ANS-C01 Practice Test 16 — 15 Questions

Question 1

A company uses AWS Shield Advanced to protect against DDoS attacks. They notice that some legitimate traffic is being throttled during a DDoS event. The security team wants to ensure that legitimate traffic from specific business partners is not affected. Which action should they take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a rate-based rule in AWS WAF with an IP set that includes the partners' IPs and set the rate limit high for that rule.. AWS Shield Advanced does not provide a whitelist feature for IP addresses; the correct way to exempt specific partners from rate-based throttling is to create an AWS WAF rate-based rule with an IP set containing the partners' IPs and set a high rate limit for that rule. This allows legitimate partner traffic to exceed the normal threshold while still protecting against volumetric attacks from other sources.

Answer

Disable the rate-based rule in AWS WAF during the DDoS event.

Answer

Increase the global rate limit in AWS Shield Advanced.

Answer

Add the partners' IP addresses to the AWS Shield Advanced whitelist.

Question 2

A company uses AWS Organizations and has multiple VPCs in different accounts. They want to centrally manage network firewall rules for all VPCs using a single firewall policy. Which AWS service should they use?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager centrally manages and enforces firewall policies, including AWS Network Firewall, WAF, and security group policies, across all accounts and VPCs in an AWS Organization. It is designed exactly for this multi-account, single-policy governance use case. Network Firewall provides the firewall capability, but Firewall Manager is what applies it centrally.

Answer

AWS WAF

Answer

AWS Network Firewall

Answer

AWS Shield Advanced

Question 3

A company is designing a network for a multi-account AWS environment using AWS Organizations. They need to establish a central inspection VPC for traffic inspection using a Gateway Load Balancer (GWLB). Traffic from all other VPCs should be routed through the inspection VPC before reaching the internet or on-premises. Which architecture should be used?

Accepted Answer

Use AWS Transit Gateway with a centralized inspection VPC that hosts a GWLB. Configure route tables on the Transit Gateway to send traffic to the GWLB endpoint.. AWS Transit Gateway enables centralized routing between multiple VPCs, and when combined with a Gateway Load Balancer (GWLB) in an inspection VPC, it allows traffic from all other VPCs to be forwarded to the GWLB for inspection before reaching the internet or on-premises. Transit Gateway route tables can be configured with static routes pointing to the GWLB endpoint (using Gateway Load Balancer Endpoint service), ensuring all inter-VPC and egress traffic is steered through the inspection VPC. This architecture scales efficiently across many VPCs in an AWS Organizations multi-account setup without requiring complex peering or direct connections.

Answer

Use VPC Peering to connect all VPCs to the inspection VPC and configure routes to the GWLB.

Answer

Use AWS Direct Connect Gateway to connect all VPCs and route traffic through the inspection VPC.

Answer

Use AWS Network Firewall in each VPC and route traffic to it.

Question 4

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They have two subnets: a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). They launch an EC2 instance in the private subnet that needs to download software updates from the internet. The company configures a NAT gateway in the public subnet and adds a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway. The NAT gateway is assigned an Elastic IP address. However, the EC2 instance cannot reach the internet. The security group for the EC2 instance allows all outbound traffic. What is the MOST likely cause?

Accepted Answer

The public subnet's route table does not have a route to an internet gateway.. For a NAT gateway to provide internet access, the public subnet hosting it must have a route to an Internet Gateway (IGW). The NAT gateway itself resides in the public subnet and uses the IGW to reach the internet. If the public subnet's route table lacks a 0.0.0.0/0 route to the IGW, the NAT gateway cannot forward traffic, so the private instance cannot reach the internet.

Answer

The NAT gateway is not associated with a security group that allows outbound traffic.

Answer

The NAT gateway's Elastic IP address is not properly allocated.

Answer

The private subnet's route table does not have a route to the NAT gateway.

Question 5

A company wants to connect its on-premises data center to AWS using AWS Direct Connect with a public VIF to access Amazon S3. The on-premises network team reports that they can ping the Direct Connect public VIF IP but cannot access S3. The VPC has a private subnet with an S3 VPC endpoint. What is the most likely reason for the failure?

Accepted Answer

The on-premises network is not routing traffic to S3 through the Direct Connect public VIF; instead, it is attempting to use the internet.. The most likely reason is that the on-premises network is not routing S3-bound traffic through the Direct Connect public VIF. A public VIF provides access to AWS public services like S3 using AWS-assigned public IP addresses, but the on-premises router must have specific routes (BGP advertisements from AWS) pointing S3 prefixes to the Direct Connect connection. If the router instead sends S3 traffic to its default internet gateway, the traffic never traverses the Direct Connect link, and the S3 VPC endpoint in the VPC is irrelevant because on-premises traffic does not use VPC endpoints.

Answer

Direct Connect does not support access to Amazon S3; you must use VPN.

Answer

The S3 endpoint is configured in the VPC, but the on-premises traffic is not using the endpoint.

Answer

A security group is blocking traffic from the on-premises network to S3.

Question 6

A company is designing a network security architecture for a multi-tier application. Which TWO of the following are best practices for implementing defense in depth?

Accepted Answer

Use security groups to control traffic between instances. Option B is correct because security groups act as stateful virtual firewalls at the instance/ENI level, allowing you to control inbound and outbound traffic per resource and enforce least-privilege segmentation between tiers (for example, letting app servers accept traffic only from the web tier's security group). Option D is correct because placing web servers in public subnets and application servers in private subnets implements network segmentation, so only the presentation tier is internet-reachable while the app tier has no direct inbound internet path, which is a core defense-in-depth practice. Option A is wrong because network ACLs are stateless, not stateful firewalls, and they operate at the subnet level with separate inbound/outbound rules. Option C is wrong because attaching internet gateways to all subnets exposes private tiers to the internet and defeats segmentation; only public subnets should route to an IGW. Option E is wrong because using one shared security group across all tiers collapses the segmentation boundary and grants overly broad, non-least-privilege access.

Answer

Use network ACLs as stateful firewalls at the subnet level

Answer

Attach internet gateways to all subnets for high availability

Answer

Use the same security group for all tiers to simplify management

Question 7

A company is designing a network security architecture for a multi-account environment using AWS Transit Gateway. The company requires that all traffic between VPCs must be inspected by a centralized security appliance in a shared services VPC. The security appliance must receive traffic for both directions (ingress and egress). Which THREE components are required to achieve this? (Choose THREE.)

Accepted Answer

A shared services VPC containing the security appliances.. Option A is correct because the centralized security appliance must reside in a shared services VPC, which serves as the inspection hub that all inter-VPC traffic is routed through. Option B is correct because every VPC—spoke VPCs and the shared services VPC—must be attached to the AWS Transit Gateway via VPC attachments so their traffic can transit the hub. Option D is correct because Transit Gateway route tables must be configured to steer traffic from spoke VPCs to the shared services VPC attachment (and back) so the appliance can inspect traffic in both directions, typically using separate route tables for the inspection VPC and spokes. Option C is not needed and would actually bypass the Transit Gateway inspection design, since VPC peering creates direct VPC-to-VPC paths that don't traverse the centralized appliance. Option E is not required for this architecture because NAT gateways only provide outbound internet access for a VPC and do not fulfill the requirement of inspecting inter-VPC traffic through the security appliance.

Answer

VPC peering connections between each spoke VPC and the shared services VPC.

Answer

NAT gateways in each spoke VPC for outbound traffic.

Question 8

A company is using AWS Certificate Manager (ACM) to manage SSL/TLS certificates for an Application Load Balancer (ALB). The security team notices that an ACM-issued certificate is about to expire. How can they automate renewal?

Accepted Answer

Use AWS Certificate Manager's automatic renewal feature; no additional configuration is required if the certificate was issued by ACM.. ACM-issued certificates are automatically renewed by AWS Certificate Manager as long as the certificate is in use and the domain validation remains valid. No CloudWatch alarm, Lambda function, or manual re-issuance is required — ACM handles renewal transparently before expiration. This is a core benefit of using ACM-issued certificates over imported ones.

Answer

Set a CloudWatch alarm to send a notification when the certificate is about to expire, then manually renew.

Answer

Manually remove the certificate from ACM and re-issue a new one.

Answer

Configure an AWS Lambda function to monitor certificate expiration and re-issue the certificate.

Question 9

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Direct Connect and VPN. They have a central inspection VPC that uses AWS Network Firewall to inspect traffic. The security team wants to ensure that all traffic between VPCs and between VPCs and on-premises is routed through the inspection VPC. They have created a transit gateway route table for each VPC and the Direct Connect/VPN attachments. They have configured the route tables to propagate routes from the inspection VPC's attachment. However, traffic is still bypassing the inspection VPC. What should the security team do to ensure traffic is inspected?

Accepted Answer

Create static routes in each VPC's transit gateway route table pointing to the inspection VPC attachment for all destination CIDRs, and remove any routes that point directly to other attachments.. Creating static routes in each VPC's transit gateway route table pointing to the inspection VPC attachment for all destination CIDRs, and removing any routes that point directly to other attachments, ensures that all traffic is sent to the inspection VPC. Without static routes, propagated routes from the inspection VPC attachment create routes to the inspection VPC, but other attachments may also propagate routes that allow direct communication, bypassing inspection. Option A is incorrect because enabling route propagation alone does not force traffic through the inspection VPC; it only adds routes automatically, but other routes (e.g., from Direct Connect or VPN attachments) can still allow direct paths. Option C is incorrect because network ACLs in the inspection VPC control traffic to and from its subnets but do not influence routing decisions in the transit gateway; they cannot prevent traffic from bypassing the inspection VPC. Option D is incorrect because VPC peering connections bypass the transit gateway entirely, so traffic would not be inspected by the Network Firewall in the inspection VPC.

Answer

Enable route propagation for all attachments in the transit gateway route tables.

Answer

Configure network ACLs in the inspection VPC to block traffic that does not come from the transit gateway.

Answer

Create VPC peering connections between all VPCs and the inspection VPC.

Question 10

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network team reports intermittent connectivity loss to resources in the VPC, but the Direct Connect tunnel status shows as UP. Which configuration is MOST likely causing the issue?

Accepted Answer

Traffic is being routed asymmetrically through the Direct Connect and a VPN backup. Asymmetric routing occurs when traffic from on-premises to the VPC uses Direct Connect, but return traffic from the VPC takes the VPN backup path. This can cause stateful firewalls (e.g., AWS Network Firewall, security groups, or on-premises firewalls) to drop packets because they expect traffic to arrive on the same interface. The Direct Connect tunnel status remains UP because the BGP session is still established, but connectivity is intermittent due to dropped return packets.

Answer

The BGP keepalive interval is set to 60 seconds

Answer

Jumbo frames are enabled on the Direct Connect interface but not on on-premises routers

Answer

A separate private VIF is required for each VPC in the account

Question 11

A company has a VPC with a public subnet and a private subnet. The private subnet contains Amazon RDS instances that should only be accessed by EC2 instances in the same VPC. The EC2 instances are in a security group named 'App-SG'. Which configuration will meet the requirement?

Accepted Answer

Configure a security group on the RDS instances to allow inbound traffic from the 'App-SG' security group.. Security groups are stateful and can reference other security groups as a source, allowing traffic from all instances associated with the source security group. By configuring the RDS security group to allow inbound traffic from 'App-SG', only EC2 instances in that group can access the RDS instances, meeting the requirement without exposing the database to the entire VPC CIDR.

Answer

Configure a network ACL on the private subnet to allow inbound traffic from the VPC CIDR.

Answer

Configure a network ACL on the private subnet to allow inbound traffic from the public subnet CIDR.

Answer

Configure a security group on the RDS instances to allow inbound traffic from the VPC CIDR.

Question 12

A company is deploying a web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application must be accessible from the internet. Which component must be attached to the VPC to allow internet traffic to reach the ALB?

Accepted Answer

Internet gateway. An Internet Gateway (IGW) is a horizontally scaled, redundant component that allows communication between a VPC and the internet. For an Application Load Balancer (ALB) to receive traffic from the internet, the ALB must be deployed in public subnets, and those subnets must have a route table entry pointing 0.0.0.0/0 to an IGW. Without the IGW, the ALB cannot accept inbound connections from the internet.

Answer

NAT gateway

Answer

Virtual private gateway

Answer

Transit gateway

Question 13

A company wants to provide internet access to instances in a public subnet. Which component must be attached to the VPC and have a route to it in the subnet's route table?

Accepted Answer

Internet Gateway. An Internet Gateway (IGW) is a horizontally scaled, redundant component that allows communication between a VPC and the internet. For instances in a public subnet to have outbound internet access and be reachable from the internet, the IGW must be attached to the VPC, and the subnet's route table must include a default route (0.0.0.0/0) pointing to the IGW as the target.

Answer

Transit Gateway

Answer

Virtual Private Gateway

Answer

NAT Gateway

Question 14

A company is designing a network architecture for a critical application that requires high availability across multiple AWS regions. The application uses an Application Load Balancer (ALB) in each region. Which TWO services can provide global routing and failover between the two ALBs?

Accepted Answer

Amazon Route 53 with failover routing and health checks. Option A is correct because Amazon Route 53 failover routing policies let you define a primary and secondary record, and Route 53 health checks monitor each regional ALB so that DNS queries are automatically answered with the healthy region's ALB when the primary fails, providing global DNS-based failover. Option E is correct because AWS Global Accelerator provides two static anycast IP addresses and routes user traffic over the AWS global network to the optimal regional endpoint, with endpoint groups and health checks that automatically fail over traffic to the healthy ALB in the other region. Option B (AWS WAF) is a web application firewall for filtering HTTP/S requests, not a global routing or failover service. Option C (Network Load Balancer) is a regional Layer 4 load balancer and cannot route across regions or fail over between regional ALBs. Option D (Amazon CloudFront) is a content delivery network that caches and distributes content at edge locations; it does not itself perform health-check-based failover between two regional ALBs.

Answer

AWS WAF

Answer

Network Load Balancer (NLB)

Answer

Amazon CloudFront

Question 15

A company has a VPC with multiple subnets. The security team requires that all outbound traffic from the VPC to the internet goes through a centralized firewall. Which design should be used?

Accepted Answer

Route all internet traffic through a centralized inspection VPC using Transit Gateway.. It uses a Transit Gateway to route all outbound internet traffic from the VPC to a centralized inspection VPC, where a firewall (e.g., AWS Network Firewall or a third-party appliance) inspects and forwards traffic to an Internet Gateway. This design meets the security requirement by enforcing a single egress point, ensuring all traffic is inspected before reaching the internet.

Answer

Attach an Internet Gateway to each VPC.

Answer

Use AWS Site-to-Site VPN to a third-party firewall.

Answer

Use VPC Endpoints for all services.