ANS-C01 Practice Test 20 — 15 Questions

Question 1

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. It needs to connect to an on-premises data center via AWS Direct Connect. The on-premises network uses 10.0.0.0/8. Which action should the network engineer take to avoid IP address overlap?

Accepted Answer

Create a new VPC with a non-overlapping CIDR block, such as 172.16.0.0/16, and migrate resources.. To avoid overlapping IP ranges, the VPC CIDR must not overlap with the on-premises network. The on-premises uses 10.0.0.0/8, which includes 10.0.0.0/16. The company must change the VPC CIDR to a non-overlapping range, such as 172.16.0.0/16 (RFC 1918 private range). Option B is incorrect because NAT does not solve overlap for VPN/Direct Connect routes. Option C is incorrect because adding a secondary CIDR does not remove the overlap. Option D is incorrect because Direct Connect does not support overlapping IPs.

Answer

Use a NAT gateway to translate the VPC addresses when connecting to on-premises.

Answer

Use AWS Direct Connect gateway to automatically handle overlapping IPs.

Answer

Add a secondary CIDR block to the VPC and use it for resources that need to connect to on-premises.

Question 2

A company is designing a network architecture for a critical application that must be highly available across AWS Regions. The application uses an Application Load Balancer (ALB) in each Region, and the company wants to use a global DNS name that automatically routes traffic to the healthy Region with the lowest latency. The company also needs to be able to perform planned failover for maintenance. Which THREE components are required to meet these requirements?

Accepted Answer

Amazon Route 53 weighted routing policy for each ALB endpoint. Route 53 latency-based routing sends traffic to the Region with lowest latency. Health checks detect Region failures. Weighted records allow shifting traffic for maintenance. Option A is correct because latency routing is needed. Option B is correct because health checks enable failover. Option D is correct because weighted records allow manual traffic shifting. Option C is not required because failover routing is not used. Option E is not required because Geo proximity is not needed.

Answer

Amazon Route 53 geolocation routing policy

Answer

Amazon Route 53 failover routing policy

Question 3

Which TWO options are valid methods to connect a VPC to an on-premises network? (Choose two.)

Accepted Answer

AWS Site-to-Site VPN. Options A and C are correct. AWS Direct Connect is a dedicated private connection, and AWS Site-to-Site VPN is a VPN over the internet. VPC peering (B) is for VPC-to-VPC. Internet Gateway (D) is for internet access. VPC endpoint (E) is for private access to AWS services.

Answer

Internet Gateway

Answer

VPC endpoint

Answer

VPC peering

Question 4

A company is designing a hybrid network with a Direct Connect connection. The VPC has multiple subnets that need to communicate with on-premises. The company wants to use a single VIF for both private and public traffic. Which type of VIF should be used?

Accepted Answer

A single VIF cannot carry both private and public traffic. Option D is correct because a private VIF allows access to VPCs via private IP addresses. A public VIF is for accessing public AWS services. Option A is wrong because a private VIF is for VPC access, but the question asks for both private and public traffic. Option B is wrong because a public VIF only provides access to public AWS services, not VPCs. Option C is wrong because a hosted VIF is a type of private VIF but still only private.

Answer

Public VIF

Answer

Hosted VIF

Answer

Private VIF

Question 5

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to add a second CIDR block of 10.1.0.0/16 for additional subnets. After adding the CIDR, the existing subnets cannot communicate with the new subnets. What is the most likely cause?

Accepted Answer

Route tables for the existing subnets do not have routes to the new CIDR.. Option C is correct because route tables must be updated to include routes for the new CIDR block. Option A is wrong because adding a CIDR does not require a new VPC. Option B is wrong because security groups are not the cause of connectivity issues between subnets. Option D is wrong because NACLs are not the issue unless they are blocking traffic.

Answer

Security groups are blocking traffic between the old and new subnets.

Answer

The VPC CIDR cannot be extended; a new VPC must be created.

Answer

Network ACLs are blocking traffic by default.

Question 6

A company has a VPC with public and private subnets. An Amazon EC2 instance in a private subnet needs to download patches from the internet. The company wants to ensure that the instance cannot be directly initiated from the internet. Which design should be used?

Accepted Answer

Attach a NAT Gateway to the public subnet and add a route to the NAT Gateway in the private subnet's route table. Option D is correct because a NAT Gateway in a public subnet allows outbound internet access from private subnets while preventing inbound connections from the internet. Option A is wrong because an Internet Gateway alone does not provide outbound-only access; it requires public IPs. Option B is wrong because a NAT Instance also works but is less managed; however, the question asks for a design, and NAT Gateway is the recommended AWS managed service. Option C is wrong because a VPC endpoint for S3 is for accessing S3, not general internet patches.

Answer

Launch a NAT instance in the public subnet and add a route in the private subnet's route table

Answer

Use a VPC endpoint for Amazon S3 and route patch traffic through it

Answer

Add a route to the internet gateway in the private subnet's route table

Question 7

A company is designing a multi-region architecture with an active-active setup. They need to route traffic to the nearest healthy endpoint. Which AWS service should they use?

Accepted Answer

Amazon Route 53 latency-based routing. Option B is correct because Amazon Route 53 latency-based routing directs traffic based on the lowest latency to the nearest healthy endpoint. Option A is wrong because Application Load Balancer is regional. Option C is wrong because Global Accelerator uses Anycast IPs but does not use latency-based routing by default. Option D is wrong because CloudFront is a CDN, not for routing to application endpoints.

Answer

Application Load Balancer (ALB)

Answer

AWS Global Accelerator

Answer

Amazon CloudFront

Question 8

A company is deploying a web application in a VPC. They need to ensure that the web servers can be accessed from the internet and that traffic is encrypted. Which TWO services should they use?

Accepted Answer

Application Load Balancer (ALB). Options A and D are correct. An Application Load Balancer (ALB) can handle HTTPS termination and distribute traffic to web servers. AWS Certificate Manager (ACM) provides SSL/TLS certificates. Option B is wrong because AWS WAF is for web application firewall, not encryption. Option C is wrong because CloudFront can be used but the question specifies two services; ALB+ACM is a standard combination. Option E is wrong because NAT Gateway is for outbound traffic.

Answer

AWS WAF

Answer

NAT Gateway

Answer

Amazon CloudFront

Question 9

A company is designing a multi-Region active-active application using Application Load Balancers (ALBs) in us-east-1 and eu-west-1, with Route 53 latency-based routing. Users report that after a failover, existing connections fail. What should the company implement to ensure seamless failover?

Accepted Answer

Enable sticky sessions (session affinity) on the ALBs with a cookie duration. Sticky sessions are required to maintain user sessions during failover. Route 53 latency routing alone does not preserve sessions. Option C is correct because ALB sticky sessions with a cookie duration keep users pinned to the same ALB. Option A is wrong because cross-Region VPC peering does not affect session persistence. Option B is wrong because client IP affinity is not supported across Regions. Option D is wrong because Global Accelerator does not provide session stickiness.

Answer

Use a Global Accelerator instead of Route 53

Answer

Enable client IP affinity on the ALBs

Answer

Use Amazon Route 53 geolocation routing instead of latency

Question 10

Which TWO statements about AWS Transit Gateway are correct? (Choose two.)

Accepted Answer

It supports transitive routing between attached VPCs. Options B and C are correct. Transit Gateway supports transitive routing between attachments. It can be shared across accounts using AWS Resource Access Manager (RAM). Option A is wrong because it does not replace Direct Connect. Option D is wrong because it does not provide internet access. Option E is wrong because it supports both IPsec VPN and Direct Connect attachments.

Answer

It provides internet access for attached VPCs

Answer

It can replace AWS Direct Connect for on-premises connectivity

Answer

It only supports VPN attachments

Question 11

A company is deploying an application that must use IPv6 for internet-facing traffic. The VPC is currently using IPv4 only. What is the simplest way to enable IPv6?

Accepted Answer

Associate an IPv6 CIDR block with the VPC and subnets, and update route tables to route IPv6 traffic to an internet gateway.. Option A is correct because you can assign an IPv6 CIDR block to the VPC and subnets, and then update route tables. Option B is wrong because a NAT device is for IPv4. Option C is wrong because an egress-only internet gateway is for outbound-only IPv6. Option D is wrong because a VPN does not provide IPv6 internet access.

Answer

Use an egress-only internet gateway for IPv6 traffic.

Answer

Deploy a NAT64 device to translate IPv6 to IPv4.

Answer

Set up a VPN connection to an ISP that provides IPv6.

Question 12

A company has a VPC with a CIDR block of 10.0.0.0/16. They have two subnets: subnet-A (10.0.1.0/24) and subnet-B (10.0.2.0/24). An EC2 instance in subnet-A needs to communicate with an RDS database in subnet-B. Both subnets are in the same Availability Zone. What is the most efficient way to enable this communication?

Accepted Answer

No additional configuration is required. The instance and database can communicate within the same VPC.. Option A is correct. By default, VPC subnets can communicate with each other; no additional configuration is needed if the security groups and network ACLs allow traffic. Option B is wrong because VPC Peering is for cross-VPC communication. Option C is wrong because a NAT Gateway is for outbound internet access. Option D is wrong because a Transit Gateway is for connecting multiple VPCs or networks.

Answer

Create a Transit Gateway and attach both subnets to it.

Answer

Place a NAT Gateway in subnet-A and configure route tables accordingly.

Answer

Create a VPC Peering connection between the two subnets.

Question 13

A company has a hybrid network with multiple VPCs connected via a Transit Gateway. They need to centralize outbound internet traffic through a single VPC. Which architecture should be used?

Accepted Answer

Designate one VPC as an egress VPC with a NAT Gateway and Internet Gateway, and use Transit Gateway route tables to route 0.0.0.0/0 from other VPCs to the egress VPC.. Option D is correct because an egress VPC with a NAT Gateway and Internet Gateway can centralize outbound traffic via Transit Gateway route tables. Option A is wrong because each VPC with its own NAT Gateway does not centralize. Option B is wrong because a VPN does not provide internet access. Option C is wrong because an Internet Gateway in each VPC does not centralize.

Answer

Attach a NAT Gateway to each VPC's private subnets.

Answer

Attach an Internet Gateway to each VPC and route 0.0.0.0/0 to the IGW.

Answer

Use a VPN connection to an on-premises data center for internet access.

Question 14

A company is deploying a multi-tier web application across multiple Availability Zones in a single Region. The web tier must be fault-tolerant and distribute traffic across EC2 instances. The application tier uses an Auto Scaling group of EC2 instances that need to be accessed by the web tier using a static IP address. Which combination of AWS services meets these requirements?

Accepted Answer

Application Load Balancer for the web tier and Network Load Balancer for the application tier. Option B is correct because an ALB distributes traffic to web tier instances, and an NLB provides a static IP for the application tier. Option A is wrong because NLB does not support path-based routing needed for web tier. Option C is wrong because Global Accelerator is for multi-Region traffic. Option D is wrong because CLB is legacy and does not support advanced features.

Answer

Classic Load Balancer for the web tier and Application Load Balancer for the application tier

Answer

AWS Global Accelerator for the web tier and Classic Load Balancer for the application tier

Answer

Network Load Balancer for the web tier and Application Load Balancer for the application tier

Question 15

A company uses AWS Direct Connect with a private VIF to access a VPC. They also have a site-to-site VPN as backup. They notice that during Direct Connect maintenance, the VPN does not take over traffic as expected. All routes are advertised over BGP. What is the most likely reason?

Accepted Answer

The VPN BGP advertisements have a longer AS PATH than the Direct Connect advertisements, making them less preferred.. Option A is correct because if the Direct Connect and VPN BGP advertisements have the same AS PATH length, the route with the lower local preference is preferred. If local preference is the same, the route with the lower MED is preferred. Typically, Direct Connect routes have a higher local preference by default, so when Direct Connect goes down, the VPN routes are available but may have a lower local preference, causing them to be ignored if the Direct Connect routes are still present. However, the scenario says Direct Connect is down, so the VPN routes should be active. Another common issue is that the VPN BGP session does not come up due to misconfiguration, but the most likely reason is that the VPN's BGP advertisements have a longer AS PATH, making them less preferred. Option B is wrong because the VPN is a backup. Option C is wrong because Direct Connect is down. Option D is wrong because the VPN is expected to have a longer AS PATH.

Answer

The Direct Connect virtual interface is still in the 'available' state even though the physical link is down.

Answer

The VPN tunnel is using a different BGP ASN than the Direct Connect.

Answer

The VPN is configured with a higher local preference than Direct Connect.