ANS-C01 Practice Test 22 — 15 Questions

Question 1

A company is designing a hybrid network using AWS Transit Gateway. The company has three VPCs (VPC-A, VPC-B, VPC-C) all attached to the same Transit Gateway. The on-premises network connects to the Transit Gateway via a Direct Connect gateway. The company needs to ensure that VPC-C can communicate with the on-premises network but not with VPC-A or VPC-B. Which TWO actions should the network engineer take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Associate the VPC-C route table with the Direct Connect gateway attachment.. Associating the VPC-C route table with the Direct Connect gateway attachment allows VPC-C to exchange routes with the on-premises network via the Transit Gateway, enabling communication. Option D is correct because creating a separate Transit Gateway route table for VPC-C and not propagating VPC-A and VPC-B routes ensures that VPC-C has no routes to those VPCs, effectively isolating it from them at the network layer. Option A is incorrect because a VPN attachment does not provide connectivity to on-premises via Direct Connect; the Direct Connect gateway attachment is required. Option C is incorrect because VPC peering enables direct communication between VPCs, which is not desired. Option E is incorrect because network ACLs at the subnet level do not control routing across a Transit Gateway; route table isolation is needed.

Answer

Establish a VPN attachment between VPC-C and the Direct Connect gateway.

Answer

Establish VPC peering connections between VPC-C and VPC-A, and VPC-C and VPC-B.

Answer

Apply a network ACL on VPC-C subnets to block traffic from VPC-A and VPC-B.

Question 2

A company has an AWS Site-to-Site VPN connection between their on-premises network and a VPC. The VPN tunnel status shows 'UP'. However, instances in the VPC cannot ping an on-premises server at 192.168.1.10. Which step should be taken to troubleshoot?

Accepted Answer

Verify that the VPC route table has a route to the on-premises network via the virtual private gateway. Even though the VPN tunnel is 'UP', traffic from the VPC to the on-premises network must be routed through the virtual private gateway (VGW). If the VPC route table does not contain a route for the on-premises CIDR (e.g., 192.168.1.0/24) pointing to the VGW, the instances have no path to reach the on-premises server, regardless of tunnel status.

Answer

Verify that the internet gateway is attached to the VPC

Answer

Verify that the security group for the instances allows outbound ICMP

Answer

Verify that the VPN tunnel is up on both ends

Question 3

A network engineer is monitoring network traffic using VPC Flow Logs. The engineer wants to capture traffic that is rejected by security groups and network ACLs. Which flow log format should be used?

Accepted Answer

Custom format with 'action' field. The default VPC Flow Log format includes the action field, so it does capture ACCEPT/REJECT information. However, a common myth is that the default format omits the action field. In reality, both default and custom formats can capture rejected traffic. The correct answer is D because a custom format that explicitly includes the action field is the targeted way to capture only the rejection status, reducing log volume and making analysis easier. Option A is incorrect because it is not the most efficient approach; it logs many unnecessary fields. Options B and C are irrelevant or incomplete.

Answer

Default format

Answer

Flow logs are delivered to CloudWatch Logs with DNS query logs

Answer

Custom format with 'srcaddr' and 'dstaddr' only

Question 4

Refer to the exhibit. A Lambda function is attached to a VPC using the network interface eni-1234567890abcdef0. The Lambda function needs to send traffic to an on-premises server via a Direct Connect connection. The traffic is failing. Which setting on the network interface is most likely causing the issue?

Accepted Answer

The SourceDestCheck flag is enabled, which prevents the Lambda function from sending traffic that it is not the source or destination of.. Lambda functions attached to a VPC use elastic network interfaces (ENIs) with the Source/Destination Check flag enabled by default. This flag causes the ENI to drop any traffic where the ENI's IP address is not the source or destination of the packet. Since the Lambda function is sending traffic to an on-premises server via Direct Connect, the ENI is acting as an intermediate hop, and the flag must be disabled for the traffic to pass.

Answer

The network interface is in a subnet that does not have a route to the Direct Connect.

Answer

The network interface has two private IP addresses.

Answer

The security group attached to the network interface may be blocking outbound traffic.

Question 5

A company has a VPC with a CIDR block of 10.0.0.0/16. It needs to create a secondary CIDR block for additional subnets that must not overlap with the existing CIDR. Which CIDR block should be used?

Accepted Answer

172.16.0.0/16. Both A (172.16.0.0/16) and D (10.1.0.0/16) are correct because they are private, non-overlapping secondary CIDRs. The primary CIDR is 10.0.0.0/16; any non-overlapping CIDR is valid, regardless of RFC 1918 class. Options B and C overlap with the primary and therefore cannot be used.

Answer

10.0.0.0/16

Answer

10.0.0.0/8

Question 6

A company has an AWS Lambda function that needs to access an S3 bucket in the same AWS account. The Lambda function is configured to use the VPC default execution role. The S3 bucket policy denies all principals except those explicitly allowed. The Lambda function cannot access the bucket. What should be done to resolve this issue?

Accepted Answer

Add an IAM policy to the Lambda execution role that allows s3:GetObject on the bucket. The Lambda execution role needs an IAM policy that allows s3:GetObject (or appropriate actions) on the S3 bucket. In this scenario, the bucket policy denies all principals except those explicitly allowed. Since the Lambda function is supposed to access the bucket, the bucket policy already explicitly allows the Lambda role. Therefore, only the IAM permission is missing. Adding the IAM policy (Option A) resolves the issue. Option B is wrong because removing the bucket policy would allow all principals, violating the security intent. Option C is wrong because Lambda functions in a VPC do not require internet gateways or public IPs to reach S3, and it does not address permissions. Option D is wrong because a VPC endpoint provides network connectivity but does not grant IAM permissions; the Lambda execution role still needs the IAM policy.

Answer

Remove the bucket policy that denies all principals

Answer

Attach an internet gateway to the VPC and a public IP to the Lambda function

Answer

Create a VPC endpoint for S3 and attach it to the Lambda function's VPC

Question 7

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from an S3 bucket. The company wants to minimize data transfer costs and avoid traversing the internet. Which solution should be implemented?

Accepted Answer

Create a Gateway VPC Endpoint for S3. A Gateway VPC Endpoint for S3 allows EC2 instances in a private subnet to access S3 without traversing the internet, using AWS's internal network. This minimizes data transfer costs because Gateway Endpoints are free and traffic stays within the AWS backbone, avoiding NAT Gateway or internet gateway charges.

Answer

Use an Interface VPC Endpoint for S3

Answer

Use AWS Direct Connect

Answer

Set up a NAT Gateway in the public subnet and route traffic through it

Question 8

A company wants to encrypt all data in transit between an Application Load Balancer (ALB) and its target EC2 instances. Which TWO actions should be taken?

Accepted Answer

Configure the target group to use HTTPS as the protocol. To encrypt data in transit between an Application Load Balancer (ALB) and its target EC2 instances, only the target group protocol needs to be configured to use HTTPS (Option B). The ALB listener protocol (HTTPS) encrypts traffic between the client and the ALB, not between the ALB and targets, so Option D is not required for this specific goal. Option A is incorrect because Client Certificate Authentication is for mutual TLS between client and ALB. Option C is incorrect because adding a listener rule based on path affects traffic routing, not encryption. Option E is incorrect because security group rules control access but do not encrypt traffic.

Answer

Enable Client Certificate Authentication on the ALB

Answer

Add a listener rule to forward traffic based on path

Answer

Configure the ALB listener to use HTTPS

Answer

Configure security groups to allow only HTTPS traffic

Question 9

Based on the output, which of the following is true?

Accepted Answer

The Direct Connect Gateway uses ASN 64512. The output shows the Direct Connect Gateway with ASN 64512, which is a private autonomous system number commonly used for Direct Connect Gateways. This ASN is assigned to the gateway and is visible in the output, confirming that option A is correct.

Answer

The Direct Connect Gateway is in a 'deleted' state

Answer

The Direct Connect Gateway is a virtual private gateway

Answer

The Direct Connect Gateway is owned by a different account

Question 10

A company wants to securely store secrets such as database credentials and API keys. Which TWO AWS services can be used for this purpose? (Choose two.)

Accepted Answer

AWS Systems Manager Parameter Store. (AWS Systems Manager Parameter Store) and Option D (AWS Secrets Manager) are correct. Parameter Store can store secrets securely with encryption and integrates with AWS KMS. Secrets Manager is designed for secrets with automatic rotation and fine-grained access control. Option B (Amazon S3) is not secure by default and requires additional configuration. Option C (AWS CloudFormation) is for infrastructure as code, not for storing secrets. Option E (AWS Identity and Access Management) is for managing users and roles, not for storing secrets.

Answer

Amazon S3

Answer

AWS CloudFormation

Answer

AWS Identity and Access Management (IAM)

Question 11

A company uses AWS Direct Connect with a private VIF to connect to a VPC. The VPC has a virtual private gateway (VGW). The on-premises network uses BGP to advertise routes. The company wants to ensure high availability by using two Direct Connect connections from different providers. Both connections terminate at the same Direct Connect location (same AWS device). The company configures two private VIFs, each with a separate BGP session, and attaches both to the same VGW. However, when one connection fails, traffic does not fail over. What is the most likely cause?

Accepted Answer

Both Direct Connect connections are on the same AWS device, creating a single point of failure. If both connections terminate at the same AWS Direct Connect location and same device, they share the same physical infrastructure. A failure at that location would affect both. True high availability requires connections at different locations. Also, BGP configuration may not have proper failover. The most likely cause is that both VIFs are on the same device, so a single point of failure exists. Option B (BGP ASN) is wrong because same ASN is allowed. Option C (allowed prefixes) would cause routes not to be accepted. Option D (MTU) would not cause complete failover failure.

Answer

The same BGP ASN is used for both VIFs, causing route conflict

Answer

The MTU size is mismatched between the VIFs

Answer

The allowed prefixes for the VIFs do not include the on-premises subnets

Question 12

A company runs a critical application on EC2 instances in a VPC with a single private subnet (10.0.1.0/24) in us-east-1a. The instances need to download security updates from the internet. The company currently uses a NAT Gateway in a public subnet (10.0.0.0/24) in us-east-1a. Recently, an Availability Zone failure caused us-east-1a to become unavailable, and the application could not reach the internet. The company wants to redesign the network to be highly available across multiple AZs for internet access. The application must continue to use private IP addresses for outbound traffic. The company has a limited budget and wants to minimize costs while meeting high availability. Which solution should the company implement?

Accepted Answer

Deploy a NAT Gateway in each of two AZs (us-east-1a and us-east-1b) in public subnets. Create private subnets in both AZs with separate route tables pointing to the local NAT Gateway.. It ensures high availability for outbound internet traffic by deploying a NAT Gateway in each of two Availability Zones (us-east-1a and us-east-1b) with separate private subnets and route tables. This design eliminates the single point of failure; if one AZ fails, the other NAT Gateway continues to route traffic. The application retains private IP addresses for outbound traffic, and the cost is minimized by using only two NAT Gateways (one per AZ) rather than a more expensive multi-AZ architecture like a transit gateway or VPN.

Answer

Deploy one NAT Gateway in a new public subnet in us-east-1b and update the private subnet route table to use it.

Answer

Remove the NAT Gateway and attach an internet gateway to the VPC. Add a route in the private subnet route table pointing 0.0.0.0/0 to the internet gateway.

Answer

Replace the NAT Gateway with a NAT instance in a public subnet in us-east-1a and configure a secondary ENI in us-east-1b for failover.

Question 13

A company runs a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all S3 buckets across all accounts are encrypted with AWS KMS and that bucket policies restrict access to specific IAM roles. They have created an SCP that denies s3:PutBucketPolicy unless the bucket is encrypted with KMS (using a condition) and restricts the PutBucketPolicy action to a specific role. After applying the SCP, the development team reports that they cannot update bucket policies even when using the allowed role. The SCP is attached to the root OU. The allowed role is in the dev account and has full S3 permissions via an IAM policy. What is the most likely reason for the failure?

Accepted Answer

The SCP denies s3:PutBucketPolicy for all principals except the allowed role, but the SCP is applied at the root OU and affects all accounts, so the allowed role is still denied because SCPs are deny-by-default and the allow list in the SCP does not override the implicit deny.

Answer

The SCP must be applied to the dev account specifically, not the root OU, because SCPs attached to OUs do not affect member accounts unless explicitly inherited.

Answer

The SCP condition key for KMS encryption is incorrect because the s3:PutBucketPolicy action does not support condition keys for encryption.

Answer

The IAM policy attached to the allowed role does not include s3:PutBucketPolicy permission, even though it has full S3 access.

Question 14

A company has a VPC with public and private subnets in two Availability Zones. They have a NAT gateway in each AZ for outbound internet access. They recently added a third AZ and created a new private subnet. Instances in the new private subnet cannot reach the internet. The route table for the new subnet has a default route (0.0.0.0/0) pointing to a NAT gateway in the same AZ. What is the most likely cause?

Accepted Answer

The NAT gateway in the new AZ does not have an Elastic IP address attached. A NAT gateway requires an Elastic IP (EIP) address to function for outbound internet traffic. Without an EIP attached, the NAT gateway cannot translate private source IPs to a public IP, so instances in the new private subnet cannot reach the internet even though the route table correctly points to the NAT gateway in the same AZ.

Answer

The security group attached to the NAT gateway blocks outbound traffic

Answer

The route table in the new private subnet does not have a route to the NAT gateway

Answer

The NAT gateway is not in a public subnet in the new AZ

Question 15

A company has a multi-account AWS environment using AWS Organizations. They need to enforce that all newly created S3 buckets are encrypted with SSE-KMS using a specific KMS key. Which policy should they use?

Accepted Answer

SCP in AWS Organizations. A Service Control Policy (SCP) in AWS Organizations can be attached to the root or an OU to deny the creation of S3 buckets that do not use a specific KMS key for encryption. This is a preventive control that applies across all accounts in the organization. Option A (S3 bucket policy) is incorrect because bucket policies are applied at the bucket level after creation and cannot prevent the creation of the bucket. Option B (IAM policy) is incorrect because IAM policies are per-account and cannot be enforced centrally across all accounts. Option C (AWS Config rule with auto-remediation) is incorrect because Config rules are detective and can only trigger remediation after a non-compliant bucket is created, not prevent the creation.

Answer

S3 bucket policy on each bucket

Answer

IAM policy in each account

Answer

AWS Config rule with auto-remediation