ANS-C01 Practice Test 16 — 15 Questions

Question 1

A company is using AWS Organizations to manage multiple accounts. The network team needs to allow a centralized inspection VPC to inspect all traffic between VPCs in different accounts. Which AWS service should be used to route traffic through the inspection VPC?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway acts as a central hub for inter-VPC and inter-account traffic, enabling you to attach VPCs from multiple AWS accounts (via AWS Organizations) and route traffic through a centralized inspection VPC. By using Transit Gateway route tables and a dedicated inspection VPC with appliances (e.g., firewall), you can enforce traffic inspection for all cross-account VPC communications without requiring individual peering connections.

Answer

VPC peering connections

Answer

AWS PrivateLink

Answer

AWS Site-to-Site VPN

Question 2

A company is running a stateful firewall appliance in an EC2 instance in a VPC. The appliance inspects traffic between subnets. The company needs to ensure that traffic from the web tier subnet to the application tier subnet passes through the firewall, but the firewall itself must not affect other traffic. Which configuration should the company implement?

Accepted Answer

Use a Gateway Load Balancer to deploy the firewall appliance in a separate subnet, and configure route tables to send inter-subnet traffic to the Gateway Load Balancer endpoint.. A Gateway Load Balancer (GWLB) allows you to deploy a fleet of third-party firewall appliances in a separate subnet and use a Gateway Load Balancer endpoint (GWLBe) to transparently intercept and steer inter-subnet traffic through the firewall. By configuring the route tables of the web and application subnets to send traffic to the GWLBe, the firewall inspects only the desired traffic without affecting other VPC traffic, as the GWLB operates at Layer 3 (Geneve encapsulation) and does not alter the source/destination IP addresses.

Answer

Place the firewall in the same subnet as the web tier and use security groups to redirect traffic.

Answer

Place the firewall in a separate subnet and use network ACLs to force traffic through it.

Answer

Use a transit gateway with appliance mode and attach all subnets to it, then configure routing to send traffic through the firewall.

Question 3

A company is deploying a VPC with public and private subnets in two Availability Zones. The public subnets contain NAT gateways for outbound internet access from the private subnets. The private subnets host web servers that need to make API calls to an external service over the internet. After implementation, the web servers cannot reach the internet. Which configuration is the most likely cause?

Accepted Answer

The NAT gateway is placed in a private subnet and does not have a route to the internet gateway.. A NAT gateway must be placed in a public subnet with a route to an internet gateway (IGW) to translate private IP addresses for outbound traffic. If the NAT gateway is in a private subnet, it cannot reach the IGW, so the private web servers' traffic destined for the internet (via the 0.0.0.0/0 route pointing to the NAT gateway) will fail, as the NAT gateway itself has no path to the internet.

Answer

The route table for the private subnets is not associated with the VPC's main route table.

Answer

The private subnets have a default route (0.0.0.0/0) pointing to an internet gateway instead of the NAT gateway.

Answer

The public subnets have a default route pointing to the NAT gateway instead of the internet gateway.

Question 4

A network engineer is configuring a Site-to-Site VPN connection between an on-premises network and AWS. The engineer wants to ensure high availability by using two tunnels. Which two components must be configured to achieve this? (Choose TWO.)

Accepted Answer

A virtual private gateway with two BGP sessions. For high availability with two tunnels in an AWS Site-to-Site VPN, a single VPN connection provides two tunnels by default, terminating on two different AWS endpoints. This requires only one customer gateway with a single public IP address. The virtual private gateway must be configured with two BGP sessions (one per tunnel) to support dynamic routing and automatic failover. Option C is incorrect because two customer gateways are unnecessary; one customer gateway with one IP suffices. Option D is incorrect because two VPN connections are not required—a single VPN connection already provides two tunnels. Option A is incorrect because a customer gateway cannot have two IP addresses. Option B is incorrect because an AWS Transit Gateway is optional and not required for a basic HA VPN setup.

Answer

A single customer gateway with two IP addresses

Answer

An AWS Transit Gateway

Answer

Two customer gateways, each with a unique public IP address

Answer

Two VPN connections

Question 5

A company applies the above S3 bucket policy. An administrator reports that an application using the AWS SDK is unable to upload objects to the bucket from an EC2 instance in the same account. The EC2 instance has an IAM role with s3:PutObject permission. What is the most likely cause?

Accepted Answer

The application is using HTTP instead of HTTPS.. The bucket policy includes a condition 'aws:SecureTransport': 'true', which requires all requests to use HTTPS. If the AWS SDK is configured to use HTTP instead of HTTPS, the request will be denied even though the IAM role has s3:PutObject permission. Option A is incorrect because the bucket policy likely grants access to all users in the account or to the IAM role specifically, not just the root user. Option B is incorrect because server-side encryption is not required by the policy; only HTTPS is enforced. Option C is incorrect because the policy resource typically covers both the bucket and its objects, so access to the bucket is granted.

Answer

The bucket policy grants access to the root user only, not the IAM role.

Answer

The application is not using server-side encryption.

Answer

The bucket policy does not grant access to the bucket itself, only to objects.

Question 6

Which TWO of the following are true about AWS VPC security groups? (Choose two.)

Accepted Answer

They have an implicit deny all rule at the end.. Security groups in AWS VPC are stateful, meaning that if you allow inbound traffic, the corresponding outbound return traffic is automatically permitted, regardless of outbound rules. They also have an implicit deny all rule at the end, so any traffic not explicitly allowed by a rule is denied. This makes options B and C correct.

Answer

Rules are evaluated in order, and the first matching rule is applied.

Answer

They support both allow and deny rules.

Answer

They can be associated with subnets.

Question 7

A security engineer attaches the above IAM policy to an IAM user. The user then attempts to launch an EC2 instance from an IP address outside the 10.0.0.0/8 range. What will happen?

Accepted Answer

The request will be denied because the condition is not satisfied.. The policy allows ec2:* only when the source IP is within 10.0.0.0/8. If the user is coming from outside that range, the condition is not met, so the action is not allowed. The default is implicit deny, so the request will be denied. Option B is correct. Option A is wrong because the condition is not met. Option C is wrong because the policy does not deny explicitly; it just doesn't allow. Option D is wrong because the condition evaluates to false.

Answer

The request will be allowed because the policy allows ec2:* on all resources.

Answer

The request will be denied because the policy does not include a Deny statement.

Answer

The request will be allowed because the condition evaluates to true.

Question 8

A company has a VPC with multiple EC2 instances that need to access an Amazon S3 bucket. The network team wants to ensure that traffic to S3 stays within the AWS network and does not traverse the internet. The VPC has a VPC endpoint for S3 (Gateway type). The team has created the endpoint and attached the appropriate policy allowing access to the specific S3 bucket. However, EC2 instances in a private subnet cannot access the S3 bucket. The private subnet route table has a default route pointing to a NAT Gateway. Which change should the network team make to allow private instances to access S3 via the endpoint?

Accepted Answer

Add a route in the private subnet route table for the S3 prefix list (com.amazonaws.region.s3) pointing to the VPC endpoint.. For a Gateway VPC endpoint to work, the route table associated with the subnet must include a route for the S3 prefix list (e.g., com.amazonaws.region.s3) pointing to the endpoint ID. The existing default route to the NAT Gateway would otherwise route S3 traffic to the internet, bypassing the endpoint. Adding the specific route for the S3 prefix list ensures that traffic destined for S3 uses the VPC endpoint and stays within the AWS network. Therefore, option D is correct.

Answer

Modify the VPC endpoint policy to allow all principals.

Answer

Change the private subnet route table's default route to point to the VPC endpoint.

Answer

Remove the default route from the private subnet route table.

Question 9

A company has a VPC with multiple subnets. An EC2 instance in a private subnet needs to access an S3 bucket to download files. The company wants to avoid using a NAT gateway and minimize latency. Which solution should be used?

Accepted Answer

Create a VPC endpoint for S3 and attach it to the private subnet's route table.. A VPC endpoint for S3 allows the EC2 instance in the private subnet to access S3 directly over the AWS network, avoiding internet-bound traffic and eliminating the need for a NAT gateway. This minimizes latency because traffic stays within the AWS backbone and does not traverse the public internet. Attaching the endpoint to the private subnet's route table ensures that S3-bound traffic is routed through the endpoint.

Answer

Place the instance in a public subnet and use a NAT gateway.

Answer

Use a VPC endpoint for EC2.

Answer

Use an internet gateway and a route to 0.0.0.0/0.

Question 10

A company is designing a network for a three-tier web application in AWS. The web tier must be accessible from the internet, but the application and database tiers must be private. The company wants to use a single AWS Region and ensure high availability across multiple Availability Zones. What is the MOST cost-effective network design that meets these requirements?

Accepted Answer

Place web servers in public subnets across three AZs. Place application and database servers in private subnets across three AZs. Use a NAT Gateway in each AZ for outbound traffic.. It places web servers in public subnets across three Availability Zones (AZs) for internet-facing access and high availability, while application and database servers reside in private subnets across three AZs for isolation. A NAT Gateway in each AZ provides cost-effective outbound internet connectivity for private instances without exposing them to inbound traffic, and using one NAT Gateway per AZ avoids cross-AZ data transfer charges, which would increase costs if a single NAT Gateway were shared across AZs.

Answer

Place web servers in public subnets across three AZs. Place application and database servers in private subnets across three AZs. Use NAT instances in each AZ behind an Auto Scaling group.

Answer

Place web servers in public subnets and application/database servers in private subnets in one AZ. Use a single NAT Gateway in the public subnet for outbound traffic.

Answer

Place all tiers in public subnets and use security groups to restrict inbound traffic to the web tier only.

Question 11

A company is designing a hybrid network with a Direct Connect connection. The VPC has multiple subnets that need to communicate with on-premises. The company wants to use a single VIF for both private and public traffic. Which type of VIF should be used?

Accepted Answer

A single VIF cannot carry both private and public traffic. A single Virtual Interface (VIF) on an AWS Direct Connect connection is designed to carry either private traffic (VPC-to-on-premises via private IPs) or public traffic (to AWS public services like S3, DynamoDB via public IPs), but not both simultaneously. This is because a Private VIF uses BGP to exchange routes over private IP addresses within a VPC, while a Public VIF uses BGP to exchange routes for AWS public IP prefixes. The two traffic types require separate BGP sessions and separate VLANs, making it impossible to combine them into one VIF.

Answer

Public VIF

Answer

Hosted VIF

Answer

Private VIF

Question 12

A company needs to connect its on-premises data center to AWS using a site-to-site VPN. The on-premises firewall does not support IPsec. What alternative solution can the company use?

Accepted Answer

Use AWS Client VPN to establish a VPN connection from the on-premises network.. AWS Client VPN is a managed, OpenVPN-based service that allows on-premises clients to securely access AWS resources without requiring IPsec support on the on-premises firewall. Since the firewall does not support IPsec, Client VPN provides an alternative by using TLS-based VPN tunnels that only require standard TCP/UDP ports (typically 443) to be open, making it compatible with nearly any firewall.

Answer

Create a VPC peering connection between the on-premises router and the VPC.

Answer

Deploy an AWS Transit Gateway and attach the on-premises network via a VPC attachment.

Answer

Use AWS Direct Connect to establish a dedicated physical link.

Question 13

A company is deploying a multi-tier web application across multiple Availability Zones in a single Region. The web tier must be fault-tolerant and distribute traffic across EC2 instances. The application tier uses an Auto Scaling group of EC2 instances that need to be accessed by the web tier using a static IP address. Which combination of AWS services meets these requirements?

Accepted Answer

Application Load Balancer for the web tier and Network Load Balancer for the application tier. The web tier requires fault tolerance and traffic distribution across EC2 instances, which is best handled by an Application Load Balancer (ALB) operating at Layer 7 with path-based routing and health checks. The application tier needs a static IP address for the web tier to access it, which is a key feature of a Network Load Balancer (NLB) — it preserves the client IP and provides static IP addresses per Availability Zone, unlike ALBs which use dynamic IPs. This combination meets both requirements: ALB for web traffic distribution and NLB for static IP access to the application tier.

Answer

Classic Load Balancer for the web tier and Application Load Balancer for the application tier

Answer

AWS Global Accelerator for the web tier and Classic Load Balancer for the application tier

Answer

Network Load Balancer for the web tier and Application Load Balancer for the application tier

Question 14

Which TWO of the following are valid methods to connect multiple VPCs in the same AWS region? (Select TWO.)

Accepted Answer

VPC peering. VPC peering (Option A) is a valid method to connect multiple VPCs in the same AWS region. It uses the AWS global network infrastructure to create a one-to-one, private IPv4 or IPv6 routing connection between two VPCs, allowing traffic to flow as if they were on the same network. This is a direct, non-transitive connection that does not require a separate transit hub.

Answer

AWS Direct Connect

Answer

VPC endpoints

Answer

Site-to-Site VPN

Question 15

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to add IPv6 connectivity to the VPC and allow resources in a private subnet to access the internet via IPv6. Which design should be used?

Accepted Answer

Allocate an IPv6 CIDR block, create an egress-only Internet Gateway, and add a route to it from the private subnet.. An egress-only Internet Gateway (EIGW) is the correct AWS-managed service for enabling outbound-only IPv6 traffic from a VPC's private subnet to the internet, while preventing any unsolicited inbound connections. Unlike an Internet Gateway (IGW), which allows bidirectional traffic, an EIGW is specifically designed for IPv6 and ensures that resources in private subnets can initiate outbound connections without being directly reachable from the internet.

Answer

Allocate an IPv6 CIDR block and add a route to an Internet Gateway from the private subnet.

Answer

Use a NAT instance with IPv6 support in a public subnet.

Answer

Allocate an IPv6 CIDR block and use a NAT Gateway for IPv6 traffic.