ANS-C01 Practice Exam 3 — 20 Questions

Question 1

A company is using AWS Shield Advanced to protect against DDoS attacks. The security team wants to receive notifications when an attack is detected. Which service should be used to send these notifications?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon SNS. AWS Shield Advanced integrates with Amazon CloudWatch to publish metrics and events. These events can be routed via Amazon EventBridge to trigger an Amazon SNS topic, which then sends notifications (e.g., email, SMS) to the security team. Option A (AWS Lambda) is a compute service, not a notification service. Option B (AWS Config) is used for configuration auditing and compliance, not notifications. Option C (Amazon SQS) is a message queue service; although it can receive events, it is not the service used to send direct notifications to subscribers. Only Amazon SNS (Option D) provides push-based notifications to endpoints like email, SMS, and mobile devices.

Answer

AWS Lambda

Answer

AWS Config

Answer

Amazon SQS

Question 2

A company has a hybrid network with multiple AWS Direct Connect connections to multiple VPCs. They want to monitor network performance and receive alerts when latency exceeds a threshold. Which combination of AWS services should be used to achieve this?

Accepted Answer

Amazon CloudWatch and Amazon CloudWatch Alarms. Amazon CloudWatch collects metrics from Direct Connect, including latency, and CloudWatch Alarms can trigger notifications via SNS when thresholds are exceeded. Option A is incorrect because CloudTrail logs API calls, not performance metrics. Option B is incorrect because Trusted Advisor provides best practice checks, not real-time latency monitoring, and SES is for email sending, not alerting. Option D is incorrect because VPC Flow Logs capture IP traffic metadata, not latency metrics, and CloudWatch Logs store log data, not metrics.

Answer

AWS CloudTrail and Amazon SNS

Answer

AWS Trusted Advisor and Amazon SES

Answer

VPC Flow Logs and Amazon CloudWatch Logs

Question 3

A company is designing a VPC with public and private subnets. The private subnets need to access Amazon S3 and Amazon DynamoDB. The company wants to minimize data transfer costs and avoid using a NAT gateway. What is the MOST cost-effective solution?

Accepted Answer

Create VPC endpoints for S3 and DynamoDB in the private subnets and update route tables. VPC endpoints for S3 and DynamoDB allow private connectivity without incurring data transfer costs or NAT gateway fees. Option A is wrong because an HTTP proxy adds complexity and cost. Option B is wrong because a NAT instance still incurs instance costs and management overhead. Option D is wrong because a NAT gateway incurs hourly and data processing charges.

Answer

Set up an HTTP proxy in the private subnets and configure the applications to use it

Answer

Use a NAT instance instead of a NAT gateway

Answer

Create a NAT gateway in a public subnet and route private subnet traffic to it

Question 4

A company wants to use Amazon Route 53 to resolve DNS queries for a domain they own. They want to ensure that DNS queries are answered quickly and that there is no single point of failure. Which configuration should they use?

Accepted Answer

Create a hosted zone and let Route 53 automatically handle the DNS resolution.. When you create a hosted zone in Route 53, AWS automatically provisions four authoritative name servers (NS records) distributed across multiple globally redundant data centers. This design inherently provides high availability and low-latency DNS resolution without any additional configuration, as Route 53 uses Anycast routing to direct queries to the nearest healthy name server.

Answer

Deploy Route 53 in multiple AWS Regions.

Answer

Create multiple hosted zones in separate AWS accounts.

Answer

Create a single hosted zone and assign it to one Route 53 name server.

Question 5

A company is deploying a multi-tier web application across three Availability Zones in a single AWS Region. The web tier must be fault-tolerant and scale horizontally. Which network design provides the highest availability and scalability?

Accepted Answer

Use an Application Load Balancer in front of an Auto Scaling group spanning three Availability Zones.. An Application Load Balancer (ALB) distributes incoming HTTP/HTTPS traffic across multiple targets, and when combined with an Auto Scaling group that spans three Availability Zones, it provides both horizontal scalability and fault tolerance. If one AZ fails, the ALB automatically routes traffic only to healthy instances in the remaining AZs, ensuring high availability. This design meets the requirement for a multi-tier web application that must scale horizontally and tolerate failures.

Answer

Deploy a single EC2 instance in one Availability Zone with an Elastic IP address.

Answer

Deploy EC2 instances in a single Availability Zone and use Route 53 weighted routing.

Answer

Use a Network Load Balancer with a single EC2 instance in each AZ.

Question 6

Which TWO actions can be taken to reduce the attack surface of a VPC's public subnets? (Choose 2.)

Accepted Answer

Place web servers in private subnets and use a load balancer in a public subnet. Placing web servers in private subnets and using a load balancer in a public subnet reduces the attack surface by ensuring that the web servers have no direct internet-facing IP addresses. The load balancer acts as a single point of ingress, allowing security groups to tightly control traffic from the load balancer to the web servers, while the public subnet only exposes the load balancer's endpoints. This architecture follows AWS best practices for a multi-tier application, minimizing the number of resources directly accessible from the internet.

Answer

Allow all inbound traffic from the internet to the public subnets

Answer

Use a single subnet for all application tiers

Answer

Disable ICMP traffic on the network ACL

Question 7

A company wants to inspect traffic between VPCs in the same region using a third-party security appliance. Which THREE components are needed? (Choose 3)

Accepted Answer

AWS Transit Gateway. Option C (AWS Transit Gateway) is correct because it acts as a regional hub that connects multiple VPCs and can route inter-VPC traffic through a central inspection point, which is exactly what is needed to steer traffic to a third-party security appliance. Option E (a dedicated inspection VPC for the security appliance) is correct because the appliance must live in its own VPC so that Transit Gateway attachments and route tables can force traffic through it before reaching the destination VPC. Option D (route tables in the inspection VPC directing traffic through the appliance) is correct because without route table entries pointing to the appliance's ENI as the next hop, traffic would bypass inspection; the inspection VPC's route tables are what enforce the traffic flow through the security appliance. Option A (VPC Peering connections between all VPCs) is not needed and would actually bypass the central inspection design, since peering creates direct VPC-to-VPC paths. Option B (NAT Gateways in each VPC) is unrelated to traffic inspection; NAT Gateways only provide outbound internet access for private subnets and do not route or inspect inter-VPC traffic.

Answer

VPC Peering connections between all VPCs

Answer

NAT Gateways in each VPC

Question 8

Which THREE of the following are benefits of using AWS Transit Gateway over VPC peering for inter-VPC connectivity? (Choose three.)

Accepted Answer

Transitive routing between all attached VPCs. Option A is correct because AWS Transit Gateway acts as a regional hub that provides transitive routing, so any attached VPC can reach any other attached VPC through the gateway without needing a full mesh of individual peering connections. Option C is correct because Transit Gateway natively supports attachments for AWS Direct Connect gateways and Site-to-Site VPN, allowing centralized hybrid connectivity to on-premises networks, whereas VPC peering cannot extend to on-premises by itself. Option E is correct because Transit Gateway centralizes connectivity management, letting you attach many VPCs and on-premises links to a single gateway and control routing with a single set of route tables, instead of managing numerous point-to-point peering relationships. Option B is not correct because Transit Gateway adds an extra hop through a central hub, so it does not inherently provide lower latency than direct VPC peering. Option D is not correct because Transit Gateway charges per attachment and per GB of data processed, so it typically costs more than VPC peering, which has no hourly attachment charge.

Answer

Lower latency than VPC peering

Answer

No additional cost compared to VPC peering

Question 9

A company is designing a network for a containerized microservices application running on Amazon ECS. The application consists of several microservices that need to communicate with each other. The company wants to use service discovery so that services can find each other by name. They also want to ensure that traffic between services is encrypted in transit. The microservices are deployed across multiple Availability Zones. Which combination of services should the company use?

Accepted Answer

Use AWS Cloud Map for service discovery and AWS App Mesh for encryption in transit. AWS Cloud Map provides service discovery by registering microservices with DNS names and health checks, allowing ECS tasks to resolve each other by name. AWS App Mesh uses Envoy sidecar proxies to enforce mutual TLS (mTLS) encryption between services, ensuring traffic is encrypted in transit without requiring changes to application code. This combination meets the requirements for name-based discovery and encrypted inter-service communication across multiple Availability Zones.

Answer

Use an Application Load Balancer for each service and configure HTTPS listeners

Answer

Use VPC peering between each service's VPC

Answer

Use Amazon Route 53 private hosted zones for service discovery and enable encryption at the application layer

Question 10

A company needs to securely connect multiple VPCs across different AWS Regions using AWS backbone network infrastructure without traversing the public internet. The solution must be managed centrally and support transitive routing between VPCs. Which service should the company use?

Accepted Answer

AWS Transit Gateway with inter-region peering.. AWS Transit Gateway with inter-region peering allows you to connect VPCs across different AWS Regions using the AWS global backbone, avoiding the public internet. It provides a central hub for managing connectivity and supports transitive routing between all attached VPCs, which is not possible with VPC peering alone. This makes it the correct choice for a centrally managed, transitive, cross-region solution.

Answer

VPC peering connections in a full mesh.

Answer

AWS PrivateLink and VPC Endpoints.

Answer

AWS ClassicLink.

Question 11

A company is using AWS Direct Connect to connect its on-premises network to a VPC via a private virtual interface (VIF) attached to a virtual private gateway (VGW). The company wants to add redundant connectivity using a second Direct Connect connection from a different provider. The network team proposes using a Direct Connect gateway (DXGW) with two private VIFs from different connections, each attached to the DXGW. The DXGW will be associated with the VGW. Which THREE steps are required to complete this configuration? (Choose three.)

Accepted Answer

Associate both private virtual interfaces with the same Direct Connect gateway.. Option B is correct because a Direct Connect gateway can aggregate multiple private VIFs from different Direct Connect connections, so both private VIFs must be associated with the same DXGW to provide redundant paths into the same VPC. Option C is correct because the DXGW must be associated with the virtual private gateway (VGW) attached to the VPC, which allows the DXGW to advertise and route traffic to that VPC over the private VIFs. Option D is correct because the on-premises network must advertise its prefixes over both BGP sessions (one per private VIF) so that AWS can learn the routes and use both connections for active-active load sharing or failover. Option A is not required because, with a DXGW associated to a VGW, the VPC route tables point to the virtual private gateway, not directly to the Direct Connect gateway. Option E is incorrect because a single VGW can be associated with the DXGW; separate VGWs per connection are not needed and would not provide the intended redundant attachment to the same VPC.

Answer

Add routes to the VPC subnets' route tables pointing to the Direct Connect gateway.

Answer

Create a separate virtual private gateway for each Direct Connect connection.

Question 12

A company wants to allow its employees to securely access internal web applications hosted in a VPC without using a VPN. The solution must authenticate users against the company's Active Directory and apply fine-grained access controls. Which AWS service should be used?

Accepted Answer

AWS Verified Access. AWS Verified Access is the correct service because it provides secure access to corporate applications hosted in a VPC without requiring a VPN, and it integrates with identity providers such as Active Directory for authentication and fine-grained access control. Option A (AWS SSO) is designed for federating access to AWS accounts and applications, not for securing access to internal VPC-based applications without a VPN. Option C (AWS Client VPN) requires VPN client software and a VPN connection, which does not meet the requirement of not using a VPN. Option D (Application Load Balancer with OIDC authentication) can authenticate users but typically requires the ALB to be publicly accessible or connected via VPN, and it does not provide the same purpose-built zero-trust access capabilities as Verified Access.

Answer

AWS Single Sign-On (SSO)

Answer

AWS Client VPN

Answer

Application Load Balancer with OIDC authentication

Question 13

Which THREE of the following are considerations when designing a VPC with multiple Availability Zones for high availability? (Choose THREE.)

Accepted Answer

Use an Application Load Balancer to distribute traffic across instances in different Availability Zones.. An Application Load Balancer (ALB) distributes incoming traffic across multiple targets, such as EC2 instances, in different Availability Zones (AZs). By registering instances from multiple AZs with the ALB, you ensure that if one AZ becomes unavailable, the ALB can route traffic to healthy instances in another AZ, thereby maintaining high availability. This aligns with the AWS Well-Architected Framework's recommendation to deploy workloads across multiple AZs and use a load balancer to handle failover.

Answer

Create a single public subnet that spans all Availability Zones.

Answer

Use a single NAT gateway in one Availability Zone to reduce cost.

Question 14

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team notices that traffic between two VPCs is taking a suboptimal path through the on-premises network instead of staying within AWS. What is the MOST likely cause?

Accepted Answer

The Transit Gateway route tables do not have a route for the destination VPC CIDR, so traffic is sent to the on-premises network via a default route.. When a Transit Gateway route table lacks a specific route for the destination VPC CIDR, traffic destined for that VPC is evaluated against the remaining routes. If a default route (0.0.0.0/0) exists pointing to an on-premises network attachment (e.g., a VPN or Direct Connect), the traffic will be forwarded over that path, resulting in a suboptimal route that leaves AWS and re-enters through the on-premises network. This is the most likely cause because the Transit Gateway performs destination-based routing, and missing a specific VPC route forces fallback to the default route.

Answer

The subnet route tables in each VPC have a route pointing to the other VPC's CIDR via the Internet Gateway.

Answer

The VPCs are peered directly, bypassing the Transit Gateway.

Answer

Security groups are blocking traffic between the VPCs.

Question 15

A company is designing a network for a three-tier web application in a single VPC. The web tier must be accessible from the internet, but the application and database tiers must not have direct internet access. The application servers need to make outbound calls to a third-party API. Which architecture meets these requirements?

Accepted Answer

Web servers in public subnets with an Application Load Balancer, application servers in private subnets with a NAT gateway, and database servers in private subnets.. It places web servers in public subnets with an Application Load Balancer for inbound internet traffic, while application and database servers reside in private subnets without direct internet access. A NAT gateway in a public subnet enables the application servers to initiate outbound connections to a third-party API, with return traffic automatically routed back, meeting the requirement for outbound-only internet access.

Answer

Web servers in public subnets, application and database servers in private subnets with an internet gateway for outbound traffic.

Answer

All servers in public subnets with security groups restricting access.

Answer

All servers in private subnets and a VPN connection to the internet.

Question 16

A company has a VPC with a CIDR of 10.0.0.0/16. It creates a subnet 10.0.1.0/24 in us-east-1a and launches an EC2 instance with a private IP 10.0.1.10. The instance needs to send traffic to an on-premises server at 192.168.1.50 over a Direct Connect private VIF. The VPC has a virtual private gateway attached and a route table associated with the subnet. Which TWO entries must exist in the route table for the traffic to succeed?

Accepted Answer

Destination: 10.0.0.0/16, Target: local. For traffic from an EC2 instance in a VPC to an on-premises server over a Direct Connect private VIF, the route table must include two entries: a local route for the VPC CIDR (10.0.0.0/16) which is automatically added and enables communication within the VPC (Option C), and a specific route to the on-premises network (192.168.1.0/24) pointing to the virtual private gateway (vgw-xxxxxxxx) so that traffic destined for 192.168.1.50 is directed over the Direct Connect (Option D). No other entries are required; the local route already covers all subnets, and there is no need for a default route to the internet.

Answer

Destination: 0.0.0.0/0, Target: igw-xxxxxxxx

Answer

Destination: 0.0.0.0/0, Target: nat-xxxxxxxx

Answer

Destination: 10.0.1.0/29, Target: local

Question 17

A company runs a latency-sensitive trading application on EC2 instances spread across three Availability Zones in a VPC. The application uses a Network Load Balancer (NLB) with a TCP listener on port 443. The company wants the NLB to route each client connection to the same backend instance for the life of the connection, and they want to minimize failover disruption if a target becomes unhealthy. Which NLB configuration should a network engineer implement?

Accepted Answer

Rely on the NLB's default flow hash behavior, which pins each TCP connection to a single healthy target for the connection's lifetime.. Network Load Balancers operate at Layer 4 and by default use a flow hash to select a target for each TCP connection; the connection stays with that target until it closes or the target becomes unhealthy. There is no cookie-based sticky session option on a TCP listener, and no separate source IP affinity attribute. Client IP preservation and cross-zone load balancing change addressing and distribution, not per-connection pinning, so the default flow hash behavior is the correct mechanism.

Answer

Enable sticky sessions using an application-controlled cookie on the TCP listener.

Answer

Configure the target group with client IP preservation and enable cross-zone load balancing.

Answer

Enable source IP affinity on the target group so that each client IP is consistently mapped to the same target.

Question 18

A financial services company is required to encrypt all data at rest and in transit. They have an Amazon S3 bucket with server-side encryption enabled (SSE-S3) and are using HTTPS for all API calls. During an audit, the auditor points out that the bucket policy does not explicitly deny requests that do not use HTTPS. Which of the following should the company add to the bucket policy to enforce HTTPS?

Accepted Answer

{"Effect":"Deny","Principal":"*","Action":"s3:*","Resource":"arn:aws:s3:::bucketname/*","Condition":{"Bool":{"aws:SecureTransport":"false"}}}. To enforce HTTPS, the bucket policy must deny requests where aws:SecureTransport is false, which is exactly what option D specifies. This condition evaluates to true for HTTP requests, causing the Deny to apply and blocking unencrypted access. The other options either allow rather than deny or use the wrong boolean value.

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:*","Resource":"arn:aws:s3:::bucketname/*","Condition":{"Bool":{"aws:SecureTransport":"true"}}}

Answer

{"Effect":"Allow","Principal":"*","Action":"s3:*","Resource":"arn:aws:s3:::bucketname/*","Condition":{"Bool":{"aws:SecureTransport":"true"}}}

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:*","Resource":"arn:aws:s3:::bucketname/*","Condition":{"Bool":{"aws:SecureTransport":"true"}}}

Question 19

A network engineer needs to analyze network traffic between EC2 instances in the same VPC to troubleshoot a performance issue. Which AWS feature should they use?

Accepted Answer

VPC Flow Logs.. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet/byte counts) for network interfaces in a VPC, making them the correct tool for analyzing network traffic between EC2 instances to troubleshoot performance issues. Unlike other options, Flow Logs operate at the network layer (Layer 3/4) and can be published to CloudWatch Logs or S3 for detailed traffic analysis.

Answer

AWS Config.

Answer

AWS CloudTrail.

Answer

AWS X-Ray.

Question 20

A company wants to monitor network traffic to and from an EC2 instance to detect anomalous outbound traffic. Which AWS service should they use to capture and analyze the traffic?

Accepted Answer

VPC Traffic Mirroring. VPC Traffic Mirroring copies network traffic from an EC2 instance's ENI to a target (another ENI or Network Load Balancer) for deep packet inspection and analysis. It is the AWS-native service designed to capture and analyze traffic for anomaly detection, intrusion detection, and forensic use cases, making it the correct choice for monitoring outbound traffic.

Answer

Amazon GuardDuty

Answer

Amazon CloudWatch Logs

Answer

AWS Config