ANS-C01 Practice Test 18 — 15 Questions

Question 1

A company is designing a hybrid network architecture that connects multiple VPCs in different AWS regions to an on-premises data center. The company wants to minimize the number of VPN tunnels and reduce management overhead. Which AWS service should be used to simplify this design?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Transit Gateway with VPN attachments. AWS Transit Gateway with VPN attachments is correct because it acts as a central hub that connects multiple VPCs across different AWS regions and an on-premises data center through a single VPN connection. This minimizes the number of VPN tunnels by eliminating the need for individual VPN connections between each VPC and the on-premises network, and reduces management overhead through a single point of configuration and routing.

Answer

AWS Direct Connect with multiple virtual interfaces

Answer

AWS VPN CloudHub

Answer

VPC peering between each VPC and the on-premises network

Question 2

A company has a VPC with multiple subnets and an AWS Transit Gateway. They have a requirement to inspect traffic between subnets using a third-party firewall appliance that is deployed in a centralized inspection VPC. The firewall appliance must process all traffic between the VPC subnets, including traffic between subnets in the same Availability Zone. Which routing configuration achieves this?

Accepted Answer

None of the options are correct.. None of the provided routing configurations can achieve this requirement because the local route for the VPC CIDR in any VPC route table cannot be overridden. Therefore, intra-VPC traffic will always use the local route and will not be sent to the Transit Gateway. To inspect traffic between subnets within the same VPC, alternative architectures such as a Gateway Load Balancer or a Transit Gateway with VPC peering between different VPCs must be used.

Answer

Create a VPC route table that routes all traffic (0.0.0.0/0) to the Transit Gateway.

Answer

Create a VPC route table that routes the VPC CIDR to the Transit Gateway and associate it with each subnet.

Answer

Use the main route table and add a route for the VPC CIDR to the Transit Gateway.

Question 3

Which TWO components are required when configuring a transit gateway to connect multiple VPCs and an on-premises network via Direct Connect? (Choose 2)

Accepted Answer

Transit Gateway association with the Direct Connect gateway. Option B is correct because the transit gateway must be associated with the Direct Connect gateway so that traffic from the on-premises network can be routed into the transit gateway and then to the attached VPCs. Option E is correct because a Direct Connect gateway is the required AWS resource that links the Direct Connect connection to the transit gateway association, enabling global routing between on-premises and multiple VPCs. An Internet gateway (A) is not required because this design uses Direct Connect, not public internet connectivity. A virtual private gateway (C) is not required because the transit gateway replaces the VGW for VPC attachment in this architecture. A customer gateway (D) is not required because it is used for Site-to-Site VPN termination, not for Direct Connect transit gateway associations.

Answer

Internet gateway (IGW)

Answer

Virtual private gateway (VGW)

Answer

Customer gateway (CGW)

Question 4

A company is deploying a web application on EC2 instances behind an ALB. The application must be accessible only over HTTPS. Which security group rule should be added to the ALB security group?

Accepted Answer

Inbound: TCP port 443 from 0.0.0.0/0. The ALB must terminate HTTPS traffic, which requires an inbound rule allowing TCP port 443 (HTTPS) from 0.0.0.0/0. This ensures clients can establish encrypted TLS connections to the load balancer, as the application is only accessible over HTTPS.

Answer

Inbound: TCP port 22 from 0.0.0.0/0

Answer

Inbound: TCP port 3306 from 0.0.0.0/0

Answer

Inbound: TCP port 80 from 0.0.0.0/0

Question 5

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to a partner VPC with CIDR 10.0.0.0/16. Both VPCs are in the same region. They want to use VPC Peering. After creating the peering connection and adding routes, connectivity fails. What is the most likely cause?

Accepted Answer

Overlapping CIDR blocks prevent VPC peering connectivity.. The most likely cause of connectivity failure is the overlapping CIDR blocks. VPC peering requires non-overlapping IP ranges for proper routing. Even if the peering connection is active and routes are added, the identical CIDR blocks (both 10.0.0.0/16) prevent the route tables from distinguishing the traffic destination, resulting in no connectivity. Option A is incorrect because VPC peering does not support transitive routing, but that is not the issue here. Option B is incorrect because the status would need to be 'active' for connectivity, but the problem is overlapping CIDRs. Option D is incorrect because although routes may be missing, the primary issue is the overlapping CIDRs.

Answer

The peering connection is not set up for transitive routing.

Answer

The peering connection status is 'pending-acceptance'.

Answer

The route tables do not have a route to the peering connection.

Question 6

A company has multiple VPCs connected via a Transit Gateway. Each VPC has its own CIDR block. The company wants to isolate network traffic between specific VPCs. What is the most scalable way to achieve this?

Accepted Answer

Create separate Transit Gateway route tables and associate VPC attachments to the appropriate route tables.. Transit Gateway route tables allow you to isolate traffic between VPCs by controlling which VPC attachments can communicate with each other. By associating each VPC attachment with a specific route table and configuring route propagation appropriately, you can enforce isolation without additional appliances or complex routing. This approach scales seamlessly as you add more VPCs, because you simply create new route tables and associate attachments as needed.

Answer

Deploy AWS Network Firewall in each VPC.

Answer

Use Security Groups in each VPC to filter traffic.

Answer

Use VPC Peering connections and modify route tables.

Question 7

Order the steps to set up a redundant Direct Connect connection with two virtual interfaces in different AWS regions:

Accepted Answer

Provision Direct Connect connections, then create virtual interfaces (VIFs), then configure BGP, then tune routing, then test failover.. First provision the connections, then create VIFs, configure BGP, tune routing, then test failover.

Answer

Create virtual interfaces (VIFs), then provision Direct Connect connections, then configure BGP, then tune routing, then test failover.

Answer

Provision Direct Connect connections, then configure BGP, then create virtual interfaces (VIFs), then tune routing, then test failover.

Answer

Provision Direct Connect connections, then create virtual interfaces (VIFs), then test failover, then configure BGP, then tune routing.

Question 8

A company is designing a multi-region application with an Application Load Balancer (ALB) in us-east-1 and us-west-2. They want to route traffic to the nearest region using latency-based routing. Which AWS service should they use to achieve this?

Accepted Answer

Amazon Route 53 with latency routing policy. Route 53's latency routing policy directs traffic to the region with the lowest network latency for the end user, based on measurements between AWS regions and the client's DNS resolver. This directly meets the requirement to route traffic to the nearest region without adding any additional infrastructure or cost beyond DNS queries.

Answer

AWS Global Accelerator

Answer

AWS Transit Gateway

Answer

Amazon CloudFront with multiple origins

Question 9

A solutions architect needs to design a highly available web application that uses an Application Load Balancer (ALB) and spans multiple Availability Zones (AZs) in a single region. The application must be able to handle a sudden increase in traffic without manual intervention. Which feature should the architect enable on the ALB to meet this requirement?

Accepted Answer

Enable cross-zone load balancing. Cross-zone load balancing distributes incoming traffic evenly across all registered targets in all enabled Availability Zones, rather than sending traffic only to targets in the same AZ as the load balancer node. This ensures that if one AZ receives more traffic than another, the ALB can still balance the load across all healthy instances, allowing the application to handle sudden traffic spikes without manual scaling intervention.

Answer

Enable connection draining

Answer

Enable sticky sessions

Answer

Enable deletion protection

Question 10

A company wants to use AWS Direct Connect to establish a dedicated network connection from their on-premises data center to AWS. They need to connect to a VPC in the us-east-1 region. Which of the following is a required step in the setup process?

Accepted Answer

Create a private virtual interface and attach it to a Virtual Private Gateway.. To establish a Direct Connect connection to a VPC, you must create a private virtual interface (VIF) and attach it to a Virtual Private Gateway (VGW) that is attached to the VPC. The private VIF carries traffic over the dedicated connection and uses BGP to exchange routes between the on-premises network and the VPC via the VGW. This is the core requirement for routing traffic from the Direct Connect link into a VPC.

Answer

Attach a Transit Gateway to the VPC.

Answer

Configure CloudFront to route traffic through the Direct Connect.

Answer

Create a site-to-site VPN connection as a backup.

Question 11

A network engineer is designing a Direct Connect solution with a public VIF and a private VIF. The private VIF will connect to a VPC via a Direct Connect Gateway. Which TWO of the following statements are correct regarding this setup? (Choose 2.)

Accepted Answer

The Direct Connect Gateway allows the private VIF to connect to multiple VPCs in different AWS Regions. Option D is correct because a Direct Connect Gateway is a globally available resource that lets a single private VIF (attached to the gateway) reach VPCs in multiple AWS Regions through the same private virtual interface, which is exactly the multi-Region connectivity this design requires. Option E is correct because a public VIF is used to reach AWS public services—such as Amazon S3, DynamoDB, and other public endpoints—over the dedicated Direct Connect link using AWS public IP addresses rather than traversing the internet. Option A is wrong because every virtual interface, including a private VIF, requires a customer-side device (router/firewall) to terminate the 802.1Q VLAN and BGP peering. Option B is wrong because a Direct Connect Gateway only associates with private VIFs (and transit VIFs), not public VIFs, so a public VIF cannot connect to a VPC through a DX Gateway. Option C is wrong because accessing Amazon S3 over a private IP address requires an interface VPC endpoint (PrivateLink) or a gateway endpoint within the VPC, not a private VIF alone.

Answer

The private VIF can be used without a virtual interface termination device on the customer side

Answer

The public VIF can be used to connect to a VPC via a Direct Connect Gateway

Answer

The private VIF can be used to access Amazon S3 over a private IP address

Question 12

A company has a VPC with public and private subnets across two Availability Zones. The private subnets require outbound internet access for updates, but must not be directly reachable from the internet. The company has a NAT gateway in each public subnet. Security team reports that instances in private subnets cannot reach the internet. Which configuration should be verified first?

Accepted Answer

Verify that the route table for the public subnets has a default route pointing to an internet gateway, and the private subnets' route table has a default route pointing to the NAT gateway. For instances in private subnets to reach the internet via a NAT gateway, the private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT gateway, and the NAT gateway must be placed in a public subnet whose route table has a default route pointing to an internet gateway. If either route is missing, outbound internet access will fail. Option B is incorrect because VPC endpoints are for accessing specific AWS services (e.g., S3), not general internet access. Option C is incorrect because NACLs are stateless and by default allow all outbound traffic; although custom NACLs could block traffic, routing misconfiguration is a more common first issue. Option D is incorrect because security groups are stateful and outbound traffic is allowed by default; blocking outbound HTTPS would be an intentional change, not the first thing to verify.

Answer

Verify that the VPC has a VPC endpoint for S3 configured

Answer

Verify that the network ACLs for the private subnets allow outbound traffic to 0.0.0.0/0

Answer

Verify that the security groups attached to the instances allow outbound HTTPS traffic

Question 13

A network engineer is troubleshooting intermittent connectivity issues between two VPCs connected via a VPC peering connection. The engineer notices that the route tables in both VPCs have the correct routes. What should the engineer check next?

Accepted Answer

Check security group and network ACL rules. When VPC peering routes are correctly configured in both route tables but connectivity is intermittent, the next logical check is security group and network ACL rules. Security groups are stateful and control instance-level traffic, while network ACLs are stateless and control subnet-level traffic — either can silently drop packets even when routing is correct. Intermittent issues often point to NACL ephemeral port ranges or security group rules that do not account for return traffic.

Answer

Verify that DNS resolution is enabled for the VPCs

Answer

Ensure that the VPN connection is active

Answer

Check the internet gateway configuration

Question 14

A company has a VPC with a CIDR of 10.0.0.0/16. The VPC contains a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). An EC2 instance in the private subnet needs to access an S3 bucket. The company wants to use a VPC endpoint for S3. Which TWO configurations are required?

Accepted Answer

Create an endpoint policy that allows access to the S3 bucket.. Option B is correct because a gateway VPC endpoint for S3 uses an endpoint policy (a resource-based IAM policy) that must allow the desired S3 bucket actions and resources; without an appropriate policy, access is denied even if routing exists. Option D is correct because a gateway endpoint is targeted via a route in the subnet's route table — you add a route with destination prefix list pl-xxxxxxxx (the S3 prefix list) pointing to the gateway endpoint (vpce-xxxx), which is what enables the private subnet's traffic to reach S3 without NAT or internet. Option A is not required because a private instance can reach S3 through the gateway endpoint without any public IP or internet gateway. Option C is not required because a NAT gateway is only needed for internet-bound traffic, and the gateway endpoint bypasses NAT entirely. Option E is not applicable because gateway endpoints do not use security groups (only interface endpoints do); access control for gateway endpoints is handled by endpoint policies and route tables.

Answer

Assign a public IP address to the EC2 instance.

Answer

Deploy a NAT gateway in the public subnet.

Answer

Attach a security group to the gateway endpoint.

Question 15

A network engineer is configuring an AWS Transit Gateway to connect multiple VPCs and an on-premises network via Direct Connect. The on-premises network advertises a prefix 10.0.0.0/8. One of the VPCs has a CIDR of 10.0.0.0/16. What will happen to traffic destined to 10.0.0.5 from another VPC attached to the Transit Gateway?

Accepted Answer

Traffic is routed to the VPC because of a more specific route. AWS Transit Gateway uses longest prefix match routing. The VPC's CIDR 10.0.0.0/16 is more specific than the on-premises prefix 10.0.0.0/8, so traffic destined to 10.0.0.5 will be routed to the VPC. Option B is incorrect; routes conflict only if they have the same prefix length, but here different lengths allow the longest prefix to win. Option C is incorrect because the on-premises route is less specific and will not be used. Option D is incorrect because there is no load-balancing; the more specific route takes precedence.

Answer

Traffic is dropped due to conflicting routes

Answer

Traffic is routed to the on-premises network because it is learned via Direct Connect

Answer

Traffic is load-balanced between the VPC and on-premises