ANS-C01 Practice Test 25 — 15 Questions

Question 1

A company has a VPC with multiple subnets and an AWS Transit Gateway. They have a requirement to inspect traffic between subnets using a third-party firewall appliance that is deployed in a centralized inspection VPC. The firewall appliance must process all traffic between the VPC subnets, including traffic between subnets in the same Availability Zone. Which routing configuration achieves this?

Accepted Answer

Create a VPC route table that routes the VPC CIDR to the Transit Gateway and associate it with each subnet.. Option D is correct. To force all inter-subnet traffic through the Transit Gateway, you must create a VPC route table that routes traffic destined for other subnets (the VPC's CIDR) to the Transit Gateway. This ensures traffic leaves the VPC and goes through the Transit Gateway to the inspection VPC. Option A is incorrect because the default route for intra-VPC traffic is local, which would bypass the Transit Gateway. Option B is incorrect because the main route table still has the local route for the VPC CIDR, so traffic between subnets stays within the VPC. Option C is incorrect because subnet route tables are attached to subnets, but if the route tables have the local route for the VPC CIDR, traffic will not go to the Transit Gateway.

Answer

Create a VPC route table that routes all traffic (0.0.0.0/0) to the Transit Gateway.

Answer

Use the main route table and add a route for the VPC CIDR to the Transit Gateway.

Answer

Associate each subnet with a custom route table that has a route for the VPC CIDR to the Transit Gateway.

Question 2

A company is using AWS Transit Gateway to connect multiple VPCs. They notice that traffic between two VPCs in different Availability Zones is taking a suboptimal path, resulting in cross-AZ data transfer costs. How can they optimize the path and reduce costs?

Accepted Answer

Use Availability Zone affinity by launching resources in the same AZ and using Transit Gateway to route within the same AZ.. Option C is correct because ensuring traffic stays within the same AZ avoids cross-AZ data transfer costs. Option A is wrong because Transit Gateway does not have AZ awareness. Option B is wrong because VPC Peering still incurs cross-AZ costs if traffic crosses AZs. Option D is wrong because moving instances to single AZ reduces availability.

Answer

Replace Transit Gateway with VPC Peering between the VPCs.

Answer

Enable Transit Gateway multicast to replicate traffic across AZs.

Answer

Configure the Transit Gateway to use a single Availability Zone for all attachments.

Question 3

A company is using AWS Direct Connect to connect its on-premises data center to a VPC. The company wants to use private virtual interfaces (VIFs) to access multiple VPCs in the same AWS Region. Which AWS service should be used to simplify this connectivity?

Accepted Answer

Direct Connect gateway. Option B is correct because a Direct Connect gateway allows a single private VIF to connect to multiple VPCs in the same or different Regions. Option A is incorrect because a transit VPC solution is more complex and not needed. Option C is incorrect because a VPN connection is not required. Option D is incorrect because VPC peering is not used with Direct Connect.

Answer

Transit VPC solution with EC2-based VPN appliances

Answer

AWS Site-to-Site VPN

Answer

VPC peering connection

Question 4

A company has a VPC with a CIDR block of 10.0.0.0/16. They have two subnets: Subnet A (10.0.1.0/24) and Subnet B (10.0.2.0/24). They launch an EC2 instance in Subnet A and assign it a primary private IP address of 10.0.1.50. They then attach a second elastic network interface (ENI) to the instance with a primary private IP of 10.0.2.100. The instance needs to send traffic from the second ENI. However, when the instance sends traffic from the second ENI, it fails. What is the MOST likely cause?

Accepted Answer

The instance's operating system routing table does not have a route for the second ENI's subnet.. Option C is correct. When an EC2 instance has multiple ENIs, each ENI must be in a different subnet. However, the operating system's routing table sends traffic based on the source IP. If the default route is associated with the primary ENI, traffic sourced from the second ENI's IP will use the primary ENI's route, which may not allow it to leave through the correct subnet. The solution is to configure the OS to use the correct ENI for outbound traffic based on the source IP. Option A is incorrect because security groups are per-ENI and do not cause this issue. Option B is incorrect because there is no requirement for the ENIs to be in the same subnet. Option D is incorrect because the routing table in the subnet does not determine which ENI the instance uses.

Answer

The two ENIs are in different subnets, which is not allowed.

Answer

The security group for the second ENI does not allow outbound traffic.

Answer

The subnet route table does not have a route for the second ENI's IP address.

Question 5

A company is migrating a legacy application to AWS. The application uses multicast for service discovery. Which THREE AWS services or features can be used to support multicast traffic within a VPC?

Accepted Answer

AWS Direct Connect with multicast. Options B, C, and D are correct. AWS Transit Gateway supports multicast domains for multicast traffic. VPC has limited multicast support via network interfaces, and AWS PrivateLink does not. Direct Connect can extend on-premises multicast. Option A is incorrect because Internet Gateway does not support multicast. Option E is incorrect because VPC Peering does not support multicast.

Answer

Internet Gateway (IGW)

Answer

VPC Peering

Question 6

A company is designing a highly available network for a critical application that requires sub-second failover between two AWS regions. The application uses active-active traffic distribution. Which routing policy should they use in Amazon Route 53?

Accepted Answer

Latency routing with health checks. Option B is correct because Latency-based routing with health checks can distribute traffic to the region with lowest latency and failover sub-second if health check fails. Option A is wrong because failover routing is active-passive. Option C is wrong because weighted routing does not consider health. Option D is wrong because geolocation is not for active-active failover.

Answer

Failover routing

Answer

Geolocation routing

Answer

Weighted routing

Question 7

A company has a VPC with public and private subnets. The private subnets need outbound internet access for software updates. The company wants to ensure that traffic from private subnets uses a single, highly available IP address for outbound traffic. Which solution meets these requirements?

Accepted Answer

Create a NAT gateway in a public subnet and route traffic from private subnets to it.. Option D is correct because a NAT gateway provides highly available outbound internet access with a single Elastic IP address. Option A is incorrect because a NAT instance is not highly available. Option B is incorrect because a VPC endpoint is for specific AWS services, not general internet access. Option C is incorrect because a proxy fleet adds complexity and does not provide a single IP.

Answer

Deploy a single EC2 instance configured as a NAT instance in a public subnet.

Answer

Configure a fleet of proxy servers in an Auto Scaling group with a Network Load Balancer.

Answer

Use a VPC endpoint for Amazon S3 to access software updates.

Question 8

A company is deploying a web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application must be accessible from the internet. Which component must be attached to the VPC to allow internet traffic to reach the ALB?

Accepted Answer

Internet gateway. Option A is correct. An internet gateway is a horizontally scaled, redundant, and highly available VPC component that allows communication between the VPC and the internet. It is required for internet-facing load balancers. Option B is incorrect because a NAT gateway is for outbound-only traffic from private subnets. Option C is incorrect because a virtual private gateway is for VPN connections. Option D is incorrect because a transit gateway is for connecting multiple VPCs and on-premises networks.

Answer

NAT gateway

Answer

Virtual private gateway

Answer

Transit gateway

Question 9

An IAM policy attached to a user allows creating and deleting VPCs and subnets only in us-east-1. The user attempts to create a VPC in eu-west-1. What will happen?

Accepted Answer

The API call will be denied with an authorization error.. Option C is correct. The condition restricts actions to us-east-1 only, so the API call in eu-west-1 will be denied. Option A is wrong because the policy explicitly allows with a region condition. Option B is wrong because the condition is evaluated. Option D is wrong because no override exists.

Answer

The VPC will be created but the user will receive a warning.

Answer

The user can create the VPC because the condition is not applicable to VPC creation.

Answer

The VPC will be created successfully because the policy allows ec2:CreateVpc.

Question 10

A company is designing a network for a critical application that requires an SLA of 99.99% availability. The application runs on EC2 instances in an Auto Scaling group across three Availability Zones. The company needs to ensure that the network design meets the SLA. Which THREE components should the company include? (Choose THREE.)

Accepted Answer

A NAT gateway in each Availability Zone for outbound internet access.. Options A, B, and C are correct. A: Application Load Balancer distributes traffic across AZs. B: NAT gateways in each AZ provide highly available outbound access. C: VPC endpoints avoid internet dependency. Option D is incorrect because a single Direct Connect connection is a single point of failure. Option E is incorrect because a VPN connection alone is not highly available.

Answer

A single AWS Direct Connect connection for all inbound traffic.

Answer

A single AWS Site-to-Site VPN connection for administrative access.

Question 11

A company is designing a VPC with both IPv4 and IPv6 workloads. The VPC has an internet gateway, and the company wants to allow outbound IPv6 traffic to the internet from instances in a private subnet while blocking inbound IPv6 traffic from the internet. Which configuration should be used?

Accepted Answer

Configure an egress-only internet gateway in the VPC and add a route for ::/0 to the egress-only internet gateway in the private subnet's route table.. Option B is correct. An egress-only internet gateway allows outbound IPv6 traffic from instances in a private subnet to the internet, but prevents the internet from initiating connections to those instances. It is the IPv6 equivalent of a NAT gateway for IPv4. Option A is incorrect because a NAT gateway only supports IPv4. Option C is incorrect because a virtual private gateway is for VPN connections, not internet access. Option D is incorrect because a security group can control traffic but cannot provide outbound-only internet access for IPv6.

Answer

Configure a security group that allows outbound traffic and denies inbound traffic.

Answer

Configure a virtual private gateway and route traffic through it.

Answer

Configure a NAT gateway in a public subnet.

Question 12

A company is deploying a multi-tier web application across two AWS Regions with an active-passive failover architecture. The application uses Application Load Balancers (ALBs) in each Region, and traffic must be directed to the active Region using DNS. Which routing policy should be used for the Amazon Route 53 record set to achieve this?

Accepted Answer

Failover routing policy. Option B is correct because a failover routing policy is used for active-passive configurations where one resource is primary and the other is secondary, allowing Route 53 to direct traffic to the active region and fail over to the passive region if the primary becomes unhealthy. Option A (weighted) distributes traffic across multiple resources. Option C (latency) routes based on lowest latency. Option D (geolocation) routes based on user location.

Answer

Geolocation routing policy

Answer

Weighted routing policy

Answer

Latency routing policy

Question 13

A company is designing a multi-VPC architecture in a single AWS Region. The company has three VPCs: Production, Development, and Shared Services. They want to enable transitive routing between all VPCs while minimizing operational overhead. Which TWO solutions meet these requirements?

Accepted Answer

Use AWS Transit Gateway to connect all VPCs.. Option A is correct: Transit Gateway provides transitive routing between multiple VPCs and supports hub-and-spoke architecture. Option D is correct: A centralized VPN to on-premises can provide transitive routing if all VPCs connect to the same VPN via Transit Gateway. Option B is incorrect because VPC peering is not transitive; each pair must be explicitly peered. Option C is incorrect because a VPN connection between two VPCs would require each pair to be connected. Option E is incorrect because Direct Connect alone does not provide transitive routing between VPCs.

Answer

Establish VPC peering connections between each pair of VPCs.

Answer

Configure a VPN connection between each VPC.

Answer

Configure AWS Direct Connect connections from each VPC to the same on-premises router.

Question 14

A company runs a critical application on Amazon EC2 instances in a VPC. The application receives data from an on-premises data center over an AWS Direct Connect connection. The company wants to add redundant connectivity using a VPN connection over the internet. They need to ensure that traffic from on-premises to AWS uses the Direct Connect connection when it is healthy, and only fails over to the VPN if Direct Connect fails. Which configuration achieves this?

Accepted Answer

Advertise a more specific prefix over Direct Connect and a less specific prefix over VPN, and set a higher MED value on the VPN routes.. Option A is correct. By advertising a more specific prefix (e.g., /24) over Direct Connect and a less specific prefix (e.g., /23) over VPN, BGP will prefer the more specific route. Additionally, setting a higher MED value on the VPN routes makes Direct Connect routes preferred. Option B is incorrect because longer AS_PATH in BGP makes a route less preferred. Option C is incorrect because a lower local preference makes a route less preferred. Option D is incorrect because a higher weight makes a route more preferred, which would prefer VPN.

Answer

Advertise the same prefix over both connections but prepend AS_PATH multiple times on the Direct Connect routes.

Answer

Set a higher BGP weight on the VPN routes.

Answer

Set a lower BGP local preference on the Direct Connect routes.

Question 15

A company wants to connect its on-premises network to AWS using AWS Direct Connect. The company has two data centers, each with a redundant connection to an AWS Direct Connect location. The company wants to ensure high availability and failover capability. Which THREE steps should be taken?

Accepted Answer

Order at least two Direct Connect connections from different providers or locations.. Option A is correct: Order two or more Direct Connect connections for redundancy. Option C is correct: Use Border Gateway Protocol (BGP) to exchange routes between on-premises and AWS. Option E is correct: Use a Direct Connect gateway to connect to multiple VPCs. Option B is incorrect because VPN is not required if Direct Connect is used, though it can be a backup. Option D is incorrect because multiple virtual interfaces can be established over a single connection, but that does not provide connection-level redundancy.

Answer

Configure a VPN connection as a backup in case Direct Connect fails.

Answer

Provision multiple virtual interfaces on a single Direct Connect connection.