ANS-C01 Practice Test 21 — 15 Questions

Question 1

A company uses AWS Direct Connect to connect their on-premises network to AWS. They have a VPC with a virtual private gateway (VGW) and a private VIF attached to it. They recently added a second Direct Connect connection for redundancy. Both connections are active and advertised via BGP. The on-premises network uses BGP with the same AS number. After configuration, they notice that traffic is not load-balanced as expected; instead, all traffic flows through one connection. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The on-premises router is configured with a higher local preference for one of the BGP sessions, causing it to prefer that path.. When two BGP sessions advertise the same prefixes with the same AS path length, the on-premises router chooses a single best path based on BGP attributes — and local preference is evaluated before AS path length, MED, and other tiebreakers. If one session has a higher local preference, all traffic for those prefixes will use that path, defeating load balancing. Equal-cost multipath (ECMP) across the two Direct Connect connections requires equal local preference, equal AS path, and multipath enabled.

Answer

The on-premises router has a static route pointing to the primary connection, overriding BGP learned routes.

Answer

Both Direct Connect connections are in the same AWS region and use the same VGW, so traffic cannot be load-balanced.

Answer

The Direct Connect connections are using different VLANs, causing asymmetric routing.

Question 2

A network engineer is designing a highly available VPN connection between an on-premises network and AWS. The on-premises network has two internet connections from different ISPs. Which AWS VPN configuration should be used to provide the highest availability?

Accepted Answer

Create two customer gateways, each with a VPN tunnel to the virtual private gateway.. For highest availability, AWS recommends using two customer gateways (CGWs), each representing a separate on-premises device or internet connection, and establishing a VPN connection from each CGW to the same virtual private gateway (VGW). This creates two independent VPN tunnels (four IPsec tunnels total, two per connection), each terminating on a different on-premises ISP link, so a failure of one ISP or device does not take down the hybrid connection. This design aligns with the AWS Well-Architected reliability pillar for hybrid networking.

Answer

Create a single VPN tunnel from one customer gateway to the virtual private gateway.

Answer

Create one customer gateway with two VPN tunnels, each using different internet connections.

Answer

Use AWS Direct Connect instead of VPN for higher availability.

Question 3

A company is designing a multi-region architecture with two AWS Regions. They need to connect VPCs in each region to an on-premises data center using AWS Direct Connect. They want to minimize latency and use the same BGP ASN on both sides. Which solution meets these requirements?

Accepted Answer

Use a Direct Connect gateway and create a private virtual interface from each region's Direct Connect connection to the Direct Connect gateway. Use the same BGP ASN on AWS side.. A Direct Connect gateway allows you to associate private virtual interfaces from multiple regions, enabling a single BGP ASN to be used on the AWS side across all connections. This minimizes latency by providing direct, private connectivity from each region to the on-premises data center without traversing the public internet. The ability to use the same BGP ASN on both sides is supported because the Direct Connect gateway presents itself as a single BGP speaker, avoiding ASN conflicts.

Answer

Establish two separate private virtual interfaces from each region to the on-premises router using different BGP ASNs.

Answer

Use AWS Site-to-Site VPN over the internet as a backup and the Direct Connect as primary.

Answer

Create a transit virtual interface from each region to a Transit Gateway in each region and peer the Transit Gateways.

Question 4

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download patches from the internet. Which configuration will allow this without exposing the instance to inbound internet traffic?

Accepted Answer

Deploy a NAT Gateway in a public subnet and update the private subnet's route table to point default route to the NAT Gateway.. A NAT Gateway, deployed in a public subnet with an Internet Gateway, allows outbound IPv4 traffic from private subnets to the internet while preventing unsolicited inbound connections. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway, enabling the EC2 instance to download patches without being directly exposed.

Answer

Use VPC Gateway Endpoints for S3 and DynamoDB.

Answer

Attach an Internet Gateway to the VPC and assign a public IP to the instance.

Answer

Configure a VPN connection from the VPC to an on-premises network that has internet access.

Question 5

A company has deployed a VPC with public and private subnets. The private subnets need outbound internet access for software updates. Which service should be used to provide this access without exposing the instances to inbound traffic?

Accepted Answer

Deploy a NAT Gateway in a public subnet and add a default route to it from the private subnets.. A NAT Gateway, deployed in a public subnet with an Elastic IP, allows instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. The private subnet’s route table directs default traffic (0.0.0.0/0) to the NAT Gateway, which performs source network address translation (SNAT) to the gateway’s Elastic IP, enabling outbound-only access.

Answer

Attach an Internet Gateway to the VPC and add a default route to it from the private subnets.

Answer

Set up a VPN connection to an on-premises network that has internet access.

Answer

Use a Direct Connect connection to route traffic through an on-premises internet gateway.

Question 6

A company wants to audit all changes made to security groups and network ACLs in its AWS account. Which AWS service should be used to capture these API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including those that modify security groups and network ACLs. By enabling CloudTrail, you can capture CreateSecurityGroup, AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress, CreateNetworkAclEntry, and similar API calls, providing an audit trail of who made the change, when, and from which IP address.

Answer

Amazon GuardDuty

Answer

VPC Flow Logs

Answer

AWS Config

Question 7

A company has set up a transit gateway with attachments to VPC-A and VPC-B. The transit gateway route table shows routes to both VPCs and a blackhole for 0.0.0.0/0. VPC-A's public subnet route table sends 10.1.0.0/16 traffic to the transit gateway. However, an EC2 instance in VPC-A's public subnet cannot reach an instance in VPC-B. What is the most likely cause?

Accepted Answer

VPC-B's route table does not have a route to VPC-A's CIDR via the transit gateway.. For traffic to flow from VPC-A to VPC-B via a transit gateway, both VPCs must have routes in their route tables pointing to the transit gateway for the other VPC's CIDR. Since VPC-A's route table sends 10.1.0.0/16 (VPC-B's CIDR) to the transit gateway, but VPC-B's route table lacks a return route to VPC-A's CIDR via the transit gateway, the return traffic from VPC-B is dropped, causing connectivity failure.

Answer

VPC-A's route table does not have a route to the transit gateway.

Answer

The transit gateway route table does not have a route for 10.0.0.0/16.

Answer

The blackhole route in the transit gateway is blocking traffic between VPCs.

Question 8

A company is designing a VPC with subnets in multiple Availability Zones (AZs) for a web application. The application must be fault-tolerant and highly available. Which design should the network engineer implement?

Accepted Answer

Deploy application instances in two AZs behind an Application Load Balancer that spans both AZs.. Deploying application instances in two Availability Zones (AZs) behind an Application Load Balancer (ALB) that spans both AZs provides fault tolerance and high availability. If one AZ fails, the ALB automatically routes traffic to healthy instances in the remaining AZ, ensuring continuous service. This design leverages cross-zone load balancing, which is enabled by default for ALBs, to distribute traffic evenly across instances in multiple AZs.

Answer

Deploy all application instances in a single AZ behind an Application Load Balancer.

Answer

Place one instance in each of two AZs and use an internet gateway for load balancing.

Answer

Use a Network Load Balancer in a single AZ with instances in multiple AZs.

Question 9

A network engineer is designing a multi-region architecture using AWS Transit Gateway and wants to minimize inter-region latency for data transfer between VPCs. The application requires high throughput and low latency. Which design should be used?

Accepted Answer

Use Transit Gateway inter-region peering between Transit Gateways. Transit Gateway inter-region peering attaches Transit Gateways in different AWS Regions over the AWS global backbone, providing predictable low latency and high throughput without the need for a VPN overlay. It supports dynamic routing via BGP and scales to thousands of VPC attachments, making it the intended solution for multi-region hub-and-spoke designs. Unlike VPC peering, it avoids full-mesh complexity and does not traverse the public internet.

Answer

Establish VPC peering connections between all VPCs across regions

Answer

Use AWS Site-to-Site VPN between Transit Gateways in each region

Answer

Configure VPC endpoints to route traffic through AWS backbone

Question 10

A company runs a multi-tier application on AWS. The web tier consists of EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application tier runs on EC2 instances in a separate Auto Scaling group, and the database tier uses an Amazon RDS MySQL instance. All resources are in the same VPC. The security team has identified that the application tier instances are receiving traffic from unknown IP addresses on port 22 (SSH). The team wants to ensure that only the web tier instances can communicate with the application tier on the application port (8080), and only from a specific security group. Additionally, the database tier should only accept traffic from the application tier on port 3306. Currently, the security groups are configured as follows: Web-SG allows inbound from 0.0.0.0/0 on ports 80 and 443; App-SG allows inbound from 0.0.0.0/0 on port 8080 and from 0.0.0.0/0 on port 22; DB-SG allows inbound from 0.0.0.0/0 on port 3306. The team has also noticed that the web tier instances can be accessed via SSH from the internet. Which course of action should the team take to remediate the security issues?

Accepted Answer

Update Web-SG to allow SSH from a specific management CIDR. Update App-SG to allow inbound on port 8080 from Web-SG only, and remove inbound SSH from App-SG (or restrict to management CIDR). Update DB-SG to allow inbound on port 3306 from App-SG only.. This option comprehensively addresses the security issues: restrict SSH access to the web tier from a trusted management CIDR, limit application tier access (port 8080) to only the web tier security group, and restrict database access (port 3306) to only the application tier security group. Additionally, it removes the overly permissive SSH rule on the application tier or restricts it to a management CIDR. Option A is insufficient because it leaves App-SG and DB-SG open to the internet on their respective ports. Option B removes SSH entirely, which may be needed for management, and does not address application traffic restrictions between tiers. Option D suggests using network ACLs, which are stateless and more complex; security groups are stateful and more appropriate for this use case.

Answer

Update Web-SG to allow SSH from a specific management CIDR. Leave App-SG and DB-SG as is because they are not directly accessible from the internet.

Answer

Remove inbound SSH rules from all security groups and rely on AWS Systems Manager Session Manager for administrative access.

Answer

Use network ACLs on the subnets to restrict traffic between tiers instead of security groups.

Question 11

A company is implementing a multi-region architecture with VPCs in us-east-1 and eu-west-1. They want to connect these VPCs using a Transit Gateway and ensure that traffic between regions can be inspected by a firewall in us-east-1. Which configuration is required?

Accepted Answer

Create a Transit Gateway in each region, peer them, and configure route tables to send inter-region traffic through the inspection VPC in us-east-1.. It uses Transit Gateway inter-region peering to connect the two regions, and by attaching an inspection VPC (with a firewall) in us-east-1 to the Transit Gateway, you can route all inter-region traffic through that VPC for inspection. The Transit Gateway route tables in each region are configured to send traffic destined for the other region to the inspection VPC attachment, ensuring traffic is inspected before being forwarded.

Answer

Establish a VPN connection between the two VPCs and route traffic through the firewall.

Answer

Create a VPC peering connection between the two VPCs and update route tables.

Answer

Use a Direct Connect gateway to connect the two VPCs directly.

Question 12

A company is designing a hybrid network using AWS Direct Connect and a Site-to-Site VPN as a backup. The company has two Direct Connect connections from different providers for redundancy. The company wants to use BGP to automatically fail over to the VPN if both Direct Connect connections fail. Which TWO configurations are required to achieve this?

Accepted Answer

Adjust BGP attributes on the Direct Connect routes to be preferred over the VPN routes.. Setting a higher local preference on Direct Connect routes makes them more preferred over VPN routes under normal conditions. Option E is correct because dynamic BGP routing on the VPN is required to allow automatic failover and route advertisement when Direct Connect fails, enabling BGP to withdraw routes and trigger failover.

Answer

Set a higher local preference on the VPN route to make it preferred over Direct Connect.

Answer

Configure the VPN connection with static routes instead of BGP.

Answer

Disable route propagation on the VPN connection's route table.

Question 13

An EC2 instance with the attached network interface shown above is unable to reach the internet. The instance is in a public subnet with a route to an internet gateway. The security group allows outbound traffic. What is the most likely cause?

Accepted Answer

The network interface's attachment status is 'attached', but the instance may not have a public IP address.. For an EC2 instance to reach the internet through an internet gateway, it must have a public IPv4 address (or Elastic IP) associated with its network interface. The question states the subnet has a route to an IGW and the security group allows outbound traffic, so the missing piece is the public IP. Without a public IP, the instance's traffic cannot be translated to a routable address for the internet.

Answer

The source/destination check is enabled, which prevents the instance from sending traffic to the internet if it is not the source of the traffic.

Answer

The route table for the subnet does not have a 0.0.0.0/0 route pointing to the internet gateway.

Answer

The security group is not associated with the network interface.

Question 14

A company wants to securely connect their on-premises data center to AWS using a site-to-site VPN. They have multiple branch offices that also need to connect to AWS. Which AWS service should they use to simplify the management of multiple VPN connections?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway (C) acts as a central hub that interconnects VPCs and on-premises networks, allowing you to manage multiple site-to-site VPN connections and branch office attachments through a single gateway. This simplifies routing and reduces operational overhead compared to managing individual VPN connections between each branch and each VPC.

Answer

VPC Peering

Answer

AWS Direct Connect

Answer

VPN CloudHub

Question 15

A company wants to monitor network traffic between VPCs in the same AWS Region that are connected via VPC Peering. Which AWS service can provide visibility into the traffic?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic metadata (source/destination IP, port, protocol, bytes, packets, action) for traffic flowing through VPCs, subnets, or ENIs, including traffic between peered VPCs in the same Region. This makes it the correct service for gaining visibility into VPC Peering traffic. Flow logs can be published to CloudWatch Logs or S3 and queried with Athena for analysis.

Answer

AWS Config

Answer

AWS Direct Connect

Answer

AWS CloudTrail