ANS-C01 Practice Test 23 — 15 Questions

Question 1

A company is setting up a Direct Connect connection to AWS. They have a virtual private gateway (VGW) attached to their VPC. They need to establish a single logical connection over the Direct Connect link to access all subnets in the VPC. Which resource should they create on the Direct Connect virtual interface?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A private virtual interface (VIF) with a BGP session to the VGW.. A private virtual interface (VIF) is the correct resource because it allows you to connect your on-premises network directly to a VPC via a Direct Connect link. By associating the private VIF with a virtual private gateway (VGW) and establishing a BGP session, you create a single logical connection that provides Layer 3 access to all subnets in the VPC, as the VGW handles routing between the Direct Connect link and the VPC's route tables.

Answer

A hosted virtual interface (VIF) provided by an AWS Partner.

Answer

A public virtual interface (VIF) with a BGP session to the VGW.

Answer

A transit virtual interface (VIF) to the VGW.

Question 2

A company has multiple AWS accounts and wants to centralize VPC flow logs for analysis. The flow logs are published to Amazon S3 in each account. A central account needs to access these logs. Which solution meets the requirements with the least operational overhead?

Accepted Answer

Use S3 bucket policies in each account to grant the central account access. Using S3 bucket policies with cross-account permissions allows the central account to access the flow logs directly from the S3 buckets in each account without additional infrastructure. Option A is incorrect because AWS Glue jobs would add unnecessary operational overhead for copying data. Option B is incorrect because AWS Transit Gateway handles network traffic routing, not S3 access. Option C is incorrect because VPC peering provides network connectivity between VPCs but does not grant access to S3 buckets; S3 access is managed via IAM and bucket policies.

Answer

Set up AWS Glue jobs to copy logs to a central S3 bucket

Answer

Use AWS Transit Gateway to centralize network traffic and capture logs

Answer

Use VPC peering to connect the accounts and access the S3 buckets directly

Question 3

A company is designing a VPC for a three-tier application. The web tier must be accessible from the internet, the application tier must only be accessible from the web tier, and the database tier must only be accessible from the application tier. Which THREE design elements are required? (Choose THREE.)

Accepted Answer

A public subnet for the web tier with an internet gateway. The web tier requires direct internet accessibility, which is achieved by placing it in a public subnet associated with an internet gateway. The internet gateway provides a target for the subnet's route table to allow inbound traffic from the internet and outbound responses, enabling users to reach the web application.

Answer

A NAT gateway in the public subnet for outbound traffic from private subnets

Answer

A VPN connection to on-premises

Question 4

A company wants to centrally manage firewall rules across multiple VPCs in different AWS accounts. Which AWS service should they use?

Accepted Answer

AWS Network Firewall with AWS Firewall Manager. AWS Network Firewall is a managed, stateful firewall service that can be deployed across VPCs, and AWS Firewall Manager allows you to centrally configure and manage firewall rules across multiple accounts and VPCs in an AWS Organization. Together they provide centralized rule management, making them the correct choice for multi-account, multi-VPC firewall administration.

Answer

Security Groups

Answer

AWS WAF

Answer

Network ACLs

Question 5

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. They want to inspect traffic between VPCs using a centralized network virtual appliance (NVA) in a security VPC. What is the most scalable and highly available design to achieve this?

Accepted Answer

Attach all VPCs to a Transit Gateway, use separate route tables for inspection, and deploy NVAs behind a Gateway Load Balancer in the security VPC.. It uses Transit Gateway with separate route tables to isolate inspection traffic, and deploys NVAs behind a Gateway Load Balancer (GWLB) in the security VPC. GWLB provides automatic scaling and health checks across multiple NVAs, ensuring high availability and scalability for inter-VPC traffic inspection without introducing a single point of failure or manual routing complexity.

Answer

Place a single NVA in the Transit Gateway and route all inter-VPC traffic through it.

Answer

Create VPC peering connections between each VPC and the security VPC, then configure the NVAs to route traffic.

Answer

Use Direct Connect to connect all VPCs to a central location and route through NVAs there.

Question 6

A company is migrating a legacy application to AWS. The application requires a fixed IP address that must not change. The application will be deployed on Amazon EC2 instances behind an Application Load Balancer. Which solution meets the requirement for a static IP address?

Accepted Answer

Place the ALB behind AWS Global Accelerator, which provides static IP addresses.. AWS Global Accelerator provides two static Anycast IP addresses that serve as fixed entry points for traffic. Traffic is then routed over the AWS global network to the Application Load Balancer, preserving the static IP requirement while still allowing the ALB to handle HTTP/HTTPS traffic. This decouples the static IP from the underlying load balancer, ensuring the IP does not change even if the ALB is replaced or recreated.

Answer

Assign an Elastic IP address to the Application Load Balancer.

Answer

Replace the ALB with a Network Load Balancer and assign an Elastic IP to it.

Answer

Use an Elastic IP address on each EC2 instance and point a CNAME record to the ALB.

Question 7

A company is designing a network for a multi-tier application. The web tier must be accessible from the internet, and the application tier must only be accessible from the web tier. Which architecture should they use?

Accepted Answer

Web servers in public subnets with an Internet Gateway, and application servers in private subnets with security groups allowing traffic only from the web tier. It places the web servers in public subnets with an Internet Gateway (IGW) to allow direct inbound traffic from the internet, while the application servers reside in private subnets with security groups that explicitly permit traffic only from the web tier's security group. This ensures the application tier is not directly reachable from the internet, adhering to the principle of least privilege and defense in depth.

Answer

Web servers in private subnets with a NAT Gateway for outbound traffic, and application servers in public subnets

Answer

All servers in a single VPC with VPC Peering to another VPC

Answer

Web servers and application servers in public subnets, each with their own security group

Question 8

A company is designing a network for a three-tier application that must be PCI DSS compliant. The web tier must be accessible from the internet, the application tier must only be accessible from the web tier, and the database tier must only be accessible from the application tier. All tiers are in the same VPC. What is the MOST secure way to implement this?

Accepted Answer

Place web tier in public subnets, application and database tiers in private subnets. Use security groups to allow only necessary traffic between tiers.. Placing the web tier in public subnets and the application and database tiers in private subnets follows the principle of least privilege and network segmentation, which is required for PCI DSS compliance. Security groups act as stateful firewalls at the instance level, allowing precise control over traffic between tiers. This design ensures that the database tier is not directly accessible from the internet and only accepts traffic from the application tier.

Answer

Use a VPN between the web and application tiers and between application and database tiers.

Answer

Place all tiers in the same private subnet and use security groups for isolation.

Answer

Place all tiers in public subnets and use network ACLs to restrict traffic.

Question 9

A company has a web application behind an Application Load Balancer (ALB) in a VPC. The ALB is internet-facing and has a security group that allows inbound HTTP/HTTPS from 0.0.0.0/0. The EC2 instances are in a private subnet with a security group that allows inbound traffic only from the ALB's security group. The application works correctly. However, the security team wants to add an additional layer of protection by using AWS WAF. What is the best way to integrate AWS WAF with the ALB to filter malicious requests?

Accepted Answer

Create a web ACL in AWS WAF and associate it with the ALB.. AWS WAF can be associated directly with an ALB to filter incoming requests before they reach the ALB. Option B is incorrect because WAF works at the application layer, not at CloudFront unless CloudFront is used. Option C is incorrect because WAF is not applied at the security group level. Option D is incorrect because WAF is not a Network Load Balancer feature.

Answer

Replace the ALB with a Network Load Balancer and use AWS WAF with it.

Answer

Configure the security group of the ALB to only allow traffic that passes AWS WAF inspection.

Answer

Use AWS WAF in front of Amazon CloudFront and then forward requests to the ALB.

Question 10

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company does not want to assign public IP addresses to the instance. Which combination of resources is required? (Choose TWO.)

Accepted Answer

NAT Gateway in a public subnet. Option B (NAT Gateway in a public subnet) is correct because a NAT Gateway performs source NAT, allowing instances in a private subnet to initiate outbound traffic to the internet while remaining unreachable from the internet and without needing a public IP. Option D (Internet Gateway attached to the VPC) is correct because the NAT Gateway itself requires an Internet Gateway attached to the VPC to route its translated traffic to the internet; without an IGW, no outbound internet path exists. Together, the private subnet routes 0.0.0.0/0 to the NAT Gateway, and the public subnet routes 0.0.0.0/0 to the Internet Gateway, enabling patch downloads. Option A (VPN connection to on-premises) is not required because the scenario is about internet access, not connectivity to a corporate data center. Option C (VPC endpoint for Amazon S3) is not required because S3 gateway endpoints only provide private access to S3, not general internet access for downloading patches from arbitrary repositories.

Answer

VPN connection to the on-premises data center

Answer

VPC endpoint for Amazon S3

Question 11

A company uses AWS Network Firewall to inspect traffic. They notice that some traffic is bypassing the firewall. The VPC has a route table with a default route (0.0.0.0/0) pointing to the firewall endpoint. Which configuration could cause traffic to bypass the firewall?

Accepted Answer

The route table has a more specific route for the destination traffic. A more specific route (e.g., a /32 or /24 for the destination network) in the VPC route table will take precedence over the default route (0.0.0.0/0) that points to the firewall endpoint. This causes traffic destined for that specific network to bypass the firewall. Option A is incorrect because route propagation adds routes from VPN or Direct Connect but does not inherently cause bypass. Option B is incorrect because if the subnet is not associated with the firewall's route table, it uses the main route table, which could bypass the firewall, but the key issue here is the existence of a more specific route. Option C is incorrect because the firewall endpoint being in a different Availability Zone does not cause traffic to bypass; it can cause increased latency or other issues but not bypass.

Answer

The route table has route propagation enabled

Answer

The subnet is not associated with the route table

Answer

The firewall endpoint is in a different Availability Zone

Question 12

A network engineer is troubleshooting connectivity issues between an on-premises network and an Amazon VPC over an AWS Direct Connect connection. The on-premises network uses BGP to advertise routes to the VPC. The VPC is associated with a virtual private gateway (VGW). The on-premises network can reach resources in the VPC, but VPC resources cannot reach on-premises resources. What is the most likely cause?

Accepted Answer

The VPC route tables do not have a route for the on-premises CIDR pointing to the virtual private gateway.. For traffic to flow bidirectionally over Direct Connect, the VPC route tables must contain a route pointing the on-premises CIDR block to the virtual private gateway. Since on-premises can reach VPC resources (proving the BGP session and VGW attachment are working), the missing piece is the return path route in the VPC route table. Without this route, VPC resources have no path back to the on-premises network.

Answer

The virtual private gateway is not attached to the VPC.

Answer

The BGP session is not established.

Answer

The security group associated with the VPC resources is blocking inbound traffic from on-premises.

Question 13

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They have peered this VPC with another VPC using a VPC Peering connection. The peered VPC has a CIDR of 10.0.0.0/16 (overlapping). The company wants to allow communication between specific instances in both VPCs without changing the CIDRs. What should they do?

Accepted Answer

Use AWS PrivateLink to create a VPC endpoint service in one VPC and access it from the other VPC. AWS PrivateLink (VPC endpoint services) allows consumers in one VPC to reach a service in another VPC via an elastic network interface backed by a private IP, without requiring non-overlapping CIDRs. Because the traffic is delivered through the endpoint's ENI rather than routed by CIDR, overlapping 10.0.0.0/16 ranges in the two VPCs do not conflict. This satisfies the requirement to enable communication between specific instances without re-addressing either VPC.

Answer

Configure a NAT gateway in each VPC

Answer

Use security group references to allow traffic between the instances

Answer

Create a Transit Gateway and attach both VPCs

Question 14

A company is designing a network for a three-tier web application. The web tier must be accessible from the internet, the application tier must only be accessible from the web tier, and the database tier must only be accessible from the application tier. Which VPC design meets these requirements with the highest security?

Accepted Answer

Create public subnets for web tier and private subnets for app and database tiers. Use security groups to allow traffic from web to app and app to database.. It uses separate public subnets for the web tier (with an Internet Gateway for inbound traffic) and private subnets for the application and database tiers, which have no direct route to the internet. Security groups act as stateful virtual firewalls at the instance level, allowing you to precisely control traffic flows: the web tier security group allows inbound HTTP/HTTPS from the internet, the application tier security group allows inbound traffic only from the web tier security group, and the database tier security group allows inbound traffic only from the application tier security group. This layered approach enforces least-privilege access and minimizes the attack surface.

Answer

Create a single public subnet and use security groups to restrict traffic between instances.

Answer

Place all instances in public subnets but assign private IP addresses only.

Answer

Use network ACLs on subnets to restrict traffic instead of security groups.

Question 15

A company has a VPC with multiple subnets across Availability Zones. An application load balancer (ALB) is deployed in public subnets. The network team notices that traffic from the ALB to targets in private subnets is intermittently failing. The targets are healthy. What is the MOST likely cause?

Accepted Answer

The target security group does not allow traffic from the ALB's security group.. ALB target security groups must explicitly allow inbound traffic from the ALB's security group on the target port. If the target SG does not reference the ALB SG (or the correct port), health checks may pass intermittently or fail, causing traffic to be dropped. This is the most common cause of intermittent ALB-to-target failures when targets are otherwise healthy.

Answer

The ALB is not associated with a public subnet.

Answer

The network ACL for the target subnets blocks outbound traffic.

Answer

Cross-zone load balancing is disabled.