ANS-C01 Practice Test 5 — 25 Questions

Question 1

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. They want to inspect traffic between VPCs using a centralized network virtual appliance (NVA) in a security VPC. What is the most scalable and highly available design to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attach all VPCs to a Transit Gateway, use separate route tables for inspection, and deploy NVAs behind a Gateway Load Balancer in the security VPC.. It uses Transit Gateway with separate route tables to isolate inspection traffic, and deploys NVAs behind a Gateway Load Balancer (GWLB) in the security VPC. GWLB provides automatic scaling and health checks across multiple NVAs, ensuring high availability and scalability for inter-VPC traffic inspection without introducing a single point of failure or manual routing complexity.

Answer

Place a single NVA in the Transit Gateway and route all inter-VPC traffic through it.

Answer

Create VPC peering connections between each VPC and the security VPC, then configure the NVAs to route traffic.

Answer

Use Direct Connect to connect all VPCs to a central location and route through NVAs there.

Question 2

A company wants to block incoming traffic from specific IP addresses at the edge of the AWS network before it reaches the application load balancer. Which AWS service should be used?

Accepted Answer

AWS WAF web ACL associated with the ALB. AWS WAF can be associated with an Application Load Balancer to filter incoming traffic based on IP addresses at the edge (before reaching the ALB). Option B is wrong because Network ACLs operate at the subnet level and do not inspect HTTP traffic or block at the edge. Option C is wrong because Security Groups are stateful firewalls that operate at the instance or ENI level, not at the edge, and they cannot block traffic before the ALB. Option D is wrong because CloudFront is a CDN that can be used with WAF, but the question specifically asks for blocking at the edge before the ALB, and CloudFront alone does not provide IP filtering for an ALB without WAF.

Answer

Network ACLs on the VPC subnet containing the ALB

Answer

Security Groups attached to the ALB

Answer

Amazon CloudFront with origin access identity

Question 3

A company needs to log all network traffic between EC2 instances in a VPC for security analysis. They want to capture metadata about traffic, including source and destination IP, ports, protocol, and packet counts. Which THREE AWS services or features can be used to achieve this? (Choose three.)

Accepted Answer

VPC Flow Logs. Options B, C, and D are correct because VPC Flow Logs capture metadata about network traffic (source/destination IP, ports, protocol, packet counts), Traffic Mirroring captures packets for deep inspection, and AWS Network Firewall provides flow logs for traffic passing through the firewall. Option A is wrong because CloudTrail logs API calls, not network traffic. Option E is wrong because Security Group rules logging does not exist; Security Groups do not log traffic.

Answer

AWS CloudTrail

Answer

Security Group rules logging

Question 4

A company has a centralized inspection VPC architecture where all traffic from spoke VPCs is routed through a Transit Gateway to a centralized VPC that hosts firewall appliances (NGFW). The company needs to inspect traffic between two instances in the same spoke VPC. What is the simplest way to achieve this?

Accepted Answer

Use AWS Transit Gateway with VPC attachments and configure route tables to force traffic between the two instances through the inspection VPC.. AWS Transit Gateway can route traffic between instances in the same spoke VPC by using VPC attachments and route tables to force the traffic through the centralized inspection VPC. This is achieved by configuring the spoke VPC's route table to send inter-instance traffic to the Transit Gateway, which then forwards it to the inspection VPC for firewall inspection before returning it to the destination instance. This approach avoids the need for additional appliances or complex routing within the spoke VPC itself.

Answer

Deploy a Gateway Load Balancer (GWLB) in the spoke VPC and route traffic to it.

Answer

Enable VPC peering and use route propagation to send traffic to the inspection VPC.

Answer

Create a VPC peering connection between the two instances' VPCs.

Question 5

A company is deploying a VPC with IPv6 support. The VPC has a CIDR block of 10.0.0.0/16 and an assigned IPv6 CIDR block of 2600:1f16:xxxx:xxxx::/56. The company wants EC2 instances in a public subnet to be able to communicate with the internet using IPv6. Which configuration is necessary?

Accepted Answer

Attach an egress-only internet gateway to the VPC and add a route for ::/0 to the egress-only internet gateway in the public subnet route table.. An egress-only internet gateway (EIGW) is the AWS-managed service designed to enable outbound-only IPv6 communication from a VPC to the internet. Since IPv6 addresses are globally unique and publicly routable, a NAT gateway (used for IPv4) is not needed; instead, the EIGW allows instances to initiate outbound traffic while preventing any unsolicited inbound connections. Adding a route for ::/0 to the EIGW in the public subnet route table directs all outbound IPv6 traffic through it.

Answer

Attach a NAT gateway to the VPC and add a route for ::/0 to the NAT gateway in the public subnet route table.

Answer

Attach an internet gateway to the VPC and add a route for 0.0.0.0/0 to the internet gateway in the public subnet route table.

Answer

Set up a NAT64 translation service to convert IPv6 requests to IPv4.

Question 6

Which TWO of the following are valid methods to secure data at rest in Amazon S3? (Choose two.)

Accepted Answer

Use SSE-S3 (Server-Side Encryption with S3 managed keys).. Options A and C are correct. SSE-S3 (Server-Side Encryption with S3 managed keys) encrypts data at rest on S3. Client-side encryption, where the customer encrypts data before uploading, also protects data at rest. Option B (SSL/TLS) encrypts data in transit, not at rest. Option D (VPC endpoint) restricts network access but does not encrypt. Option E (network ACL) controls traffic but does not encrypt data.

Answer

Use SSL/TLS to encrypt data during transfer.

Answer

Use a VPC endpoint to restrict access to the bucket.

Answer

Configure a network ACL to block unauthorized access.

Question 7

Refer to the exhibit. A company applies this bucket policy to an S3 bucket. What is the effect of the policy?

Accepted Answer

Only HTTPS requests are allowed, and HTTP requests are denied. The bucket policy uses a Deny effect that blocks any request where SecureTransport is false, which corresponds to HTTP requests. Therefore, only HTTPS requests are allowed, and HTTP requests are denied. Option B is correct.

Answer

All requests are denied

Answer

Only HTTP requests are allowed

Answer

All requests are allowed

Question 8

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. It needs to connect to two other VPCs: VPC B (10.1.0.0/16) and VPC C (10.2.0.0/16). The company wants to use AWS Transit Gateway. Which THREE configurations are required to enable full mesh connectivity between all three VPCs?

Accepted Answer

Associate each VPC attachment with the Transit Gateway route table.. Associating each VPC attachment with the Transit Gateway route table is necessary for the Transit Gateway to know which attachments can communicate. Without this association, the Transit Gateway would not forward traffic between the VPCs, even if routes are present in the route table.

Answer

Create separate Transit Gateway route tables for each VPC to isolate traffic.

Answer

Create a VPN attachment to each VPC for encrypted communication.

Question 9

A security engineer is designing a hybrid network with an AWS Site-to-Site VPN. The company requires that all traffic between the on-premises network and VPC be encrypted in transit. Which configuration ensures this requirement is met?

Accepted Answer

Use AWS Site-to-Site VPN with IPsec tunnels. AWS Site-to-Site VPN inherently uses IPsec tunnels to encrypt all traffic. Option A is wrong because VPC peering does not provide encryption; it uses the AWS network without encryption. Option B is wrong because Direct Connect does not encrypt by default; MACsec is an optional encryption layer but not the standard Site-to-Site VPN. Option C is wrong because Transit Gateway itself is a network transit hub and does not provide encryption; it can route encrypted VPN traffic but does not encrypt.

Answer

Use VPC peering instead of VPN

Answer

Use AWS Direct Connect with MACsec

Answer

Deploy a Transit Gateway with route tables

Question 10

A company is designing a hybrid network architecture that connects an on-premises data center to AWS via AWS Direct Connect. The on-premises network uses BGP to advertise routes to AWS. The company wants to ensure that the on-premises network can reach all VPCs in the AWS account using a single Direct Connect virtual interface. Which solution should the architect use?

Accepted Answer

Create a transit gateway and a Direct Connect gateway. Attach the VPCs to the transit gateway and associate the transit gateway with the Direct Connect gateway.. A transit gateway acts as a central hub for VPC-to-VPC and on-premises connectivity, and when associated with a Direct Connect gateway via a transit virtual interface, it allows a single Direct Connect connection to reach multiple VPCs. The Direct Connect gateway terminates the BGP session from on-premises and forwards traffic to the transit gateway, which then routes to the attached VPCs. This design scales to many VPCs without requiring multiple virtual interfaces or complex peering.

Answer

Create a Direct Connect gateway and associate all VPCs directly.

Answer

Create VPC peering connections between all VPCs and the on-premises network.

Answer

Create a virtual private gateway and attach all VPCs to it.

Question 11

Refer to the exhibit. A security engineer applies this SCP to an AWS account. What is the effect of this policy?

Accepted Answer

All API calls that are not made over HTTPS will be denied. The SCP uses a Deny effect with a condition that blocks all API calls when the request is not made over HTTPS (i.e., aws:SecureTransport is false). This effectively denies any API call that uses HTTP instead of HTTPS. Option A is incorrect because the policy denies non-HTTPS calls, not allows them. Option B is incorrect because the policy applies to all AWS services, not just S3. Option C is incorrect because the condition checks for transport security, not multi-factor authentication. Option D correctly states that all API calls not made over HTTPS will be denied.

Answer

All API calls over HTTPS will be allowed

Answer

Only S3 API calls will be affected

Answer

The policy requires multi-factor authentication

Question 12

A security engineer needs to centrally manage and enforce rules for network traffic between VPCs in a large AWS environment. Which AWS service provides this capability?

Accepted Answer

AWS Network Firewall. AWS Network Firewall provides centralized management of firewall rules across multiple VPCs, allowing security engineers to enforce consistent network traffic controls. Option A (VPC peering) is just a connectivity mechanism, not a filtering service. Option B (Security groups) operate at the ENI level and are not centrally managed across VPCs. Option C (Network ACLs) are stateless and applied per subnet, not centrally. Therefore, D is correct.

Answer

VPC peering

Answer

Security groups

Answer

Network ACLs

Question 13

A company is designing a hybrid network architecture that requires high availability and low latency between its on-premises data center and AWS. The company currently has two Direct Connect connections from different providers terminating at two different AWS Direct Connect locations. Which solution provides the most resilient and high-performance connectivity?

Accepted Answer

Use two Direct Connect connections from different providers at different locations with a VPN backup.. Using two Direct Connect connections from different providers at different locations ensures physical and provider diversity, eliminating single points of failure. Adding a VPN backup provides an additional failover path over the internet, which is essential for maintaining connectivity if both Direct Connect links fail. This design meets the requirements for high availability and low latency by leveraging active/active or active/passive traffic engineering with BGP routing and AS path prepending.

Answer

Use a single Direct Connect connection with multiple VLANs.

Answer

Use Site-to-Site VPN over the internet as the primary connection.

Answer

Use two Direct Connect connections from the same provider at the same location.

Question 14

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. It needs to add an additional non-overlapping CIDR for new workloads. Which CIDR should be used?

Accepted Answer

10.1.0.0/16. (10.1.0.0/16) is correct because it provides a non-overlapping CIDR block that does not conflict with the existing VPC CIDR of 10.0.0.0/16. In AWS, when adding a secondary CIDR to a VPC, the new block must not overlap with the existing VPC CIDR or any of its subnets. The 10.1.0.0/16 range is entirely separate from 10.0.0.0/16, satisfying this requirement.

Answer

10.0.0.0/24

Answer

10.0.1.0/24

Answer

10.0.0.0/8

Question 15

A company has an AWS account with multiple VPCs. The security team wants to ensure that no VPC has an internet gateway attached. Which AWS service can be used to automatically detect and remediate non-compliant VPCs?

Accepted Answer

AWS Config with a managed rule to detect internet gateways and an automatic remediation action to detach them.. AWS Config rules can evaluate compliance of resources and trigger automatic remediation actions. A managed rule such as 'restricted-common-ports' or a custom rule can detect VPCs with internet gateways, and an accompanying remediation action can automatically detach them. Option A (Amazon GuardDuty) is a threat detection service, not a configuration compliance tool. Option B (AWS CloudTrail) logs API calls but does not evaluate current resource configurations. Option C (Service control policies, SCPs) define permissions boundaries but cannot detect or remediate existing non-compliant resources. Option D is correct.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

Service control policies (SCPs)

Question 16

A company wants to connect multiple VPCs in different AWS Regions using AWS Transit Gateway. The company requires full mesh connectivity with centralized inspection of inter-Region traffic. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Create Transit Gateway peering attachments between the Transit Gateways in each Region.. AWS Transit Gateway supports inter-Region peering attachments, which allow you to connect Transit Gateways in different Regions and route traffic between them using the AWS global network. Option D is correct because you can centralize traffic inspection by routing inter-Region traffic through a dedicated inspection VPC attached to one Transit Gateway, using separate route tables to force traffic through that VPC before forwarding it to the destination Region.

Answer

Create VPN attachments between each Transit Gateway and the inspection VPC.

Answer

Use VPC peering connections between VPCs in different Regions.

Answer

Disable cross-Region peering on the Transit Gateway.

Question 17

A company needs to encrypt data in transit between an Application Load Balancer and EC2 instances. Which TWO actions should they take?

Accepted Answer

Upload a certificate to AWS Certificate Manager (ACM).. To encrypt traffic between the ALB and EC2 instances, you need to upload a certificate to AWS Certificate Manager (ACM) for the backend HTTPS listener (Option C) and configure the ALB target group to use HTTPS protocol (Option D). Option A (TCP listener) does not support encryption. Option B (CloudFront) is a CDN and not required for backend encryption. Option E (self-signed certificate) is not recommended for production environments.

Answer

Create a TCP listener on the ALB.

Answer

Place Amazon CloudFront in front of the ALB.

Answer

Use a self-signed certificate on the EC2 instances.

Question 18

A network engineer is designing a VPC with private subnets for workloads that must not have direct internet access. However, the workloads need to download patches from a specific third-party vendor's IP range. Which solution minimizes the attack surface?

Accepted Answer

Create a managed prefix list for the vendor's IPs and add a route in the private subnet route table to a NAT gateway, with the prefix list as destination. Using a managed prefix list for the vendor's IPs and adding a route to a NAT gateway in the private subnet route table allows traffic only to those specific IPs, minimizing attack surface by avoiding direct internet access. Option B (VPC endpoint) is for AWS services only, not third-party. Option C (proxy server) would allow all internet traffic, not just to the vendor, increasing exposure. Option D (VPN) introduces complexity and potential trust issues, and still might allow other traffic if not carefully restricted.

Answer

Configure a VPC endpoint for the vendor's service

Answer

Deploy a proxy server in a public subnet and configure the workloads to use it for all internet traffic

Answer

Establish a VPN connection to the vendor's network and route all traffic to the vendor through the VPN

Question 19

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The network team wants to ensure that traffic between the on-premises network and AWS is encrypted. Which solution meets this requirement?

Accepted Answer

Establish an IPSec VPN tunnel over the Direct Connect connection using a public VIF or transit VIF.. Direct Connect does not provide encryption by default. To encrypt traffic between on-premises and AWS over a Direct Connect connection, you can establish an IPSec VPN tunnel over a public VIF or transit VIF. This encrypts the traffic while still using the Direct Connect link. Option A is correct. Option B (VPC peering) is not applicable to on-premises networks. Option C (private VIF) does not provide encryption. Option D (IPSec VPN over the internet) does not use Direct Connect and does not meet the requirement to use Direct Connect.

Answer

Establish a VPC peering connection between the on-premises network and the VPC.

Answer

Use a private virtual interface (VIF) over Direct Connect.

Answer

Use an IPSec VPN connection over the internet.

Question 20

Which TWO actions can be taken to reduce the attack surface of a VPC's public subnets? (Choose 2.)

Accepted Answer

Place web servers in private subnets and use a load balancer in a public subnet. Placing web servers in private subnets and using a load balancer in a public subnet reduces the attack surface by ensuring that the web servers have no direct internet-facing IP addresses. The load balancer acts as a single point of ingress, allowing security groups to tightly control traffic from the load balancer to the web servers, while the public subnet only exposes the load balancer's endpoints. This architecture follows AWS best practices for a multi-tier application, minimizing the number of resources directly accessible from the internet.

Answer

Allow all inbound traffic from the internet to the public subnets

Answer

Use a single subnet for all application tiers

Answer

Disable ICMP traffic on the network ACL