ANS-C01 Practice Test 23 — 15 Questions

Question 1

A company has a VPC with a public subnet and a private subnet. They have a NAT Gateway in the public subnet. Instances in the private subnet need to download patches from the internet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway. However, instances cannot reach the internet. What is a possible cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The route table for the NAT Gateway's subnet does not have a route to an Internet Gateway.. For a NAT Gateway to route traffic to the internet, its subnet must have a route to an Internet Gateway (IGW). The NAT Gateway resides in the public subnet, and the public subnet's route table must include a default route (0.0.0.0/0) pointing to the IGW. Without this route, the NAT Gateway cannot forward traffic from the private subnet to the internet, even though the private subnet's route table correctly points to the NAT Gateway.

Answer

The NAT Gateway is in a private subnet.

Answer

The network ACL on the private subnet is blocking outbound traffic.

Answer

The NAT Gateway does not have a security group allowing outbound traffic.

Question 2

A company is setting up a Site-to-Site VPN connection between their on-premises network and AWS. Which THREE components are required for a VPN connection?

Accepted Answer

VPN Tunnel. A VPN tunnel is a required component for an AWS Site-to-Site VPN connection because it provides the encrypted, secure communication channel between the on-premises customer gateway and the AWS virtual private gateway. Each VPN connection consists of two tunnels for high availability, each using IPsec (IKEv1 or IKEv2) to encrypt traffic. Without at least one VPN tunnel, no encrypted data can traverse the VPN connection.

Answer

Transit Gateway

Answer

Internet Gateway

Question 3

A media company is designing a global streaming platform using AWS. They have a primary workload in us-east-1 (VPC A, 10.0.0.0/16) and a secondary workload in eu-west-1 (VPC B, 10.1.0.0/16). They need to replicate data between these VPCs with low latency and high throughput, and also allow their on-premises data center (10.2.0.0/16) in us-east-2 to communicate with both VPCs. The on-premises network is connected to AWS via two Direct Connect connections terminating in us-east-1 and eu-west-1. The company uses a Transit Gateway in each region, with inter-region peering between the Transit Gateways. The on-premises network has BGP advertisements for 10.2.0.0/16. The routing is set up such that the on-premises network can reach both VPCs via the Direct Connect connections. However, the VPCs cannot reach each other's CIDRs. The network engineer checks the Transit Gateway route tables and sees that the inter-region peering attachment is associated with the appropriate route tables, and static routes for the remote VPC CIDRs are present. What is the MOST likely cause of the problem?

Accepted Answer

The static routes for the remote VPC CIDRs are pointing to the Direct Connect attachment instead of the inter-region peering attachment. In a Transit Gateway inter-region peering, you need to add static routes in both directions to point to the peering attachment. The engineer confirmed static routes are present, so that might not be the issue. However, a common misconfiguration is that the on-premises network's route propagation via Direct Connect may be causing the Transit Gateway to prefer the on-premises path (which may not have connectivity between regions) over the inter-region peering. But the VPCs cannot reach each other's CIDRs, so the issue is likely that the route tables for the VPC attachments do not have the routes for the remote VPC CIDRs pointing to the inter-region peering attachment. Alternatively, the inter-region peering attachment might not be in the correct route table. The most likely issue is that the Transit Gateway route tables for the VPCs do not include routes for the remote VPC CIDRs via the peering attachment. Since the engineer says they are present, the issue might be that the propagation from the Direct Connect attachment is overriding the static route with a less preferred route or causing a conflict. Actually, the most common problem is that the static routes for the inter-region CIDRs are pointing to the wrong attachment (e.g., the Direct Connect attachment instead of the peering attachment).

Answer

The inter-region peering attachment is not in the same route table as the VPC attachments

Answer

The VPC CIDRs overlap with each other

Answer

The on-premises network is advertising a default route that is being preferred

Question 4

A company runs a critical application on EC2 instances in an Auto Scaling group across two Availability Zones. The application is fronted by an Application Load Balancer (ALB). The network team recently migrated from a transit VPC to a transit gateway for inter-VPC connectivity. After the migration, users experience intermittent connectivity failures. The team checks the ALB target group and sees that health checks are passing. However, from an EC2 instance in the same VPC, they can reach the ALB but not the application. They notice that the application sends traffic to an internal DNS server that is in a different VPC, and the application depends on that DNS resolution. The transit gateway route tables are configured to propagate routes from attached VPCs. The DNS server is reachable from the application VPC over the transit gateway. What is the MOST likely cause of the intermittent failures?

Accepted Answer

The DNS server returns different IP addresses for the same DNS name, and some IPs are not reachable due to route table misconfiguration.. If the DNS server returns different IP addresses for the same DNS name due to DNS round-robin or time-to-live (TTL) caching, the application may get an IP address that is not reachable (e.g., from a different VPC or a terminated instance). The health check may pass because the target group health check uses the ALB's IP, not the application's DNS resolution. Option A is plausible but less likely because the DNS server is reachable. Option B could cause total failure, not intermittent. Option D would affect all traffic, not just intermittent.

Answer

The transit gateway route tables have a blackhole route for the DNS server's VPC.

Answer

The Auto Scaling group is scaling in and out frequently, causing application instances to be terminated during DNS resolution.

Answer

The ALB security group does not allow traffic from the application instances on the ephemeral ports.

Question 5

A company is setting up an AWS Site-to-Site VPN connection between its on-premises network and a VPC. The VPC has a virtual private gateway (VGW) attached, and the VPN connection uses two tunnels for redundancy. The on-premises customer gateway (CGW) is configured with the public IP address of the on-premises VPN device. The VPN tunnels are up and BGP sessions are established. However, the company cannot ping an EC2 instance in the VPC from an on-premises server. The security group for the EC2 instance allows ICMP from the on-premises network CIDR. What is the MOST likely cause of the issue?

Accepted Answer

The route tables of the VPC subnets do not have a route for the on-premises CIDR pointing to the virtual private gateway.. The VPC subnet route tables must have a route pointing to the VGW for the on-premises CIDR. Option B is incorrect because BGP is established. Option C is incorrect because the CGW is configured correctly. Option D is incorrect because the VPN connection does not have a security group.

Answer

The customer gateway is configured with an incorrect private IP address.

Answer

The VPN connection's security group is blocking ICMP traffic.

Answer

The BGP session is not advertising the on-premises routes to the VGW.

Question 6

Which TWO measures can be taken to protect an AWS account's root user credentials? (Choose two.)

Accepted Answer

Create an IAM user with administrative privileges and use that instead of the root user. Options A and D are correct. Creating an IAM user with administrative privileges allows you to avoid using the root user for daily tasks, which is a best practice. Enabling MFA on the root user adds an extra layer of security. Option B is incorrect because using the root user for daily administrative tasks increases risk and violates security best practices. Option C is incorrect because the root user cannot be deleted. Option E is incorrect because storing credentials in a shared password manager is insecure and not recommended.

Answer

Use the root user for daily administrative tasks

Answer

Delete the root user account after creating IAM users

Answer

Store the root user credentials in a shared password manager

Question 7

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The company wants to centralize network security by inspecting all traffic between VPCs and between VPCs and on-premises. Which architecture should be used?

Accepted Answer

Attach all VPCs to a Transit Gateway and use route tables to send traffic through a firewall appliance in one VPC.. AWS Transit Gateway supports centralized routing through a shared services VPC. By attaching all VPCs and VPN connections to the Transit Gateway and configuring route tables to point default or inter-VPC routes to a network firewall appliance (e.g., a third-party firewall or AWS Network Firewall) in a dedicated inspection VPC, all traffic between VPCs and between VPCs and on-premises can be forced through the firewall for inspection. This architecture leverages Transit Gateway route tables and blackhole routes to enforce traffic steering without requiring complex peering or VPN meshes.

Answer

Use VPN connections between all VPCs and on-premises.

Answer

Use VPC peering between all VPCs and configure security groups.

Answer

Use Network Load Balancer to distribute traffic across VPCs.

Question 8

A company is troubleshooting connectivity issues between two VPCs that are peered using an inter-region VPC peering connection. The VPCs have the following CIDR blocks: VPC A (10.0.0.0/16) and VPC B (10.1.0.0/16). Which THREE of the following are possible reasons for the connectivity failure?

Accepted Answer

The route tables in each VPC do not have routes pointing to the peer VPC's CIDR.. For inter-region VPC peering to function, each VPC must have explicit routes in its route tables pointing to the CIDR block of the peer VPC, with the VPC peering connection as the target. Without these routes, traffic destined for the peer VPC will not be forwarded over the peering link, causing connectivity failure.

Answer

The VPC CIDR blocks overlap.

Answer

The VPC peering connection is in a 'pending-acceptance' state.

Question 9

A company has an on-premises data center connected to AWS via a Site-to-Site VPN. The VPN connection uses BGP for dynamic routing. The company wants to add an additional VPN tunnel for redundancy. What must be configured?

Accepted Answer

Create a second VPN connection to a second customer gateway device.. To add an additional VPN tunnel for redundancy, you must create a second VPN connection that uses a second customer gateway device. This provides a second BGP session and a separate tunnel, ensuring failover if the primary tunnel or customer gateway fails. The existing virtual private gateway can support multiple VPN connections, so no replacement or additional VGW is needed.

Answer

Create a second virtual private gateway and attach it to the VPC.

Answer

Add a transit gateway to replace the virtual private gateway.

Answer

Configure static routes instead of BGP.

Question 10

A company uses AWS Transit Gateway with multiple VPC attachments and a VPN attachment to an on-premises network. The on-premises network advertises the same prefix via two separate VPN connections for redundancy. The TGW route table shows both routes as active. Traffic from a VPC to on-premises is not load-balanced and prefers one connection. Which THREE actions would help achieve active-active load balancing? (Choose 3.)

Accepted Answer

Configure BGP AS_PATH prepending on the preferred VPN connection to make it less preferred. BGP AS_PATH prepending artificially increases the AS path length for routes advertised over the preferred VPN connection, making them less preferred by BGP's path selection algorithm. This causes the Transit Gateway to prefer the other VPN connection for those prefixes, enabling active-active load balancing when combined with ECMP.

Answer

Set a higher BGP weight on the less preferred connection

Answer

Use static routes for both VPN connections instead of BGP

Question 11

A company has deployed a web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application must be accessible over the internet, but the security team requires that all traffic be inspected by a third-party firewall appliance. What is the MOST scalable architecture?

Accepted Answer

Use a Gateway Load Balancer with firewall appliances in each Availability Zone.. Gateway Load Load Balancer (GWLB) is designed to scale third-party virtual appliances (e.g., firewalls) horizontally across multiple Availability Zones. It uses the GENEVE protocol to encapsulate traffic, enabling transparent inspection while preserving the original packet headers. This architecture meets the security requirement for traffic inspection and provides high availability and elasticity, unlike a single appliance or a proxy-based solution.

Answer

Configure a Network Load Balancer with target groups pointing to firewall appliances.

Answer

Use an EC2 instance as a transparent proxy and set it as the next-hop in the route table.

Answer

Deploy a single firewall appliance in one Availability Zone and route all traffic through it.

Question 12

A network engineer is troubleshooting connectivity issues between an on-premises network and a VPC over a Direct Connect private VIF. The on-premises network can reach EC2 instances in the VPC, but cannot reach an RDS database in the same VPC. The VPC has a single subnet. What is the MOST likely cause?

Accepted Answer

The RDS database security group is not allowing inbound traffic from the on-premises CIDR. Since the on-premises network can reach EC2 instances but not the RDS database, the issue is likely at the security group level, not the network ACL or routing. Security groups are stateful and act as a virtual firewall for instances; by default, they deny all inbound traffic unless explicitly allowed. The RDS database's security group must have an inbound rule permitting traffic from the on-premises CIDR range, and its absence would block the connection while leaving EC2 access unaffected.

Answer

The VPC network ACL is blocking inbound traffic from on-premises

Answer

The direct connect virtual interface is configured for a different VLAN

Answer

The VPC route table does not have a route to the on-premises network

Question 13

A company has a Direct Connect connection with a private VIF connected to a VPC. The network engineer notices that traffic from on-premises to the VPC is being dropped intermittently. The on-premises router shows BGP session is up, but the VPC route table does not have the on-premises prefix. What is the most likely cause?

Accepted Answer

The on-premises router is advertising a route that is more specific than the allowed prefix list on the Direct Connect gateway.. The Direct Connect gateway (DXGW) uses allowed prefix lists to control which routes are accepted from the on-premises router via BGP. If the on-premises router advertises a prefix that is more specific (e.g., /28) than the allowed prefix list (e.g., /24), the DXGW will reject the route, causing the VPC route table to lack the on-premises prefix. The BGP session remains up because the session itself is not affected, but the specific route is not installed.

Answer

The MTU on the on-premises router is set too high.

Answer

The BGP session is flapping due to high latency.

Answer

The on-premises router is using AS_PATH prepending.

Question 14

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network is advertising a default route (0.0.0.0/0) over BGP. The VPC has an internet gateway attached. When an EC2 instance in the VPC sends traffic to an internet destination, which path does it take by default?

Accepted Answer

Traffic goes to the on-premises network via Direct Connect.. When an on-premises network advertises a default route (0.0.0.0/0) over BGP via a Direct Connect private VIF, that route is propagated into the VPC route tables as a static route. By default, the most specific route (longest prefix match) is preferred, but since both the internet gateway and the BGP-advertised route are for 0.0.0.0/0, the BGP route takes precedence because it is learned via a more specific path (Direct Connect) and is considered a static route in the VPC route table, overriding the internet gateway's implicit route.

Answer

Traffic goes to the on-premises network only if there is a static route.

Answer

Traffic is dropped because there is no route.

Answer

Traffic goes to the internet via the internet gateway.

Question 15

A company needs to ensure that all traffic between their VPC and on-premises network is encrypted. Which solution meets this requirement?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN creates an encrypted IPsec tunnel between the VPC and on-premises network, ensuring all traffic is encrypted over the public internet. This meets the requirement for mandatory encryption, unlike unencrypted options such as Direct Connect or VPC Peering.

Answer

AWS Direct Connect with a private VIF

Answer

VPC Peering connection

Answer

AWS Internet Gateway