ANS-C01 Practice Test 4 — 25 Questions

Question 1

A company has a global application deployed across multiple AWS Regions. Users are routed to the nearest Region using Amazon Route 53. The application uses an Application Load Balancer in each Region. The network team wants to ensure that traffic is always routed to a healthy Region in case of a Regional failure. Which Route 53 routing policy should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Latency-based routing with health checks. Latency-based routing with health checks. This policy routes traffic to the region with the lowest latency and can automatically failover to a healthy region if health checks fail. Option B (Weighted routing) distributes traffic based on weights, not latency, and does not provide automatic failover based on health. Option C (Simple routing) routes to a single resource and cannot automatically failover. Option D (Failover routing) is a primary/backup setup, not latency-based, so it doesn't consider latency.

Answer

Weighted routing

Answer

Simple routing

Answer

Failover routing

Question 2

A network engineer is troubleshooting high latency between two EC2 instances in the same VPC but different Availability Zones. Which AWS service can provide detailed network performance metrics to identify the source of latency?

Accepted Answer

AWS X-Ray. Correct answer: C. AWS X-Ray provides end-to-end tracing and can capture network latency between services, including EC2 instances. It can help identify where delays occur. Option A (AWS Config) is incorrect because it monitors configuration changes, not performance. Option B (AWS CloudTrail) is incorrect because it records API calls for auditing, not network metrics. Option D (VPC Flow Logs) is incorrect because it captures IP traffic metadata (packet-level) but does not provide latency or performance metrics.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Question 3

A company has a Direct Connect connection with a public VIF to access AWS public services. The on-premises network team reports that they can reach S3 but not DynamoDB. The route table on the customer router shows a default route to the public VIF. What is the most likely cause?

Accepted Answer

The on-premises firewall is blocking outbound traffic to the DynamoDB IP ranges.. DynamoDB uses a different set of public IP ranges than S3, and the on-premises firewall might block access to those ranges. Option A is wrong because the Direct Connect connection is a single physical link; if it were degraded, it would affect all traffic, not just DynamoDB. Option B is wrong because the public VIF does use BGP, but the customer router has a default route to the public VIF, indicating the BGP session is established and routes are being received. Option D is wrong because the public VIF accesses AWS public services directly, not through the VPC route table.

Answer

The Direct Connect connection is degraded and only supports S3 traffic.

Answer

The BGP session between the customer router and AWS is down.

Answer

The VPC route table does not have a route to the DynamoDB endpoint.

Question 4

A company has a Direct Connect connection with a private VIF to a VPC. They want to add a second Direct Connect connection for redundancy. The two connections will terminate on different AWS Direct Connect locations. Which configuration will provide the HIGHEST availability?

Accepted Answer

Use different customer gateway devices and different Direct Connect locations. Using different customer gateway devices and different Direct Connect locations provides full physical diversity, eliminating single points of failure at both the device and location level. Option A introduces a single point of failure by using the same device. Option B uses the same location, reducing availability in case of location failure. Option C uses the same BGP ASN, which can cause routing issues but is not the primary concern for physical redundancy.

Answer

Use the same customer gateway device for both connections

Answer

Use the same Direct Connect location for both connections

Answer

Use the same BGP ASN for both connections

Question 5

A company has a VPC with public and private subnets. They have a NAT gateway in a public subnet for outbound internet access from private instances. Which TWO of the following are required for the NAT gateway to function correctly?

Accepted Answer

A route in the public subnet's route table to an internet gateway. A NAT gateway must be placed in a public subnet and requires an Elastic IP address (E) to enable outbound internet traffic with a source IP that can be routed back. Additionally, the public subnet where the NAT gateway resides must have a route in its route table that points to an internet gateway (C) for the NAT gateway to reach the internet. Security groups are not attached to NAT gateways (they use security groups for attached instances, but NAT gateways themselves are not security group–aware). Network ACLs control traffic at the subnet level but are not a requirement specific to NAT gateway functionality; they can be configured as needed. Deploying the NAT gateway in a private subnet (A) would prevent it from accessing the internet because private subnets do not have direct routes to an internet gateway. Therefore, only options C and E are required.

Answer

The NAT gateway is deployed in a private subnet

Answer

A security group attached to the NAT gateway

Answer

A network ACL attached to the NAT gateway's subnet that allows inbound traffic from the internet

Question 6

A company has deployed a transit gateway with multiple VPC attachments and VPN attachments. The network team notices that traffic between two VPCs is taking an unexpected path and experiencing high latency. Which tool should be used to trace the path and identify the specific transit gateway route table that is being used?

Accepted Answer

VPC Reachability Analyzer. VPC Reachability Analyzer performs connectivity and path analysis between sources and destinations, showing the route table decisions, including the specific transit gateway route table used. Option D is correct. Options A (CloudTrail), B (CloudWatch ServiceLens), and C (X-Ray) are not designed for path tracing.

Answer

AWS CloudTrail

Answer

Amazon CloudWatch ServiceLens

Answer

AWS X-Ray

Question 7

A company is using AWS Direct Connect with a private VIF to connect to multiple VPCs in the same region. The company wants to use AWS Transit Gateway to simplify management. Which three components are required to achieve this? (Choose THREE.)

Accepted Answer

Direct Connect private virtual interface. Options A, B, and E are correct. A Direct Connect private virtual interface provides the physical connection from on-premises to AWS. AWS Transit Gateway serves as the central hub to interconnect multiple VPCs. A Direct Connect gateway is required to associate the Direct Connect virtual interface with the Transit Gateway, enabling connectivity to multiple VPCs in the same region. Options C and D are incorrect: VPC peering and Site-to-Site VPN are not required when using Transit Gateway with Direct Connect.

Answer

VPC peering connection

Answer

AWS Site-to-Site VPN connection

Question 8

A company is using AWS Direct Connect to connect its on-premises network to AWS. The company wants to encrypt all traffic between its on-premises network and AWS. Which solution meets this requirement?

Accepted Answer

Use a private VIF and establish an IPsec VPN tunnel over the Direct Connect connection.. AWS Direct Connect does not natively encrypt traffic; it provides a private, dedicated network connection. To meet the encryption requirement, you can establish an IPsec VPN tunnel over the private VIF, which encrypts all traffic between the on-premises network and the VPC. This approach combines the low latency and reliability of Direct Connect with the security of IPsec encryption.

Answer

Use a public virtual interface (VIF) and route traffic through a NAT gateway.

Answer

Use a private virtual interface (VIF) and enable encryption on the Direct Connect connection.

Answer

Use a private VIF and enable TLS on all applications.

Question 9

A company has a VPC with multiple subnets. They want to centrally manage and inspect all traffic between subnets using a security appliance. Which AWS service should be used to achieve this?

Accepted Answer

Transit Gateway with a security appliance in a central VPC. Transit Gateway with a security appliance in a central VPC (Option D) is the correct approach because it allows centralized inspection of all traffic between subnets by routing traffic through a central inspection VPC where security appliances are deployed. Option A (VPC peering) is incorrect because it only provides direct connectivity between two VPCs and does not support centralized inspection. Option B (AWS Route 53 Resolver) is a DNS service and has no traffic inspection capability. Option C (AWS Network Firewall) is a managed firewall service, but it does not provide the multi-VPC architecture needed to centrally route traffic from multiple subnets/VPCs; Transit Gateway is required to route traffic to the firewall.

Answer

VPC peering

Answer

AWS Route 53 Resolver

Answer

AWS Network Firewall

Question 10

A company wants to monitor network traffic between its EC2 instances and determine which IP addresses are generating the most traffic. Which AWS service should be used to capture and analyze this traffic?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces in a VPC, enabling analysis of traffic patterns and identification of high-traffic IP addresses. AWS Trusted Advisor (Option A) provides best-practice checks, not traffic data. AWS CloudTrail (Option B) records API calls, not network traffic. AWS Config (Option C) tracks resource configuration changes.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

AWS Config

Question 11

A company has a Direct Connect connection with two private virtual interfaces (VIFs) to two different VPCs in the same AWS Region. The company wants to use AWS Transit Gateway to simplify connectivity between these VPCs and their on-premises network. Which steps are required to integrate the existing Direct Connect connection with Transit Gateway?

Accepted Answer

Create a Direct Connect gateway, associate the existing VIFs, and attach the Direct Connect gateway to the Transit Gateway.. AWS Direct Connect private VIFs cannot be attached directly to a Transit Gateway. Instead, you must create a Direct Connect Gateway, associate the existing private VIFs with it, and then attach the Direct Connect Gateway to the Transit Gateway. This architecture allows the Transit Gateway to route traffic between the on-premises network (via the Direct Connect connection) and the attached VPCs, while also enabling inter-VPC routing through the Transit Gateway.

Answer

Set up a VPN connection over the Direct Connect link and attach the VPN to the Transit Gateway.

Answer

Attach the existing private VIFs directly to the Transit Gateway.

Answer

Create a new private VIF on the Direct Connect connection and attach it to the Transit Gateway.

Question 12

A company is troubleshooting a slow network connection between two EC2 instances in the same VPC but different Availability Zones. Which TWO tools can be used to measure throughput and diagnose performance issues?

Accepted Answer

iperf. Options A and C are correct. iperf is a tool used to measure network throughput between two hosts. Traceroute diagnoses network path and latency, which can help identify performance bottlenecks. Options B, D, and E are incorrect: tcpdump captures packets but does not measure throughput; nslookup is a DNS lookup tool that does not measure network performance; ping measures latency but not throughput.

Answer

tcpdump

Answer

nslookup

Answer

ping

Question 13

A company is migrating on-premises workloads to AWS using AWS Direct Connect. The company has two Direct Connect connections from different providers for redundancy. Which configuration ensures seamless failover with automatic traffic rerouting?

Accepted Answer

Create two Direct Connect gateways, each attached to a separate Transit Gateway, and advertise the same prefixes via BGP.. Using two Direct Connect gateways, each attached to a separate Transit Gateway, with the same BGP prefixes advertised from both connections enables active-active or active-passive failover via BGP path selection (e.g., AS_PATH prepending or MED). This design ensures automatic traffic rerouting if one connection fails, as BGP withdraws the failed path and the remaining path takes over without manual intervention.

Answer

Use one Direct Connect connection as primary and the other as standby with static routes.

Answer

Connect both Direct Connect connections to the same Virtual Private Gateway (VGW) and enable BGP.

Answer

Use a VPN connection over the internet as a backup for the Direct Connect links.

Question 14

A company is using AWS Transit Gateway with multiple VPC attachments. They need to ensure that traffic between two specific VPCs is encrypted in transit. The VPCs are in the same AWS region. What is the SIMPLEST solution?

Accepted Answer

Create a VPN attachment on the Transit Gateway and route traffic through it. Creating a VPN attachment on the Transit Gateway and routing traffic through it provides encryption in transit between VPCs. The VPN attachment establishes an IPsec VPN tunnel over the AWS network, ensuring encryption. Option A is incorrect because Transit Gateway route tables do not provide encryption. Option B is incorrect because AWS PrivateLink is designed for accessing services, not for VPC-to-VPC encryption. Option D is incorrect because VPC peering does not encrypt traffic by default and is not the simplest solution.

Answer

Enable encryption on the Transit Gateway route tables

Answer

Use AWS PrivateLink to connect the VPCs

Answer

Use VPC peering instead of Transit Gateway and enable encryption

Question 15

A company has deployed a multi-VPC architecture with AWS Transit Gateway. The network team notices that traffic between two VPCs is intermittently dropped. Both VPCs are attached to the same transit gateway. Which action should the network engineer take to troubleshoot the issue?

Accepted Answer

Enable VPC Flow Logs on the subnets of the VPCs.. VPC Flow Logs capture IP traffic information at the network interface level, allowing engineers to analyze traffic patterns and identify dropped packets. Option A is incorrect because AWS Direct Connect is a dedicated network connection from on-premises to AWS, not between VPCs. Option B is incorrect because Transit Gateway Network Manager provides a visual representation of the network topology but does not provide packet-level details. Option C is incorrect because CloudWatch metrics for transit gateway attachments show aggregate metrics like bytes in/out but not individual packet drops.

Answer

Configure AWS Direct Connect to route traffic between the VPCs.

Answer

Use Transit Gateway Network Manager to view the network topology.

Answer

Enable CloudWatch metrics for the transit gateway attachments.

Question 16

A network team is planning a migration of a legacy application to AWS. The application requires a static IP address for the on-premises firewall whitelist. Which THREE AWS services can provide a static IP address for outbound traffic from a VPC?

Accepted Answer

AWS Direct Connect with a public virtual interface.. Options A, D, and E are correct. A Direct Connect public virtual interface uses a static public IP address for outbound traffic. A NAT Gateway with an Elastic IP provides a static IP for outbound traffic from private subnets. A Network Load Balancer with Elastic IPs per subnet provides static IPs for inbound and outbound traffic. Option B (VPC endpoint for S3) does not provide a static IP; it uses a prefix list. Option C (Application Load Balancer) does not have a static IP by default; it uses dynamic IPs.

Answer

VPC endpoint (gateway endpoint) for S3.

Answer

Application Load Balancer without a static IP.

Question 17

A network engineer needs to monitor the network traffic between EC2 instances in a VPC. Which AWS service should be used to capture IP traffic information?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces in a VPC. Option B is wrong because AWS Config tracks resource configuration changes, not network traffic. Option C is wrong because CloudTrail records API calls, not IP traffic. Option D is wrong because CloudWatch Logs can store logs but does not capture network traffic; it is a destination for logs, not a traffic capture service.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Question 18

A company is deploying a web application in a VPC with an Application Load Balancer (ALB) in front of EC2 instances. The ALB must only accept traffic from the internet and forward it to the instances. Which subnet configuration is correct for the ALB and EC2 instances?

Accepted Answer

ALB in public subnets, EC2 in private subnets.. An Application Load Balancer (ALB) must be deployed in public subnets to accept traffic directly from the internet, as it requires an internet gateway (IGW) route to receive inbound connections. The EC2 instances should reside in private subnets to enhance security, as they only need to respond to the ALB via the VPC's internal routing, not directly from the internet. This configuration ensures the ALB handles internet-facing traffic while the instances remain isolated from direct external access.

Answer

ALB in private subnets, EC2 in private subnets with a NAT gateway.

Answer

ALB in public subnets, EC2 in public subnets.

Answer

ALB in private subnets, EC2 in public subnets.

Question 19

A company has a Direct Connect connection with a public VIF to access AWS public services. They notice that traffic to Amazon S3 is taking a suboptimal path via the internet instead of the Direct Connect. What is the MOST likely cause?

Accepted Answer

The on-premises router does not have a route for the S3 CIDR ranges pointing to the Direct Connect. The most likely cause is that the on-premises router does not have a route for the S3 CIDR ranges pointing to the Direct Connect interface. Even though the public VIF is established and BGP is advertising the appropriate prefixes, the on-premises router must have a specific route directing S3 traffic to the Direct Connect. Without this route, traffic will take the default path via the internet. Option A is incorrect because BGP for public VIFs does advertise prefixes, including S3. Option B is incorrect because a 'DOWN' state would prevent all traffic, not just suboptimal routing. Option D is incorrect because a virtual private gateway is not used with a public VIF.

Answer

The BGP session for the public VIF is not advertising the S3 prefixes

Answer

The public VIF is in a 'DOWN' state

Answer

The virtual private gateway is not attached to the VPC

Question 20

A network engineer needs to capture and analyze DNS query logs generated by Amazon Route 53. Which AWS service should be used to store and query these logs?

Accepted Answer

Amazon CloudWatch Logs. Amazon Route 53 can be configured to log DNS queries to Amazon CloudWatch Logs. CloudWatch Logs provides a centralized location to store and query these logs using CloudWatch Logs Insights. Option A (AWS CloudTrail) records API calls, not DNS queries. Option B (Amazon Kinesis Data Firehose) is a streaming data delivery service that can deliver logs to destinations like S3, but it does not directly store logs for querying. Option D (Amazon S3) is an object storage service and requires additional services (e.g., Athena) to query logs. Therefore, Amazon CloudWatch Logs is the correct service for storing and querying Route 53 DNS query logs directly.

Answer

AWS CloudTrail

Answer

Amazon Kinesis Data Firehose

Answer

Amazon S3