ANS-C01 Practice Test 5 — 25 Questions

Question 1

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises data centers. They want to centralize internet traffic through a single VPC that has an internet gateway. Which Transit Gateway feature should they enable?

Accepted Answer

Transit Gateway route tables. To centralize internet traffic through a single VPC with an internet gateway, you need to control the routing of traffic from other VPCs and on-premises networks. Transit Gateway route tables allow you to isolate or share routes between attachments, enabling you to create a default route (0.0.0.0/0) pointing to the centralized VPC's attachment. This ensures all outbound internet traffic from other VPCs is forwarded to the egress VPC, which then uses its internet gateway.

Answer

VPN attachments

Answer

Multicast support

Answer

IPsec acceleration

Question 2

A company is designing a high-availability architecture for an application that will be deployed across multiple Availability Zones. Which THREE components are recommended for this design? (Choose three.)

Accepted Answer

Application Load Balancer across multiple AZs. An Application Load Balancer (ALB) distributes incoming traffic across multiple targets in different Availability Zones (AZs). By enabling cross-zone load balancing, the ALB can route requests to healthy instances in any AZ, ensuring that if one AZ fails, traffic is automatically redirected to instances in the remaining AZs. This is a foundational component for high availability because it eliminates a single point of failure at the traffic distribution layer.

Answer

One EC2 instance in each AZ

Answer

Single NAT Gateway in one AZ

Question 3

A company is deploying a critical application across multiple AWS accounts. The network team wants to simplify IP address management and ensure that VPCs in different accounts can communicate securely. The company has a centralized network account with a transit gateway. Which architecture should the company use?

Accepted Answer

Use AWS Resource Access Manager to share the transit gateway in the network account with other accounts and attach their VPCs.. Option A is correct because AWS Resource Access Manager (RAM) allows you to share a transit gateway from a centralized network account with other AWS accounts, enabling VPCs in those accounts to attach to the shared transit gateway. This simplifies IP address management by providing a single hub for inter-VPC routing and avoids the complexity of managing multiple VPC peering connections. The transit gateway supports transitive routing, so VPCs in different accounts can communicate securely through the centralized gateway without needing direct peering.

Answer

Create VPC peering connections between each VPC in different accounts.

Answer

Configure VPC endpoints in each account to communicate through the network account.

Answer

Set up AWS Direct Connect between accounts and route through the network account.

Question 4

A company is designing a hybrid network connecting an on-premises data center to AWS via AWS Direct Connect. The company requires high availability and wants to avoid a single point of failure. Which design meets these requirements?

Accepted Answer

Provision two Direct Connect connections at two different Direct Connect locations.. Option D is correct because provisioning two Direct Connect connections at two different Direct Connect locations eliminates any single point of failure. This design ensures that if one connection or location fails, traffic can automatically fail over to the other connection, meeting the high availability requirement. A single Direct Connect connection, regardless of the number of VIFs or VLANs, remains a single point of failure.

Answer

Provision a single Direct Connect connection with multiple virtual interfaces (VIFs).

Answer

Provision one Direct Connect connection with two VLANs to separate production and non-production traffic.

Answer

Use a single Direct Connect connection and a VPN backup over the internet.

Question 5

A company needs to monitor network traffic to and from EC2 instances for security analysis. Which AWS service should they use?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including metadata such as source/destination IPs, ports, protocols, and packet accept/reject decisions. This makes it the correct service for monitoring network traffic to and from EC2 instances for security analysis, as it provides detailed network-level logs without requiring any agent installation on the instances.

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 6

A company has a VPC with public and private subnets in two Availability Zones. The private subnets host EC2 instances that need to access the internet for software updates. The company must ensure that traffic from the private instances uses a single, predictable public IP address. What is the MOST cost-effective solution?

Accepted Answer

Deploy a NAT Gateway in a public subnet in one Availability Zone, and route private subnet traffic to it.. Option C is correct because a NAT Gateway in a public subnet provides outbound-only internet access for private instances, and it uses a single Elastic IP address, ensuring a predictable public IP. This is the most cost-effective managed solution, as NAT Gateways are highly available within an Availability Zone and require no manual instance management.

Answer

Attach an Internet Gateway to the VPC and update the private subnet route table with a default route to the Internet Gateway.

Answer

Create a Transit Gateway with a VPC attachment and route traffic through a central egress VPC.

Answer

Launch a NAT instance in a public subnet and configure source/destination check.

Question 7

A company is designing a VPC with a public subnet and a private subnet. The private subnet instances need to access the internet for software updates. Which TWO options allow outbound internet access while preventing inbound connections? (Choose two.)

Accepted Answer

NAT Gateway in the public subnet. A NAT Gateway in the public subnet allows instances in the private subnet to initiate outbound connections to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. The NAT Gateway translates the private IP addresses of the instances to its own Elastic IP address, and because it does not maintain state for inbound traffic that was not initiated from within the VPC, it blocks all inbound connection attempts.

Answer

Internet Gateway attached to the VPC

Answer

AWS Site-to-Site VPN connection to on-premises

Answer

VPC Peering connection to a VPC with internet access

Question 8

A company is designing a multi-Region application using Amazon Route 53 latency-based routing. The application must be highly available and failover automatically if an AWS Region becomes unavailable. What should the company do to meet these requirements?

Accepted Answer

Configure active-passive failover with latency-based routing and associate health checks with each record.. Option B is correct because it combines latency-based routing with health checks and active-passive failover, which allows Route 53 to route traffic to the region with the lowest latency under normal conditions and automatically fail over to the passive region if the active region's health check fails. This meets the high availability and automatic failover requirements by leveraging Route 53's DNS failover mechanism, which updates DNS responses based on health check status.

Answer

Configure latency-based routing with health checks and enable DNS failover.

Answer

Configure geolocation routing policies and associate health checks.

Answer

Configure weighted routing policies with equal weights for all regions.

Question 9

A company is designing a hybrid network architecture that requires a dedicated, private, and consistent connection between its on-premises data center and AWS. The connection must support multiple VLANs and provide a service-level agreement (SLA) of 99.99% availability. Which AWS service should be used to meet these requirements?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct choice because it provides a dedicated, private, and consistent network connection from an on-premises data center to AWS, bypassing the public internet. It supports multiple VLANs via 802.1Q tagging over a single physical connection, and offers a 99.99% service-level agreement (SLA) when configured with redundant connections at separate Direct Connect locations.

Answer

AWS Transit Gateway

Answer

AWS Client VPN

Answer

AWS Site-to-Site VPN

Question 10

An administrator needs to create an interface VPC endpoint for Amazon S3 in a VPC and attach an elastic network interface (ENI) to an EC2 instance. The administrator applies the IAM policy shown in the exhibit. Which action will be DENIED by this policy?

Answer

Attach the ENI to the EC2 instance

Answer

Create the VPC endpoint

Answer

Describe VPC endpoints

Answer

Modify the VPC endpoint

Question 11

A company is designing a network for a critical application that requires high availability across three Availability Zones in a single AWS Region. The application uses Network Load Balancers (NLBs) and Application Load Balancers (ALBs). The company must ensure that cross-zone load balancing is enabled for the NLBs and that the ALBs have a fixed response timeout. Which combination of settings meets these requirements?

Accepted Answer

Enable cross-zone load balancing on the NLB (default) and set the idle timeout on the ALB to a fixed value.. Option B is correct because cross-zone load balancing is enabled by default on Network Load Balancers (NLBs) and ensures traffic is distributed evenly across targets in all Availability Zones, which is critical for high availability across three AZs. The idle timeout on an Application Load Balancer (ALB) is a fixed value (default 60 seconds, configurable from 1 to 4000 seconds) that controls how long the ALB keeps a connection open without data transfer, meeting the requirement for a fixed response timeout. This combination satisfies both requirements without conflicting settings.

Answer

Disable cross-zone load balancing on the ALB and set the idle timeout on the NLB.

Answer

Disable cross-zone load balancing on the NLB and set the connection timeout on the ALB.

Answer

Enable cross-zone load balancing on the ALB and set the connection timeout on the NLB.

Question 12

A company has deployed a multi-tier application across three VPCs (VPC-A, VPC-B, VPC-C) in the us-east-1 region. Each VPC has its own CIDR block (10.0.0.0/16, 10.1.0.0/16, 10.2.0.0/16 respectively). All VPCs are attached to an AWS Transit Gateway. The web tier is in VPC-A, the application tier is in VPC-B, and the database tier is in VPC-C. The application servers in VPC-B need to connect to the database servers in VPC-C on TCP port 3306. The database servers are in a private subnet with a security group (sg-db) that allows inbound traffic from the application server security group (sg-app). The application servers have a security group (sg-app) that allows outbound traffic to the database servers. However, the application servers cannot connect to the database servers. The route tables in VPC-B and VPC-C have routes pointing to the Transit Gateway for the other VPC CIDRs. The Transit Gateway has attachments in all three VPCs and has a default route table with propagation enabled. What is the MOST likely cause of the connectivity failure?

Accepted Answer

The Transit Gateway attachments are not associated with the same route table. The most likely cause is that the Transit Gateway attachments are not associated with the same route table. In AWS Transit Gateway, for traffic to flow between VPCs, the attachments must be associated with a route table that contains routes for the destination VPC CIDRs. Even though propagation is enabled on the default route table, if the attachments are associated with different route tables (or the default route table is not shared), transitive routing will fail. Without a common route table association, the Transit Gateway cannot forward traffic between VPC-B and VPC-C.

Answer

The network ACLs in VPC-B or VPC-C are blocking the traffic

Answer

The Transit Gateway does not support transitive routing between VPCs

Answer

The security group sg-app does not allow outbound traffic to the database server's security group

Question 13

An organization has multiple VPCs connected to a common Transit Gateway. The network team wants to centrally manage and enforce routing policies, such as allowing or denying traffic between specific VPCs based on tags. Which AWS feature should be used to implement this requirement?

Accepted Answer

AWS Transit Gateway Network Manager. AWS Transit Gateway Network Manager provides a central dashboard to manage and monitor transit gateways, on-premises networks, and attached VPCs. It supports defining and enforcing routing policies based on tags, enabling the network team to centrally allow or deny traffic between specific VPCs without manually managing individual route tables.

Answer

AWS Direct Connect Gateway

Answer

Amazon Route 53 Resolver

Answer

VPC Peering with route tables

Question 14

A company has a VPC with a CIDR block of 10.0.0.0/16. They have two subnets: a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). The public subnet has an internet gateway attached, and the private subnet has a NAT Gateway in the public subnet for outbound internet access. The company is deploying an Amazon RDS for MySQL database in a Multi-AZ configuration. The database should be accessible only from the application servers running in the private subnet. The company wants to ensure that the database is highly available and that failover does not require any changes to the application. Which networking configuration should they use?

Accepted Answer

Create a DB subnet group with subnets in two Availability Zones, launch the RDS instance with Multi-AZ enabled, and configure the application to connect to the RDS endpoint DNS name. Option D is correct because creating a DB subnet group with subnets in two Availability Zones and enabling Multi-AZ on the RDS instance ensures automatic failover to a standby in another AZ. The application connects to the RDS endpoint DNS name, which automatically points to the current primary instance, so no application changes are needed during failover. This satisfies the high availability and access requirements while keeping the database in private subnets.

Answer

Place the RDS instances behind an internal Network Load Balancer and configure the application to connect to the NLB's DNS name

Answer

Create the RDS instance in the public subnet and restrict access using a security group that allows traffic from the private subnet

Answer

Configure the application to use the IP address of the primary RDS instance and update the application when failover occurs

Question 15

A company is designing a hybrid network connecting on-premises data centers to AWS via AWS Direct Connect. The company requires high availability with multiple connections. Which design ensures that a failure of a single Direct Connect location does not impact connectivity?

Accepted Answer

Provision two Direct Connect connections at two different Direct Connect locations.. Option B is correct because deploying two Direct Connect connections at two different Direct Connect locations ensures that a single location failure (e.g., power outage, fiber cut, or facility issue) does not affect connectivity. This design provides geographic redundancy, meeting the high availability requirement by eliminating a single point of failure at the Direct Connect location level.

Answer

Provision a single Direct Connect connection with a large bandwidth.

Answer

Provision two Direct Connect connections at the same AWS Direct Connect location.

Answer

Provision one Direct Connect connection and one AWS Site-to-Site VPN as backup.

Question 16

A company has an existing VPC with a public subnet and a private subnet. The company launches an EC2 instance in the private subnet. The instance needs to access an S3 bucket to download software updates. The company does not want the instance to have a public IP address. The company creates a VPC endpoint for S3 (Gateway type) in the VPC, and associates it with the private subnet route table by adding a route for the S3 prefix list. However, the instance still cannot access the S3 bucket. The security group for the instance allows all outbound traffic. The network ACL for the private subnet allows all inbound and outbound traffic. What is the MOST likely reason for the connectivity failure?

Accepted Answer

The VPC endpoint policy does not grant access to the S3 bucket. The most likely reason is that the VPC endpoint policy does not grant access to the S3 bucket. Even though the Gateway VPC Endpoint is created and associated with the private subnet route table, the endpoint's policy controls which S3 buckets and actions are allowed. If the policy is too restrictive (e.g., default deny or does not explicitly allow access to the specific bucket), traffic will be dropped at the endpoint, preventing the instance from downloading updates. The security group and network ACL are already permissive, and internet access is not required because the Gateway endpoint uses AWS's private network.

Answer

The network ACL is blocking the traffic

Answer

The security group does not allow outbound HTTPS traffic

Answer

The instance does not have a route to the internet

Question 17

A company is designing a network for a containerized microservices application running on Amazon ECS. The application consists of several microservices that need to communicate with each other. The company wants to use service discovery so that services can find each other by name. They also want to ensure that traffic between services is encrypted in transit. The microservices are deployed across multiple Availability Zones. Which combination of services should the company use?

Accepted Answer

Use AWS Cloud Map for service discovery and AWS App Mesh for encryption in transit. AWS Cloud Map provides service discovery by registering microservices with DNS names and health checks, allowing ECS tasks to resolve each other by name. AWS App Mesh uses Envoy sidecar proxies to enforce mutual TLS (mTLS) encryption between services, ensuring traffic is encrypted in transit without requiring changes to application code. This combination meets the requirements for name-based discovery and encrypted inter-service communication across multiple Availability Zones.

Answer

Use an Application Load Balancer for each service and configure HTTPS listeners

Answer

Use VPC peering between each service's VPC

Answer

Use Amazon Route 53 private hosted zones for service discovery and enable encryption at the application layer

Question 18

A company has multiple VPCs in the same AWS region that need to communicate with each other. The network team wants to minimize the number of connections and simplify management. The solution must support transitive routing between all VPCs. Which AWS service should be used?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway (TGW) is a network transit hub that enables transitive routing between multiple VPCs and on-premises networks through a single gateway. It uses a hub-and-spoke architecture, which inherently supports transitive routing (e.g., VPC A can reach VPC C via the TGW without requiring direct peering between A and C). This minimizes the number of connections (N VPCs require only N attachments instead of N*(N-1)/2 VPC peering connections) and simplifies management with a central routing table.

Answer

VPC Peering

Answer

AWS Direct Connect Gateway

Answer

VPC Endpoints

Question 19

A company has a VPC with a CIDR block of 172.16.0.0/16. They have a public subnet (172.16.1.0/24) and a private subnet (172.16.2.0/24). They have an internet gateway attached to the public subnet. They launch an EC2 instance in the public subnet with a public IP address. The instance is running a web server on port 80. They also launch an EC2 instance in the private subnet that needs to download updates from the internet. The private subnet does not have a route to the internet. The company wants to provide internet access to the private instance in a secure and cost-effective manner. Which solution should they implement?

Accepted Answer

Create a NAT Gateway in the public subnet and add a route in the private subnet's route table pointing to the NAT Gateway. A NAT Gateway in the public subnet allows instances in the private subnet to initiate outbound connections to the internet (e.g., for downloading updates) while preventing inbound connections from the internet. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway. This is secure because the NAT Gateway uses Elastic IPs and does not accept unsolicited inbound traffic, and it is cost-effective as it is a managed service with no maintenance overhead.

Answer

Create a VPC Gateway Endpoint for S3 and configure the private instance to use it

Answer

Create a forward proxy server in the public subnet and configure the private instance to use it

Answer

Create a NAT instance in the public subnet and configure the private instance to use it

Question 20

A company is designing a hybrid network with AWS Direct Connect and a VPN backup. They have two on-premises sites connected via MPLS. They want to ensure that if the Direct Connect fails, traffic automatically fails over to the VPN without manual intervention. Which routing configuration should they use?

Accepted Answer

Use BGP and set a higher local preference for routes learned via Direct Connect, and enable BGP graceful shutdown on the Direct Connect router. Option B is correct because using BGP with a higher local preference for routes learned via Direct Connect ensures that the Direct Connect path is preferred over the VPN backup. If the Direct Connect fails, the BGP session goes down, the routes are withdrawn, and traffic automatically fails over to the VPN without manual intervention. BGP graceful shutdown is not required for failover but can be used to gracefully drain traffic before maintenance.

Answer

Configure static routes with equal cost pointing to Direct Connect and VPN

Answer

Use BGP and advertise the same prefixes with a lower MED on the VPN connection

Answer

Create a VPC peering connection between the VPC and on-premises network