ANS-C01 Practice Test 19 — 15 Questions

Question 1

A company has a VPC peering connection between VPC A (10.0.0.0/16) and VPC B (10.1.0.0/16). They have added routes in both route tables. However, instances in VPC A cannot ping instances in VPC B. The security groups and network ACLs allow ICMP. What is the most likely cause?

Accepted Answer

The route tables in VPC A do not have a route to VPC B CIDR pointing to the peering connection. VPC peering does not support transitive routing. If VPC A tries to reach VPC B via a CIDR that is not directly peered, traffic will not be forwarded. The route tables must have specific routes for the peered VPC CIDR. The issue likely is that the route tables are missing the route to the peer, or the route is pointing to an incorrect target.

Answer

The security groups in VPC B do not allow inbound ICMP from VPC A CIDR

Answer

The VPC peering connection is not in the 'active' state

Answer

The instances are in different Availability Zones

Question 2

A company is designing a multi-Region application with an Application Load Balancer (ALB) in each Region fronting an Auto Scaling group of EC2 instances. The application must be accessible via a single DNS name, and traffic should be routed to the closest healthy Region using a latency-based routing policy. Which AWS service should be used as the DNS endpoint to achieve this?

Accepted Answer

Amazon Route 53. Amazon Route 53 with latency-based routing directs traffic to the Region with the lowest latency. The ALB in each Region is registered as a latency alias record. Option A is incorrect because Global Accelerator uses Anycast IPs and does not use latency-based routing via DNS. Option C is incorrect because CloudFront uses edge locations and does not route based on latency to origins in the same way. Option D is incorrect because Network Load Balancer does not provide DNS-level routing policies.

Answer

Amazon CloudFront

Answer

AWS Global Accelerator

Answer

AWS Network Load Balancer

Question 3

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The company wants to centralize internet egress for all VPCs through a single VPC that has a NAT Gateway and an internet gateway. Which TWO configurations are required to achieve this?

Accepted Answer

In the egress VPC, add a route for 0.0.0.0/0 to the internet gateway in the route table of the subnet containing the NAT Gateway.. To centralize internet egress, the NAT Gateway must be in the egress VPC. Other VPCs must route 0.0.0.0/0 to the Transit Gateway, which then forwards to the egress VPC. The egress VPC's route table must point 0.0.0.0/0 to the internet gateway. Option A is correct because the egress VPC needs a default route to the internet gateway. Option C is correct because other VPCs need a default route to the Transit Gateway. Option B is incorrect because the egress VPC should not route to the Transit Gateway for internet traffic. Option D is incorrect because you do not need a separate VPN. Option E is incorrect because you cannot delete the local route.

Answer

In the egress VPC, add a route for 0.0.0.0/0 to the Transit Gateway.

Answer

Create a VPN connection between each VPC and the Transit Gateway.

Answer

In each non-egress VPC, delete the local route.

Question 4

A company has an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The ALB is configured with a target group that has a health check path of /health. Some instances are failing health checks and being marked unhealthy, but the application logs show the instances are healthy. What is the most likely cause?

Accepted Answer

The security group for the instances does not allow inbound traffic from the ALB's security group on the health check port. The health check is failing because the security group for the instances is not allowing traffic from the ALB. Option A is correct. Option B (health check path) is working as configured. Option C (slow start) does not cause health check failures. Option D (stickiness) does not affect health checks.

Answer

The health check path is incorrect

Answer

The target group's slow start duration is too long

Answer

The ALB's stickiness is preventing health checks

Question 5

A company is using AWS Organizations to manage multiple accounts. The network team needs to allow a centralized inspection VPC to inspect all traffic between VPCs in different accounts. Which AWS service should be used to route traffic through the inspection VPC?

Accepted Answer

AWS Transit Gateway. Option C is correct because a Transit Gateway with route tables can route traffic between VPCs and send it to a network appliance in the inspection VPC. Option A is wrong because VPC peering is a simple point-to-point connection and does not support transitive routing. Option B is wrong because a VPN is for hybrid connectivity, not inter-VPC routing. Option D is wrong because PrivateLink is for accessing services privately, not for routing traffic.

Answer

VPC peering connections

Answer

AWS PrivateLink

Answer

AWS Site-to-Site VPN

Question 6

A company has a VPC with a CIDR block of 10.0.0.0/16. It has two subnets: subnet A (10.0.1.0/24) and subnet B (10.0.2.0/24). Both subnets have a route to an Internet Gateway. An EC2 instance in subnet A has a security group that allows inbound HTTP from 0.0.0.0/0. The instance's network ACL allows inbound HTTP from 0.0.0.0/0. Users report they cannot access the web server. What is the most likely cause?

Accepted Answer

The instance does not have a public IP address. The instance does not have a public IP address, so it cannot be reached from the internet. Without a public IP or Elastic IP, traffic from the internet cannot be routed to the instance even if security groups and network ACLs allow it.

Answer

The network ACL inbound rule is incorrectly configured

Answer

The security group is not associated with the instance

Answer

The route table does not have a route to the Internet Gateway

Question 7

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to add additional IP address space for new subnets. The existing subnets use 10.0.0.0/17 and 10.0.128.0/17. Which CIDR block should be added as a secondary CIDR to the VPC to provide the most additional contiguous address space?

Accepted Answer

10.1.0.0/16. Option C is correct because 10.1.0.0/16 is a contiguous block that does not overlap with the existing CIDR and adds a full /16 of address space. Option A is wrong because 10.0.0.0/8 overlaps with the existing CIDR and is too large. Option B is wrong because 10.0.0.0/16 duplicates the existing CIDR. Option D is wrong because 10.0.0.0/0 is invalid.

Answer

10.0.0.0/0

Answer

10.0.0.0/8

Answer

10.0.0.0/16

Question 8

A company has a VPC with public and private subnets. They want to provide outbound internet access to instances in private subnets while preventing inbound internet traffic. The solution must be highly available and scale automatically. Which combination of services should be used?

Accepted Answer

NAT Gateway in each Availability Zone with route tables pointing to the NAT Gateway. A NAT Gateway in each AZ provides high availability and scales automatically. Route tables direct private subnet traffic to the NAT Gateway. An Internet Gateway is needed for the NAT Gateway to reach the internet. A NAT instance is single point of failure and requires manual scaling. VPC endpoint is for accessing AWS services privately, not for general internet. Egress-Only Internet Gateway is for IPv6 only.

Answer

NAT instances in each Availability Zone

Answer

VPC endpoint for S3 and DynamoDB

Answer

Internet Gateway attached to the VPC with route tables pointing to the Internet Gateway

Question 9

A company has an AWS Transit Gateway with multiple VPC attachments. They need to inspect traffic between VPCs using a third-party firewall appliance. Which THREE steps are necessary?

Accepted Answer

Deploy a Gateway Load Balancer (GWLB) in the firewall VPC and register the firewall instances as targets. To inspect traffic, the firewall must be placed in the path. Transit Gateway supports routing to a network appliance in a VPC. The firewall VPC must be attached to the Transit Gateway. Route tables in the Transit Gateway must be configured to direct traffic to the firewall VPC. A Gateway Load Balancer (GWLB) is the modern way to deploy firewall appliances transparently. A simple VPC peering bypasses Transit Gateway. NAT Gateway is for outbound internet traffic, not for east-west inspection.

Answer

Create a VPC peering connection between the VPCs to allow traffic flow

Answer

Configure a NAT Gateway in each VPC to route traffic through the firewall

Question 10

A company wants to design a highly available architecture for a web application that runs on EC2 instances in an Auto Scaling group across multiple Availability Zones. The application must be able to handle sudden traffic spikes. Which load balancing solution provides the best combination of high availability, automatic scaling, and SSL offloading?

Accepted Answer

Application Load Balancer. An Application Load Balancer (ALB) is Layer 7, supports SSL termination, and integrates with Auto Scaling for health checks. Option A is correct. Option B is incorrect because Classic Load Balancer is deprecated and less feature-rich. Option C is incorrect because NLB is Layer 4 and does not natively offload SSL. Option D is incorrect because CloudFront is a CDN, not a load balancer for the application.

Answer

Amazon CloudFront with an origin pointing to the Auto Scaling group

Answer

Network Load Balancer

Answer

Classic Load Balancer

Question 11

A company is designing a network for a VPC with a CIDR of 10.0.0.0/16. The VPC has three private subnets in three different Availability Zones. The company needs to provide internet access to instances in the private subnets for software updates. The architecture must be highly available and cost-effective. Which TWO actions should the network engineer take?

Accepted Answer

Configure each private subnet's route table to route 0.0.0.0/0 to the NAT Gateway in the same Availability Zone.. To achieve high availability, deploy a NAT Gateway in each AZ. Each private subnet's route table should point to the NAT Gateway in its own AZ. Option A is correct because multiple NAT Gateways provide fault tolerance. Option D is correct because routing to the NAT Gateway in the same AZ ensures traffic stays within the AZ. Option B is incorrect because a single NAT Gateway is a single point of failure. Option C is incorrect because NAT instances are not fully managed and less reliable. Option E is incorrect because a single route table would force all traffic through one NAT Gateway.

Answer

Use a NAT instance in an Auto Scaling group.

Answer

Use a single route table for all private subnets and route to one NAT Gateway.

Answer

Deploy a single NAT Gateway in one Availability Zone.

Question 12

A company wants to improve the performance and availability of its application that is deployed on EC2 instances in a single Availability Zone. Which architecture should the company implement?

Accepted Answer

Deploy EC2 instances in multiple Availability Zones. Deploying instances across multiple Availability Zones improves availability. Option B is correct. Option A (larger instances) does not improve availability. Option C (Auto Scaling in one AZ) still has a single point of failure. Option D (more subnets in one AZ) does not help.

Answer

Add more subnets in the same Availability Zone

Answer

Use larger EC2 instances

Answer

Use Auto Scaling in the same Availability Zone

Question 13

A company is designing a VPC for a three-tier web application. The web servers must be accessible from the internet, while the application and database servers must be isolated. Which subnet design should the company use?

Accepted Answer

Public subnet for web servers, private subnets for application and database servers. Option A is correct because a public subnet for web servers allows internet access, while private subnets for application and database servers provide isolation. Option B is wrong because placing all servers in public subnets exposes them to the internet. Option C is wrong because placing all servers in private subnets would block internet access to web servers. Option D is wrong because a single subnet for all tiers does not provide isolation.

Answer

A single subnet for all tiers with network ACLs to isolate traffic

Answer

Private subnets for all tiers

Answer

Public subnets for all tiers

Question 14

A company is designing a multi-region application with active-active configuration. They need a global DNS service that can route users to the nearest healthy endpoint and automatically failover to another region if an endpoint becomes unhealthy. Which AWS service should be used?

Accepted Answer

Amazon Route 53 with latency-based routing and health checks. Option A is correct because Amazon Route 53 with latency-based routing can route to the region with the lowest latency, and health checks can failover. Option B is wrong because AWS Global Accelerator provides static IP addresses and improves performance, but it does not provide DNS-level routing with health-based failover. Option C is wrong because CloudFront is a CDN. Option D is wrong because ELB is regional.

Answer

Amazon CloudFront

Answer

Elastic Load Balancer

Answer

AWS Global Accelerator

Question 15

A company has a Direct Connect connection with a private VIF to a VPC. They want to extend connectivity to an on-premises data center that does not support BGP. What is the simplest way to achieve this?

Accepted Answer

Use AWS Site-to-Site VPN with static routing to a Transit Gateway. A Transit Gateway with a VPN attachment can connect to the on-premises network over the internet using static routes if BGP is not supported. Direct Connect Gateway only works with BGP. VPC peering is not for on-premises. VPN CloudHub requires multiple VPN connections. The simplest is to use a VPN connection to the Transit Gateway with static routing.

Answer

Create a VPC peering connection between the VPC and the on-premises network

Answer

Create a Direct Connect Gateway and attach the VPC

Answer

Set up a VPN CloudHub with multiple VPN connections