ANS-C01 Practice Test 17 — 15 Questions

Question 1

A company is designing a hybrid network using AWS Direct Connect. They have two Direct Connect connections from different providers to two different AWS Direct Connect locations. They want to configure a virtual interface (VIF) that provides connectivity to multiple VPCs in the same region. Which type of VIF should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Transit virtual interface. A transit virtual interface (VIF) is the correct choice because it is specifically designed to connect a Direct Connect gateway to a single physical connection, enabling connectivity to multiple VPCs in the same or different AWS Regions. Unlike a private VIF, which only connects to a single VPC, a transit VIF works with a Direct Connect gateway and supports up to 3,000 VPC attachments per gateway, making it ideal for multi-VPC architectures.

Answer

Hosted virtual interface

Answer

Public virtual interface

Answer

Private virtual interface

Question 2

A company is deploying a fleet of EC2 instances in private subnets. The instances need to download patches from the internet. The company wants to minimize cost and avoid managing NAT instances. The VPC has an internet gateway (IGW) attached. What should the company do?

Accepted Answer

Deploy a NAT Gateway in a public subnet and update the private subnet route tables.. A NAT Gateway, deployed in a public subnet with an Elastic IP, allows instances in private subnets to initiate outbound traffic to the internet (e.g., for patch downloads) while preventing inbound connections from the internet. This solution is fully managed by AWS, eliminating the need to manage a NAT instance, and it is cost-effective compared to maintaining a dedicated instance. The private subnet route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway ID.

Answer

Attach the IGW to the private subnet route table.

Answer

Create a VPC endpoint for internet access.

Answer

Launch a NAT instance and configure routing.

Question 3

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to add an IPv6 CIDR block and ensure that traffic from the internet to the IPv6-enabled resources is allowed. Which configuration is required?

Accepted Answer

Attach an internet gateway and update route tables for IPv6.. To enable IPv6 communication from the internet to resources in a VPC, you must associate an IPv6 CIDR block with the VPC, attach an internet gateway, and update the route tables to include a default route (::/0) pointing to the internet gateway for IPv6 traffic. Option B correctly describes this configuration, as the internet gateway handles both IPv4 and IPv6 traffic, and route tables must be explicitly updated for IPv6.

Answer

Attach a NAT gateway to the VPC and update route tables.

Answer

Create a Virtual Private Gateway and attach the VPC.

Answer

Create a Transit Gateway and attach the VPC.

Question 4

Match each AWS Direct Connect virtual interface type to its use case.

Accepted Answer

Private VIF: Used to access VPCs using private IP addresses. Correct matches: Private VIF accesses VPCs via private IPs, Public VIF accesses AWS public services, Transit VIF connects multiple VPCs via Transit Gateway. Common confusions involve swapping public/private access or confusing Transit VIF with Private VIF.

Answer

Private VIF: Used to access AWS public services using public IPs

Answer

Public VIF: Used to access VPCs using private IP addresses

Answer

Transit VIF: Used to connect directly to a single VPC

Question 5

Match each AWS security feature to its description.

Accepted Answer

Security Groups: Acts as a virtual firewall for an EC2 instance at the instance level, controlling inbound and outbound traffic.. These are core security services for network protection. Security Groups are instance-level, NACLs are subnet-level, WAF protects web apps, and Shield provides DDoS protection.

Answer

Security Groups: Acts as a firewall at the subnet level.

Answer

Network ACLs: Acts as a virtual firewall for an EC2 instance.

Question 6

A company uses AWS Client VPN to provide remote access to its corporate network. Users report that they can connect to the VPN but cannot reach resources in the VPC. The VPN is configured with mutual authentication and authorization rules. What should the network engineer verify first?

Accepted Answer

The authorization rules grant access to the target network. In AWS Client VPN, authorization rules determine which users or groups can access which network resources after authentication succeeds. If users can connect (authentication works) but cannot reach VPC resources, the most likely cause is that the authorization rules do not grant access to the target network. The engineer should first verify that the authorization rules include the VPC CIDR and allow the necessary access.

Answer

The security group associated with the VPN endpoint allows inbound traffic from the client CIDR

Answer

The server certificate is valid and trusted by the client

Answer

The client CIDR range does not overlap with the VPC CIDR

Question 7

A network engineer configured VPC Flow Logs for a subnet to capture all traffic. After reviewing the logs in CloudWatch Logs, they notice that some logs show 'NODATA' for the log-status field. What does 'NODATA' indicate?

Accepted Answer

No network traffic was observed for the given capture period.. When VPC Flow Logs display 'NODATA' for the log-status field, it indicates that no network traffic was observed for the subnet during the aggregation interval (typically 10 minutes). This is a normal status meaning the capture window had zero packets flowing through the monitored interfaces, not an error or delivery issue.

Answer

The flow log record was skipped due to an internal error.

Answer

The log record was successfully delivered to CloudWatch.

Answer

The traffic was rejected by a network ACL or security group.

Question 8

A company is deploying a VPC with public and private subnets. They want to allow instances in a private subnet to access the internet for software updates while preventing inbound internet traffic. Which configuration should be used?

Accepted Answer

Attach an internet gateway to the VPC, and create a NAT gateway in a public subnet. Add a route in the private subnet route table to the NAT gateway for 0.0.0.0/0. A NAT gateway, deployed in a public subnet with an Internet Gateway (IGW) attached, allows instances in private subnets to initiate outbound IPv4 traffic to the internet (e.g., for software updates) while the IGW's one-way translation prevents unsolicited inbound traffic from reaching the private instances. The private subnet's route table must include a default route (0.0.0.0/0) pointing to the NAT gateway's elastic network interface.

Answer

Create a VPC endpoint for internet access

Answer

Use a transit gateway with a NAT instance

Answer

Attach an internet gateway to the VPC and add a route in the private subnet to the internet gateway for 0.0.0.0/0

Question 9

A company is deploying a new VPC with both public and private subnets. The public subnet hosts an internet-facing Application Load Balancer (ALB), and the private subnet hosts EC2 instances running a web application. The EC2 instances need to download updates from the internet, but they must not be directly accessible from the internet. Which combination of steps should a network engineer implement to meet these requirements?

Accepted Answer

Create a NAT Gateway in a public subnet, and add a default route (0.0.0.0/0) to the NAT Gateway in the private subnet's route table.. A NAT Gateway in a public subnet allows EC2 instances in private subnets to initiate outbound traffic to the internet (e.g., for updates) while preventing any unsolicited inbound connections from the internet. Adding a default route (0.0.0.0/0) to the NAT Gateway in the private subnet's route table directs all outbound internet traffic through the NAT Gateway, which translates the private IPs to the NAT Gateway's Elastic IP. This meets the requirement of internet access for downloads without direct internet accessibility.

Answer

Launch a proxy server in the public subnet and configure the private instances to use it for outbound traffic.

Answer

Set up a VPN connection to an on-premises network and route all internet traffic through the VPN.

Answer

Attach an Internet Gateway to the VPC and add a default route (0.0.0.0/0) to the Internet Gateway in the private subnet's route table.

Question 10

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. They want to add a second Direct Connect connection for redundancy. What is the MINIMUM number of virtual interfaces required to achieve active-active failover for the VPC?

Accepted Answer

Two private virtual interfaces (one on each connection). To achieve active-active failover for a VPC over Direct Connect, each physical connection must carry its own private virtual interface (VIF) bound to the same virtual private gateway. Two private VIFs — one per connection — allow BGP to advertise the same VPC prefixes over both links, enabling ECMP-style active-active forwarding. A single VIF cannot span two physical connections, so redundancy requires one VIF per connection.

Answer

Two transit virtual interfaces (one on each connection)

Answer

One private virtual interface and one transit virtual interface

Answer

One private virtual interface

Question 11

A company uses AWS Shield Advanced and AWS WAF to protect its web application. The security team notices that some legitimate traffic is being blocked. They want to allow traffic from a specific set of IP addresses used by their partners. How can they ensure that partner traffic is not blocked by WAF rules?

Accepted Answer

Create a WAF IP set and add a rule to allow traffic from that IP set, with a higher priority than blocking rules.. AWS WAF allows you to create an IP set containing the partner IP addresses and then add a rule with a higher priority than the blocking rules to allow traffic from that IP set. This ensures that partner traffic is explicitly allowed even if other rules would block it. Option A is incorrect because Network ACLs operate at the subnet level and are not evaluated by AWS WAF for application-layer traffic; they also do not have a whitelist feature within WAF. Option B is incorrect because removing blocking rules would leave the application vulnerable; Shield Advanced provides DDoS protection but does not replace WAF rule logic. Option C is incorrect because AWS Shield Advanced does not have an IP whitelist feature; it focuses on mitigating DDoS attacks, not on application-layer allowlisting.

Answer

Add the partner IPs to a Network ACL allow rule in the VPC.

Answer

Remove the blocking WAF rules and rely on Shield Advanced only.

Answer

Add the partner IPs to an AWS Shield Advanced IP whitelist.

Question 12

A company has a VPC with a CIDR block of 10.0.0.0/16. They have two subnets: subnet-A (10.0.1.0/24) and subnet-B (10.0.2.0/24). An EC2 instance in subnet-A needs to communicate with an RDS database in subnet-B. Both subnets are in the same Availability Zone. What is the most efficient way to enable this communication?

Accepted Answer

No additional configuration is required. The instance and database can communicate within the same VPC.. Both the EC2 instance and the RDS database reside within the same VPC (10.0.0.0/16), and subnets within a VPC can communicate with each other by default using the VPC's local route. No additional configuration is needed, as the VPC's main route table or subnet route tables already include a local route for the VPC CIDR, enabling direct communication within the same Availability Zone.

Answer

Create a Transit Gateway and attach both subnets to it.

Answer

Place a NAT Gateway in subnet-A and configure route tables accordingly.

Answer

Create a VPC Peering connection between the two subnets.

Question 13

A company is designing a disaster recovery solution that requires replicating data from an on-premises database to an Amazon RDS instance in a different AWS region. The data transfer must be encrypted in transit and should not traverse the public internet. Which approach meets these requirements?

Accepted Answer

Establish an AWS Site-to-Site VPN over an AWS Direct Connect connection. An AWS Site-to-Site VPN over an AWS Direct Connect connection provides encrypted IPsec tunnels for data in transit while keeping traffic entirely within the private network, avoiding the public internet. The Direct Connect private VIF establishes a dedicated private link to AWS, and the VPN overlay adds encryption, meeting both requirements for an on-premises to RDS cross-region replication scenario.

Answer

Use an AWS Direct Connect connection with public VIF

Answer

Establish an AWS Site-to-Site VPN over the internet

Answer

Use VPC Peering between the on-premises network and the RDS VPC

Question 14

A company wants to securely connect an on-premises data center to a VPC in AWS. The connection must be encrypted and use the public internet. The company has a moderate volume of traffic and needs a quick setup. Which solution meets these requirements?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN uses IPsec over the public internet to connect an on-premises network to a VPC, providing encryption in transit and quick provisioning (typically minutes). It supports moderate throughput per tunnel (up to ~1.25 Gbps per tunnel) and is the standard answer when encryption plus public internet plus fast setup are required. It is the only option that satisfies all three constraints simultaneously.

Answer

AWS Client VPN

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Question 15

A company uses a centralized inspection VPC for traffic inspection. All VPCs route traffic to the inspection VPC via Transit Gateway. The security team wants to ensure that all traffic between VPCs is inspected by a network virtual appliance in the inspection VPC. Which Transit Gateway feature should be configured?

Accepted Answer

Transit Gateway route tables. Transit Gateway route tables allow you to control routing between attachments. By associating VPC attachments with a specific route table and propagating routes only to the inspection VPC attachment, you can force all inter-VPC traffic through the inspection VPC. This is the standard method to achieve centralized inspection with AWS Transit Gateway.

Answer

Transit Gateway flow logs

Answer

Transit Gateway multicast

Answer

Transit Gateway peering