ANS-C01 Practice Test 21 — 15 Questions

Question 1

Based on the VPC Flow Logs entry, which of the following statements is correct?

Accepted Answer

The traffic originated from a web server (port 443) and was sent to a client (port 80). Option B is correct because the source port is 443 (HTTPS) and destination port is 80 (HTTP). The protocol number 6 indicates TCP. The ACCEPT shows the traffic was allowed. Option A is wrong because the source is 10.0.1.5. Option C is wrong because the destination port is 80. Option D is wrong because the protocol is TCP (6).

Answer

The destination port is 443

Answer

The protocol used is UDP

Answer

The source IP address is 10.0.2.10

Question 2

A company is designing a VPC with public and private subnets. The private subnets need to access the internet for software updates but must not be directly accessible from the internet. Which AWS service should be used to provide internet access to instances in the private subnets?

Accepted Answer

NAT gateway. Option B is correct because a NAT gateway allows instances in private subnets to initiate outbound traffic to the internet but prevents inbound traffic from the internet. Option A is wrong because an internet gateway is for public subnets and allows inbound connections. Option C is wrong because a transit gateway connects VPCs but does not provide internet access. Option D is wrong because a VPC endpoint is for accessing AWS services privately, not the internet.

Answer

Internet gateway

Answer

VPC endpoint

Answer

Transit gateway

Question 3

A company has an AWS Site-to-Site VPN connection between its on-premises network and a VPC. The tunnel status is up, but traffic from on-premises cannot reach an EC2 instance in the VPC. The instance's security group allows inbound traffic from the on-premises CIDR. Which configuration should be checked first?

Accepted Answer

Verify that the VPC route table includes a route to the on-premises CIDR with the VPN gateway as target.. Option A is correct. The VPC's route table must have a route pointing to the VPN gateway for the on-premises CIDR. If missing, traffic will not be forwarded to the VPN tunnel. Option B is wrong because network ACLs are stateless and need both inbound and outbound rules; but first check routing. Option C is wrong because the VPN connection uses a virtual private gateway, not a transit gateway, unless specifically designed. Option D is wrong because the VPN tunnel being up indicates BGP is working; the issue is likely routing.

Answer

Ensure the VPN connection is attached to a transit gateway instead of a virtual private gateway.

Answer

Check the network ACL associated with the EC2 instance's subnet to ensure it allows inbound traffic from on-premises.

Answer

Confirm that BGP session is established and exchanging routes.

Question 4

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16 and needs to connect to an on-premises network via AWS Direct Connect. The on-premises network uses 10.0.0.0/16. Which solution allows connectivity without IP overlap?

Accepted Answer

Create a new VPC with a non-overlapping CIDR, connect both VPCs via Transit Gateway, and use NAT on the Transit Gateway attachment to the on-premises network.. Option D is correct because creating a new VPC with a non-overlapping CIDR (e.g., 172.16.0.0/16) and using Transit Gateway with network address translation (NAT) on the attachment resolves overlap. Option A is wrong because overlapping CIDRs cannot be directly peered or connected via VPN. Option B is wrong because Direct Connect does not change IP addresses. Option C is wrong because a single NAT instance cannot handle all traffic for overlapping CIDRs.

Answer

Establish a VPC peering connection between the VPC and on-premises network.

Answer

Use AWS Direct Connect with a private VIF and static routes to route traffic.

Answer

Deploy a NAT instance in the VPC to translate on-premises IPs.

Question 5

A company wants to ensure that traffic between Amazon EC2 instances in the same VPC but different subnets is inspected by a network security appliance. The appliance is deployed in a separate security VPC. Which AWS service should be used to route traffic through the security VPC?

Accepted Answer

AWS Transit Gateway. Option B is correct because Transit Gateway with route tables allows inter-VPC traffic to be forwarded to the security VPC. Option A is wrong because VPC Peering does not support transitive routing. Option C is wrong because an NLB is a load balancer, not a routing device. Option D is wrong because VPC endpoints are for accessing AWS services.

Answer

VPC Peering

Answer

VPC Endpoint

Answer

Network Load Balancer

Question 6

A company wants to use AWS Direct Connect to connect their on-premises network to a VPC. They have two Direct Connect locations and want high availability. What is the minimum number of Direct Connect virtual interfaces needed?

Accepted Answer

Two private VIFs. Option B is correct because for high availability, you need at least two connections, each with a virtual interface (VIF). Option A is wrong because a single VIF is a single point of failure. Option C is wrong because you need at least two VIFs, one for each connection. Option D is wrong because four is more than necessary.

Answer

One public VIF and one private VIF

Answer

Four private VIFs

Answer

One private VIF

Question 7

A company is designing a multi-account architecture using AWS Transit Gateway. They need to isolate development and production environments but allow shared services account access to both. What is the most scalable and secure design?

Accepted Answer

Create two Transit Gateways: one for development and one for production. Share the Transit Gateways with the shared services account via AWS Resource Access Manager.. Option B is correct because separate Transit Gateways with resource sharing provide complete isolation. Option A is wrong because a single Transit Gateway with separate route tables still has a shared control plane. Option C is wrong because VPC Peering does not scale. Option D is wrong because a single Transit Gateway with centralized inspection does not isolate traffic.

Answer

Use a single Transit Gateway and configure separate route tables for each environment, attaching VPCs from each account.

Answer

Use a single Transit Gateway with one route table for all environments and implement security groups to isolate traffic.

Answer

Use VPC Peering between each VPC and the shared services VPC, and set up Internet Gateway for each environment.

Question 8

A company is designing a network for a global application that requires low latency between users and application servers. They plan to use multiple AWS regions and want to route users to the nearest healthy endpoint. Which THREE services should they use together? (Select THREE.)

Accepted Answer

Amazon CloudFront. Options A, C, and E are correct because Route 53 latency routing directs users to the region with lowest latency; Global Accelerator provides anycast IP and fast failover; and CloudFront caches content at edge locations for low latency. Option B is wrong because ALB is regional and not for global routing. Option D is wrong because WAF is for security, not routing.

Answer

AWS WAF

Answer

Application Load Balancer in each region

Question 9

A company is designing a multi-account AWS environment using AWS Organizations. The company wants to centralize outbound internet traffic from all VPCs in all accounts through a single VPC in a shared services account. The shared services account has a VPC with a NAT gateway and an internet gateway. Which architecture meets this requirement?

Accepted Answer

Attach all VPCs to a transit gateway and route traffic through a shared services VPC that has NAT gateway and internet gateway.. Option B is correct because a transit gateway with a default route to the shared services VPC and a NAT gateway there provides centralized outbound internet access. Option A is incorrect because VPC peering does not support transitive routing. Option C is incorrect because a VPN connection is not needed. Option D is incorrect because VPC endpoints are for specific services, not general internet.

Answer

Create VPC gateway endpoints for all AWS services in each VPC.

Answer

Set up a VPN connection from each VPC to the shared services VPC and use the latter's internet gateway.

Answer

Peer each VPC to the shared services VPC and configure a default route pointing to the shared services VPC's NAT gateway.

Question 10

A company is deploying a critical application across multiple Availability Zones (AZs) in a single AWS region. The application requires a highly available network layer that can automatically detect and reroute traffic away from failed endpoints. Which AWS service should be used to meet this requirement?

Accepted Answer

Network Load Balancer (NLB). Option A is correct because a Network Load Balancer (NLB) operates at Layer 4, provides high availability across AZs, and automatically reroutes traffic from unhealthy targets. Option B is wrong because an Application Load Balancer (ALB) is Layer 7 and may introduce unnecessary overhead. Option C is wrong because a NAT gateway provides outbound internet access, not load balancing. Option D is wrong because AWS Global Accelerator is for multi-region traffic, not intra-region.

Answer

AWS Global Accelerator

Answer

Application Load Balancer (ALB)

Answer

NAT gateway

Question 11

A company is designing a network for a large-scale e-commerce platform that must handle sudden traffic spikes. The architecture uses an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances across multiple Availability Zones. The ALB is internet-facing. To protect against DDoS attacks, which AWS services should be used at the network edge?

Accepted Answer

Subscribe to AWS Shield Advanced and deploy AWS WAF on the ALB.. Option D is correct. AWS Shield Advanced provides enhanced protection against DDoS attacks, and AWS WAF can be integrated with ALB to filter malicious traffic. Option A is wrong because Network ACLs are not at the edge; they are subnet-level. Option B is wrong because AWS Shield Standard is included automatically but does not provide advanced protection. Option C is wrong because Route 53 is for DNS, not DDoS mitigation at the network edge.

Answer

Configure network ACLs to allow only known IP ranges.

Answer

Enable AWS Shield Standard and configure security groups to block traffic from suspicious sources.

Answer

Use Amazon Route 53 with DNS-based failover to redirect traffic away from the ALB during an attack.

Question 12

A company wants to allow its VPC to access an S3 bucket securely without traversing the internet. Which AWS resource enables private connectivity between a VPC and S3?

Accepted Answer

VPC Gateway Endpoint. Option C is correct because a VPC Gateway Endpoint provides private access to S3 without using the internet. Option A is wrong because NAT Gateway is for outbound internet access, not for S3 access. Option B is wrong because Internet Gateway allows internet traffic, not private access. Option D is wrong because a VPN connection is for on-premises connectivity, not for S3 access.

Answer

Internet Gateway

Answer

AWS Site-to-Site VPN

Answer

NAT Gateway

Question 13

A company has a VPC with a public subnet and a private subnet. The private subnet needs to access an S3 bucket for backups. Which TWO actions are required to provide private connectivity to S3 without using a NAT Gateway?

Accepted Answer

Create a VPC Gateway Endpoint for S3.. Options B and D are correct. A VPC Gateway Endpoint (B) provides private access to S3. The route table for the private subnet must have a route to the gateway endpoint (D) to direct S3 traffic through it. Option A is wrong because a NAT Gateway is not used. Option C is wrong because a VPC Interface Endpoint is for other services, not S3. Option E is wrong because a VPC Peering connection is not needed.

Answer

Create a NAT Gateway in the public subnet.

Answer

Create a VPC Interface Endpoint for S3.

Answer

Create a VPC Peering connection to an S3 VPC.

Question 14

A company has a VPC with multiple subnets across two AZs. The VPC is connected to an on-premises data center via AWS Direct Connect. The company wants to ensure that traffic between the VPC and on-premises is load-balanced across two Direct Connect virtual interfaces (VIFs) for high availability. Which configuration should be used?

Accepted Answer

Configure two VIFs and use BGP to advertise the same prefixes with equal metrics to enable ECMP.. Option D is correct because using BGP routing with equal-cost multipath (ECMP) across two VIFs allows traffic to be load-balanced. Option A is wrong because a single VIF is a single point of failure. Option B is wrong because static routes do not provide load balancing; one route is typically preferred. Option C is wrong because a VPN over the VIFs adds overhead and does not provide native load balancing.

Answer

Configure a VPN connection over each VIF and use equal-cost routes between the VPN tunnels.

Answer

Configure a single Direct Connect VIF with a 10 Gbps connection and a single BGP session.

Answer

Configure two VIFs with static routes pointing to different on-premises IPs.

Question 15

A company wants to connect its VPC to an on-premises data center using AWS Direct Connect. The company has two Direct Connect locations in the same AWS region. For high availability, they plan to establish two separate connections. Which configuration ensures that if one connection fails, traffic automatically fails over to the other?

Accepted Answer

Establish two Direct Connect connections from different Direct Connect locations to the same VPC, each with a private VIF attached to the same virtual private gateway.. Option C is correct. Two Direct Connect connections from different locations to the same VPC, each with a private VIF attached to the same virtual private gateway, and using BGP with ASN prepending on one path to make it less preferred, provides automatic failover. Option A is wrong because a single connection cannot provide failover. Option B is wrong because two connections to the same DX location are not fully diverse. Option D is wrong because VPN backup is not required; two DX connections can provide HA.

Answer

Establish one Direct Connect connection and one AWS Site-to-Site VPN connection as backup.

Answer

Establish two Direct Connect connections from the same Direct Connect location to the same VPC.

Answer

Establish a single Direct Connect connection with two virtual interfaces (VIFs) to the same VPC.

ANS-C01 Practice Test 21 — 15 Questions

Exhibit

ANS-C01 Practice Test 21 — 15 Questions

Exhibit