ANS-C01 Practice Test 23 — 15 Questions

Question 1

A company is designing a network architecture for a critical application that requires high availability and fault tolerance. The application will be deployed on EC2 instances in an Auto Scaling group across three Availability Zones. The instances must be able to communicate with each other across AZs. Which TWO design decisions improve the fault tolerance of the application? (Choose TWO.)

Accepted Answer

Configure the Auto Scaling group to launch instances in multiple Availability Zones. Options B and D are correct. Option B is correct because distributing instances across three AZs ensures that the application survives an AZ failure. Option D is correct because Auto Scaling across AZs automatically replaces failed instances. Option A is wrong because a single NAT Gateway is a single point of failure. Option C is wrong because a single NLB in one AZ is a single point of failure. Option E is wrong because VPC endpoints do not improve fault tolerance for inter-instance communication.

Answer

Use a single NAT Gateway in one Availability Zone for internet access

Answer

Use VPC endpoints for Amazon S3 to reduce internet dependency

Answer

Use a single Network Load Balancer in one Availability Zone

Question 2

A company is designing a hybrid network using AWS Direct Connect. They want to ensure high availability and minimize downtime. Which TWO actions should they take?

Accepted Answer

Set up a site-to-site VPN as a backup for the Direct Connect connection. Options B and D are correct. Using two separate Direct Connect locations provides geographic redundancy. Having a VPN backup provides failover if Direct Connect fails. Option A is wrong because a single connection is a single point of failure. Option C is wrong because a single router is a SPOF. Option E is wrong because using the same ASN on both connections is fine, but not specifically for HA.

Answer

Use a single customer router for both connections

Answer

Provision a single Direct Connect connection with two virtual interfaces

Answer

Use the same BGP ASN on both Direct Connect connections

Question 3

A company is designing a hybrid network using AWS Direct Connect with multiple VPCs in the same region. They need to ensure that traffic between on-premises and VPCs is encrypted and that VPC-to-VPC traffic does not traverse the internet. Which solution meets these requirements?

Accepted Answer

Use AWS Transit Gateway with an IPsec VPN over Direct Connect using a virtual private gateway on each VPC, and configure Transit Gateway route tables.. Option D is correct because Transit Gateway with IPsec VPN over Direct Connect provides encryption and VPC connectivity. Option A is wrong because Direct Connect alone does not encrypt traffic. Option B is wrong because VPN over the internet does not use Direct Connect. Option C is wrong because it does not provide encryption for VPC-to-VPC traffic.

Answer

Use a single Direct Connect connection with multiple virtual interfaces and enable encryption on the physical connection.

Answer

Use AWS Transit Gateway with Direct Connect Gateway and enable encryption on the Transit Gateway attachments.

Answer

Set up a VPN connection over the internet between on-premises and each VPC, and use VPC Peering for VPC-to-VPC traffic.

Question 4

A company is designing a hybrid network architecture that connects its on-premises data center to AWS via AWS Direct Connect. The on-premises network uses BGP to advertise routes to AWS. The company wants to ensure that if the Direct Connect connection fails, traffic automatically fails over to a VPN connection. Which configuration ensures this failover behavior?

Accepted Answer

Advertise the on-premises prefixes over Direct Connect with a lower MED value than over the VPN.. Option A is correct because using a lower MED value on the Direct Connect advertisement makes it preferred over the VPN route. Option B is incorrect because AS path prepending would make the Direct Connect route less preferred. Option C is incorrect because the local preference is only relevant within the same AS. Option D is incorrect because the multi-exit discriminator (MED) is used for BGP path selection, not community tags.

Answer

Advertise the on-premises prefixes over Direct Connect with a higher AS path prepend than over the VPN.

Answer

Advertise the on-premises prefixes over Direct Connect with a specific BGP community to influence path selection.

Answer

Advertise the on-premises prefixes over Direct Connect with a higher local preference than over the VPN.

Question 5

A company wants to improve disaster recovery by replicating data between two AWS Regions. Which AWS service provides a managed solution for cross-Region network connectivity?

Accepted Answer

AWS Global Accelerator. Option D is correct because AWS Global Accelerator uses the AWS global network to route traffic to optimal endpoints, improving performance and availability for cross-Region replication. Option A is wrong because VPC Peering does not support cross-Region. Option B is wrong because Direct Connect is for on-premises connections. Option C is wrong because AWS VPN is not managed for cross-Region replication.

Answer

AWS Direct Connect

Answer

VPC Peering

Answer

AWS Site-to-Site VPN

Question 6

A company wants to connect two VPCs in the same AWS region using a hub-and-spoke model. Which AWS service should be used to route traffic between the VPCs through a central inspection VPC?

Accepted Answer

AWS Transit Gateway. Option C is correct because AWS Transit Gateway provides a hub-and-spoke model for connecting multiple VPCs, with centralized routing and inspection capabilities. Option A is wrong because VPC Peering does not allow transitive routing; each peering connection is a one-to-one relationship. Option B is wrong because AWS Direct Connect is for on-premises connectivity, not VPC-to-VPC. Option D is wrong because AWS VPN CloudHub is for connecting multiple VPN connections.

Answer

AWS Direct Connect

Answer

AWS VPN CloudHub

Answer

VPC Peering

Question 7

A company wants to use AWS Transit Gateway to connect multiple VPCs and on-premises networks. They need to centrally manage and enforce security policies. Which THREE components are required?

Accepted Answer

Transit Gateway route tables. Options A, C, and D are correct. Transit Gateway route tables control traffic flow. Network Firewall provides centralized inspection and policy enforcement. Resource shares via AWS RAM allow sharing the Transit Gateway across accounts. Option B is wrong because VPC endpoints are not needed for Transit Gateway connectivity. Option E is wrong because Direct Connect gateway is optional for on-premises but not strictly required for security policy enforcement.

Answer

VPC Gateway Endpoints

Answer

AWS Direct Connect Gateway

Question 8

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. They need to add IPv6 support for their application. What is the simplest way to enable IPv6 communication for instances in the VPC?

Accepted Answer

Assign an Amazon-provided IPv6 CIDR block to the VPC and subnets, and create an Egress-Only Internet Gateway for outbound traffic.. Option A is correct because assigning an IPv6 CIDR to the VPC and subnet, and using an Egress-Only Internet Gateway for outbound, is the standard method. Option B is wrong because NAT Gateways are IPv4-only. Option C is wrong because IPv6 does not use NAT. Option D is wrong because VPN does not provide IPv6 internet access.

Answer

Create a VPN connection to an external IPv6 network.

Answer

Configure a NAT Gateway in a public subnet and assign IPv6 addresses to instances.

Answer

Use an Internet Gateway with NAT for IPv6 traffic.

Question 9

A global company is deploying a multi-Region application on AWS. The application requires low-latency access to a shared dataset that is updated frequently in multiple Regions. The company wants to use Amazon Route 53 latency-based routing to direct users to the closest Region. Which data store provides the best combination of low-latency reads and cross-Region consistency for this use case?

Accepted Answer

Amazon ElastiCache for Redis Global Datastore. Option C is correct because Amazon ElastiCache for Redis offers sub-millisecond latency and can be used as a global datastore with cross-Region replication using Global Datastore. Option A is incorrect because DynamoDB global tables offer eventual consistency, but with higher latency for strongly consistent reads. Option B is incorrect because S3 is object storage and not suitable for frequently updated shared dataset requires sub-millisecond latency. Option D is incorrect because Aurora Global Database provides low-latency reads but with a lag of typically 1 second, not sub-millisecond.

Answer

Amazon S3 with cross-Region replication

Answer

Amazon Aurora Global Database

Answer

Amazon DynamoDB global tables with eventually consistent reads

Question 10

A company is migrating a legacy application to AWS. The application requires multicast traffic between EC2 instances in the same VPC. Which TWO AWS services can support this requirement? (Choose TWO.)

Accepted Answer

AWS VPC Lattice. Options B and D are correct. B: VPC Lattice supports multicast. D: Transit Gateway with multicast domain supports multicast. Option A is incorrect because a Network Load Balancer does not support multicast. Option C is incorrect because a Gateway Load Balancer does not support multicast. Option E is incorrect because Application Load Balancer does not support multicast.

Answer

Network Load Balancer (NLB)

Answer

Application Load Balancer (ALB)

Answer

Gateway Load Balancer (GWLB)

Question 11

A company has a VPC with a public subnet containing a NAT gateway and a private subnet containing Amazon EC2 instances. The instances in the private subnet need to download patches from the internet. The NAT gateway is in the public subnet and has an Elastic IP address. The private subnet's route table has a default route pointing to the NAT gateway. However, the instances cannot reach the internet. What is the MOST likely cause?

Accepted Answer

The public subnet's route table does not have a route to an internet gateway.. Option D is correct. For a NAT gateway to work, it must be in a public subnet with a route to an internet gateway. If the public subnet does not have a route to the internet gateway, the NAT gateway cannot forward traffic to the internet. Option A is incorrect because security groups for instances in private subnets should allow outbound traffic, but that is not the most likely cause. Option B is incorrect because the NAT gateway automatically replies to traffic; no route back is needed for responses. Option C is incorrect because the NAT gateway does not need a security group; it uses network ACLs and route tables.

Answer

The NAT gateway does not have a route back to the private subnet.

Answer

The NAT gateway is not associated with a security group that allows inbound internet traffic.

Answer

The security group attached to the EC2 instances does not allow outbound traffic to the internet.

Question 12

A company is deploying a critical application that requires low latency between EC2 instances in the same AWS region but across multiple Availability Zones. The instances are part of an Auto Scaling group behind a Network Load Balancer. Which network design provides the lowest latency while maintaining high availability?

Accepted Answer

Do not use a placement group; enable Enhanced Networking (ENA) on all instances.. Option C is correct. A placement group with a partition strategy spreads instances across logical partitions but within a single AZ, which does not provide multi-AZ HA. For low latency across AZs, a cluster placement group is not possible because it is limited to a single AZ. Therefore, the best practice is to place instances in the same VPC and subnet in the same AZ for lowest latency, but that sacrifices AZ-level HA. Actually, the question asks for low latency across multiple AZs, so the best option is to use a cluster placement group in a single AZ (which is not across AZs). The correct answer is to use a cluster placement group in a single AZ, but the option that mentions that is D? Let me review: Option D says 'Cluster placement group across two AZs' which is not possible. Option C says 'Partition placement group across two AZs' which provides low latency? Actually, partition placement groups are not designed for low latency; they are for large distributed workloads. The correct answer is that cluster placement groups are limited to one AZ, so for low latency across AZs, you cannot use placement groups. The question might be tricky. The best answer is B: 'Use a spread placement group across two AZs' but spread placement groups increase latency. I think the intended answer is D: 'Cluster placement group across two AZs' is not possible, so that's wrong. Option A: 'No placement group, use Enhanced Networking' is the correct approach because placement groups cannot be used across AZs for low latency. Actually, Enhanced Networking (ENA) provides low latency regardless. So correct answer is A.

Answer

Use a cluster placement group across two Availability Zones.

Answer

Use a spread placement group across two Availability Zones.

Answer

Use a partition placement group across two Availability Zones.

Question 13

A company is designing a multi-Region architecture with active-active failover for a web application. The application uses Application Load Balancers (ALBs) in two AWS Regions. Traffic must be routed to the closest healthy Region with automatic failover. Which AWS service should be used to route traffic?

Accepted Answer

Amazon Route 53 with latency-based routing and health checks. Option C is correct because Amazon Route 53 latency-based routing routes traffic to the Region with the lowest latency, and health checks enable automatic failover. Option A is wrong because Global Accelerator uses anycast IPs and does not provide latency-based routing with health checks in the same way. Option B is wrong because CloudFront is a CDN, not for active-active load balancing across Regions. Option D is wrong because Network Load Balancer operates within a single Region.

Answer

Network Load Balancer with cross-zone load balancing

Answer

Amazon CloudFront with multiple origins

Answer

AWS Global Accelerator

Question 14

A company needs to provide secure access to an Amazon S3 bucket for a third-party partner. The partner has their own AWS account. The company wants to avoid exposing the bucket to the public internet. Which solution meets these requirements?

Accepted Answer

Create a VPC Gateway Endpoint for S3 in your VPC and allow the partner to access the bucket through a VPC peering connection. Option D is correct because an S3 VPC Gateway Endpoint allows access from a VPC, and the partner can connect to that VPC via VPC Peering or Direct Connect. Option A is wrong because bucket policies with Principal set to partner's account allow access from anywhere, not just from a specific VPC. Option B is wrong because Pre-signed URLs expire and are not a permanent solution. Option C is wrong because CloudFront requires public internet access to the origin.

Answer

Set up Amazon CloudFront with an origin access identity (OAI)

Answer

Use pre-signed URLs generated by AWS Lambda

Answer

Configure an S3 bucket policy that grants access to the partner's AWS account

Question 15

A company is designing a hybrid network using AWS Direct Connect. They have a VPC with a CIDR of 10.0.0.0/16 and an on-premises network with CIDR 10.0.0.0/8. The company needs to ensure that traffic from the VPC to the on-premises network uses the Direct Connect connection and that traffic does not traverse the internet. Which TWO actions are required? (Choose TWO.)

Accepted Answer

Create a private virtual interface (VIF) on the Direct Connect connection. Options B and D are correct. Option B is correct because a Private VIF is required for private IP communication. Option D is correct because static routes or BGP advertise the on-premises CIDR over the VIF. Option A is wrong because a Public VIF is for internet-routable IPs. Option C is wrong because a Direct Connect Gateway is not required for a single VPC. Option E is wrong because Transit Gateway is not required.

Answer

Attach the VPC to an AWS Transit Gateway

Answer

Create a public virtual interface (VIF) on the Direct Connect connection

Answer

Create a Direct Connect Gateway to connect the VPC to the on-premises network