ANS-C01 Practice Test 2 — 25 Questions

Question 1

A company is using AWS Direct Connect to connect its on-premises network to AWS. The company wants to encrypt all traffic between its on-premises network and AWS. Which solution meets this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a private VIF and establish an IPsec VPN tunnel over the Direct Connect connection.. AWS Direct Connect does not natively encrypt traffic; it provides a private, dedicated network connection. To meet the encryption requirement, you can establish an IPsec VPN tunnel over the private VIF, which encrypts all traffic between the on-premises network and the VPC. This approach combines the low latency and reliability of Direct Connect with the security of IPsec encryption.

Answer

Use a public virtual interface (VIF) and route traffic through a NAT gateway.

Answer

Use a private virtual interface (VIF) and enable encryption on the Direct Connect connection.

Answer

Use a private VIF and enable TLS on all applications.

Question 2

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that no VPC in any account can have an internet gateway attached. Which option meets this requirement?

Accepted Answer

Apply a service control policy (SCP) that denies ec2:AttachInternetGateway at the root level.. A service control policy (SCP) applied at the root organizational unit (OU) level can deny the ec2:AttachInternetGateway action across all accounts in the organization. This centrally enforces the restriction. Option A is incorrect because IAM policies are applied per account and do not prevent the action if the user has permissions through other means. Option B is incorrect because security groups control traffic at the instance level, not internet gateway attachments. Option D is incorrect because network ACLs control traffic at the subnet level, not internet gateway attachments.

Answer

Create an IAM policy that denies ec2:AttachInternetGateway and attach it to each account's admin role.

Answer

Use security groups to block traffic from internet gateways.

Answer

Use network ACLs to block traffic from internet gateways.

Question 3

A company is deploying a global web application that will be accessed by users in North America, Europe, and Asia. The application runs on Amazon EC2 instances behind Application Load Balancers (ALBs) in three AWS Regions: us-east-1, eu-west-1, and ap-southeast-1. The company wants to provide a single global anycast IP address that routes users to the closest healthy endpoint based on latency, and must ensure that if an entire Region becomes unavailable, traffic is automatically redirected to the next closest Region. The solution must also support WebSocket connections. Which AWS service should the network engineer use to meet these requirements?

Accepted Answer

AWS Global Accelerator with a standard accelerator and endpoint groups in each Region.. AWS Global Accelerator provides static anycast IP addresses that act as a fixed entry point for global applications. It uses the AWS global network to route traffic to the optimal endpoint based on latency, and it performs health checks to automatically fail over to healthy endpoints in other Regions within seconds. It supports TCP and UDP, including WebSocket, making it the correct choice for this requirement.

Answer

AWS Transit Gateway with inter-Region peering and equal-cost multi-path routing.

Answer

Amazon CloudFront with a custom origin and Lambda@Edge for failover.

Answer

Amazon Route 53 with latency-based routing and health checks.

Question 4

A company has a VPC with multiple subnets across three Availability Zones. The company wants to deploy a Network Load Balancer (NLB) to distribute TCP traffic to a fleet of EC2 instances. The NLB must preserve the source IP address of the client. Which configuration is required?

Accepted Answer

Create the NLB with a TCP listener and register the EC2 instances as targets in a target group.. Network Load Balancers (NLBs) preserve the source IP address of clients by default when using a TCP listener. No additional configuration is required to enable this behavior; the NLB forwards packets with the original source IP intact. Therefore, simply creating the NLB with a TCP listener and registering EC2 instances as targets is sufficient.

Answer

Enable Proxy Protocol v2 on the NLB target group.

Answer

Enable cross-zone load balancing on the NLB.

Answer

Attach a security group to the NLB that allows inbound traffic from the client IP range.

Question 5

A company is migrating on-premises workloads to AWS using AWS Direct Connect. The company has two Direct Connect connections from different providers for redundancy. Which configuration ensures seamless failover with automatic traffic rerouting?

Accepted Answer

Create two Direct Connect gateways, each attached to a separate Transit Gateway, and advertise the same prefixes via BGP.. Using two Direct Connect gateways, each attached to a separate Transit Gateway, with the same BGP prefixes advertised from both connections enables active-active or active-passive failover via BGP path selection (e.g., AS_PATH prepending or MED). This design ensures automatic traffic rerouting if one connection fails, as BGP withdraws the failed path and the remaining path takes over without manual intervention.

Answer

Use one Direct Connect connection as primary and the other as standby with static routes.

Answer

Connect both Direct Connect connections to the same Virtual Private Gateway (VGW) and enable BGP.

Answer

Use a VPN connection over the internet as a backup for the Direct Connect links.

Question 6

A network engineer is troubleshooting a Site-to-Site VPN connection between an on-premises network and AWS. The VPN tunnel is up, but traffic is not flowing from the on-premises network to a VPC. The VPC has a virtual private gateway attached, and the route table has a route pointing to the virtual private gateway for the on-premises CIDR (192.168.0.0/16). The on-premises firewall shows that traffic is being sent to the VPN tunnel. What should the engineer check next?

Accepted Answer

Verify that the on-premises route table has a route to the VPC CIDR via the VPN tunnel.. Since the VPN tunnel is up and the on-premises firewall confirms traffic is being sent to the tunnel, the issue is likely on the on-premises routing side. For traffic to flow from on-premises to the VPC, the on-premises router must have a route pointing to the VPC CIDR via the VPN tunnel interface. Without this route, packets will not be forwarded into the tunnel, even though the tunnel itself is operational.

Answer

Verify that the virtual private gateway is attached to the VPC.

Answer

Verify that the on-premises firewall is not blocking UDP port 500 for IKE.

Answer

Verify that the VPN tunnel's pre-shared key matches on both sides.

Question 7

A company is planning to connect its on-premises data center to AWS using AWS Direct Connect. The company requires high availability and wants to ensure that if one Direct Connect connection fails, traffic automatically fails over to another. Which THREE design elements should be included?

Accepted Answer

Provision two Direct Connect connections at different AWS Direct Connect locations.. Option A is correct because provisioning two Direct Connect connections at different AWS Direct Connect locations provides physical path diversity, so a failure at one location or its equipment does not take down all connectivity, which is required for high availability. Option D is correct because Direct Connect uses BGP to exchange routes between the on-premises routers and AWS; BGP is what enables dynamic routing and automatic failover when a connection or path becomes unavailable. Option E is correct because advertising the same BGP prefixes from both on-premises routers ensures AWS has redundant paths to the same networks and can fail over to the alternate connection when one path is withdrawn or fails. Option B is not appropriate because a single customer router is a single point of failure, defeating the high-availability goal even if it connects to two locations. Option C is not one of the three required design elements here because a VPN backup is a separate hybrid connectivity option, not a Direct Connect high-availability design element, and the scenario specifically asks for failover between Direct Connect connections.

Answer

Use a single customer router with multiple connections to both Direct Connect locations.

Answer

Configure a VPN connection as a backup to Direct Connect.

Question 8

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. It needs to connect to two other VPCs: VPC B (10.1.0.0/16) and VPC C (10.2.0.0/16). The company wants to use AWS Transit Gateway. Which THREE configurations are required to enable full mesh connectivity between all three VPCs?

Accepted Answer

Associate each VPC attachment with the Transit Gateway route table.. Associating each VPC attachment with the Transit Gateway route table is necessary for the Transit Gateway to know which attachments can communicate. Without this association, the Transit Gateway would not forward traffic between the VPCs, even if routes are present in the route table.

Answer

Create separate Transit Gateway route tables for each VPC to isolate traffic.

Answer

Create a VPN attachment to each VPC for encrypted communication.

Question 9

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. It needs to add an additional non-overlapping CIDR for new workloads. Which CIDR should be used?

Accepted Answer

10.1.0.0/16. (10.1.0.0/16) is correct because it provides a non-overlapping CIDR block that does not conflict with the existing VPC CIDR of 10.0.0.0/16. In AWS, when adding a secondary CIDR to a VPC, the new block must not overlap with the existing VPC CIDR or any of its subnets. The 10.1.0.0/16 range is entirely separate from 10.0.0.0/16, satisfying this requirement.

Answer

10.0.0.0/24

Answer

10.0.1.0/24

Answer

10.0.0.0/8

Question 10

A company has a Direct Connect connection with a private VIF to a VPC. They want to extend this connectivity to multiple VPCs in the same region without creating additional VIFs. Which solution should they implement?

Accepted Answer

Use a Direct Connect Gateway and attach the VPCs. A Direct Connect Gateway (DX Gateway) is a managed service that allows you to associate a single private virtual interface (VIF) with up to 10 VPCs in the same AWS Region (or across Regions with inter-region peering). This enables the company to extend their existing Direct Connect connection to multiple VPCs without provisioning additional VIFs, simplifying management and reducing costs.

Answer

Provision additional private VIFs for each VPC

Answer

Use VPC peering between the VPCs

Answer

Use a Transit VPC with VPN connections

Question 11

A company is designing a multi-account AWS environment using AWS Organizations. They want to restrict the use of certain instance types across all accounts. Which approach should they use to enforce this policy?

Accepted Answer

Create a service control policy (SCP) that denies the ec2:RunInstances action for noncompliant instance types and attach it to the root organizational unit.. Service control policies (SCPs) in AWS Organizations are the correct mechanism to enforce permission guardrails across multiple accounts. An SCP attached to the root organizational unit applies to all member accounts and can deny the ec2:RunInstances action for specific instance types, ensuring centralized, preventive control. SCPs do not grant permissions; they only limit the maximum available permissions.

Answer

Create an IAM policy that denies the ec2:RunInstances action for noncompliant instance types and attach it to each IAM user.

Answer

Set up AWS Config rules to detect noncompliant instances and trigger an AWS Lambda function to terminate them.

Answer

Use AWS CloudTrail to monitor ec2:RunInstances events and send alerts.

Question 12

A company is using AWS Direct Connect to connect its on-premises data center to AWS. The company has a single hosted virtual interface (VIF) with a private VIF to a VPC. The network team notices that traffic from on-premises to AWS is asymmetric—some packets go through the Direct Connect while others use a VPN backup. The team wants all traffic to use Direct Connect when available. What should they do?

Accepted Answer

Advertise more specific prefixes (e.g., /24) over Direct Connect and less specific (e.g., /16) over VPN.. BGP route selection prefers more specific prefixes (longest prefix match) over less specific ones. By advertising a more specific prefix (e.g., /24) over Direct Connect and a less specific prefix (e.g., /16) over the VPN, the on-premises router will prefer the Direct Connect path for the more specific route, ensuring all traffic uses Direct Connect when available. This leverages BGP's prefix-length-based path selection without requiring removal of the VPN backup.

Answer

Disable AS_PATH prepending on the Direct Connect BGP session.

Answer

Convert the private VIF to a public VIF.

Answer

Remove the VPN connection to force all traffic through Direct Connect.

Question 13

A company is designing a VPC with public and private subnets. They need to allow instances in the private subnet to access the internet for software updates while preventing inbound internet traffic. Which AWS service should they use?

Accepted Answer

NAT Gateway. A NAT Gateway allows instances in a private subnet to initiate outbound internet traffic while preventing inbound internet traffic from reaching them. It is deployed in a public subnet and uses an Elastic IP.

Answer

AWS Direct Connect

Answer

VPC Peering

Answer

Internet Gateway

Question 14

A company wants to connect its on-premises data center to AWS using a dedicated, high-bandwidth, low-latency connection. The data center is collocated with an AWS Direct Connect location. Which AWS service should be used to establish this connection?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct service because it provides a dedicated, private, high-bandwidth, low-latency connection from an on-premises data center to AWS. Since the data center is collocated with an AWS Direct Connect location, the company can establish a physical cross-connect directly to the AWS Direct Connect router, bypassing the public internet entirely.

Answer

VPC peering

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Question 15

Refer to the exhibit. A network engineer is analyzing VPC Flow Logs to troubleshoot connectivity issues. The engineer notices that traffic from 10.0.1.5 to 192.168.1.1 on port 80 is logged as ACCEPT, but the application team reports that the web request failed. What is the most likely cause?

Accepted Answer

The destination host 192.168.1.1 is not reachable or does not have a route back to the source.. The VPC Flow Logs record the state of the TCP handshake from the perspective of the network path, but they do not confirm that the destination host successfully processed the request or that a return path exists. If 192.168.1.1 has no route back to 10.0.1.5, the initial SYN-ACK will never reach the source, causing the application to time out even though the forward traffic was accepted by the network ACL and security group.

Answer

The VPC Flow Logs are not capturing all packets due to sampling.

Answer

The network ACL is returning an ICMP unreachable message that is not logged.

Answer

The security group on the ENI is blocking outbound traffic to 192.168.1.1.

Question 16

A company is using AWS Shield Advanced to protect against DDoS attacks. The security team wants to receive notifications when an attack is detected. Which service should be used to send these notifications?

Accepted Answer

Amazon SNS. AWS Shield Advanced integrates with Amazon CloudWatch to publish metrics and events. These events can be routed via Amazon EventBridge to trigger an Amazon SNS topic, which then sends notifications (e.g., email, SMS) to the security team. Option A (AWS Lambda) is a compute service, not a notification service. Option B (AWS Config) is used for configuration auditing and compliance, not notifications. Option C (Amazon SQS) is a message queue service; although it can receive events, it is not the service used to send direct notifications to subscribers. Only Amazon SNS (Option D) provides push-based notifications to endpoints like email, SMS, and mobile devices.

Answer

AWS Lambda

Answer

AWS Config

Answer

Amazon SQS

Question 17

A company has a hybrid network with multiple AWS Direct Connect connections to multiple VPCs. They want to monitor network performance and receive alerts when latency exceeds a threshold. Which combination of AWS services should be used to achieve this?

Accepted Answer

Amazon CloudWatch and Amazon CloudWatch Alarms. Amazon CloudWatch collects metrics from Direct Connect, including latency, and CloudWatch Alarms can trigger notifications via SNS when thresholds are exceeded. Option A is incorrect because CloudTrail logs API calls, not performance metrics. Option B is incorrect because Trusted Advisor provides best practice checks, not real-time latency monitoring, and SES is for email sending, not alerting. Option D is incorrect because VPC Flow Logs capture IP traffic metadata, not latency metrics, and CloudWatch Logs store log data, not metrics.

Answer

AWS CloudTrail and Amazon SNS

Answer

AWS Trusted Advisor and Amazon SES

Answer

VPC Flow Logs and Amazon CloudWatch Logs

Question 18

A company is designing a VPC with public and private subnets. The private subnets need to access Amazon S3 and Amazon DynamoDB. The company wants to minimize data transfer costs and avoid using a NAT gateway. What is the MOST cost-effective solution?

Accepted Answer

Create VPC endpoints for S3 and DynamoDB in the private subnets and update route tables. VPC endpoints for S3 and DynamoDB allow private connectivity without incurring data transfer costs or NAT gateway fees. Option A is wrong because an HTTP proxy adds complexity and cost. Option B is wrong because a NAT instance still incurs instance costs and management overhead. Option D is wrong because a NAT gateway incurs hourly and data processing charges.

Answer

Set up an HTTP proxy in the private subnets and configure the applications to use it

Answer

Use a NAT instance instead of a NAT gateway

Answer

Create a NAT gateway in a public subnet and route private subnet traffic to it

Question 19

A company wants to use Amazon Route 53 to resolve DNS queries for a domain they own. They want to ensure that DNS queries are answered quickly and that there is no single point of failure. Which configuration should they use?

Accepted Answer

Create a hosted zone and let Route 53 automatically handle the DNS resolution.. When you create a hosted zone in Route 53, AWS automatically provisions four authoritative name servers (NS records) distributed across multiple globally redundant data centers. This design inherently provides high availability and low-latency DNS resolution without any additional configuration, as Route 53 uses Anycast routing to direct queries to the nearest healthy name server.

Answer

Deploy Route 53 in multiple AWS Regions.

Answer

Create multiple hosted zones in separate AWS accounts.

Answer

Create a single hosted zone and assign it to one Route 53 name server.

Question 20

A company is deploying a multi-tier web application across three Availability Zones in a single AWS Region. The web tier must be fault-tolerant and scale horizontally. Which network design provides the highest availability and scalability?

Accepted Answer

Use an Application Load Balancer in front of an Auto Scaling group spanning three Availability Zones.. An Application Load Balancer (ALB) distributes incoming HTTP/HTTPS traffic across multiple targets, and when combined with an Auto Scaling group that spans three Availability Zones, it provides both horizontal scalability and fault tolerance. If one AZ fails, the ALB automatically routes traffic only to healthy instances in the remaining AZs, ensuring high availability. This design meets the requirement for a multi-tier web application that must scale horizontally and tolerate failures.

Answer

Deploy a single EC2 instance in one Availability Zone with an Elastic IP address.

Answer

Deploy EC2 instances in a single Availability Zone and use Route 53 weighted routing.

Answer

Use a Network Load Balancer with a single EC2 instance in each AZ.