ANS-C01 Practice Test 22 — 15 Questions

Question 1

A security group is configured as shown. An EC2 instance in the same VPC with IP 10.0.1.50 can connect to the instance on port 443. An on-premises client with IP 203.0.113.5 cannot connect. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The security group only allows traffic from the 10.0.0.0/16 CIDR. The security group inbound rule only allows traffic from the 10.0.0.0/16 CIDR block. The on-premises client IP (203.0.113.5) is outside that range, so the connection is implicitly denied. Option A is incorrect because security groups are stateful, so return traffic is allowed automatically. Option B is incorrect because HTTPS uses TCP, not UDP. Option D is incorrect because security groups do not support explicit deny rules; they only have allow rules, and any traffic not matching an allow rule is implicitly denied.

Answer

The security group's outbound rules block return traffic

Answer

The protocol is incorrect; HTTPS uses UDP

Answer

The security group has a deny rule for the on-premises IP

Question 2

A company is designing a network architecture for a multi-tier web application. The application consists of web servers, application servers, and database servers. The web servers must be accessible from the internet. The application servers should only be accessible from the web servers. The database servers should only be accessible from the application servers. Which TWO actions should the company take to meet these requirements? (Choose two.)

Accepted Answer

Place the web servers in a public subnet and the application and database servers in private subnets. The correct answers are C and D. Option C: Placing web servers in a public subnet (with an internet gateway) enables internet access, while placing application and database servers in private subnets prevents direct internet access, ensuring they are only reachable from within the VPC. Option D: Security groups act as stateful firewalls at the instance level, allowing fine-grained control over traffic between tiers (e.g., allowing only HTTP from web to app servers, and only database port from app to database servers). Option A is incorrect because a NAT gateway provides outbound internet access for private instances, not inbound access for web servers. Option B is incorrect because network ACLs are stateless and less granular; while they can restrict traffic between subnets, security groups are the recommended approach for tier-to-tier access control. Option E is incorrect because placing all servers in public subnets exposes application and database servers to the internet unnecessarily, increasing security risk.

Answer

Use a NAT gateway to allow the web servers to access the internet

Answer

Use network ACLs to restrict traffic between the tiers

Answer

Place all servers in public subnets and use security groups to restrict traffic

Question 3

A company has a VPC with multiple subnets. They want to monitor all network traffic entering and leaving the VPC for security analysis. Which AWS service should they use?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet/byte counts) for all network interfaces in a VPC, including subnets, enabling security analysis of all traffic entering and leaving the VPC. This is the correct service because it provides network-level visibility into traffic flows without requiring agents or changes to routing.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon GuardDuty

Question 4

Which TWO options are valid methods to connect multiple VPCs together in a hub-and-spoke topology? (Select TWO.)

Accepted Answer

VPC peering. VPC peering (A) is a valid method because it creates a direct one-to-one private connection between two VPCs using AWS's internal network, and multiple peering connections can be arranged so that spoke VPCs each peer with a central hub VPC, forming a hub-and-spoke topology. AWS Transit Gateway (E) is also valid because it acts as a regional network hub to which VPCs, VPNs, and Direct Connect gateways attach, natively providing a scalable hub-and-spoke design where spokes route through the transit gateway. AWS Direct Connect (B) is a dedicated private physical network link between on-premises and AWS, not a mechanism for interconnecting VPCs to each other. VPC Endpoints (C) provide private connectivity to AWS services (Gateway or Interface endpoints) and do not connect VPCs together. AWS Site-to-Site VPN (D) connects on-premises networks to a VPC over IPsec tunnels, not VPC-to-VPC hub-and-spoke topologies.

Answer

AWS Direct Connect

Answer

VPC Endpoints

Answer

AWS Site-to-Site VPN

Question 5

A company is designing a multi-tier application with web servers in public subnets and database servers in private subnets. The database servers should only be accessible from the web servers. Which AWS feature should be used to enforce this?

Accepted Answer

Security groups that reference the web server security group as a source. Security groups that reference the web server security group as a source allow the database security group to accept traffic only from instances that are members of the web server security group. This enforces least privilege at the instance level and automatically adapts as web servers are added or removed. It is the recommended AWS best practice for tiered applications.

Answer

VPC endpoints to restrict access to the database servers

Answer

Network ACLs with allow rules for the web server subnet CIDR

Answer

Network ACLs with deny rules for all traffic except from the web server subnet

Question 6

A company has a VPC with multiple EC2 instances that need to access an Amazon S3 bucket. The network team wants to ensure that traffic to S3 stays within the AWS network and does not traverse the internet. The VPC has a VPC endpoint for S3 (Gateway type). The team has created the endpoint and attached the appropriate policy allowing access to the specific S3 bucket. However, EC2 instances in a private subnet cannot access the S3 bucket. The private subnet route table has a default route pointing to a NAT Gateway. Which change should the network team make to allow private instances to access S3 via the endpoint?

Accepted Answer

Add a route in the private subnet route table for the S3 prefix list (com.amazonaws.region.s3) pointing to the VPC endpoint.. For a Gateway VPC endpoint to work, the route table associated with the subnet must include a route for the S3 prefix list (e.g., com.amazonaws.region.s3) pointing to the endpoint ID. The existing default route to the NAT Gateway would otherwise route S3 traffic to the internet, bypassing the endpoint. Adding the specific route for the S3 prefix list ensures that traffic destined for S3 uses the VPC endpoint and stays within the AWS network. Therefore, option D is correct.

Answer

Modify the VPC endpoint policy to allow all principals.

Answer

Change the private subnet route table's default route to point to the VPC endpoint.

Answer

Remove the default route from the private subnet route table.

Question 7

A network engineer created a VPC endpoint for the service shown in the exhibit. The endpoint is in the 'available' state, but instances in the VPC cannot resolve the private DNS name 'example.com'. What is the most likely cause?

Accepted Answer

The endpoint does not have 'Private DNS names enabled'. The private DNS name is only resolved via Route 53 private hosted zone if 'Private DNS names enabled' is set. The exhibit shows the service has a PrivateDnsName, but the endpoint must have 'Private DNS names enabled' for resolution to work.

Answer

The VPC does not have a Route 53 private hosted zone for example.com

Answer

The VPC does not have an internet gateway

Answer

The security group for the endpoint is blocking DNS traffic

Question 8

A company needs to ensure that all traffic between their VPC and on-premises network is encrypted. Which solution meets this requirement?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN creates an encrypted IPsec tunnel between the VPC and on-premises network, ensuring all traffic is encrypted over the public internet. This meets the requirement for mandatory encryption, unlike unencrypted options such as Direct Connect or VPC Peering.

Answer

AWS Direct Connect with a private VIF

Answer

VPC Peering connection

Answer

AWS Internet Gateway

Question 9

A company is deploying an application across multiple Availability Zones in a single AWS Region. The application requires that all traffic between EC2 instances in the same subnet be inspected by a network appliance. Which configuration should be used to meet this requirement?

Accepted Answer

Create a Gateway Load Balancer and configure the appliance as a target. A Gateway Load Balancer (GWLB) can inspect intra-subnet traffic between EC2 instances in the same subnet. Traffic between instances in the same subnet is Layer 2 and does not traverse route tables, so traditional routing methods cannot intercept it. GWLB uses Geneve encapsulation to transparently redirect traffic at the hypervisor level to the appliance targets without modifying the route table. The appliance must be configured to handle this encapsulation. Other options do not support inspection of same-subnet traffic.

Answer

Set up a VPC peering connection between the subnets

Answer

Use a Transit Gateway to route traffic through the appliance

Answer

Deploy AWS Network Firewall in the subnet

Question 10

A company wants to implement a defense-in-depth strategy for a web application hosted on AWS. Which THREE services should they combine to protect against common web attacks and network threats?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty (A) is correct because it provides continuous threat detection by analyzing VPC Flow Logs, DNS logs, and CloudTrail events to identify malicious activity and compromised resources, adding an intelligent monitoring layer to the defense-in-depth strategy. AWS WAF (B) is correct because it filters and monitors HTTP(S) requests against customizable rules to block common web exploits like SQL injection and cross-site scripting at the application layer. AWS Shield Advanced (C) is correct because it delivers enhanced DDoS protection with real-time attack visibility and mitigation for network and transport layer threats against the web application. AWS Direct Connect (D) is not a security service but a dedicated private network connection, and AWS Certificate Manager (E) only provisions and manages TLS/SSL certificates for encryption, neither of which defends against web attacks or network threats.

Answer

AWS Direct Connect

Answer

AWS Certificate Manager (ACM)

Question 11

A company is using AWS Transit Gateway to connect multiple VPCs and an on-premises network via AWS Direct Connect. They need to ensure that traffic between VPCs is inspected by a centralized security appliance. How should they design the routing?

Accepted Answer

Create a Transit Gateway with separate route tables. Attach each VPC and the Direct Connect virtual interface to the Transit Gateway. In the route tables, propagate routes and add static routes to send inter-VPC traffic to the security appliance VPC.. AWS Transit Gateway supports separate route tables, allowing you to isolate traffic domains. By attaching each VPC and the Direct Connect virtual interface to the Transit Gateway, you can create a centralized inspection VPC. Static routes in the Transit Gateway route tables direct inter-VPC traffic to the security appliance VPC, ensuring all traffic between VPCs is inspected before reaching its destination.

Answer

Use Network ACLs on the subnets to restrict traffic and allow inspection.

Answer

Create VPC peering connections between all VPCs and route traffic through a security appliance in a central VPC.

Answer

Use security groups on the security appliance to inspect traffic.

Question 12

A company has a VPC with a CIDR block of 10.0.0.0/16. They have a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). They have an internet gateway attached to the public subnet. They deploy a web server on an EC2 instance in the public subnet and a database on an EC2 instance in the private subnet. The database should only be accessible from the web server. The company wants to secure the database by not assigning a public IP address to it. Which configuration will allow the web server to connect to the database?

Accepted Answer

Keep the database instance in the private subnet with no public IP, and configure the security group of the database to allow inbound traffic from the web server's security group on the database port. Security groups in AWS can reference other security groups as a source, allowing traffic from any instance associated with the source security group. By configuring the database's security group to allow inbound traffic on the database port from the web server's security group, the web server can connect to the database without the database needing a public IP address. This leverages AWS's built-in security group chaining, which works across subnets within the same VPC.

Answer

Create a VPC Peering connection between the public and private subnets

Answer

Assign a public IP address to the database instance and configure the security group to allow inbound traffic from the web server's public IP

Answer

Set up a VPN connection between the web server and the database

Question 13

A network engineer is troubleshooting connectivity issues between two VPCs that are peered. The VPCs are in the same region and the peering connection is in the 'active' state. Security groups in both VPCs allow all traffic. However, instances in VPC A cannot reach instances in VPC B. What is the most likely cause?

Accepted Answer

Route tables in one or both VPCs do not have routes pointing to the peering connection. For VPC peering to work, both VPCs must have route table entries pointing to the peering connection (pcx-xxxx) for the peer's CIDR range. Even with an 'active' peering connection and permissive security groups, traffic is dropped if no route exists — AWS does not auto-populate route tables for peering. This is the classic 'peering is up but traffic fails' scenario.

Answer

Security groups are blocking traffic between the VPCs

Answer

The VPC peering connection is in the 'pending-acceptance' state

Answer

Network ACLs are blocking traffic between the VPCs

Question 14

A company has a VPC with a CIDR of 10.0.0.0/16 and has enabled VPC Flow Logs to capture all traffic. The logs show that an EC2 instance (10.0.1.10) is sending outbound traffic to an external IP (203.0.113.50) on port 443, but the traffic is being rejected. The instance's security group allows outbound HTTPS to 0.0.0.0/0, and the subnet's NACL allows outbound traffic on port 443. The VPC has an internet gateway attached, and the route table directs 0.0.0.0/0 to the internet gateway. What is the most likely cause of the rejection?

Accepted Answer

The NACL inbound rules are blocking the return traffic.. The outbound traffic from the EC2 instance is allowed by the security group and NACL outbound rules, but the return traffic (responses from 203.0.113.50:443 back to 10.0.1.10) must also be permitted by the subnet's NACL inbound rules. Since the NACL is stateless, it requires explicit inbound rules for ephemeral ports (typically 1024-65535) to allow the return traffic. If those inbound rules are missing, the return packets are dropped, causing the outbound traffic to appear as rejected in VPC Flow Logs.

Answer

The security group does not allow inbound HTTPS traffic.

Answer

The internet gateway is not attached to the VPC.

Answer

The route table does not have a route to the internet gateway.

Question 15

A company is using AWS WAF to protect a web application behind an Application Load Balancer. They want to block requests from a specific IP address range. Which component should they use?

Accepted Answer

IP set match condition in AWS WAF. AWS WAF allows you to create IP set match conditions, which can be used to block or allow requests based on IP addresses or ranges. This is the correct component to block a specific IP address range at the application layer.

Answer

Security group associated with the ALB

Answer

AWS Shield Advanced

Answer

Network ACL on the ALB's subnets