ANS-C01 Practice Test 16 — 15 Questions

Question 1

An engineer runs the command above for a subnet associated with this network ACL. The subnet's CIDR is 10.0.1.0/24. An EC2 instance in the subnet attempts to initiate an HTTPS connection to a server on the internet. What is the result?

Accepted Answer

The connection fails because the inbound HTTPS return traffic is denied by rule 200.. Option C is correct. The outbound rule allows ephemeral ports for return traffic. Inbound rule 100 allows HTTPS from the subnet CIDR only, not from the internet. Rule 200 denies all other HTTPS inbound. Therefore, the outbound SYN packet is allowed by the default outbound allow (since no outbound deny), but the inbound SYN-ACK from the internet is denied by rule 200 (since it is HTTPS return traffic, source port 443, destination ephemeral port). However, the outbound rule allows traffic to any destination on ephemeral ports, but the inbound rule for return traffic must match the source port (443) and destination port (ephemeral). The inbound rules show rule 100 allows from 10.0.1.0/24 port 443, which is not the return path. Rule 200 denies all HTTPS from anywhere. So the inbound SYN-ACK is dropped. The connection fails.

Answer

The connection fails because the outbound rule does not allow HTTPS.

Answer

The connection succeeds because outbound traffic is allowed.

Answer

The connection succeeds because inbound rule 100 allows HTTPS from the subnet.

Question 2

A company has an AWS Direct Connect connection and wants to use it to access Amazon S3 buckets without traversing the public internet. Which virtual interface type should be used?

Accepted Answer

Public virtual interface. A public virtual interface (VIF) allows access to public AWS services, including S3, over Direct Connect. A private VIF is for accessing resources in a VPC. A transit VIF is for connecting to a transit gateway. A hosted VIF is provided by an AWS partner.

Answer

Transit virtual interface

Answer

Hosted virtual interface

Answer

Private virtual interface

Question 3

A company is setting up a new AWS Direct Connect connection. They have provisioned a 1 Gbps dedicated connection. They need to create a private virtual interface (VIF) to connect to their VPC. The VIF has been created and is in the 'available' state, but the BGP session is not coming up. What is the most likely cause?

Accepted Answer

The BGP authentication key does not match between the customer router and AWS.. Option B is correct because BGP authentication must match on both sides. Option A is wrong because VLAN ID must be unique per VIF but does not prevent BGP from coming up. Option C is wrong because the BGP timer can be adjusted but does not prevent session establishment. Option D is wrong because the interface state is already available.

Answer

The BGP hold timer is set too high on the customer router.

Answer

The VLAN ID assigned to the VIF is already in use on another VIF.

Answer

The Direct Connect interface is in the 'down' state.

Question 4

A company needs to allow a specific IP address range (203.0.113.0/24) to access an Amazon RDS database in a private subnet. The RDS instance is deployed in a VPC with no public access. Which configuration step is required?

Accepted Answer

Create an AWS Site-to-Site VPN connection and update route tables to route the on-premises CIDR to the virtual private gateway. RDS instances in a private subnet are not directly accessible from the internet. To allow access from an on-premises network, a VPN or Direct Connect connection is needed. The security group must allow inbound traffic from the on-premises CIDR, and the route tables must route traffic to the VPN/Direct Connect. Simply adding a security group rule does not provide connectivity; a network path is required.

Answer

Add a security group rule allowing inbound traffic from 203.0.113.0/24

Answer

Assign a public IP address to the RDS instance

Answer

Modify the network ACL of the private subnet to allow inbound traffic from 203.0.113.0/24

Question 5

A company has a VPC with a CIDR of 10.0.0.0/16. It has six subnets: three public (10.0.1.0/24, 10.0.2.0/24, 10.0.3.0/24) and three private (10.0.4.0/24, 10.0.5.0/24, 10.0.6.0/24). The company wants to launch an RDS instance in a private subnet. Which subnet should the RDS instance be placed in to maximize high availability and follow best practices?

Accepted Answer

Place the RDS instance in two private subnets that are in different Availability Zones.. RDS requires two subnets in different AZs for Multi-AZ deployments. The private subnets 10.0.4.0/24, 10.0.5.0/24, and 10.0.6.0/24 are in three different AZs (assuming each subnet is in a different AZ). Option A is correct because it indicates using two private subnets in different AZs. Option B is incorrect because public subnets expose the database. Option C is incorrect because a single subnet does not provide high availability. Option D is incorrect because RDS does not require all six subnets.

Answer

Place the RDS instance in a public subnet and use security groups to restrict access.

Answer

Place the RDS instance in all three private subnets to maximize availability.

Answer

Place the RDS instance in a single private subnet with a large CIDR for future scaling.

Question 6

A company has a VPC with a CIDR of 10.0.0.0/16 and wants to connect to another VPC with CIDR 10.0.0.0/16 in a different account. The VPCs are in the same region. Which THREE steps are necessary to establish connectivity? (Choose THREE.)

Accepted Answer

Change the CIDR block of one VPC to a non-overlapping range.. Option A is correct: Overlapping CIDRs must be resolved, typically by changing one VPC's CIDR. Option B is correct: VPC peering requires a request from one account and acceptance from the other. Option D is correct: Route tables must be updated to route traffic to the peering connection. Option C is wrong because a VPN is unnecessary. Option E is wrong because VPC endpoints are for accessing services, not for VPC peering.

Answer

Create VPC endpoints in each VPC for the other VPC's services.

Answer

Set up a VPN connection between the VPCs.

Question 7

A company has a global application that uses Amazon Route 53 for DNS. The application is deployed in us-east-1 and eu-west-1. The company wants to route users to the Region with the lowest latency, but also provide failover if one Region becomes unhealthy. Which Route 53 routing policy should be used?

Accepted Answer

Latency-based routing with health checks. Option D is correct because latency-based routing with health checks automatically routes to the lowest latency region that is healthy. Option A is wrong because geoproximity routing uses location, not latency. Option B is wrong because failover routing does not consider latency. Option C is wrong because weighted routing does not consider latency or health.

Answer

Weighted routing with equal weights

Answer

Failover routing with primary in us-east-1

Answer

Geoproximity routing

Question 8

A company is migrating its on-premises data center to AWS. The network team needs to extend the on-premises network to the cloud and support IP multicast traffic between environments. Which AWS service or feature should be used?

Accepted Answer

AWS Transit Gateway with multicast support. AWS Transit Gateway supports multicast groups and allows multicast traffic between attached VPCs and VPN connections. VPC peering does not support multicast. AWS Direct Connect alone does not support multicast. A VPN connection alone does not support multicast.

Answer

AWS Direct Connect with a private virtual interface

Answer

Site-to-Site VPN connection

Answer

VPC peering connection

Question 9

A company is deploying a multi-tier web application across multiple AWS accounts. They want to centralize network security by using a shared services VPC with a Transit Gateway. All application VPCs will be attached to the Transit Gateway. The security team needs to inspect and filter traffic between application VPCs. Which solution should be used to meet this requirement?

Accepted Answer

Deploy a Transit Gateway and attach a central inspection VPC with a firewall appliance. Configure route tables to send inter-VPC traffic through the inspection VPC.. Option C is correct because a Transit Gateway with a central inspection VPC containing a firewall appliance (like Palo Alto Networks or AWS Network Firewall) allows traffic to be routed through the inspection point for filtering. Option A is wrong because Network ACLs are stateless and applied at the subnet level, not between VPCs. Option B is wrong because security groups are stateful and applied at the instance level, not for traffic between VPCs. Option D is wrong because VPC Peering does not support centralized inspection by default.

Answer

Create VPC Peering connections between each pair of application VPCs and apply security groups to the peer connections.

Answer

Use security groups in each application VPC to control traffic between VPCs.

Answer

Use network ACLs in each application VPC to filter traffic between VPCs.

Question 10

A company is deploying a VPC with public and private subnets. They need to provide internet access to instances in the private subnets for software updates. Which THREE components are required to achieve this?

Accepted Answer

Route table in the private subnet with a default route pointing to the NAT Gateway. Options B, C, and E are correct. A NAT Gateway (or NAT instance) in a public subnet, an Internet Gateway attached to the VPC, and a route table in the private subnet pointing to the NAT Gateway are required. Option A is wrong because a VPN connection is not needed. Option D is wrong because a Direct Connect connection is not needed.

Answer

AWS Site-to-Site VPN connection

Answer

AWS Direct Connect connection

Question 11

A company is designing a network for a high-traffic web application that must be highly available across multiple AWS Regions. The application uses Application Load Balancers (ALBs) in each region. Which TWO actions should be taken to route traffic to the nearest healthy endpoint?

Accepted Answer

Use Amazon Route 53 latency-based routing with health checks. Route 53 latency-based routing directs traffic to the region with the lowest latency. Health checks ensure traffic is only sent to healthy endpoints. Global Accelerator also provides routing to the nearest healthy endpoint via anycast. Weighted routing does not consider latency. Failover routing is for active-passive. Multi-value answer routing is for DNS-based load balancing without health check integration with latency.

Answer

Use Amazon Route 53 weighted routing

Answer

Use Amazon Route 53 multi-value answer routing

Answer

Use Amazon Route 53 failover routing

Question 12

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to two on-premises locations via AWS Direct Connect. Each Direct Connect connection uses a private VIF. The company wants to use BGP to exchange routes. The on-premises routers advertise the same prefix 10.0.0.0/8 for both connections. How should the network engineer configure the VPC route tables to ensure traffic is load balanced across both Direct Connect connections?

Accepted Answer

Allow BGP to install both routes; AWS will automatically load balance across them using ECMP.. AWS supports equal cost multipath (ECMP) only when BGP routes are learned from different Direct Connect connections but with the same AS path length and prefix. Since both on-premises advertise the same prefix with identical AS path, AWS will install two equal-cost routes and load balance (ECMP) across them. Option A is correct. Option B is incorrect because using a VPN would not use Direct Connect. Option C is incorrect because weight-based routing requires different weights. Option D is incorrect because AWS does not support ECMP across different prefixes.

Answer

Create a VPN connection over the Direct Connect and use BGP with different metrics.

Answer

Create two separate route tables and associate each with half the subnets.

Answer

Use AWS Transit Gateway with equal cost multipath routing.

Question 13

A company is designing a network for a three-tier web application. The web tier must be accessible from the internet, the application tier must only be accessible from the web tier, and the database tier must only be accessible from the application tier. All tiers must be in private subnets except the web tier. Which combination of AWS services and routing should be used to meet these requirements?

Accepted Answer

Use an internet gateway attached to the VPC, public subnet for web tier, private subnets for app and database tiers, and security groups to restrict traffic between tiers.. An internet gateway provides internet access to the public subnet (web tier). Security groups control traffic between tiers: allow HTTP/HTTPS from internet to web, allow traffic from web to app, and from app to database. Option A is correct. Option B is incorrect because NACLs are stateless and more complex for tier-to-tier filtering. Option C is incorrect because NAT gateways are for outbound internet, not inbound. Option D is incorrect because a VPN is not needed for internet access.

Answer

Use a NAT gateway in the public subnet for web tier, and route all traffic through it.

Answer

Use a VPN connection to the internet gateway and route traffic through a virtual private gateway.

Answer

Use an internet gateway, public subnet for web tier, private subnets for app and database, and network ACLs to filter traffic between tiers.

Question 14

A network engineer is designing a hybrid network using AWS Transit Gateway with multiple VPCs and an on-premises data center connected via AWS Direct Connect. The VPCs need to communicate with each other and with on-premises, but must isolate development VPCs from production VPCs. What is the MOST scalable and cost-effective approach?

Accepted Answer

Use a single Transit Gateway with separate route tables for development and production VPCs, and a shared route table for on-premises attachment.. Option A is correct because Transit Gateway route tables allow isolation between VPCs while sharing connectivity to on-premises. Option B is wrong because VPC peering does not scale and requires full mesh. Option C is wrong because a single route table would not isolate development and production. Option D is wrong because VPN over Direct Connect adds complexity and cost without benefit.

Answer

Use a single Transit Gateway with one route table for all VPCs and on-premises, and use network ACLs for isolation.

Answer

Create VPC peering connections between all VPCs and a Direct Connect gateway for on-premises connectivity.

Answer

Use a VPN connection from each VPC to on-premises over Direct Connect, and allow VPC communication via VPN.

Question 15

A company is designing a VPC architecture for a web application that must be highly available across multiple Availability Zones. Which TWO components should be deployed in at least two Availability Zones to meet this requirement?

Accepted Answer

NAT Gateway. Options B and D are correct. NAT Gateways are AZ-specific, so deploying in multiple AZs ensures availability if one AZ fails. Application Load Balancers are regional services but can be configured with subnets in multiple AZs. Option A is wrong because an Internet Gateway is a horizontally scaled, redundant service per VPC, not per AZ. Option C is wrong because a VPN connection is per VPC, not per AZ. Option E is wrong because a Transit Gateway is a regional service.

Answer

Transit Gateway

Answer

Internet Gateway

Answer

VPN connection