ANS-C01 Practice Test 24 — 15 Questions

Question 1

A company has a VPC with multiple subnets across three Availability Zones. They deploy an Amazon RDS for MySQL Multi-AZ DB instance. The application tier consists of EC2 instances in private subnets. To improve read performance, the company wants to add read replicas. Which THREE design considerations are important for network connectivity? (Choose THREE.)

Accepted Answer

Read replicas can be placed in different Availability Zones than the primary DB instance. Options B, C, and D are correct. Option B is correct because EC2 instances must be in the same VPC to connect via private IP. Option C is correct because read replicas can be in different AZs for high availability. Option D is correct because a security group for the RDS must allow inbound MySQL traffic from the application tier. Option A is wrong because read replicas do not require public IPs. Option E is wrong because read replicas can be in the same or different Regions.

Answer

Read replicas must be in public subnets with public IP addresses

Answer

Read replicas must be in the same Region as the primary DB instance

Question 2

A company has a VPC with public and private subnets. They launch an EC2 instance in a private subnet and need it to access the internet. Which combination of components is required?

Accepted Answer

A NAT Gateway in a public subnet and a default route (0.0.0.0/0) in the private subnet's route table pointing to the NAT Gateway. Option D is correct because a NAT Gateway in a public subnet with a route in the private subnet's route table pointing to the NAT Gateway provides internet access. Option A is wrong because an Internet Gateway alone is not enough; it must be attached to the VPC and the route table must point to it. Option B is wrong because a NAT Instance is also a solution but the question asks for a combination. Option C is wrong because a VPC endpoint is for accessing AWS services, not the internet.

Answer

A NAT instance in the private subnet with a route to an Internet Gateway

Answer

A VPC Gateway Endpoint for S3 in the private subnet

Answer

An Internet Gateway (IGW) attached to the VPC and a default route (0.0.0.0/0) in the private subnet's route table pointing to the IGW

Question 3

A company is designing a network for a multi-tier application. The web tier must be accessible from the internet, and the application tier must only be accessible from the web tier. Which architecture should they use?

Accepted Answer

Web servers in public subnets with an Internet Gateway, and application servers in private subnets with security groups allowing traffic only from the web tier. Option A is correct because public subnets for web servers with Internet Gateway and private subnets for app servers with no direct internet access is standard. Option B is wrong because placing app servers in public subnets exposes them. Option C is wrong because NAT Gateway is for outbound, not inbound. Option D is wrong because VPC Peering is not needed.

Answer

Web servers in private subnets with a NAT Gateway for outbound traffic, and application servers in public subnets

Answer

All servers in a single VPC with VPC Peering to another VPC

Answer

Web servers and application servers in public subnets, each with their own security group

Question 4

A company has a VPC with a CIDR of 10.0.0.0/16. They need to peer with another VPC that has a CIDR of 10.0.0.0/24. What will happen?

Accepted Answer

The peering connection will fail because the CIDRs overlap.. Option D is correct because overlapping CIDRs cannot be peered. Option A is wrong because VPC Peering does not support overlapping CIDRs. Option B is wrong because AWS will reject the peering request. Option C is wrong because overlapping CIDRs are not allowed.

Answer

The peering connection will be established, but only the first VPC's CIDR will be used.

Answer

The peering connection will be established, but routes with overlapping CIDRs will not be added automatically.

Answer

The peering connection will be established, and the overlapping CIDRs will be ignored.

Question 5

Based on the output, which of the following is true?

Accepted Answer

The Direct Connect Gateway uses ASN 64512. Option A is correct because the output shows a Direct Connect Gateway with an Amazon-side ASN of 64512. Option B is wrong because the state is 'available'. Option C is wrong because the ID starts with 'dxgw'. Option D is wrong because ownerAccount is present.

Answer

The Direct Connect Gateway is in a 'deleted' state

Answer

The Direct Connect Gateway is a virtual private gateway

Answer

The Direct Connect Gateway is owned by a different account

Question 6

A company is designing a network for a multi-tier application that must meet compliance requirements. The architecture includes a VPC with public, private, and database subnets. Which TWO actions should be taken to ensure the database subnets are not directly accessible from the internet? (Select TWO.)

Accepted Answer

Configure a network ACL on the database subnets to deny inbound traffic from 0.0.0.0/0.. Options A and D are correct because a public subnet must not be used for databases, and a proper network ACL on the database subnet can deny inbound from 0.0.0.0/0. Option B is wrong because a NAT Gateway in the database subnet would still allow outbound but not inbound; however, placing NAT in database subnet is not best practice. Option C is wrong because security groups are stateful and allow return traffic, but a deny rule in network ACL is needed. Option E is wrong because IGW in database subnet would expose it.

Answer

Attach an Internet Gateway to the database subnets.

Answer

Create a NAT Gateway in the database subnets.

Answer

Associate a security group that denies inbound traffic from 0.0.0.0/0.

Question 7

A company wants to allow its employees to securely access internal applications hosted in a VPC without traversing the internet. The company also wants to be able to enforce security policies at the user level. Which AWS service should the company use?

Accepted Answer

AWS Client VPN. Option C is correct because AWS Client VPN provides secure access to VPC resources with user-level authentication and authorization. Option A is incorrect because AWS Site-to-Site VPN is for site-to-site connectivity, not individual users. Option B is incorrect because Direct Connect is dedicated network connection, not for remote users. Option D is incorrect because a bastion host requires SSH/RDP and does not enforce user-level policies natively.

Answer

Bastion host in a public subnet

Answer

AWS Direct Connect

Answer

AWS Site-to-Site VPN

Question 8

A company is designing a multi-Region active-active application using Application Load Balancers (ALBs) behind AWS Global Accelerator. They require that traffic from a specific client IP address is always routed to the same AWS Region for session persistence. Which Global Accelerator feature should be used?

Accepted Answer

Enable client IP address affinity (sticky sessions).. Option B is correct because Global Accelerator's sticky sessions (client IP address affinity) ensure that traffic from a given client IP is routed to the same endpoint for a set duration. Option A is incorrect because health checks determine endpoint health but do not enforce stickiness. Option C is incorrect because traffic dials control traffic distribution percentages but cannot pin a client to one endpoint. Option D is incorrect because endpoint weights distribute traffic proportionally but do not guarantee stickiness.

Answer

Configure health checks on the endpoints.

Answer

Assign endpoint weights to each ALB.

Answer

Set traffic dials to 100% for both Regions.

Question 9

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They have subnets in three Availability Zones. They need to add IPv6 connectivity to the VPC and allow instances in private subnets to initiate outbound IPv6 connections to the internet, but not allow inbound connections from the internet. Which TWO actions must be taken?

Accepted Answer

Create an egress-only internet gateway and add a route for ::/0 to it in the private subnet route tables.. Option A is correct: Allocate an IPv6 CIDR block to the VPC and associate it with subnets. Option D is correct: Create an egress-only internet gateway and add a route for ::/0 to it in the private subnet route tables. Option B is incorrect because a NAT gateway is for IPv4. Option C is incorrect because an internet gateway allows bidirectional IPv6 traffic, which would allow inbound connections. Option E is incorrect because a security group is used for fine-grained control but does not provide internet connectivity.

Answer

Create an internet gateway and add a route for ::/0 to it in the private subnet route tables.

Answer

Create a NAT gateway in a public subnet.

Answer

Configure a security group that allows outbound IPv6 traffic.

Question 10

A company is designing a multi-region active-active application using Amazon Route 53 and Application Load Balancers (ALBs). The application must be highly available and route traffic to the closest healthy endpoint. Which TWO configurations should the company use? (Choose two.)

Accepted Answer

Configure Route 53 with latency-based routing. Latency-based routing directs traffic to the region with the lowest latency, supporting active-active. Health checks ensure traffic is not sent to unhealthy endpoints. Failover routing is active-passive, not active-active. Geoproximity is for location-based, not latency. Weighted routing distributes traffic by weight, not based on health or latency for active-active.

Answer

Configure Route 53 with failover routing

Answer

Configure Route 53 with weighted routing

Answer

Configure Route 53 with geoproximity routing

Question 11

A company is migrating to AWS and needs to connect its on-premises data center to multiple VPCs across several AWS regions. The on-premises network uses BGP and requires high availability with sub-second failover. The solution must be cost-effective and support traffic segmentation. Which design meets these requirements?

Accepted Answer

Order an AWS Direct Connect connection and create multiple virtual interfaces, each connecting to a different VPC in different regions. Use BGP with Bidirectional Forwarding Detection (BFD) for fast failover.. Option C is correct because Direct Connect with multiple virtual interfaces (one per VPC) provides segmentation, and BGP fast failover can be achieved. Option A is wrong because VPN over the internet cannot guarantee sub-second failover. Option B is wrong because Transit Gateway inter-region peering is for VPC-to-VPC, not on-premises. Option D is wrong because it adds unnecessary complexity and cost.

Answer

Set up a Site-to-Site VPN connection between on-premises and each VPC using a VPN appliance on AWS.

Answer

Use AWS Transit Gateway with inter-region peering and attach VPN connections from on-premises to a central Transit Gateway.

Answer

Use a combination of Direct Connect and VPN as a backup, and route all traffic through a single VPC that acts as a transit hub.

Question 12

A network engineer runs the AWS CLI command shown in the exhibit. The VPC has an Amazon Route 53 private hosted zone associated. What is the impact of this setting?

Accepted Answer

No instances in the VPC can resolve DNS records from the private hosted zone.. Option B is correct because when DNS support is disabled, instances in the VPC cannot use the DNS resolution provided by the VPC's Route 53 Resolver, including private hosted zones. Option A is incorrect because the VPC's DNS resolution affects all resources. Option C is incorrect because the private hosted zone is still associated but not resolvable. Option D is incorrect because the DHCP option set is separate.

Answer

Only instances in public subnets can resolve private hosted zone records.

Answer

The DHCP option set must be updated to provide DNS resolution.

Answer

The private hosted zone is automatically deleted.

Question 13

A company is migrating its on-premises data center to AWS. The migration requires connectivity between the on-premises network and a VPC. The company needs a connection that supports multiple VLANs for separate environments (development, test, production) and provides consistent performance. The company also wants to avoid using the public internet. Which AWS service should be used?

Accepted Answer

AWS Direct Connect. Option B is correct. AWS Direct Connect provides a private, dedicated connection from on-premises to AWS, supporting multiple VLANs via Virtual Local Area Networks (VLANs) on a single physical connection. This meets the requirements for isolation and consistent performance. Option A is incorrect because Site-to-Site VPN uses the public internet and does not support VLANs natively. Option C is incorrect because Client VPN is for individual user connections, not site-to-site. Option D is incorrect because Transit Gateway is a network transit hub, not a connectivity service; it can be used with Direct Connect or VPN but is not the connection itself.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

AWS Client VPN

Question 14

A company has a VPC with an application load balancer (ALB) in public subnets and web servers in private subnets. The web servers must be accessible only from the ALB. What is the most secure and efficient configuration?

Accepted Answer

Configure the web server security group to allow inbound HTTP from the ALB's security group.. Option B is correct because ALB uses a security group source, and using the ALB's security group ID as the source restricts traffic to only the ALB. Option A is wrong because it allows all traffic from the VPC. Option C is wrong because it allows traffic from any source on port 80. Option D is wrong because it restricts to a specific IP range which may not represent the ALB.

Answer

Configure the web server security group to allow inbound HTTP from 0.0.0.0/0.

Answer

Configure the web server security group to allow inbound HTTP from the ALB's private IP addresses.

Answer

Configure the web server security group to allow inbound HTTP from the VPC CIDR.

Question 15

A company wants to connect multiple VPCs in different AWS Regions using AWS Transit Gateway. The company requires full mesh connectivity with centralized inspection of inter-Region traffic. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Create Transit Gateway peering attachments between the Transit Gateways in each Region.. Options B and D are correct. B: Transit Gateway peering attachments allow inter-Region connectivity. D: Centralized inspection is achieved by routing traffic through a shared services VPC with a network appliance. Option A is incorrect because VPN attachments are not needed for inter-Region connectivity. Option C is incorrect because VPC peering does not scale. Option E is incorrect because cross-Region peering is supported.

Answer

Create VPN attachments between each Transit Gateway and the inspection VPC.

Answer

Use VPC peering connections between VPCs in different Regions.

Answer

Disable cross-Region peering on the Transit Gateway.