ANS-C01 Practice Test 24 — 15 Questions

Question 1

Refer to the exhibit. After deploying this CloudFormation stack, the VPC is attached to the transit gateway. However, routes are not being propagated to the transit gateway route table. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The transit gateway route table propagation is not configured.. The exhibit shows a transit gateway route table attached to the VPC, but no propagation is configured. Without explicit propagation, the VPC attachment's CIDR blocks are not automatically added to the transit gateway route table. The CloudFormation resource AWS::EC2::TransitGatewayRouteTablePropagation must be declared to enable route propagation from the VPC attachment into the transit gateway route table.

Answer

The VPC attachment is not in the 'available' state.

Answer

VPN ECMP support is enabled, preventing propagation.

Answer

DNS support is disabled on the transit gateway.

Question 2

A security engineer needs to audit all API calls made in an AWS account for compliance. The engineer wants to capture the source IP address and the user agent for each call. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records every API call made in an AWS account, capturing the identity of the caller, the source IP address, the user agent, the timestamp, and the request parameters. This makes it the authoritative service for auditing API activity for compliance. CloudTrail event history and trails deliver these records to S3, CloudWatch Logs, or EventBridge for analysis.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs

Question 3

A company wants to allow its developers to access Amazon RDS databases from their on-premises network without traversing the public internet. Which solution meets this requirement?

Accepted Answer

Establish an AWS Site-to-Site VPN connection. A Site-to-Site VPN connection between the on-premises network and the AWS VPC provides a private, encrypted tunnel over the internet, allowing on-premises developers to reach RDS without exposing the database publicly. This is the standard hybrid connectivity solution when dedicated private circuits are not required.

Answer

Use a NAT gateway in the VPC

Answer

Create a VPC endpoint for RDS

Answer

Configure VPC Peering between the on-premises network and the VPC

Question 4

Match each AWS Direct Connect term to its definition.

Accepted Answer

Virtual Interface (VIF): A logical connection over a Direct Connect line that connects to a VPC or other AWS services.. Correct matches: VIF is a logical connection; Direct Connect Gateway interconnects VPCs and on-premises. Common confusions: LAG is a bundle of physical connections, not a VPN endpoint; VGW is a VPN endpoint, not a bundle.

Answer

Link Aggregation Group (LAG): The AWS VPN endpoint that provides connectivity to on-premises networks over IPsec.

Answer

Virtual Private Gateway (VGW): A bundle of multiple physical connections aggregated to increase bandwidth and provide redundancy.

Question 5

A network engineer troubleshoots a VPN connection that shows 'available' state but traffic is not passing. The on-premises firewall logs show that the tunnel is established, but no traffic. The engineer checks the VPN configuration. Based on the exhibit, what is the MOST likely cause of the problem?

Accepted Answer

The VPN is configured for BGP (StaticRoutesOnly: false), but only a static route is added.. The VPN connection is configured for BGP (StaticRoutesOnly: false), but only a static route is added. This mismatch means that the VPN expects BGP to exchange routes, but no BGP configuration is present, so no routes are learned, and traffic cannot be routed. The tunnel is up, but no traffic passes because the routing table lacks the necessary routes.

Answer

The VPN connection is not in 'available' state.

Answer

The outside IP addresses are not routable over the internet.

Answer

The inside IP addresses for the tunnels are missing.

Question 6

A company has a VPC with an application load balancer (ALB) in public subnets and EC2 instances in private subnets. The EC2 instances must only accept traffic from the ALB. Which security group configuration achieves this?

Accepted Answer

Allow inbound traffic from the ALB's security group on the application port.. Referencing the ALB's security group as the source in the EC2 instances' inbound rule ensures that only traffic originating from the ALB is allowed. This leverages AWS security group referencing, which dynamically resolves to the private IP addresses of the ALB's elastic network interfaces (ENIs), providing a secure and scalable solution without exposing the instances to broader network ranges.

Answer

Allow inbound traffic from 0.0.0.0/0 on the application port.

Answer

Allow inbound traffic from the VPC CIDR on the application port.

Answer

Allow inbound traffic from the private subnet CIDR on the application port.

Question 7

A company uses AWS Direct Connect with a private VIF to connect to a VPC. The network team notices that traffic from on-premises to an EC2 instance in the VPC is taking a suboptimal path through the internet instead of the Direct Connect. What is the most likely cause?

Accepted Answer

The on-premises router does not have a specific route for the VPC CIDR via the Direct Connect.. If the on-premises router lacks a specific route for the VPC CIDR pointing to the Direct Connect virtual interface, traffic destined for the VPC will follow the default route out to the internet instead of the private VIF. The most likely cause is therefore a missing or incorrect static route (or BGP advertisement) on the customer side for the VPC CIDR via the DX connection. Adding the route restores the intended private path.

Answer

The VPC route table does not include a route to the Direct Connect gateway.

Answer

The Direct Connect virtual interface has BGP ASN prepending configured.

Answer

The VPC route table does not have a prefix list for the on-premises CIDR.

Question 8

A company is implementing a network security solution for a VPC that contains a web application. The application uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances in private subnets. The company wants to protect against common web exploits and also filter outbound traffic from the instances. Which TWO services should be used together?

Accepted Answer

AWS WAF. AWS WAF (B) is correct because it integrates directly with the Application Load Balancer to inspect incoming HTTP/HTTPS requests and block common web exploits such as SQL injection and cross-site scripting using managed rule groups. AWS Network Firewall (C) is correct because it is a stateful, managed firewall that can be deployed in the VPC to filter outbound (egress) traffic from the EC2 instances, including domain-based and intrusion-prevention filtering. AWS Shield Advanced (A) only provides DDoS protection and does not address web exploits or outbound traffic filtering. Network ACLs (D) are stateless subnet-level controls that cannot inspect application-layer payloads or perform the required egress filtering with the same depth. Amazon GuardDuty (E) is a threat-detection service that identifies malicious activity but does not block or filter traffic.

Answer

AWS Shield Advanced

Answer

Network ACLs

Answer

Amazon GuardDuty

Question 9

A company is troubleshooting high latency on an AWS Direct Connect connection. The network team notices that the latency increases during peak hours. The connection uses a single virtual interface (VIF) with a 1 Gbps capacity. What is the MOST likely cause of the latency?

Accepted Answer

The bandwidth limit of the virtual interface is being exceeded. The most likely cause of increased latency during peak hours is that the bandwidth limit of the virtual interface (VIF) is being exceeded. When traffic approaches or surpasses the 1 Gbps capacity, the router's egress queue begins to fill, causing packet buffering and queuing delay. This queuing delay directly manifests as higher round-trip time (RTT) and is a classic symptom of link saturation.

Answer

The VLAN ID is mismatched between the customer router and AWS

Answer

Jumbo frames are not enabled on the customer router

Answer

BGP keepalive timers are set too high

Question 10

A security engineer attaches the above IAM policy to an IAM user. The user then attempts to launch an EC2 instance from an IP address outside the 10.0.0.0/8 range. What will happen?

Accepted Answer

The request will be denied because the condition is not satisfied.. The policy allows ec2:* only when the source IP is within 10.0.0.0/8. If the user is coming from outside that range, the condition is not met, so the action is not allowed. The default is implicit deny, so the request will be denied. Option B is correct. Option A is wrong because the condition is not met. Option C is wrong because the policy does not deny explicitly; it just doesn't allow. Option D is wrong because the condition evaluates to false.

Answer

The request will be allowed because the policy allows ec2:* on all resources.

Answer

The request will be denied because the policy does not include a Deny statement.

Answer

The request will be allowed because the condition evaluates to true.

Question 11

A company needs to connect its on-premises data center to AWS using a dedicated, low-latency connection. Which AWS service should be used?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct choice because it provides a dedicated, private, low-latency network connection from an on-premises data center directly to AWS, bypassing the public internet. This service uses industry-standard 802.1Q VLANs to create virtual interfaces, ensuring consistent performance and reduced latency for mission-critical workloads.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

VPC Peering

Question 12

A small company has a single VPC with one public subnet and one private subnet. They have a web server in the public subnet and a database server in the private subnet. The web server needs to access the database server on port 3306 (MySQL). The network engineer has configured the security group for the database server to allow inbound TCP port 3306 from the security group of the web server. However, the web server cannot connect to the database server. The network ACL for the private subnet is the default (allows all inbound and outbound). The web server can ping the database server's private IP. What is the MOST likely cause of the connection failure?

Accepted Answer

The MySQL service on the database server is not running or not listening on port 3306. The web server can ping the database server's private IP, indicating network connectivity (including security group and NACL rules for ICMP) is working. The security group for the database server allows inbound TCP 3306 from the web server's security group, and the NACL is default (allow all). Therefore, the most likely cause is that the MySQL service on the database server is not running or not listening on port 3306. This would prevent the connection even though network paths are open.

Answer

The web server cannot reach the private IP of the database server because it is in a different subnet

Answer

The network ACL for the private subnet is blocking inbound traffic on port 3306

Answer

The security group for the database server is not allowing inbound traffic from the web server's security group

Question 13

A company has an S3 bucket that stores sensitive documents. They need to ensure that all objects in the bucket are encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). Additionally, they want to prevent any uploads that do not specify the required KMS key. Which combination of bucket policy and default encryption should they implement?

Accepted Answer

Enable default encryption on the bucket with SSE-KMS using the required KMS key, and add a bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption-aws-kms-key-id header with the required key ARN.. It combines S3 default encryption with SSE-KMS using the required KMS key, ensuring all objects are encrypted at rest with that key, and a bucket policy that explicitly denies s3:PutObject requests lacking the x-amz-server-side-encryption-aws-kms-key-id header with the required key ARN. This enforces that uploads must specify the correct KMS key, preventing any uploads that do not meet the encryption requirement. The bucket policy denial is evaluated before the request is allowed, providing a hard enforcement mechanism.

Answer

Enable default encryption with SSE-S3, and add a bucket policy that denies s3:PutObject unless the request uses the required KMS key.

Answer

Use a bucket policy that requires the kms:Encrypt permission for the required key, but do not enable default encryption.

Answer

Enable default encryption with SSE-KMS using the required key, and rely on IAM policies to enforce encryption, not bucket policies.

Question 14

A company has a security group that allows inbound SSH (port 22) from 0.0.0.0/0. A security engineer discovers that an EC2 instance was compromised via SSH. The engineer needs to identify which IAM user created the overly permissive security group rule. Which AWS service or feature should the engineer use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API calls made within the AWS environment, including the AuthorizeSecurityGroupIngress API call that created the overly permissive security group rule. By searching CloudTrail logs for this specific API event, the engineer can identify the IAM user, source IP, and timestamp of the rule creation. VPC Flow Logs, AWS Config, and GuardDuty do not capture IAM user identity for API-level changes.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon GuardDuty

Question 15

A solutions architect is designing a VPC with public and private subnets in two Availability Zones. The private subnets require outbound internet access for software updates, but inbound internet access must be blocked. Which solution meets these requirements?

Accepted Answer

Deploy a NAT Gateway in a public subnet and add a default route to the NAT Gateway in the private subnet route tables.. A NAT Gateway, deployed in a public subnet with an Elastic IP and a route to an Internet Gateway, enables outbound traffic from private subnets to the internet while blocking unsolicited inbound connections. The private subnet route table directs default traffic (0.0.0.0/0) to the NAT Gateway, which performs source network address translation (SNAT) on outbound packets, ensuring responses return to the NAT Gateway without exposing private instances directly.

Answer

Attach an internet gateway to the VPC and add a default route to the internet gateway in the private subnet route tables.

Answer

Launch an EC2 instance in a public subnet with a proxy software and route private subnet traffic through it.

Answer

Create a VPC endpoint for Amazon S3 and add a route to the endpoint in the private subnet route tables.