ANS-C01 Practice Test 2 — 10 Questions

Question 1

A company has deployed an application in a VPC with public and private subnets. The application uses an Amazon RDS for MySQL database in a private subnet. To meet security requirements, the database must not be accessible from the internet. The application team needs to connect to the database for maintenance using SSH over a bastion host. Which architecture is the most secure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Bastion host in a public subnet with a security group allowing SSH from the corporate IP range, and database security group allowing MySQL from the bastion host's security group. The most secure architecture because it restricts SSH access to the bastion host from only the corporate IP range, and the database security group allows MySQL (port 3306) traffic solely from the bastion host's security group. This ensures the database is never directly exposed to the internet and only accepts connections from the bastion, which itself is locked down to authorized corporate IPs. The use of security group referencing (instead of IP-based rules) provides dynamic, scalable access control that automatically applies to any instances with the bastion's security group.

Answer

Bastion host in a public subnet with the same security group as the database, allowing SSH from the corporate IP range and MySQL from the bastion

Answer

Bastion host in a public subnet with a security group allowing SSH from 0.0.0.0/0, and database security group allowing MySQL from the bastion host's security group

Answer

Connect to the database directly using a Site-to-Site VPN without a bastion host

Question 2

A network engineer is configuring a new AWS Direct Connect connection and needs to establish BGP peering with the AWS side. The engineer has received the BGP configuration from the AWS Direct Connect endpoint. Which information is required to complete the BGP configuration on the on-premises router?

Accepted Answer

The AWS BGP peer IP address and the BGP ASN. B is correct because BGP peering requires the remote peer's IP address and Autonomous System Number (ASN) to establish a TCP connection and exchange routing information. AWS provides these two values in the Direct Connect endpoint configuration, and the on-premises router must use them to configure the BGP neighbor statement. Without both, the BGP session cannot be established.

Answer

The AWS Side BGP password and MD5 hash

Answer

The Amazon side routing table and prefix list

Answer

The Direct Connect virtual interface ID and VLAN ID

Question 3

A company has a VPC with public and private subnets in multiple Availability Zones. They want to deploy a NAT gateway for outbound internet access for instances in private subnets. Which of the following is the most highly available architecture?

Accepted Answer

Deploy one NAT gateway in each Availability Zone with a route table per AZ that points to the NAT gateway in the same AZ.. For high availability, you should deploy a NAT gateway in each Availability Zone and route traffic from private subnets in each AZ to the NAT gateway in the same AZ. This avoids cross-AZ data transfer costs and ensures that an AZ failure does not affect other AZs. Option A is correct. Options B and C do not provide equal HA. Option D is incorrect because deploying both NAT gateways in the same Availability Zone creates a single point of failure—if that AZ goes down, both gateways fail, so it is not highly available.

Answer

Deploy one NAT gateway in the first Availability Zone and route all private subnet traffic to that NAT gateway.

Answer

Use a single NAT instance in a public subnet with an auto scaling group and health checks.

Answer

Deploy two NAT gateways in the first Availability Zone and use a single route table pointing to one of them.

Question 4

A company is designing a network architecture for a critical application that requires high availability and low latency. The application will be deployed on EC2 instances in an Auto Scaling group across three Availability Zones in a single region. The instances will communicate with an Amazon RDS database. Which configuration will provide the MOST resilient and performant network connectivity?

Accepted Answer

Create an RDS Multi-AZ cluster with one writer and two reader instances in different AZs, and use the cluster endpoint for writes and reader endpoint for reads.. A Multi-AZ cluster with one writer and two reader instances provides both high availability and low latency. The cluster endpoint automatically routes write traffic to the primary instance, while the reader endpoint distributes read traffic across the reader instances in different Availability Zones, reducing latency and improving resilience. This architecture ensures that if one Availability Zone fails, the database remains available without manual intervention, meeting the critical application's requirements.

Answer

Launch a single RDS instance in a public subnet and use Route 53 latency-based routing to direct traffic.

Answer

Use a Network Load Balancer in front of the RDS instance to distribute connections across Availability Zones.

Answer

Place the RDS instance in a single Availability Zone and use a read replica in another AZ for failover.

Question 5

A company is deploying a hybrid network architecture with an AWS Direct Connect connection. They require high availability with redundant connections to two different AWS Direct Connect locations. Which configuration meets the high availability requirement?

Accepted Answer

Two Direct Connect connections at two different AWS Direct Connect locations. Deploying two Direct Connect connections at two different AWS Direct Connect locations provides physical and logical redundancy. This ensures that if one location experiences an outage, the other location can continue to handle traffic, meeting the high availability requirement. AWS recommends this architecture for production workloads requiring resilient hybrid connectivity.

Answer

One Direct Connect connection and one AWS Site-to-Site VPN as backup

Answer

Two virtual interfaces (VIFs) on the same Direct Connect connection

Answer

Two Direct Connect connections at the same AWS Direct Connect location

Question 6

A security engineer created the above S3 bucket policy to grant public read access to objects in the 'confidential/' prefix. However, users report that they receive 'Access Denied' errors when trying to access objects that have the tag 'classification: public'. What is the most likely cause?

Accepted Answer

The objects in the 'confidential/' prefix do not have the required tag 'classification: public'.. The bucket policy includes a condition that requires the object to have the tag 'classification: public' (using s3:ExistingObjectTag). If the objects in the 'confidential/' prefix do not have this tag, the condition fails and access is denied, even though the prefix matches. The policy explicitly grants public read access only to objects that satisfy both the prefix and the tag condition.

Answer

The bucket policy does not grant access to objects owned by other AWS accounts.

Answer

The 's3:GetObjectVersion' action is not allowed because the bucket is not versioned.

Answer

The condition should use 'StringLike' instead of 'StringEquals' for tag matching.

Question 7

Refer to the exhibit. A flow log record shows ACCEPT for traffic from 10.0.1.5 to 10.0.2.10 on port 443. Which AWS service is most likely the destination?

Accepted Answer

Application Load Balancer. An Application Load Balancer (ALB) terminates HTTPS (port 443) connections and forwards traffic to targets. Flow logs showing ACCEPT for traffic to port 443 on an ALB's internal IP (10.0.2.10) are expected because the ALB listens on that port for incoming client connections. The ALB operates at Layer 7 and is the only listed service that natively accepts HTTPS traffic on port 443 within a VPC.

Answer

Amazon RDS instance

Answer

NAT Gateway

Answer

Amazon S3

Question 8

A company is designing a network architecture for a multi-account AWS environment using AWS Transit Gateway. They need to meet the following requirements: (1) Centralized inspection of traffic between VPCs using a firewall appliance. (2) Isolated development environments that cannot communicate with each other but can access the internet via a centralized NAT gateway. (3) Compliance with PCI DSS for production workloads, requiring encryption in transit between VPCs. Which TWO actions should they take?

Accepted Answer

Create a dedicated inspection VPC with a firewall appliance and attach it to the Transit Gateway. Use Transit Gateway route tables to route traffic from all VPCs through the inspection VPC.. It enables centralized traffic inspection by attaching a dedicated inspection VPC with a firewall appliance to the Transit Gateway and using separate route tables to force all inter-VPC traffic through that inspection VPC. This design meets the requirement for centralized inspection without requiring complex peering or VPN configurations.

Answer

Use VPC Peering for all inter-VPC communication

Answer

Use AWS Site-to-Site VPN between each VPC and a central VPN hub

Answer

Use AWS Client VPN to connect development VPCs to the production VPC

Question 9

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team observes that traffic between two VPCs (VPC A and VPC B) is not being forwarded correctly. The transit gateway route table is configured with static routes for the VPC CIDRs. Which THREE steps should the engineer take to troubleshoot this issue? (Choose THREE.)

Accepted Answer

Verify that the transit gateway route table contains the CIDR blocks of both VPCs.. The transit gateway route table must contain the CIDR blocks of both VPCs for traffic to be forwarded between them. Without these static routes, the transit gateway has no destination to route the traffic, causing it to be dropped. Verifying the route table entries ensures the necessary paths exist.

Answer

Check the Direct Connect virtual interface status.

Answer

Verify that the NAT Gateway in each VPC is properly configured.

Question 10

Which TWO statements about AWS Direct Connect are correct? (Select TWO.)

Accepted Answer

Direct Connect supports multiple virtual interfaces (VIFs) over a single connection. AWS Direct Connect allows you to create multiple virtual interfaces (VIFs) — including private VIFs, public VIFs, and transit VIFs — over a single physical Direct Connect connection. This enables you to segment traffic to different AWS services (e.g., VPCs via private VIF, public AWS endpoints via public VIF) without needing separate physical cables, leveraging 802.1Q VLAN tagging to isolate each VIF.

Answer

Direct Connect traffic is encrypted by default

Answer

Direct Connect is a managed VPN service

Answer

Direct Connect can be provisioned in minutes without any physical infrastructure