ANS-C01 Practice Test 20 — 15 Questions

Question 1

A company is designing a network security architecture for a multi-tier web application. Which THREE best practices should they implement? (Choose three.)

Accepted Answer

Use network ACLs as a stateless firewall for subnet-level traffic. Option C is correct because network ACLs (NACLs) are stateless, subnet-level firewalls in AWS that evaluate inbound and outbound rules independently, making them appropriate for controlling traffic at the subnet boundary. Option D is correct because databases should be placed in private subnets without a route to an internet gateway, ensuring no direct inbound or outbound internet access and reducing the attack surface for sensitive data. Option E is correct because security groups operate at the instance (ENI) level and are stateful, allowing precise control of allowed inbound and outbound traffic for each resource. Option A is incorrect because an internet gateway is attached to a VPC and used by public subnets for internet access; private subnets typically use a NAT gateway or NAT instance for outbound traffic instead. Option B is incorrect because security groups are stateful, not stateless, so describing them as a stateless firewall is technically wrong.

Answer

Attach an internet gateway to the private subnet for outbound traffic

Answer

Use security groups as a stateless firewall

Question 2

A company is designing a VPC for a three-tier web application. The web servers must be accessible from the internet, while the application and database servers must be isolated. Which subnet design should the company use?

Accepted Answer

Public subnet for web servers, private subnets for application and database servers. It uses a public subnet with an Internet Gateway (IGW) for the web servers to receive inbound traffic from the internet, while placing the application and database servers in private subnets with no direct internet route. This design enforces the principle of least privilege by isolating sensitive tiers, using NAT Gateway or VPC endpoints for outbound traffic if needed, and relying on security groups and network ACLs for fine-grained access control.

Answer

A single subnet for all tiers with network ACLs to isolate traffic

Answer

Private subnets for all tiers

Answer

Public subnets for all tiers

Question 3

A company runs a critical application on EC2 instances behind an Application Load Balancer. They need to ensure that if an instance fails health checks, it is automatically terminated and replaced. Which AWS service should they use?

Accepted Answer

Auto Scaling group. An Auto Scaling group (Option C) is the correct service because it automatically replaces unhealthy EC2 instances by integrating with the Application Load Balancer's health checks. When an instance fails the configured health check (e.g., HTTP 5xx or TCP timeout), the Auto Scaling group marks it as unhealthy, terminates it, and launches a new instance to maintain the desired capacity. This lifecycle management is a core feature of Auto Scaling groups, not available in the other options.

Answer

AWS Lambda

Answer

EC2 Instance Connect

Answer

Amazon CloudWatch

Question 4

A company is designing a highly available architecture for a web application using an Application Load Balancer (ALB) across multiple Availability Zones. The ALB is internet-facing and uses TLS termination. The application requires that client IP addresses be preserved in the backend logs. The backend instances are in private subnets behind the ALB. Which configuration will ensure client IP addresses are preserved without additional overhead?

Accepted Answer

Configure the ALB to pass the X-Forwarded-For header and ensure backend logs parse it. The ALB automatically adds the X-Forwarded-For header to HTTP requests, containing the original client IP address. Since the backend instances are in private subnets and receive traffic from the ALB's private IPs, parsing this header in the backend logs is the standard, zero-overhead method to preserve client IPs for HTTP/HTTPS traffic with TLS termination.

Answer

Attach a VPC Endpoint to the ALB to capture client IP

Answer

Enable Proxy Protocol v2 on the target group

Answer

Replace the ALB with a Network Load Balancer (NLB)

Question 5

A company is deploying a web application in a VPC with an Application Load Balancer (ALB) in front of EC2 instances. The ALB must only accept traffic from the internet and forward it to the instances. Which subnet configuration is correct for the ALB and EC2 instances?

Accepted Answer

ALB in public subnets, EC2 in private subnets.. An Application Load Balancer (ALB) must be deployed in public subnets to accept traffic directly from the internet, as it requires an internet gateway (IGW) route to receive inbound connections. The EC2 instances should reside in private subnets to enhance security, as they only need to respond to the ALB via the VPC's internal routing, not directly from the internet. This configuration ensures the ALB handles internet-facing traffic while the instances remain isolated from direct external access.

Answer

ALB in private subnets, EC2 in private subnets with a NAT gateway.

Answer

ALB in public subnets, EC2 in public subnets.

Answer

ALB in private subnets, EC2 in public subnets.

Question 6

Refer to the exhibit. A company has two VPCs (vpc-aaaaaaaa and vpc-bbbbbbbb) that are peered. The CIDR blocks are both 10.0.0.0/16. The peering connection status is 'active'. Which of the following is true about this configuration?

Accepted Answer

The VPCs cannot communicate because of overlapping CIDR blocks. VPC peering does not support overlapping CIDR blocks. Even though the peering connection status is active, routes cannot be added to the route tables because the CIDR blocks are identical (both 10.0.0.0/16), preventing communication. Option B is incorrect because the peering connection can become active despite overlapping CIDRs; the issue arises at the routing layer. Option C is incorrect because the overlapping CIDRs prevent any communication between the VPCs. Option D is incorrect because DNS resolution is not automatically enabled; it requires additional configuration.

Answer

The VPC peering connection will not become active due to overlapping CIDRs

Answer

The VPCs can communicate using the peering connection without any issues

Answer

DNS resolution between the VPCs will be automatically enabled

Question 7

A company is designing a hybrid network architecture that requires high availability and low latency between its on-premises data center and AWS. The company currently has two Direct Connect connections from different providers terminating at two different AWS Direct Connect locations. Which solution provides the most resilient and high-performance connectivity?

Accepted Answer

Use two Direct Connect connections from different providers at different locations with a VPN backup.. Using two Direct Connect connections from different providers at different locations ensures physical and provider diversity, eliminating single points of failure. Adding a VPN backup provides an additional failover path over the internet, which is essential for maintaining connectivity if both Direct Connect links fail. This design meets the requirements for high availability and low latency by leveraging active/active or active/passive traffic engineering with BGP routing and AS path prepending.

Answer

Use a single Direct Connect connection with multiple VLANs.

Answer

Use Site-to-Site VPN over the internet as the primary connection.

Answer

Use two Direct Connect connections from the same provider at the same location.

Question 8

A network engineer is setting up a VPC peering connection between two VPCs in the same AWS account and Region. Which TWO steps are required to enable communication between instances in the peered VPCs? (Choose two.)

Accepted Answer

Add routes in each VPC's route table pointing to the CIDR of the other VPC. Option C is correct because after a VPC peering connection is accepted, the route tables in each VPC must be updated with a route whose destination is the peer VPC's CIDR block and whose target is the peering connection (pcx-xxxxxxxx); without these routes, instances have no path to the peer network. Option E is correct because security groups are stateful and must explicitly permit the desired traffic; since the peered VPC's CIDR is a different source range, you must add inbound rules referencing the peer CIDR (or the peer security group) to allow communication. Option A is wrong because an internet gateway is only needed for public internet access, not for private VPC-to-VPC peering traffic. Option B is wrong because a VPN connection is unnecessary for same-Region peering; peering uses AWS's private backbone, not IPsec tunnels. Option D is wrong because a NAT gateway provides outbound internet access for private subnets and plays no role in routing traffic across a peering connection.

Answer

Attach an internet gateway to each VPC

Answer

Establish a VPN connection between the VPCs

Answer

Configure a NAT gateway in each VPC

Question 9

A company is deploying a latency-sensitive application across two AWS Regions using Application Load Balancers (ALBs) and AWS Global Accelerator. The application uses TCP port 8443. Which configuration ensures the lowest possible latency for global users?

Accepted Answer

Use AWS Global Accelerator with endpoints as the ALBs in each Region.. AWS Global Accelerator uses the Anycast static IP addresses to route traffic over the AWS global network to the optimal ALB endpoint, minimizing internet hops and latency. For TCP port 8443, Global Accelerator preserves the client IP and provides connection termination at the edge, ensuring the lowest possible latency for global users by avoiding the public internet.

Answer

Use Amazon CloudFront with the ALBs as origins.

Answer

Use Amazon Route 53 latency-based routing with ALB endpoints in each Region.

Answer

Deploy a Network Load Balancer in each Region and use Route 53 geoproximity routing.

Question 10

A company is designing a hub-and-spoke network in AWS. The security team requires that all traffic between VPCs in different spokes must be inspected by a third-party firewall deployed in the hub VPC. Which architecture meets this requirement with minimal complexity?

Accepted Answer

Use a Transit Gateway with separate route tables for each spoke VPC, and configure the spoke route tables to route all inter-spoke traffic through the hub VPC firewall.. A Transit Gateway acts as a regional hub that supports transitive routing between attached VPCs, and by using separate route tables per spoke attachment, the architect can force all inter-spoke traffic through the hub VPC where the third-party firewall resides. This is the canonical AWS hub-and-spoke inspection pattern because TGW route tables provide the segmentation needed to redirect traffic to a security VPC appliance without full mesh complexity. It scales cleanly as spokes are added, unlike peering meshes.

Answer

Create VPC peering connections between each spoke VPC and configure security groups to enforce inspection.

Answer

Use AWS PrivateLink to connect all spoke VPCs to a central service in the hub.

Answer

Set up AWS Direct Connect between all VPCs and route through a central firewall.

Question 11

A company is connecting their on-premises data center to AWS using a site-to-site VPN. The customer gateway device has a dynamic routing configuration with BGP. The VPN connection is established, but the VPC route table does not contain the on-premises network routes. What is the most likely cause?

Accepted Answer

Route propagation is not enabled on the VPC route table.. When using a site-to-site VPN with dynamic routing (BGP), the VPC route table must have route propagation enabled to automatically import the BGP-advertised routes from the virtual private gateway (VGW). Without route propagation, the VPC route table will not contain the on-premises network routes, even though the VPN tunnel and BGP session are established.

Answer

The customer gateway device is not configured with the correct BGP ASN.

Answer

The VPC route table has static routes pointing to the virtual private gateway.

Answer

The VPN connection is using static routing instead of dynamic routing.

Question 12

A company has a VPC with multiple subnets. They want to enforce that all traffic between subnets must be inspected by a security appliance deployed in a centralized inspection VPC. Which AWS feature should be used to route traffic to the inspection VPC without changing the routing on each subnet?

Accepted Answer

Transit Gateway with route tables. A Transit Gateway with route tables allows central routing and inspection. Option A is wrong because VPC peering does not support centralized inspection easily. Option B is correct because Transit Gateway can route traffic between VPCs and subnets with centralized inspection. Option C is wrong because NAT Gateway is for outbound internet traffic. Option D is wrong because a Network Load Balancer is for load balancing, not routing.

Answer

VPC Peering

Answer

NAT Gateway

Answer

Network Load Balancer

Question 13

A company uses AWS Direct Connect and VPN as backup. The network team notices that during a VPN failover, traffic drops for several minutes. The VPN tunnels are configured with BGP dynamic routing. Which configuration change would MOST likely reduce failover time?

Accepted Answer

Enable BFD on the VPN BGP sessions. BFD (Bidirectional Forwarding Detection) provides sub-second failure detection for BGP sessions by sending rapid heartbeat packets independent of BGP keepalives. When enabled on VPN BGP sessions, BFD can detect a dead peer in milliseconds rather than waiting for the BGP hold timer to expire (which defaults to 90 seconds), dramatically reducing failover time during VPN failover scenarios.

Answer

Configure static routes over the VPN instead of BGP

Answer

Increase the BGP keepalive interval and decrease the hold timer

Answer

Decrease the BGP keepalive interval and increase the hold timer

Question 14

A network administrator is setting up VPC Flow Logs to monitor traffic to an Amazon RDS instance. The logs are sent to Amazon S3. After enabling Flow Logs, the administrator notices that no logs are being delivered. What is the most likely cause?

Accepted Answer

The IAM role for Flow Logs does not have permissions to write to S3. VPC Flow Logs require an IAM role that grants permissions to write logs to the destination (S3, CloudWatch Logs, or Kinesis Data Firehose). If the role lacks s3:PutObject and related permissions, logs will not be delivered. The other options are less likely because Flow Logs can be enabled on any VPC, RDS instances in private subnets still generate flow logs, and S3 buckets in different regions can still receive logs if permissions are correct.

Answer

The VPC Flow Logs are not enabled for the correct VPC

Answer

The RDS instance is in a private subnet

Answer

The S3 bucket is in a different region

Question 15

A company has a Direct Connect connection with two private virtual interfaces (VIFs) to two different VPCs. The company wants to use the same Direct Connect connection for both VPCs, but the on-premises router only has one physical port. The network engineer configures a single BGP session over a VLAN-tagged interface. After configuration, only one VPC is reachable. What is the most likely reason?

Accepted Answer

Each private VIF requires a separate BGP session, and only one session was configured. Each AWS Direct Connect private virtual interface (VIF) requires its own BGP session with its own VLAN and peer IP addresses, even when carried over the same physical port. Configuring a single BGP session over one VLAN-tagged interface only establishes reachability to one VIF, so only one VPC becomes reachable.

Answer

The on-premises router is using the same BGP ASN for both VIFs, which is not allowed

Answer

The BGP peer IP addresses must be in the same subnet for both VIFs

Answer

The VLAN ID must be the same for both VIFs to work over a single physical port