routing and health checks. Amazon Route 53 with failover routing policy and health checks can route traffic to the primary ALB and automatically fail over to the secondary ALB in another region when the primary health check fails. This provides global DNS-based routing and failover across regions, meeting the high-availability requirement.

Answer

AWS WAF

Answer

Network Load Balancer (NLB)

Answer

Amazon CloudFront

Question 13

A company has a VPC with a NAT Gateway in a public subnet. The network team notices that instances in private subnets cannot access the internet. Reviewing the route tables, the private subnet route table has a default route (0.0.0.0/0) pointing to the NAT Gateway. What is the most likely cause of the issue?

Accepted Answer

The NAT Gateway's subnet route table does not have a default route pointing to an Internet Gateway.. The NAT Gateway must have a route to an Internet Gateway. If the NAT Gateway's subnet route table does not have a default route pointing to an IGW, it cannot route traffic to the internet. Security groups, NACLs, or EIP are less likely to be the issue.

Answer

The network ACL in the private subnet blocks outbound traffic.

Answer

The NAT Gateway does not have an Elastic IP address attached.

Answer

The security group attached to the NAT Gateway blocks outbound traffic.

Question 14

Which THREE actions can AWS Config perform to help with network security compliance? (Choose 3)

Accepted Answer

Evaluate whether security groups allow unrestricted SSH access. AWS Config can evaluate whether security groups allow unrestricted SSH access using managed rules like 'restricted-ssh'. Option C is correct because Config records configuration changes to Network ACLs and security groups, enabling tracking. Option D is correct because Config can trigger custom rules or send notifications via Amazon SNS when a security group rule is modified. Option B is incorrect because Config does not block traffic; it only evaluates and can trigger remediation actions via other services. Option E is incorrect because Config evaluates resources after creation; it cannot prevent creation, though it can trigger automated remediation via Lambda or Systems Manager.

Answer

Automatically block non-compliant traffic

Answer

Prevent creation of VPCs that do not have a specific tag

Question 15

A company is deploying a hybrid network with AWS Direct Connect and a VPN backup. The Direct Connect virtual interface is configured for private VIF with BGP. The VPN uses IPsec tunnels over the internet. What is the best practice to ensure symmetric routing and failover?

Accepted Answer

Use the same BGP ASN for both Direct Connect and VPN, and set a higher MED (Multi-Exit Discriminator) on the VPN routes.. Using the same BGP ASN for both Direct Connect and VPN, and setting a higher MED on the VPN routes, ensures symmetric routing by making the Direct Connect path more preferred. AWS uses the BGP AS_PATH length as a tie-breaker; with the same ASN, the paths are equal in AS_PATH length, so MED is evaluated. A higher MED on the VPN routes causes AWS to prefer the Direct Connect path, and if Direct Connect fails, the VPN routes (with higher MED) become active, providing failover.

Answer

Configure ASN prepending on the VPN BGP advertisements to make them less preferred.

Answer

Use different BGP ASNs for Direct Connect and VPN to allow AWS to prefer the Direct Connect path.

Answer

Disable BGP on the Direct Connect private VIF and use static routes to force traffic through Direct Connect.