ANS-C01 Practice Test 18 — 15 Questions

Question 1

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to connect two separate branch offices using AWS Client VPN. Each branch office has a different subnet: Branch A uses 10.0.1.0/24 and Branch B uses 10.0.2.0/24. The Client VPN endpoint is configured with a CIDR range of 10.0.3.0/24. The route table for the VPC has the local route and routes to the Client VPN endpoint. Users from both branches can connect to the VPN but cannot communicate with each other. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The branch subnets 10.0.1.0/24 and 10.0.2.0/24 are part of the VPC CIDR, so the VPC routes traffic locally instead of via the VPN. Branch subnets overlap with the VPC CIDR, causing routing conflicts. The VPC sees 10.0.1.0/24 and 10.0.2.0/24 as local, thus traffic destined to those addresses is routed locally within the VPC, not to the VPN. Options B and C are not relevant to inter-branch communication. Option D would not cause the issue because branch subnets are within the VPC CIDR.

Answer

The route tables in the branch subnets do not have routes to the Client VPN endpoint

Answer

The Client VPN endpoint is configured with a CIDR that overlaps with the branch subnets

Answer

The security group for the Client VPN endpoint does not allow inbound traffic from branch subnets

Question 2

Which TWO of the following are best practices for securing a VPC?

Accepted Answer

Use multiple Availability Zones for redundancy.. (Use multiple Availability Zones) is correct because it provides redundancy and improves availability, which is a key security best practice by ensuring fault tolerance. Option D (Restrict inbound SSH access to specific IP ranges) is correct as it minimizes the attack surface by limiting administrative access to authorized IPs only. Option A is wrong: VPC Flow Logs capture IP traffic information but do not block traffic; they are used for monitoring and analysis, not as a security control. Option C is wrong: placing databases in public subnets exposes them to the internet, increasing risk; they should be in private subnets with controlled access. Option E is wrong: the default VPC security group allows all inbound traffic, which is overly permissive; custom security groups should be used to implement least privilege.

Answer

Enable VPC Flow Logs on all subnets to block malicious traffic.

Answer

Place database instances in public subnets for easier management.

Answer

Use the default VPC security group for all instances.

Question 3

A network engineer is designing a VPC with public and private subnets. The private subnets must have outbound internet access but not be directly reachable from the internet. Which AWS service should be used?

Accepted Answer

NAT Gateway. A NAT Gateway is the correct choice because it enables instances in private subnets to initiate outbound internet traffic (e.g., for software updates) while preventing the internet from initiating inbound connections to those instances. It translates the private IP addresses of the instances to the NAT Gateway's Elastic IP address, providing one-way internet access without direct reachability.

Answer

Elastic IP Address (EIP)

Answer

Internet Gateway (IGW)

Answer

Virtual Private Gateway (VGW)

Question 4

A company has a VPC with multiple subnets. They want to monitor all network traffic to and from an EC2 instance for troubleshooting. Which AWS service should they use?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including metadata such as source/destination IPs, ports, protocols, and packet accept/reject decisions. This makes it the correct service for monitoring all network traffic to and from an EC2 instance for troubleshooting purposes.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS CloudTrail

Question 5

A company has a VPC with a public subnet and a private subnet. The private subnet hosts Amazon RDS instances. The security team wants to ensure that the RDS instances are not accessible from the internet. Which TWO actions should be taken?

Accepted Answer

Remove the route to an internet gateway from the private subnet's route table.. Options C and D are the correct actions. Removing the route to an internet gateway from the private subnet's route table ensures that the subnet cannot send traffic to or receive traffic from the internet. Launching RDS instances in a private subnet without a public IP address ensures they do not have direct internet connectivity. Option A is not effective because disabling 'Publicly accessible' only prevents RDS from being assigned a public IP address, but if the instance is in a public subnet with a public route, it could still be accessible. Option B is incorrect because a network ACL that denies all inbound traffic from 0.0.0.0/0 would block all inbound traffic, including necessary traffic from within the VPC, and is not a recommended approach. Option E is wrong because configuring a security group to deny all inbound traffic would block all inbound connections, which would prevent legitimate access to RDS from authorized resources.

Answer

Disable the 'Publicly accessible' option for the RDS instances.

Answer

Create a network ACL that denies all inbound traffic from 0.0.0.0/0.

Answer

Configure the security group for the RDS instances to deny all inbound traffic.

Question 6

A company has deployed a Network Load Balancer (NLB) in front of a fleet of EC2 instances in a VPC. The NLB is configured with a TCP listener on port 443. Clients are experiencing timeouts. The target group health checks are passing. What is the most likely cause?

Accepted Answer

The security group for the EC2 instances does not allow traffic from the NLB.. Security groups must allow traffic from the NLB's private IP addresses. Option A is incorrect because cross-zone load balancing affects distribution, not timeouts. Option B is incorrect because health checks passing means targets are healthy. Option D is incorrect because deletion protection prevents accidental deletion, not timeouts.

Answer

Cross-zone load balancing is disabled.

Answer

Deletion protection is enabled on the NLB.

Answer

The target group is using an incorrect health check path.

Question 7

A company needs to establish a dedicated, private, high-bandwidth connection between its on-premises data center and AWS. Which AWS service should be used?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct service because it provides a dedicated, private, high-bandwidth network connection from an on-premises data center to AWS, bypassing the public internet. This is achieved through a physical cross-connect at an AWS Direct Connect location, delivering consistent latency and higher throughput compared to internet-based connections.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

VPC peering

Question 8

A company is deploying a multi-tier web application across multiple Availability Zones in a VPC. The architecture includes public-facing Application Load Balancers, Amazon EC2 instances in private subnets, and an Amazon RDS for MySQL Multi-AZ DB instance. To meet compliance requirements, all traffic between the web tier and database tier must be encrypted and must not traverse the internet. Which TWO actions should the company take to implement this securely? (Choose two.)

Accepted Answer

Enable SSL/TLS encryption on the RDS DB instance and configure the web servers to connect using SSL.. Enabling SSL/TLS encryption on the RDS DB instance and configuring the web servers to connect using SSL ensures that all traffic between the web tier and database tier is encrypted in transit. This satisfies the compliance requirement for encrypted traffic without needing external connectivity. Option E is correct because using the RDS endpoint (DNS name) that resolves to a private IP within the same VPC ensures that database traffic remains within the VPC and does not traverse the internet, meeting the compliance requirement for no internet traversal.

Answer

Establish an AWS Site-to-Site VPN between the web tier subnets and the database subnet.

Answer

Create a VPC endpoint for Amazon RDS and route database traffic through it.

Answer

Assign an Elastic IP address to the RDS DB instance to ensure a stable IP for the web tier.

Question 9

A company has deployed a web application using an Application Load Balancer (ALB) in front of EC2 instances in an Auto Scaling group. The application experiences intermittent high latency. The network team suspects that the ALB is being overwhelmed by traffic. Which metrics should be analyzed in Amazon CloudWatch to determine if the ALB is the bottleneck?

Accepted Answer

SurgeQueueLength and SpilloverCount. SurgeQueueLength and SpilloverCount are the correct metrics to analyze because they directly indicate whether the ALB is overwhelmed. SurgeQueueLength measures the number of requests waiting to be routed to a target, and SpilloverCount tracks requests that were rejected because the queue was full. If these metrics are consistently high or non-zero, the ALB is the bottleneck, as it cannot keep up with incoming traffic.

Answer

ActiveConnectionCount and NewConnectionCount

Answer

RequestCount and TargetResponseTime

Answer

HealthyHostCount and UnhealthyHostCount

Question 10

A company is deploying a new web application on AWS. They need to distribute incoming HTTPS traffic across multiple EC2 instances in different Availability Zones. Which AWS service should they use?

Accepted Answer

Application Load Balancer (ALB). The Application Load Balancer (ALB) is the correct choice because it operates at Layer 7 (HTTP/HTTPS) and can terminate TLS, inspect HTTPS headers, and route traffic based on content. It is designed to distribute incoming HTTPS traffic across multiple EC2 instances in different Availability Zones, providing health checks and automatic scaling.

Answer

Amazon Route 53

Answer

Amazon CloudFront

Answer

Network Load Balancer (NLB)

Question 11

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access the internet for software updates. The instance is associated with an Elastic IP address. The route table for the private subnet has a default route (0.0.0.0/0) pointing to a NAT gateway. The NAT gateway is in the public subnet and has an Elastic IP. Despite this, the instance cannot reach the internet. The security groups and NACLs are properly configured. What is the likely cause?

Accepted Answer

The NAT gateway is not in a public subnet. The instance cannot reach the internet because the NAT gateway, although placed in a subnet labeled as public, is not in a functional public subnet—the subnet's route table must include a default route (0.0.0.0/0) pointing to an internet gateway. The problem statement indicates the NAT gateway has an Elastic IP, so association is not the issue. Instead, the likely cause is that the public subnet's route table lacks this route, meaning the NAT gateway cannot communicate with the internet gateway. Option A is incorrect because the NAT gateway's Elastic IP is properly associated. Option C is incorrect because NACLs are properly configured. Option D is incorrect because the private subnet route table correctly points to the NAT gateway for 0.0.0.0/0.

Answer

The NAT gateway's Elastic IP is not associated with the NAT gateway

Answer

The private subnet's network ACL is blocking outbound traffic

Answer

The EC2 instance does not have a route to the internet

Question 12

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team notices that traffic between two VPCs is taking a suboptimal path through the on-premises network instead of staying within AWS. What is the MOST likely cause?

Accepted Answer

The Transit Gateway route tables do not have a route for the destination VPC CIDR, so traffic is sent to the on-premises network via a default route.. When a Transit Gateway route table lacks a specific route for the destination VPC CIDR, traffic destined for that VPC is evaluated against the remaining routes. If a default route (0.0.0.0/0) exists pointing to an on-premises network attachment (e.g., a VPN or Direct Connect), the traffic will be forwarded over that path, resulting in a suboptimal route that leaves AWS and re-enters through the on-premises network. This is the most likely cause because the Transit Gateway performs destination-based routing, and missing a specific VPC route forces fallback to the default route.

Answer

The subnet route tables in each VPC have a route pointing to the other VPC's CIDR via the Internet Gateway.

Answer

The VPCs are peered directly, bypassing the Transit Gateway.

Answer

Security groups are blocking traffic between the VPCs.

Question 13

A company is deploying a multi-region application and needs to route users to the nearest healthy endpoint. They are using Amazon Route 53 with latency-based routing and health checks. Users in Asia are sometimes routed to the US region even when the Asia endpoint is healthy. What is the most likely cause?

Accepted Answer

The health check for the Asia region endpoint is failing or misconfigured. Latency-based routing selects the endpoint with the lowest latency for the user. If users in Asia are routed to the US even when the Asia endpoint is healthy, the most likely cause is that the health check for the Asia endpoint is failing or misconfigured. When a health check fails, Route 53 considers the endpoint unhealthy and excludes it from latency-based routing, causing traffic to be sent to the next-best region (e.g., US).

Answer

The Asia region endpoint's Route 53 geolocation routing policy is misconfigured

Answer

The TTL value for the DNS records is set too high

Answer

The DNS resolver used by users in Asia does not support latency-based routing

Question 14

Refer to the exhibit. A network engineer created a NAT gateway in a public subnet, but its state shows 'failed'. What is the most likely cause?

Accepted Answer

The Elastic IP is already associated with another instance. A NAT gateway requires an Elastic IP that is not associated with any other resource. If the Elastic IP is already associated with another instance or NAT gateway, the NAT gateway creation fails. Option A is incorrect because the subnet must have a route to an internet gateway to be public, but that is not the cause of the failure. Option B is incorrect because the NAT gateway is explicitly placed in a public subnet. Option C is incorrect because the state 'failed' indicates the creation did not succeed, not that it is still pending.

Answer

The subnet does not have a route to an internet gateway

Answer

The subnet is private

Answer

The NAT gateway is still being created

Question 15

A company is designing a network for a three-tier web application that must be highly available across multiple Availability Zones. The application uses an Application Load Balancer (ALB) for the web tier, EC2 instances for the application tier, and an Amazon RDS Multi-AZ database for the database tier. Which TWO design choices improve availability and fault tolerance?

Accepted Answer

Configure Amazon RDS Multi-AZ with a standby instance in a different Availability Zone.. Amazon RDS Multi-AZ automatically provisions and maintains a synchronous standby replica in a different Availability Zone, providing automatic failover in the event of an AZ failure or database instance failure. This ensures the database tier remains available without manual intervention, directly improving fault tolerance for the three-tier application.

Answer

Launch all EC2 instances in a single Availability Zone to reduce network latency.

Answer

Use a single NAT gateway in one Availability Zone for all outbound traffic.

Answer

Use VPC Gateway Endpoints for S3 to avoid NAT gateway costs.