ANS-C01 Practice Test 2 — 25 Questions

Question 1

A company is designing a multi-region active-active application. They need to ensure that traffic is routed to the closest healthy region and that failover happens automatically. Which TWO services should be used together to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Global Accelerator with endpoint groups. AWS Global Accelerator (C) uses Anycast IPs to direct traffic to the closest healthy endpoint group, automatically rerouting traffic if a region becomes unhealthy. This provides fast regional failover and low-latency routing without DNS caching delays, making it ideal for active-active multi-region applications.

Answer

AWS Transit Gateway with inter-region peering

Answer

Amazon CloudFront with multiple origins

Answer

AWS Direct Connect with multiple locations

Question 2

A company has a multi-VPC architecture with VPCs in the same region. They need to ensure that traffic between VPCs never traverses the public internet and is encrypted in transit. Which solution meets these requirements with the lowest operational overhead?

Accepted Answer

Use AWS PrivateLink to connect VPCs via Network Load Balancers.. AWS PrivateLink allows you to connect VPCs privately using VPC endpoints and Network Load Balancers. Traffic stays within the AWS network and never traverses the public internet. When the application uses TLS/HTTPS, the traffic is encrypted end-to-end. This solution has low operational overhead because PrivateLink is fully managed and requires no VPN tunnels or third-party appliances.

Answer

Use AWS Transit Gateway with IPsec VPN attachments between VPCs.

Answer

Use VPC peering connections between all VPCs.

Answer

Use AWS Transit Gateway with VPC attachments and enable multicast.

Question 3

A company is using AWS Site-to-Site VPN connections to connect multiple branch offices to a central VPC. The network team wants to ensure high availability and automatic failover if one VPN tunnel goes down. Which configuration should be implemented?

Accepted Answer

Use the two tunnels provided by the VPN connection with dynamic routing (BGP). Each AWS Site-to-Site VPN connection provides two tunnels for high availability. By using dynamic routing (BGP) with both tunnels, the VPN automatically fails over to the second tunnel if the first goes down, without manual intervention. This meets the requirement for automatic failover and high availability.

Answer

Configure a second VPN connection to the same customer gateway and use BGP with equal-cost multipath

Answer

Use a single tunnel and rely on AWS automatic recovery

Answer

Configure static routes with a higher metric for the secondary tunnel

Question 4

Which TWO services can be used to centrally manage and monitor VPN connections across multiple AWS accounts? (Choose 2.)

Accepted Answer

AWS Network Manager. AWS Network Manager centrally manages and monitors VPN connections across multiple AWS accounts by providing a global view of your network topology, including on-premises and AWS resources. It integrates with Transit Gateway to monitor VPN tunnel status and performance metrics, enabling cross-account visibility via resource shares.

Answer

AWS CloudFormation

Answer

AWS Organizations

Answer

AWS Direct Connect Gateway

Question 5

A company needs to connect its on-premises data center to a VPC in AWS using a dedicated, private, and high-bandwidth connection. Which AWS service should be used?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct choice because it provides a dedicated, private, high-bandwidth network connection from an on-premises data center directly to AWS, bypassing the public internet. This meets the requirements for a private, low-latency, and consistent network path, unlike VPN-based solutions that traverse the internet.

Answer

AWS Client VPN

Answer

VPC Peering

Answer

AWS Site-to-Site VPN

Question 6

A network engineer is troubleshooting connectivity issues between an EC2 instance in a VPC and an on-premises server over a Direct Connect connection. The engineer has verified that the VPC route tables, Direct Connect virtual interface, and on-premises routing are correctly configured. Which tool should be used to verify the path MTU and identify fragmentation issues?

Accepted Answer

Use the ping command with the DF flag set to test MTU. The ping command with the Don't Fragment (DF) flag set (e.g., `ping -M do -s <size>` on Linux) is the correct tool to verify path MTU because it forces the packet not to be fragmented. If the packet size exceeds the MTU of any link along the path, the router will drop the packet and send an ICMP Fragmentation Needed message back, allowing the engineer to pinpoint the maximum supported MTU and identify fragmentation issues.

Answer

Use the netstat command

Answer

Use the nslookup command

Answer

Use the traceroute command

Question 7

A company is using AWS CloudFormation to deploy a stack that includes an S3 bucket with a bucket policy that restricts access to a specific VPC endpoint. The stack fails to create, and the error indicates that the bucket policy contains an invalid principal. Which condition key should be used to restrict access to a VPC endpoint in the bucket policy?

Accepted Answer

The condition key aws:SourceVpce. To restrict access to a specific VPC endpoint in an S3 bucket policy, you must use the `aws:SourceVpce` condition key in the `Condition` element, not a principal. VPC endpoints cannot be specified as principals in policies. Option A correctly identifies the condition key. Option B (VPC ID) is incorrect because you need the VPC endpoint ID, not the VPC ID. Option C (ARN of the VPC endpoint) is incorrect because ARNs are not used in condition keys for this purpose. Option D (VPC endpoint service) is incorrect because the endpoint service is not used in this condition.

Answer

The VPC ID

Answer

The ARN of the VPC endpoint

Answer

The VPC endpoint service

Question 8

A network engineer needs to capture and analyze traffic crossing a VPC peering connection for troubleshooting. Which AWS service should be used?

Accepted Answer

VPC Flow Logs for the peering connection.. VPC Flow Logs capture IP traffic information for network interfaces, including those attached to a VPC peering connection. They can be published to Amazon CloudWatch Logs or Amazon S3, and the logs contain fields such as source/destination IP, ports, protocol, and packet/byte counts, which are essential for troubleshooting traffic across the peering link. This is the correct service because it directly logs metadata about the traffic traversing the peering connection without requiring any changes to the network path.

Answer

AWS CloudTrail.

Answer

VPC Traffic Mirroring.

Answer

AWS Transit Gateway Network Manager.

Question 9

A network engineer is troubleshooting high latency between two EC2 instances in the same VPC but in different Availability Zones. The instances are in the same security group and have proper rules. Which configuration is most likely causing the latency?

Accepted Answer

The instances are in different Availability Zones.. The primary cause of higher latency between EC2 instances in different Availability Zones is the physical distance and the additional network hops required to traverse the AZ boundary. Even within the same VPC, traffic between AZs must pass through AWS's regional network infrastructure, which introduces a baseline latency of 1-2 milliseconds, whereas instances in the same AZ can communicate with sub-millisecond latency. The question explicitly states the instances are in different AZs, making this the most likely source of the latency issue.

Answer

The instances are using jumbo frames.

Answer

The instances are in a cluster placement group.

Answer

The instances have Enhanced Networking enabled.

Question 10

A company is migrating a legacy on-premises application to AWS. The application requires multicast traffic between instances within a VPC. The network engineer must design a solution that supports multicast without modifying the application. Which AWS service or feature should be used?

Accepted Answer

AWS Transit Gateway with multicast domain.. AWS Transit Gateway supports multicast through the creation of a multicast domain, which allows multicast traffic to flow between instances in different subnets within the same VPC or across attached VPCs without modifying the application. This is the only native AWS service that provides multicast forwarding, making it the correct choice for this requirement.

Answer

VPC peering connections between all instance subnets.

Answer

Application Load Balancer with UDP listener.

Answer

AWS Site-to-Site VPN connections with multicast routing enabled.

Question 11

A network engineer is troubleshooting a VPN connection between an on-premises network (172.16.0.0/16) and an AWS VPC (10.0.0.0/16). The VPN status is 'available' but traffic is not passing. The engineer runs the command shown in the exhibit. What is the most likely cause of the issue?

Accepted Answer

The VPC route table does not have a route for 172.16.0.0/16 pointing to the virtual private gateway.. The VPN status is 'available', which indicates that the VPN tunnels are established and the BGP sessions (if configured) are up. However, traffic still fails because the VPC route table lacks a route for the on-premises CIDR (172.16.0.0/16) pointing to the virtual private gateway (VGW). Without this route, the VPC does not know to send traffic destined for the on-premises network through the VPN connection, even though the tunnels themselves are operational.

Answer

The VPN tunnels are not in 'UP' state.

Answer

The tunnel inside CIDRs overlap with the VPC CIDR.

Answer

The BGP session is not established.

Question 12

A company has a VPC with CIDR 10.0.0.0/16 and two subnets: 10.0.1.0/24 (public) and 10.0.2.0/24 (private). The company wants to add a new subnet for a third tier. Which of the following are valid subnet CIDRs that can be added? (Select TWO.)

Accepted Answer

10.0.3.0/24. (10.0.3.0/24) is correct because it falls within the VPC CIDR 10.0.0.0/16 and does not overlap with the existing subnets (10.0.1.0/24 and 10.0.2.0/24). The /24 prefix length matches the existing subnet structure, and the third octet (3) is outside the range of the first two subnets, ensuring no IP address conflict.

Answer

10.0.1.128/25

Answer

10.1.0.0/16

Answer

10.0.2.64/26

Question 13

A company has a VPC with a CIDR of 10.0.0.0/16 and uses AWS Direct Connect with a private VIF to connect to on-premises. The on-premises network uses 10.0.0.0/8. The company wants to access an AWS service (e.g., S3) privately from the VPC without using public endpoints. Which solution avoids IP overlap and meets the requirement?

Accepted Answer

Create a VPC endpoint for S3 (Gateway type) and use it from the VPC.. A Gateway VPC Endpoint for S3 allows private access to S3 from within the VPC without traversing the internet or requiring public IPs. It avoids IP overlap because the endpoint uses prefix lists and route table entries within the VPC's 10.0.0.0/16 range, and does not involve the on-premises 10.0.0.0/8 network. The Direct Connect private VIF is not used for S3 traffic, so the overlapping CIDR is irrelevant.

Answer

Create a NAT gateway in a public subnet and route S3 traffic through it.

Answer

Use a public virtual interface and access S3 via public endpoints.

Answer

Add a route in the VPC route table pointing to the Direct Connect virtual interface for the S3 prefix list.

Question 14

A company is designing a network architecture for a critical application that requires sub-millisecond latency between EC2 instances in the same placement group. The instances will be launched in a single Availability Zone in us-east-1. Which combination of features should be used to achieve the lowest latency?

Accepted Answer

Launch instances in a cluster placement group with Elastic Fabric Adapter (EFA) enabled.. Elastic Fabric Adapter (EFA) provides OS-bypass capabilities that enable HPC and machine learning workloads to achieve sub-millisecond latency by bypassing the operating system kernel for inter-instance communication. Combined with a cluster placement group, which ensures instances are in close physical proximity within a single Availability Zone, this configuration delivers the lowest possible latency for tightly coupled applications.

Answer

Launch instances in a cluster placement group with Enhanced Networking (ENA) enabled.

Answer

Launch instances in a spread placement group with SR-IOV enabled.

Answer

Launch instances in a spread placement group with Enhanced Networking (ENA) enabled.

Question 15

A company is running a latency-sensitive application in a VPC with a public subnet and a private subnet. The application in the private subnet needs to access an Amazon S3 bucket in the same region. The company wants to minimize latency and avoid using a NAT gateway. Which solution meets these requirements?

Accepted Answer

Create a VPC Gateway Endpoint for Amazon S3 and update the route table for the private subnet. A VPC Gateway Endpoint for Amazon S3 allows instances in a private subnet to access S3 without traversing the internet or requiring a NAT gateway. This minimizes latency by routing traffic over the AWS internal network, and it avoids the cost and complexity of NAT devices. The route table for the private subnet must be updated with a route pointing to the gateway endpoint for the S3 prefix list.

Answer

Use S3 Transfer Acceleration and access the bucket via the public endpoint

Answer

Attach an Internet Gateway to the VPC and route the private subnet traffic through a NAT instance

Answer

Set up a NAT gateway in the public subnet and route traffic to the S3 bucket through it

Question 16

A company is designing a network for a three-tier web application. The web tier must be accessible from the internet, while the application and database tiers must be in private subnets. The company wants to minimize the number of load balancers. Which design should be used?

Accepted Answer

Place an internet-facing Application Load Balancer in a public subnet, web tier instances in public subnets, and app/database instances in private subnets.. An internet-facing Application Load Balancer (ALB) in a public subnet can receive internet traffic and forward it to web tier instances in public subnets, while the application and database tiers remain in private subnets with no direct internet access. This design uses a single load balancer to handle all external traffic, minimizing the number of load balancers while maintaining security boundaries.

Answer

Place an internal Application Load Balancer in a private subnet and use a NAT gateway for internet access.

Answer

Place an internet-facing Network Load Balancer in a public subnet and use it for all tiers.

Answer

Place an internet-facing Application Load Balancer in a private subnet.

Question 17

A solutions architect needs to design a highly available web application that uses an Application Load Balancer (ALB) and spans multiple Availability Zones (AZs) in a single region. The application must be able to handle a sudden increase in traffic without manual intervention. Which feature should the architect enable on the ALB to meet this requirement?

Accepted Answer

Enable cross-zone load balancing. Cross-zone load balancing distributes incoming traffic evenly across all registered targets in all enabled Availability Zones, rather than sending traffic only to targets in the same AZ as the load balancer node. This ensures that if one AZ receives more traffic than another, the ALB can still balance the load across all healthy instances, allowing the application to handle sudden traffic spikes without manual scaling intervention.

Answer

Enable connection draining

Answer

Enable sticky sessions

Answer

Enable deletion protection

Question 18

A company has an S3 bucket with the bucket policy shown. The VPC endpoint ID is correct. However, an EC2 instance in a private subnet in the same VPC cannot download objects from the bucket. What is a possible reason?

Accepted Answer

The EC2 instance is accessing S3 via a NAT Gateway instead of the VPC endpoint. The bucket policy likely includes a condition that restricts access to only requests originating from the VPC endpoint (e.g., `aws:sourceVpce`). If the EC2 instance in the private subnet routes traffic through a NAT Gateway instead of the VPC endpoint, the source IP will be the NAT Gateway's public IP, not the VPC endpoint's private IP, causing the condition to fail and the request to be denied. The instance can still reach S3 via the NAT Gateway, but the policy explicitly blocks non-endpoint traffic.

Answer

The EC2 instance does not have a route to the VPC endpoint

Answer

The bucket policy does not allow s3:ListBucket

Answer

The VPC endpoint security group is blocking traffic

Question 19

A company has created a VPC Interface Endpoint for Amazon ECR (Docker registry API) as shown in the exhibit. However, an EC2 instance in the same VPC is unable to authenticate with the ECR registry using the private DNS name. What is the most likely cause?

Accepted Answer

Private DNS is not enabled for the endpoint. The most likely cause is that Private DNS is not enabled for the VPC Interface Endpoint. When Private DNS is enabled, the endpoint automatically associates a Route 53 private hosted zone with the VPC, allowing the default private DNS name (e.g., *.dkr.ecr.us-east-1.amazonaws.com) to resolve to the endpoint's elastic network interface IP addresses. Without this, the EC2 instance will resolve the private DNS name to the public IP of the ECR service, bypassing the endpoint and failing authentication due to network path issues.

Answer

The endpoint service name is incorrect; it should be com.amazonaws.us-east-1.ecr.api

Answer

The endpoint is not in the 'available' state

Answer

The endpoint type should be Gateway, not Interface

Question 20

A company has a VPC with an Application Load Balancer (ALB) that distributes traffic to EC2 instances in private subnets. The ALB needs to be accessible from the internet. The security team requires that all traffic to the ALB be inspected by AWS WAF. Which configuration meets these requirements?

Accepted Answer

Associate AWS WAF with the ALB and make the ALB internet-facing. AWS WAF can be directly associated with an Application Load Balancer (ALB) to inspect HTTP/HTTPS traffic before it reaches the ALB. Making the ALB internet-facing allows it to receive traffic directly from the internet while WAF provides the required traffic inspection. This combination meets both the accessibility and security requirements without additional components.

Answer

Use a Network Load Balancer with AWS WAF attached

Answer

Place the ALB behind a Security Group that inspects traffic

Answer

Use Amazon CloudFront in front of the ALB with AWS WAF