ANS-C01 Practice Test 18 — 15 Questions

Question 1

A company is designing a multi-region active-active architecture with Amazon Route 53. The application is deployed behind Application Load Balancers (ALBs) in us-east-1 and eu-west-1. The company wants to minimize latency for users and provide automatic failover. Which routing policy should be used?

Accepted Answer

Latency-based routing policy. Latency-based routing directs traffic to the region with the lowest latency for the end user. If one endpoint becomes unhealthy, Route 53 automatically routes to the other, providing failover. Weighted routing requires manual weight adjustments. Failover routing is active-passive. Geolocation routing is based on user location but does not provide automatic failover.

Answer

Failover routing policy

Answer

Geolocation routing policy

Answer

Weighted routing policy

Question 2

A company has a VPC with two subnets: subnet A (10.0.1.0/24) and subnet B (10.0.2.0/24). An EC2 instance in subnet A needs to communicate with an EC2 instance in subnet B. The instances are in the same VPC. What is the default behavior?

Accepted Answer

Communication is allowed by default because they are in the same VPC. By default, instances within the same VPC can communicate with each other regardless of subnet, as long as security groups and network ACLs allow traffic. No additional configuration is needed.

Answer

Communication is not allowed by default; a VPC peering connection is required

Answer

Communication is allowed only if they are in the same subnet

Answer

Communication is allowed only if a transit gateway is attached

Question 3

A company is designing a network architecture for a critical application that requires high availability across multiple AWS regions. The application uses an Application Load Balancer (ALB) in each region. Which TWO services can provide global routing and failover between the two ALBs?

Accepted Answer

Amazon Route 53 with failover routing and health checks. Options A and D are correct. Amazon Route 53 with health checks can route DNS queries to healthy endpoints across regions. AWS Global Accelerator provides anycast IPs and can route traffic to healthy regional endpoints. Option B is wrong because CloudFront is a CDN and does not route to ALBs directly for failover. Option C is wrong because a Network Load Balancer is regional. Option E is wrong because AWS WAF is a web application firewall.

Answer

AWS WAF

Answer

Network Load Balancer (NLB)

Answer

Amazon CloudFront

Question 4

A company has a hub-and-spoke VPC architecture using AWS Transit Gateway. The hub VPC contains shared services (e.g., Active Directory). Spoke VPCs need to resolve DNS names from the hub VPC. The hub VPC has an Amazon Route 53 Resolver inbound endpoint. What is the correct configuration for the spoke VPCs to use this endpoint?

Accepted Answer

Create an outbound endpoint in the spoke VPC and associate a resolver rule that forwards queries to the inbound endpoint in the hub VPC. To use a Route 53 Resolver inbound endpoint in the hub VPC, spoke VPCs must forward DNS queries to the endpoint's IP addresses. This is done by creating an outbound endpoint in the spoke VPC and associating a forwarding rule that points to the hub's inbound endpoint. The rule must be associated with the spoke VPC via a resolver rule association. Simply updating DHCP options or using the hub's VPC CIDR does not configure DNS forwarding.

Answer

Configure the spoke VPC's DHCP options set to use the hub VPC's CIDR as the domain name server

Answer

Create an inbound endpoint in each spoke VPC

Answer

Use VPC peering and configure the spoke VPC's route table to route DNS traffic to the hub VPC

Question 5

A company is deploying a web application across multiple AWS Regions using an Application Load Balancer (ALB) in each Region. The company wants to use AWS Global Accelerator to provide a static IP address and accelerate traffic. The application requires that client IP addresses be preserved in the backend logs. Which configuration should the network engineer use?

Accepted Answer

Use Network Load Balancers as endpoints in Global Accelerator.. Global Accelerator preserves the client IP address when using a Network Load Balancer (NLB) as the endpoint because NLB preserves the source IP. ALB terminates the client connection, so client IP is not preserved unless using X-Forwarded-For headers. Option A is correct because NLB with Global Accelerator preserves client IP. Option B is incorrect because ALB does not preserve client IP by default. Option C is incorrect because CloudFront does not provide static IP and adds complexity. Option D is incorrect because VPC endpoints are not for internet-facing traffic.

Answer

Use VPC endpoints and AWS PrivateLink to route traffic through the Global Accelerator.

Answer

Use Amazon CloudFront in front of the ALBs with origin protocol policy set to HTTPS.

Answer

Use Application Load Balancers as endpoints and enable X-Forwarded-For header logging.

Question 6

A company has a VPC with a CIDR block of 10.0.0.0/16. It needs to create a secondary CIDR block for additional subnets that must not overlap with the existing CIDR. Which CIDR block should be used?

Accepted Answer

10.1.0.0/16. VPC secondary CIDR blocks must not overlap with the primary CIDR. Option C (10.1.0.0/16) is in the 10.0.0.0/8 range but does not overlap with 10.0.0.0/16. Option A overlaps (10.0.0.0/8 includes 10.0.0.0/16). Option B overlaps (10.0.0.0/16 same). Option D (172.16.0.0/16) is valid but not in the 10.0.0.0/8 range; however, VPC can have any private CIDR, but the question implies a secondary CIDR that is not overlapping; Option C is correct because it is a common practice to use a different /16 within the 10.0.0.0/8.

Answer

172.16.0.0/16

Answer

10.0.0.0/16

Answer

10.0.0.0/8

Question 7

A company is migrating its on-premises data center to AWS. The network team needs to design a hybrid connectivity solution that provides high availability with a bandwidth of at least 10 Gbps and low latency for real-time data replication. The company has two redundant on-premises routers connected to two separate internet service providers (ISPs). Which combination of AWS services should the company use to meet these requirements?

Accepted Answer

Provision two AWS Direct Connect connections at two different Direct Connect locations, each with a 10 Gbps port, and connect each on-premises router to one of them.. Option C is correct because AWS Direct Connect provides dedicated, low-latency, high-bandwidth connections. Using two Direct Connect locations with redundant connections ensures high availability. Option A is wrong because AWS VPN is limited to ~1.25 Gbps per tunnel and may not meet the 10 Gbps requirement. Option B is wrong because a single Direct Connect connection is a single point of failure. Option D is wrong because Direct Connect Gateway does not provide the connection itself.

Answer

Use AWS Direct Connect Gateway to aggregate multiple VPN connections to achieve higher bandwidth.

Answer

Provision a single AWS Direct Connect connection with a 10 Gbps port and connect both on-premises routers to it via a single interface.

Answer

Set up two AWS Site-to-Site VPN tunnels from each on-premises router to two different AWS VPN endpoints in the same region.

Question 8

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download updates from the internet. The company wants to minimize costs and avoid exposing the instance to inbound internet traffic. Which solution should the engineer choose?

Accepted Answer

Deploy a NAT Gateway in the public subnet and add a route in the private subnet route table pointing to the NAT Gateway.. Option C is correct because a NAT Gateway in the public subnet allows outbound internet access from private instances while blocking inbound traffic. Option A is wrong because a NAT instance is more expensive and less managed. Option B is wrong because an internet gateway alone does not allow private instances to reach the internet. Option D is wrong because a proxy would need to be managed and adds latency.

Answer

Deploy a NAT instance in the private subnet and route traffic through it.

Answer

Configure a forward proxy on the EC2 instance itself.

Answer

Attach an internet gateway to the VPC and add a route to the internet gateway in the private subnet's route table.

Question 9

A financial services company must ensure that all traffic between its on-premises data center and VPC is encrypted in transit and does not traverse the public internet. The company has an AWS Direct Connect connection. Which solution meets these requirements?

Accepted Answer

Use a private virtual interface (VIF) over the Direct Connect connection and establish an IPsec VPN tunnel over the private VIF. A private VIF over Direct Connect provides a private connection that does not traverse the internet. When combined with IPsec VPN on top of the private VIF, traffic is encrypted. Direct Connect alone does not encrypt traffic. A transit VIF is for connecting to transit gateways, not for encryption. A public VIF accesses public AWS services and still does not encrypt traffic.

Answer

Use a private virtual interface (VIF) and rely on Direct Connect encryption

Answer

Use a public virtual interface (VIF) over the Direct Connect connection and configure an IPsec VPN tunnel over it

Answer

Use a transit virtual interface (VIF) over the Direct Connect connection and attach it to a transit gateway

Question 10

A company is designing a VPC with public and private subnets in two Availability Zones. The private subnets host databases that must be accessible only from the application servers in the public subnets. Which VPC feature should be used to allow the application servers to access the databases while preventing direct internet access to the databases?

Accepted Answer

Attach a NAT Gateway in a public subnet and update the route table of the private subnets to point to the NAT Gateway for outbound traffic.. Option B is correct because a NAT Gateway allows instances in private subnets to initiate outbound traffic to the internet, but it does not allow inbound traffic from the internet, which aligns with the requirement. Option A is wrong because an Internet Gateway would allow inbound traffic from the internet. Option C is wrong because a VPC Peering connection is used for connecting VPCs. Option D is wrong because a Virtual Private Gateway is used for VPN connections.

Answer

Create a VPC Peering connection between the public and private subnets.

Answer

Attach an Internet Gateway to the VPC and update the route table of the private subnets to point to the Internet Gateway.

Answer

Attach a Virtual Private Gateway to the VPC and update the route table of the private subnets.

Question 11

A company has a VPC with a CIDR of 10.0.0.0/16. They have created a VPC peering connection with another VPC (CIDR 10.1.0.0/16). They want to enable DNS resolution between the VPCs. Which TWO actions must be taken?

Accepted Answer

The requester must accept the peering connection with the 'Enable DNS Resolution' option checked.. Options B and D are correct. To enable DNS resolution across a VPC peering connection, the requester must accept the peering connection with DNS resolution enabled, and the accepter must update the route tables. Option A is wrong because the VPCs must be in the same region? Actually, cross-region peering is allowed. Option C is wrong because the accepter does not need to modify the peering connection. Option E is wrong because DNS resolution settings are at the peering connection level, not the VPC level.

Answer

Ensure both VPCs are in the same AWS region.

Answer

The accepter must modify the peering connection to enable DNS resolution from their side.

Answer

The route tables must include a route for the peered VPC's CIDR.

Question 12

A company needs to connect two VPCs in the same AWS account and region. They want to use private IP addresses and avoid any single point of failure. Which solution should they use?

Accepted Answer

VPC peering connection. VPC peering allows direct connectivity between two VPCs using private IPs and has no single point of failure. Transit Gateway also works but adds cost and complexity. VPN is not needed within the same region. Internet Gateway would expose traffic to the internet.

Answer

AWS Transit Gateway

Answer

Internet Gateway and public IPs

Answer

AWS Site-to-Site VPN between the VPCs

Question 13

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. It needs to connect to two other VPCs: VPC B (10.1.0.0/16) and VPC C (10.2.0.0/16). The company wants to use AWS Transit Gateway. Which THREE configurations are required to enable full mesh connectivity between all three VPCs?

Accepted Answer

Associate each VPC attachment with the Transit Gateway route table.. Options A, B, and C are correct. Transit Gateway requires VPC attachments, route tables with routes to each other's CIDR, and association of attachments to route tables. Option D is wrong because you can create a single route table and associate all attachments; separate route tables are needed for isolation, not required for full mesh. Option E is wrong because a transit gateway does not require a VPN attachment for VPC-to-VPC routing.

Answer

Create separate Transit Gateway route tables for each VPC to isolate traffic.

Answer

Create a VPN attachment to each VPC for encrypted communication.

Question 14

A company wants to connect multiple VPCs across different AWS accounts to a common on-premises network using AWS Transit Gateway. Which resource should be used to allow cross-account VPC attachments?

Accepted Answer

AWS Resource Access Manager (RAM). AWS Resource Access Manager (RAM) allows sharing Transit Gateways across accounts. VPC peering does not attach to Transit Gateway. AWS Organizations is an organization management service but does not directly share Transit Gateways. AWS PrivateLink is for private connectivity to services.

Answer

AWS PrivateLink

Answer

VPC peering connection

Answer

AWS Organizations

Question 15

A company has deployed a web application using an Application Load Balancer (ALB) in front of EC2 instances in an Auto Scaling group. The application experiences intermittent high latency. The network team suspects that the ALB is being overwhelmed by traffic. Which metrics should be analyzed in Amazon CloudWatch to determine if the ALB is the bottleneck?

Accepted Answer

SurgeQueueLength and SpilloverCount. Option B is correct because SurgeQueueLength and SpilloverCount indicate when the ALB is unable to handle incoming requests. SurgeQueueLength shows the number of requests queued, and SpilloverCount shows requests that were rejected. Option A is wrong because RequestCount and TargetResponseTime do not directly show ALB capacity issues. Option C is wrong because HealthyHostCount and UnhealthyHostCount indicate backend health, not ALB load. Option D is wrong because ActiveConnectionCount and NewConnectionCount are normal metrics.

Answer

ActiveConnectionCount and NewConnectionCount

Answer

RequestCount and TargetResponseTime

Answer

HealthyHostCount and UnhealthyHostCount