ANS-C01 Practice Test 17 — 15 Questions

Question 1

A company has deployed an application in a VPC with public and private subnets. The application uses an Amazon RDS for MySQL database in a private subnet. To meet security requirements, the database must not be accessible from the internet. The application team needs to connect to the database for maintenance using SSH over a bastion host. Which architecture is the most secure?

Accepted Answer

Bastion host in a public subnet with a security group allowing SSH from the corporate IP range, and database security group allowing MySQL from the bastion host's security group. A bastion host in a public subnet with a security group that allows SSH only from the corporate IP range, and the database security group allowing MySQL access only from the bastion host's security group, provides defense in depth. Using the same security group for both is less secure. Allowing SSH from anywhere (0.0.0.0/0) is insecure. A VPN provides secure access but is not always the simplest for maintenance; the bastion approach is common and secure when properly restricted.

Answer

Bastion host in a public subnet with the same security group as the database, allowing SSH from the corporate IP range and MySQL from the bastion

Answer

Bastion host in a public subnet with a security group allowing SSH from 0.0.0.0/0, and database security group allowing MySQL from the bastion host's security group

Answer

Connect to the database directly using a Site-to-Site VPN without a bastion host

Question 2

A company has a VPC with a CIDR of 10.0.0.0/16. They have set up a VPC peering connection with another VPC (CIDR 172.16.0.0/16). The route tables are configured correctly. However, instances in the first VPC cannot communicate with instances in the peered VPC. The security groups and network ACLs are configured to allow all traffic. What is the most likely cause?

Accepted Answer

The DNS resolution settings for the VPC peering connection are not enabled.. Option B is correct because DNS resolution settings for VPC peering must be enabled for instances to resolve DNS hostnames across the peering connection. Option A is wrong because route tables are already configured correctly. Option C is wrong because the CIDRs are different and non-overlapping. Option D is wrong because ICMP is not required for basic connectivity.

Answer

The route tables in the VPCs are not propagated to the subnets.

Answer

The instances do not have ICMP traffic allowed.

Answer

The VPC CIDR ranges overlap.

Question 3

A company is deploying a critical application across multiple Availability Zones in a single AWS Region. They need a network design that provides the lowest possible latency between application tiers and supports automatic failover if an AZ becomes unavailable. Which design meets these requirements?

Accepted Answer

Deploy an internal NLB per Availability Zone, with each NLB only registering targets in its own AZ, and an internet-facing Application Load Balancer (ALB) with targets in all AZs. Using an internal Network Load Balancer (NLB) in each AZ with cross-zone load balancing disabled ensures traffic stays within the AZ for lowest latency, and using an Application Load Balancer (ALB) for the front end with targets in each AZ provides failover. A single NLB across AZs adds cross-AZ latency. Classic Load Balancer is legacy. Route 53 weighted routing is not automatic failover.

Answer

Use Amazon Route 53 weighted routing to distribute traffic to each AZ

Answer

Use a single internal Classic Load Balancer across all AZs

Answer

Deploy an internal Network Load Balancer (NLB) in a single AZ and route traffic from other AZs through it

Question 4

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company wants to use a single NAT Gateway for all private subnets to reduce costs, but the NAT Gateway is in a single Availability Zone (AZ). The network architect is concerned about single points of failure. Which design best addresses high availability while still using the minimum number of NAT Gateways?

Accepted Answer

Deploy one NAT Gateway in each AZ that contains private subnets, and update the route tables accordingly.. Using one NAT Gateway per AZ that has private subnets provides high availability. The minimum is 2 if there are at least 2 AZs with private subnets. Option B is incorrect because a single NAT Gateway is a single point of failure. Option C is incorrect because NAT instances are less reliable and require management. Option D is incorrect because multiple VPCs add complexity and cost.

Answer

Deploy a single NAT Gateway in one AZ and use a VPN to an on-premises internet gateway as backup.

Answer

Use a NAT instance in an Auto Scaling group across multiple AZs instead of a NAT Gateway.

Answer

Create a second VPC with a NAT Gateway and peer the VPCs to share the NAT Gateway.

Question 5

A company has a VPC with a CIDR of 10.0.0.0/16. It has two subnets: 10.0.1.0/24 (public) and 10.0.2.0/24 (private). The company wants to use AWS Site-to-Site VPN to connect to an on-premises network with a CIDR of 192.168.0.0/16. The VPN connection uses a virtual private gateway (VGW) attached to the VPC. The on-premises network has a VPN appliance that supports BGP. The company also wants to use static routes for the VPN. Which configuration is required to enable communication between the VPC and on-premises network?

Accepted Answer

Add a route in the VPC route table for 192.168.0.0/16 with target the virtual private gateway.. For a VPN using a virtual private gateway with static routes, you must add a route in the VPC route table for the on-premises CIDR (192.168.0.0/16) pointing to the virtual private gateway. Option A is correct. Option B is incorrect because the route must be to the VGW. Option C is incorrect because you don't need to modify the on-premises route table. Option D is incorrect because NAT is not required.

Answer

Add a route in the on-premises route table for 10.0.0.0/16 pointing to the VPN appliance.

Answer

Create a NAT gateway in the public subnet and route traffic through it.

Answer

Add a route in the VPC route table for 192.168.0.0/16 with target the internet gateway.

Question 6

A company wants to connect its on-premises data center to AWS using a dedicated, high-bandwidth, low-latency connection. The data center is collocated with an AWS Direct Connect location. Which AWS service should be used to establish this connection?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated private connection from on-premises to AWS. Option B is correct. Option A (VPN) uses the public internet. Option C (VPC peering) is for VPC-to-VPC. Option D (Transit Gateway) is a network transit hub but requires an underlying connection.

Answer

VPC peering

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Question 7

A company uses AWS Direct Connect with a private VIF to connect its data center to a VPC. The VPC has multiple subnets. The on-premises network team reports that they can ping the VPC's private IP addresses but cannot connect to an EC2 instance's port 443. The EC2 instance's security group allows HTTPS from the on-premises CIDR. What should the engineer check NEXT?

Accepted Answer

Check the EC2 instance's operating system firewall (e.g., iptables, Windows Firewall) to see if port 443 is blocked.. Option C is correct because the instance may have a host-based firewall blocking the port; this is a common issue. Option A is wrong because route tables are for routing, not port filtering. Option B is wrong because security group already allows the traffic. Option D is wrong because the virtual interface is up (ping works).

Answer

Check the security group's inbound rules for port 443.

Answer

Confirm that the Direct Connect virtual interface is in the 'up' state.

Answer

Verify that the route tables in the VPC have a route back to the on-premises CIDR.

Question 8

A Network Engineer is troubleshooting a cross-account VPC endpoint connection. The service provider account (123456789012) has the above IAM policy attached to the endpoint service. The consumer account (111111111111) has created a VPC endpoint (vpce-abc123) and is trying to accept the connection. The consumer receives an 'AccessDenied' error when calling ec2:AcceptVpcEndpointConnections. What is the MOST likely cause?

Accepted Answer

The consumer account does not have permission to accept the connection; only the service provider can accept.. Option D is correct. The policy allows the ec2:AcceptVpcEndpointConnections action, but that action is performed by the service provider, not the consumer. The consumer needs to create the endpoint, but the acceptance is done by the provider. The error likely occurs because the consumer does not have permission to call AcceptVpcEndpointConnections on the provider's endpoint service. The policy in the provider account allows the provider to accept connections from the specified consumer endpoint. However, the consumer is trying to accept the connection themselves, which is not allowed. The provider must accept the connection using the provider account. Alternatively, the consumer might be trying to modify the endpoint to auto-accept, but that requires permissions. The most likely cause is that the consumer is attempting to accept the connection, but only the provider can accept. So the answer is D: The consumer does not have the required permissions to accept the connection on the provider's endpoint service.

Answer

The policy action should be 'ec2:CreateVpcEndpoint' instead.

Answer

The policy condition 'aws:SourceArn' does not match the consumer's endpoint ARN.

Answer

The policy resource ARN is incorrect; it should be the endpoint service ARN.

Question 9

A company has a VPC with a CIDR block of 10.0.0.0/16. It has a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). An EC2 instance in the private subnet needs to access an S3 bucket. The company wants to ensure that traffic to S3 does not traverse the internet. Which solution should be used?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and add a route in the private subnet route table pointing to the endpoint. A VPC Gateway Endpoint for S3 allows private subnet instances to access S3 without internet. A NAT Gateway uses the internet. An Interface Endpoint is for other AWS services, not S3. Direct Connect is not necessary for S3 access within the same region.

Answer

Create a VPC Interface Endpoint for S3 and associate it with the private subnet

Answer

Create a NAT Gateway in the public subnet and add a route in the private subnet route table pointing to the NAT Gateway

Answer

Set up an AWS Direct Connect connection and use a private virtual interface

Question 10

A company has a VPC with multiple subnets. They want to ensure that all outbound traffic from EC2 instances in the VPC goes through a centralized NAT device for inspection. They have deployed a NAT instance in a public subnet and configured the route tables for private subnets to point to the NAT instance. However, traffic is not being routed through the NAT instance. What is the most likely cause?

Accepted Answer

The source/destination check is enabled on the NAT instance.. Option C is correct because the NAT instance must have source/destination check disabled to forward traffic for other instances. Option A is wrong because the route table is already configured. Option B is wrong because the NAT instance itself can have its own route table for internet access. Option D is wrong because security groups can allow traffic; the issue is routing.

Answer

The NAT instance does not have a public IP address.

Answer

The route table for the private subnets does not have a default route (0.0.0.0/0) pointing to the NAT instance.

Answer

The security group of the NAT instance blocks outbound traffic.

Question 11

A company has a VPC with multiple subnets. They want to monitor all network traffic to and from an EC2 instance for troubleshooting. Which AWS service should they use?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information and can be used to monitor network traffic. AWS CloudTrail records API calls, not network traffic. Amazon Inspector is for security assessments. AWS Config tracks resource configuration. Amazon GuardDuty is for threat detection.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS CloudTrail

Question 12

A company has a VPC with public and private subnets in two Availability Zones. The private subnets host EC2 instances that need to access the internet for software updates but must not be accessible from the internet. Which combination of resources meets these requirements with the least operational overhead?

Accepted Answer

A NAT Gateway in each public subnet, with a route in the private route tables pointing to the NAT Gateway. A NAT Gateway in a public subnet provides outbound internet access for private instances while preventing inbound access. Option A is correct. Option B (NAT instance) requires management. Option C (VPC endpoint) is for specific AWS services, not general internet. Option D (Internet Gateway directly) would make instances publicly accessible.

Answer

A VPC endpoint for Amazon S3 in each private subnet

Answer

A NAT instance in each public subnet, with a route in the private route tables pointing to the NAT instance

Answer

An Internet Gateway attached to the VPC with a route in the private route tables pointing to the Internet Gateway

Question 13

A company is designing a multi-region active-active architecture for a web application using Application Load Balancers (ALBs) and AWS Global Accelerator. The application must provide low-latency access to users worldwide and automatically route traffic to healthy endpoints. Which design should be used?

Accepted Answer

Deploy Global Accelerator with endpoints in each region (ALBs) and configure health checks to route traffic to healthy endpoints.. Option B is correct because Global Accelerator uses anycast IPs and health checks to route traffic to the closest healthy endpoint. Option A is wrong because Route 53 latency routing with health checks can work but does not use anycast and may not provide the same performance. Option C is wrong because multiple ALBs in a single region would not provide multi-region failover. Option D is wrong because CloudFront with ALB origins can provide low latency but does not support active-active multi-region traffic routing by default.

Answer

Use Amazon CloudFront with multiple origins pointing to ALBs in each region and configure origin failover.

Answer

Use Amazon Route 53 latency-based routing with health checks to route traffic to ALBs in each region.

Answer

Deploy a single ALB with multiple target groups across regions using cross-zone load balancing.

Question 14

A company is deploying a hybrid network with AWS Direct Connect and a VPN backup. The Direct Connect virtual interface is configured for private VIF with BGP. The VPN uses IPsec tunnels over the internet. What is the best practice to ensure symmetric routing and failover?

Accepted Answer

Use the same BGP ASN for both Direct Connect and VPN, and set a higher MED (Multi-Exit Discriminator) on the VPN routes.. Option B is correct. Using the same BGP ASN on the VPN side ensures that AWS treats both paths as equal, and with BGP attributes you can control active/passive behavior. Option A is wrong because ASN prepending is used to influence path selection, not to ensure symmetry. Option C is wrong because you cannot disable BGP on Direct Connect private VIF; it requires BGP. Option D is wrong because using different ASNs would make AWS treat them as separate paths and might cause asymmetric routing.

Answer

Configure ASN prepending on the VPN BGP advertisements to make them less preferred.

Answer

Use different BGP ASNs for Direct Connect and VPN to allow AWS to prefer the Direct Connect path.

Answer

Disable BGP on the Direct Connect private VIF and use static routes to force traffic through Direct Connect.

Question 15

A company is building a serverless application using API Gateway, Lambda, and DynamoDB. The API must be accessible from the internet and be resilient to Regional failures. Which design provides the HIGHEST availability?

Accepted Answer

Deploy in two Regions with API Gateway, Lambda, and DynamoDB global tables. Use Route 53 failover routing with health checks.. Option B is correct because using a custom domain with Route 53 failover routing to API Gateway in two regions provides regional failover. Option A is wrong because a single region is not resilient. Option C is wrong because CloudFront does not provide active-active for API Gateway across regions. Option D is wrong because Global Accelerator does not support API Gateway as an endpoint.

Answer

Deploy API Gateway, Lambda, and DynamoDB in a single Region with multi-AZ.

Answer

Deploy API Gateway in two Regions behind a Global Accelerator accelerator.

Answer

Use a single API Gateway with CloudFront distribution in front, and Lambda@Edge for compute.