ANS-C01 Practice Test 2 — 10 Questions

Question 1

A company is designing a network for a multi-tier application. The web tier must be accessible from the internet, the application tier must be accessible only from the web tier, and the database tier must be accessible only from the application tier. Which architecture meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Place each tier in a separate subnet and use security groups to allow traffic between tiers. Security groups act as a stateful virtual firewall at the instance level, allowing you to specify inbound and outbound rules based on source/destination security group IDs. By placing each tier in a separate subnet and referencing the web tier's security group as the source for the application tier's inbound rule, and the application tier's security group as the source for the database tier's inbound rule, you achieve the required least-privilege access without exposing the application or database tiers to the internet.

Answer

Place each tier in a separate subnet and use network ACLs to allow traffic between tiers

Answer

Place all tiers in the same subnet and use security groups to control traffic

Answer

Place all tiers in a public subnet and use a NAT gateway for the application and database tiers

Question 2

Arrange the steps to configure an AWS Transit Gateway with attachments to multiple VPCs:

Accepted Answer

Step 1: Create the transit gateway. Step 2: Create transit gateway attachments to VPCs. Step 3: Associate attachments with a transit gateway route table. Step 4: Update VPC route tables to point to the transit gateway. Step 5: Test connectivity.. First create the transit gateway, then create attachments, associate them with a route table, update VPC routes, and test connectivity.

Answer

Step 1: Create transit gateway attachments to VPCs. Step 2: Create the transit gateway. Step 3: Update VPC route tables. Step 4: Associate attachments with a route table. Step 5: Test connectivity.

Answer

Step 1: Create the transit gateway. Step 2: Update VPC route tables. Step 3: Create transit gateway attachments. Step 4: Associate attachments with a route table. Step 5: Test connectivity.

Answer

Step 1: Create the transit gateway. Step 2: Create transit gateway attachments. Step 3: Update VPC route tables. Step 4: Associate attachments with a route table. Step 5: Test connectivity.

Question 3

A company's security team notices that a VPC flow log record shows an outbound connection from a private EC2 instance to an IP address in a restricted country. The security group allows outbound 0.0.0.0/0 for TCP 443. The network ACL allows outbound traffic to 0.0.0.0/0 on ephemeral ports. The company uses AWS Network Firewall with a firewall policy that has a stateful rule group that denies traffic to the restricted country. The flow log shows the traffic was accepted. What is the most likely cause?

Accepted Answer

The subnet's route table does not have a route that sends traffic to the AWS Network Firewall endpoint.. AWS Network Firewall's stateful rules are only evaluated for traffic that is routed through the firewall endpoint. If the subnet's route table does not include a route directing traffic to the firewall endpoint, the traffic bypasses the firewall entirely, allowing the outbound connection even though the firewall policy denies it. Option A is incorrect because VPC Flow Logs capture all accepted and rejected traffic after security group and NACL evaluation. Option C is incorrect because the network ACL allows outbound traffic on ephemeral ports, so inbound return traffic is permitted by the default ephemeral port rule. Option D is incorrect because the security group explicitly allows outbound HTTPS (TCP 443) to 0.0.0.0/0, which is permissive.

Answer

VPC Flow Logs are not capturing all traffic.

Answer

The network ACL inbound rule blocks the return traffic.

Answer

The security group outbound rule is not configured correctly.

Question 4

A company wants to block inbound SSH traffic to all EC2 instances in a VPC while allowing all other traffic. Which security group rule should be configured?

Accepted Answer

Remove any inbound rule that allows TCP port 22. Security groups are stateful and act as a virtual firewall. By default, all inbound traffic is denied unless explicitly allowed. Therefore, to block SSH traffic, you simply remove any inbound rule that permits TCP port 22. This is option B. Option A is incorrect because security groups do not support 'deny' rules; they only support allow rules. Option C is incorrect because the question specifically asks about security group configuration, not network ACLs. Option D is incorrect because outbound rules do not affect inbound traffic, and security groups are stateful, so blocking outbound SSH would not block incoming SSH connections.

Answer

Add an inbound rule to deny TCP port 22

Answer

Add an inbound deny rule for TCP port 22 to the network ACL

Answer

Add an outbound rule to deny TCP port 22

Question 5

A startup is launching a new web application on AWS and needs to design a highly available and secure network architecture. The application will run on EC2 instances in an Auto Scaling group across two Availability Zones in a single region. The application must be accessible from the internet over HTTPS. The company expects variable traffic and wants to reduce costs where possible. They also need to protect against common web exploits like SQL injection and cross-site scripting. Which combination of AWS services should be used for the network design?

Accepted Answer

Use an Application Load Balancer (ALB) in public subnets. Enable AWS WAF on the ALB. Place EC2 instances in private subnets with a NAT gateway for outbound traffic.. An Application Load Balancer (ALB) in public subnets can terminate HTTPS and distribute traffic to EC2 instances in private subnets, which enhances security by removing direct internet access from the instances. Enabling AWS WAF on the ALB protects against common web exploits like SQL injection and cross-site scripting. A NAT gateway in public subnets provides outbound internet access for instances in private subnets, which is cost-effective for variable traffic as it scales automatically and incurs charges only when used.

Answer

Use an Application Load Balancer (ALB) in private subnets. Enable AWS WAF on the ALB. Place EC2 instances in public subnets with a VPC endpoint for outbound traffic.

Answer

Use an Application Load Balancer (ALB) in public subnets. Use a VPC endpoint for outbound traffic. Place EC2 instances in public subnets with Elastic IPs.

Answer

Use a Network Load Balancer (NLB) in public subnets. Enable AWS Shield Advanced for DDoS protection. Place EC2 instances in private subnets with a NAT gateway for outbound traffic.

Question 6

A company has a VPC with multiple subnets across three Availability Zones. They are deploying an NFS file system using Amazon EFS. They need high availability and low latency from all subnets. Which EFS deployment option meets these requirements?

Accepted Answer

Use EFS Standard storage class with Multi-AZ and create mount targets in each Availability Zone.. The EFS Standard storage class provides Multi-AZ durability and availability, and creating mount targets in each Availability Zone ensures that EC2 instances in any subnet can connect to EFS with low latency by using a mount target in the same AZ. This architecture avoids cross-AZ data transfer charges and minimizes latency, meeting both high availability and low latency requirements.

Answer

Use EFS One Zone storage class with a single mount target in the same Availability Zone as the application.

Answer

Use EFS Standard storage class with Multi-AZ and create a single mount target in one Availability Zone.

Answer

Use EFS One Zone storage class and create mount targets in each Availability Zone.

Question 7

A company is deploying a VPC with both public and private subnets. They have an EC2 instance in a private subnet that needs to access the internet for software updates. Which AWS service should be placed in a public subnet to enable this?

Accepted Answer

NAT gateway. A NAT gateway is correct because it enables EC2 instances in a private subnet to initiate outbound connections to the internet (e.g., for software updates) while preventing the internet from initiating inbound connections to those instances. The NAT gateway must be placed in a public subnet with an associated Internet Gateway to translate private IP addresses to the public IP of the NAT gateway for outbound traffic.

Answer

Internet gateway

Answer

VPC endpoint

Answer

Direct Connect virtual interface

Question 8

A network engineer is troubleshooting connectivity between an EC2 instance in a VPC and an on-premises server connected via AWS Site-to-Site VPN. The ping from the EC2 instance to the on-premises server fails. The VPN tunnel status shows 'UP'. Which configuration should the engineer check first?

Accepted Answer

Check the route table associated with the EC2 instance's subnet for a route to the on-premises network. Even when the VPN tunnel is UP, traffic from the EC2 instance to the on-premises server will be dropped if the VPC route table associated with the instance's subnet does not contain a route pointing to the on-premises network via the virtual private gateway (VGW). The ping failure in this scenario is most likely due to missing routing, not tunnel misconfiguration, since the tunnel status is UP.

Answer

Ensure the customer gateway device is configured with the correct public IP address

Answer

Check that the pre-shared key matches on both sides

Answer

Verify that the VPN tunnel is using the correct encryption algorithms

Question 9

A company is using AWS Client VPN for remote access. Users can authenticate and establish a VPN connection, but they cannot access resources in the VPC. The Client VPN endpoint is associated with a subnet in the VPC. The security group for the Client VPN endpoint allows all traffic. What is the most likely cause?

Accepted Answer

There is no authorization rule to allow access to the VPC CIDR.. AWS Client VPN requires authorization rules to permit access to the VPC CIDR. Without an authorization rule, even if authentication and connection succeed, the client cannot access VPC resources. The security group allowing all traffic is irrelevant because the authorization rule is a separate access control layer. Therefore, the missing authorization rule is the most likely cause.

Answer

The Client VPN endpoint is not associated with the correct subnet.

Answer

The route table for the subnet does not have a route to the Client VPN endpoint.

Answer

The Client VPN endpoint's server certificate is expired.

Question 10

A financial services company is designing a hybrid network architecture using AWS Direct Connect. They have a Direct Connect connection with a public VIF and a private VIF. The private VIF is associated with a Direct Connect gateway that is attached to a Transit Gateway in us-east-1. The Transit Gateway has attachments to a production VPC and a shared services VPC. The company wants to ensure that all traffic from the on-premises network to the production VPC flows through a centralized inspection appliance in the shared services VPC for security compliance. Additionally, traffic from the production VPC to the internet must use a NAT gateway in the shared services VPC. The inspection appliance in the shared services VPC performs stateful inspection and must see both directions of traffic. The network engineer configured the following route tables: In the Transit Gateway route table associated with the Direct Connect gateway attachment, a static route for 0.0.0.0/0 points to the shared services VPC attachment. In the Transit Gateway route table associated with the production VPC attachment, a static route for the on-premises CIDR (10.0.0.0/8) points to the shared services VPC attachment. In the Transit Gateway route table associated with the shared services VPC attachment, a static route for the on-premises CIDR points to the Direct Connect gateway attachment, and a static route for 0.0.0.0/0 points to the Direct Connect gateway attachment (for outbound internet traffic, the shared services VPC has its own internet gateway and NAT gateway). The production VPC has a default route (0.0.0.0/0) pointing to the Transit Gateway. The shared services VPC has a default route pointing to the NAT gateway. However, traffic from on-premises to the production VPC is not being inspected; it goes directly to the production VPC. What is the most likely reason?

Accepted Answer

The Transit Gateway route table associated with the Direct Connect gateway attachment has propagation enabled, which installs a more specific route for the production VPC CIDR directly to the production VPC attachment, bypassing the shared services VPC.. When propagation is enabled on the Transit Gateway route table associated with the Direct Connect gateway attachment, the production VPC CIDR is automatically learned as a more specific route (e.g., 10.1.0.0/16) pointing directly to the production VPC attachment. This more specific route overrides the static 0.0.0.0/0 route that was intended to force traffic through the shared services VPC, causing on-premises traffic to bypass the inspection appliance.

Answer

The shared services VPC has a default route pointing to the NAT gateway, which is not a valid next hop for traffic coming from the Transit Gateway.

Answer

The production VPC route table has a default route pointing to the Transit Gateway, but the NAT gateway is in the shared services VPC, causing asymmetric routing.

Answer

The Transit Gateway route table associated with the shared services VPC attachment does not have a route for the production VPC CIDR pointing to the production VPC attachment, so return traffic cannot reach production.