ANS-C01 Practice Test 19 — 15 Questions

Question 1

A company uses AWS Client VPN for remote access. Users report intermittent disconnections. The network engineer notices that the Client VPN endpoint is associated with a single subnet. What change should be made to improve reliability?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Associate the Client VPN endpoint with subnets in at least two Availability Zones.. Associating the Client VPN endpoint with subnets in at least two Availability Zones provides high availability for the VPN tunnel endpoints. If a single subnet (and its underlying AZ) fails or experiences network issues, the Client VPN endpoint can still route traffic through the other AZ's subnet, preventing the intermittent disconnections users are experiencing.

Answer

Split the client CIDR into smaller ranges for each Availability Zone.

Answer

Create multiple route tables for the same subnet.

Answer

Increase the subnet CIDR size to accommodate more clients.

Question 2

A company is using AWS Client VPN to provide remote access to their VPC. They want to ensure that only authenticated users from their corporate Active Directory can access the VPN. Which authentication method should they use?

Accepted Answer

SAML-based federated authentication. AWS Client VPN supports SAML-based federated authentication, which can integrate with your corporate Active Directory to authenticate users. Option A is wrong because IAM authorization is not an authentication method for Client VPN; it is used for controlling access to AWS APIs. Option C is wrong because certificate-based authentication uses client certificates and does not directly tie to Active Directory user identities. Option D is wrong because mutual authentication still relies on certificates and does not inherently provide integration with Active Directory.

Answer

IAM authorization

Answer

Certificate-based authentication using AWS Certificate Manager

Answer

Mutual authentication

Question 3

A company designs a multi-account AWS environment using AWS Organizations. The networking team wants a centralized inspection VPC for traffic between VPCs and on-premises. Which architecture ensures that all inter-VPC traffic passes through the inspection VPC?

Accepted Answer

AWS Transit Gateway with centralized routing to the inspection VPC.. AWS Transit Gateway enables centralized routing by attaching all VPCs and the on-premises network to a single transit gateway, then configuring route tables to force all inter-VPC traffic through a dedicated inspection VPC appliance (e.g., firewall or NGFW). This ensures traffic flows via the inspection VPC without requiring full-mesh peering or per-VPC firewalls.

Answer

VPC peering between all VPCs and the inspection VPC.

Answer

AWS Network Firewall deployed in each VPC.

Answer

AWS Direct Connect Gateway with virtual interfaces.

Question 4

A company has multiple VPCs that need to communicate with each other and with an on-premises network via AWS Transit Gateway. Which THREE of the following are valid attachment types for a transit gateway?

Accepted Answer

Direct Connect Gateway. AWS Transit Gateway supports attachments to Direct Connect Gateways, enabling integration of Direct Connect virtual interfaces with the transit gateway for hybrid connectivity. This allows traffic from on-premises networks connected via Direct Connect to be routed through the transit gateway to multiple VPCs and other attachments.

Answer

Internet Gateway

Answer

Network Load Balancer

Question 5

A network engineer is designing a hybrid network with multiple AWS accounts. The company wants to simplify management by using a single AWS Direct Connect connection shared among accounts. Which service should be used to achieve this?

Accepted Answer

Transit Gateway with Direct Connect Gateway. A Transit Gateway with a Direct Connect Gateway allows you to attach multiple VPCs from different AWS accounts to a single Direct Connect connection. The Direct Connect Gateway acts as a bridge between the on-premises network and the Transit Gateway, which then routes traffic to the appropriate VPCs across accounts. This setup simplifies management by centralizing the Direct Connect connection while supporting multi-account architectures.

Answer

VPC Peering

Answer

AWS PrivateLink

Answer

AWS VPN CloudHub

Question 6

A network engineer is designing a security group for a web application that must allow inbound HTTPS traffic from the internet and outbound traffic to an RDS MySQL database. The web servers are in a public subnet and the RDS database is in a private subnet. What is the most secure way to configure the security groups?

Accepted Answer

Web SG: inbound HTTPS from 0.0.0.0/0; outbound MySQL to DB SG. DB SG: inbound MySQL from Web SG.. The most secure configuration. The web server security group allows inbound HTTPS from the internet (0.0.0.0/0) and outbound MySQL traffic specifically to the database security group. The database security group allows inbound MySQL only from the web server security group. This ensures that only the web servers can communicate with the database, minimizing exposure. Option B is less secure because the web server security group allows outbound traffic to 0.0.0.0/0, which is overly permissive. Option C is incorrect because the database security group allows inbound MySQL from 0.0.0.0/0, exposing the database to the internet. Option D combines both overly permissive outbound and inbound rules, making it the least secure.

Answer

Web SG: inbound HTTPS from 0.0.0.0/0; outbound 0.0.0.0/0. DB SG: inbound MySQL from Web SG.

Answer

Web SG: inbound HTTPS from 0.0.0.0/0; outbound MySQL to DB SG. DB SG: inbound MySQL from 0.0.0.0/0.

Answer

Web SG: inbound HTTPS from 0.0.0.0/0; outbound 0.0.0.0/0. DB SG: inbound MySQL from 0.0.0.0/0.

Question 7

A company is designing a network for a critical application that requires high availability across two AWS Regions (us-east-1 and us-west-2). The application uses an Application Load Balancer (ALB) in each region, with Auto Scaling groups behind them. The database is an Amazon Aurora Global Database with a primary cluster in us-east-1 and a secondary cluster in us-west-2. The company wants to use Amazon Route 53 to route traffic to the closest healthy ALB. They also need to ensure that if the primary database fails over to the secondary region, the application can still write to the database with minimal latency. Additionally, the application must be able to read from the local database in each region for read-intensive workloads. The network team has designed the following: Route 53 with latency-based routing and health checks for the ALBs. The application instances in each region are configured to connect to the local Aurora cluster endpoint. For writes, they use the global writer endpoint. What is the MOST significant design flaw?

Accepted Answer

The Route 53 health checks only monitor the ALB endpoint, not the overall application health including database connectivity. The most significant design flaw is that Route 53 health checks only monitor the ALB endpoint, not the overall application health including database connectivity. If the Aurora primary database fails over to us-west-2, the ALB in us-east-1 may still appear healthy even though the application there can no longer write to the database, causing Route 53 to continue routing traffic to an impaired region. Health checks should evaluate application-level health, including database connectivity, to trigger failover correctly.

Answer

The Auto Scaling groups are not configured with lifecycle hooks to drain connections during scale-in

Answer

The application instances in us-west-2 experience high latency for write operations due to cross-region traffic to the primary database

Answer

The Aurora Global Database does not support cross-region replication for read replicas

Question 8

A company is designing a VPC architecture with a public subnet and a private subnet. They want to allow instances in the private subnet to download software updates from the internet. Which TWO options satisfy this requirement? (Choose TWO.)

Accepted Answer

Set up a NAT Gateway in a public subnet and add a default route in the private subnet route table pointing to the NAT Gateway.. Options C and D are correct because both provide outbound-only internet access for private-subnet instances: a NAT Gateway placed in a public subnet (C) translates the private instances' source IPs to its own Elastic IP, and the private subnet's route table needs a 0.0.0.0/0 route targeting that NAT Gateway; similarly, a NAT instance in a public subnet (D) performs source NAT (with ip_forwarding enabled and its security group allowing outbound traffic), and the private route table's default route points to the instance's ENI. These satisfy the requirement to download software updates from the internet without exposing the private instances to inbound internet traffic. Option A is not a standard AWS-native solution and still requires the proxy host itself to have internet egress, so it does not by itself satisfy the requirement. Option B only provides private access to Amazon S3 via a gateway endpoint and cannot reach arbitrary internet update servers. Option E is invalid because an Internet Gateway attaches to a VPC, not a subnet, and a private subnet with a 0.0.0.0/0 route to an IGW would become public rather than remain private.

Answer

Configure a forward proxy in the private subnet and configure the instances to use it.

Answer

Create a VPC Gateway Endpoint for Amazon S3 and route traffic to it.

Answer

Attach an Internet Gateway to the private subnet and add a default route to it.

Question 9

Which TWO features are provided by AWS Shield Advanced that are not available in AWS Shield Standard? (Choose 2)

Accepted Answer

DDoS cost protection. Shield Advanced provides DDoS cost protection (option B) and 24/7 access to the AWS DDoS Response Team (option D). Option A is incorrect because automatic web application firewall rule updates are not a feature of Shield Advanced; AWS WAF can be integrated but rules are not automatically updated. Option C is incorrect because detailed DDoS logs are not a distinct feature of Shield Advanced; both Standard and Advanced provide access to AWS Shield logs. Option E is incorrect because network-layer DDoS protection (e.g., SYN flood, UDP flood) is provided by both Shield Standard and Shield Advanced; Advanced adds application-layer protection and other benefits.

Answer

Automatic web application firewall rule updates

Answer

Access to detailed DDoS logs

Answer

Network-layer DDoS protection

Question 10

Refer to the exhibit. A VPC endpoint for S3 is created as a Gateway endpoint. The route tables rtb-11111111 and rtb-22222222 are associated with the endpoint. An EC2 instance in a subnet associated with rtb-11111111 cannot access S3 via the endpoint. What is the most likely cause?

Accepted Answer

The route table rtb-11111111 does not have a route to the S3 prefix list with the target as the VPC endpoint.. A Gateway VPC Endpoint for S3 works by adding a route in the subnet's route table that points the S3 prefix list (com.amazonaws.region.s3) to the endpoint ID (vpce-xxx). Without this specific route, traffic destined for S3 from the subnet associated with rtb-11111111 will follow the default route (e.g., an Internet Gateway or NAT Gateway) instead of being routed through the endpoint. Since the endpoint is only associated with rtb-11111111 and rtb-22222222, but rtb-11111111 lacks the required prefix list route, traffic from that subnet cannot reach S3 via the endpoint.

Answer

The endpoint policy denies access to S3 from the instance's IAM role.

Answer

The security group on the EC2 instance does not allow outbound traffic to the S3 prefix list.

Answer

The VPC does not have DNS resolution enabled for the endpoint.

Question 11

A network engineer is monitoring a Direct Connect connection. The exhibit shows CloudWatch metric data for the ConnectionState metric. The engineer sees that the average value is 0.0 for most of the day. What does this indicate?

Accepted Answer

The connection was down for most of the day.. The CloudWatch ConnectionState metric for Direct Connect reports 1 when the connection is up and 0 when it is down. An average of 0.0 across most of the day therefore indicates the connection was in the down state for that period. This is a direct reading of the metric's binary semantics.

Answer

The connection was fluctuating between up and down.

Answer

The metric data is incomplete.

Answer

The connection was up and stable.

Question 12

A company has deployed an application in a VPC with public and private subnets across two Availability Zones. The application uses an Application Load Balancer (ALB) in the public subnets to distribute traffic to EC2 instances in the private subnets. The company wants to use AWS WAF to protect against SQL injection attacks. Where should the AWS WAF web ACL be associated?

Accepted Answer

The Application Load Balancer.. AWS WAF is a web application firewall that protects web resources from common exploits like SQL injection. It integrates directly with Application Load Balancers (ALBs) by allowing you to associate a web ACL with the ALB, which inspects HTTP/HTTPS traffic before it reaches the backend EC2 instances. This is the only supported integration point among the options for protecting application-layer traffic in this architecture.

Answer

Amazon Route 53 hosted zone.

Answer

The security group of the EC2 instances.

Answer

The VPC internet gateway.

Question 13

A company has a VPC with public and private subnets in multiple Availability Zones. They want to deploy a NAT gateway for outbound internet access for instances in private subnets. Which of the following is the most highly available architecture?

Accepted Answer

Deploy one NAT gateway in each Availability Zone with a route table per AZ that points to the NAT gateway in the same AZ.. A NAT gateway is an Availability Zone-scoped resource: it is created in a specific subnet in a specific AZ, and if that AZ fails, the NAT gateway becomes unavailable. The most highly available architecture is therefore to deploy one NAT gateway per AZ and configure each AZ's private subnet route table to point to the NAT gateway in the same AZ. This eliminates cross-AZ dependency and ensures that an AZ failure only affects resources in that AZ.

Answer

Deploy one NAT gateway in the first Availability Zone and route all private subnet traffic to that NAT gateway.

Answer

Use a single NAT instance in a public subnet with an auto scaling group and health checks.

Answer

Deploy two NAT gateways in the first Availability Zone and use a single route table pointing to one of them.

Question 14

A company wants to allow its VPC to access an S3 bucket securely without traversing the internet. Which AWS resource enables private connectivity between a VPC and S3?

Accepted Answer

VPC Gateway Endpoint. A VPC Gateway Endpoint (C) is the correct choice because it provides private, direct connectivity between a VPC and S3 without traversing the internet. It uses AWS PrivateLink to route traffic through the AWS network, using prefix lists in the VPC route table to direct S3 traffic to the endpoint, ensuring data never leaves the AWS backbone.

Answer

Internet Gateway

Answer

AWS Site-to-Site VPN

Answer

NAT Gateway

Question 15

A company is designing a network architecture for a critical application that requires sub-millisecond latency between EC2 instances in the same placement group. The instances will be launched in a single Availability Zone in us-east-1. Which combination of features should be used to achieve the lowest latency?

Accepted Answer

Launch instances in a cluster placement group with Elastic Fabric Adapter (EFA) enabled.. Elastic Fabric Adapter (EFA) provides OS-bypass capabilities that enable HPC and machine learning workloads to achieve sub-millisecond latency by bypassing the operating system kernel for inter-instance communication. Combined with a cluster placement group, which ensures instances are in close physical proximity within a single Availability Zone, this configuration delivers the lowest possible latency for tightly coupled applications.

Answer

Launch instances in a cluster placement group with Enhanced Networking (ENA) enabled.

Answer

Launch instances in a spread placement group with SR-IOV enabled.

Answer

Launch instances in a spread placement group with Enhanced Networking (ENA) enabled.