ANS-C01 Practice Test 26 — 15 Questions

Question 1

A company is migrating its on-premises data center to AWS using Direct Connect and a VPN connection as backup. The company has multiple VPCs connected via a Transit Gateway. They want to ensure high availability for the Direct Connect connection. Which TWO actions should be taken? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure BGP with multiple virtual interfaces on the Direct Connect connections. Options D and E are correct. To achieve high availability for Direct Connect, you need redundant physical connections at different locations (Option E) and configure BGP with multiple virtual interfaces to enable active-active or active-passive failover (Option D). Option A is not required because a VPN backup already exists, and a second Direct Connect connection alone does not guarantee location diversity. Option B (jumbo frames) does not affect availability, and Option C (higher bandwidth) does not provide redundancy.

Answer

Replace the VPN backup with a second Direct Connect connection

Answer

Enable jumbo frames on the Direct Connect connection

Answer

Use a single Direct Connect connection but with higher bandwidth

Question 2

A company is designing a hybrid network using AWS Direct Connect. They have a VPC with CIDR 10.0.0.0/16 and an on-premises network with CIDR 192.168.0.0/16. They want to establish a Direct Connect private virtual interface with a virtual private gateway. Which THREE steps are required to complete the connectivity? (Choose three.)

Accepted Answer

Create a virtual private gateway and attach it to the VPC.. A virtual private gateway (VGW) is the required AWS-side endpoint for a Direct Connect private virtual interface (VIF) to terminate on a single VPC. The VGW must be created and attached to the VPC before the private VIF can be associated with it, enabling private connectivity between the on-premises network and the VPC.

Answer

Create a Transit Gateway and attach the VPC to it.

Answer

Create a customer gateway object in the AWS account.

Question 3

A company has a multi-tier web application running on EC2 instances in a VPC. The web tier must be accessible from the internet, but the application tier should only be accessible from the web tier. Which network design configuration meets these requirements?

Accepted Answer

Place both tiers in public subnets and use security groups to restrict traffic from the web tier to the application tier.. Placing both tiers in public subnets with an internet gateway allows the web tier to be accessible from the internet. Security groups can then be used to restrict inbound traffic to the application tier to only come from the web tier's security group, ensuring that the application tier is not directly accessible from the internet. This design meets the requirement without unnecessary complexity.

Answer

Use a VPN connection from the web tier to the application tier, and place both tiers in private subnets.

Answer

Place web servers in a public subnet with a NAT gateway, and application servers in a private subnet with a default route to the NAT gateway.

Answer

Place web servers in a public subnet with an internet gateway, and application servers in a private subnet with a route to the web subnet via a VPC peering connection.

Question 4

A company is designing a VPC with a public subnet for a web server and a private subnet for a database. The web server needs to download patches from the internet. The database should not have direct internet access. Which architecture meets these requirements?

Accepted Answer

Place the web server in the public subnet with an Internet Gateway, and the database in the private subnet with a route to a NAT Gateway in the public subnet for outbound access only.. It places the web server in a public subnet with a route to an Internet Gateway (IGW) for direct outbound internet access to download patches, while the database resides in a private subnet with a route to a NAT Gateway in the public subnet. The NAT Gateway enables outbound-only internet access for the database (e.g., for license validation or updates) without exposing it to unsolicited inbound connections, meeting the requirement that the database should not have direct internet access.

Answer

Place the web server in the public subnet with an Internet Gateway, and the database in the private subnet without any internet access.

Answer

Place both instances in the public subnet and use security groups to restrict inbound access to the database.

Answer

Place the web server in the private subnet with a NAT Gateway, and the database in the public subnet with an Internet Gateway.

Question 5

A company is deploying a multi-tier web application across three Availability Zones in a VPC. The web tier must be highly available and scale based on CPU utilization. The database tier uses an Amazon RDS Multi-AZ DB instance. The web tier must have the lowest possible latency to the internet. Which configuration should be used for the web tier subnets?

Accepted Answer

Place the web tier in public subnets with auto-assign public IP addresses enabled.. Placing the web tier in public subnets with auto-assign public IP addresses enabled ensures that each EC2 instance receives a public IPv4 address automatically, allowing direct internet access for low-latency communication. Public subnets have a route to an internet gateway, which provides the shortest path to the internet without additional hops. This configuration supports high availability across three Availability Zones and integrates with an Auto Scaling group based on CPU utilization.

Answer

Place the web tier in public subnets with auto-assign public IP addresses disabled.

Answer

Place the web tier in private subnets and use a VPC endpoint for internet access.

Answer

Place the web tier in private subnets and use a NAT gateway for internet access.

Question 6

A network engineer is reviewing VPC Flow Logs for a VPC. The logs show that traffic from 10.0.1.5 to 10.0.2.10 on port 443 is being accepted and rejected intermittently. Both instances are in the same VPC. What is the most likely cause?

Accepted Answer

The network ACL is blocking traffic.. VPC Flow Logs show intermittent ACCEPT and REJECT for traffic from 10.0.1.5 to 10.0.2.10 on port 443. Since the traffic is within the same VPC, the route table is not involved (Option C is unlikely). Security groups are stateful, so even if the destination security group denies outbound traffic, return traffic for the established inbound connection is still allowed; thus Option A is incorrect. The intermittent behavior is characteristic of a stateless network ACL (NACL). A NACL is applied at the subnet level and evaluates inbound and outbound rules independently. If the NACL allows inbound traffic but blocks outbound response traffic (or vice versa), the flow will be partially accepted (initial packets) and then rejected when return packets hit the blocking rule. This matches the logs showing both ACCEPT and REJECT for the same flow. Therefore, the most likely cause is a misconfigured NACL (Option B).

Answer

The security group on the destination instance is configured to allow inbound HTTPS but deny outbound traffic.

Answer

The route table is misconfigured.

Answer

The source instance's security group is denying outbound traffic.

Question 7

A company is designing a hybrid network using AWS Direct Connect. Which TWO of the following are required to establish a private virtual interface (VIF) to a single VPC?

Accepted Answer

A VLAN ID for the virtual interface.. A VLAN ID is required to create a private virtual interface (VIF) because it uniquely identifies the 802.1Q VLAN tag used to segregate traffic on the Direct Connect link. Without a VLAN ID, the physical connection cannot logically separate the private VIF from other virtual interfaces (e.g., public or transit VIFs) on the same circuit.

Answer

A Direct Connect Gateway to connect to the VPC.

Answer

A public IP address for the AWS side of the BGP session.

Answer

A BGP session with the AWS Direct Connect endpoint using public IPs.

Question 8

A company wants to ensure that traffic between EC2 instances in the same VPC but different subnets is encrypted. Which solution should be used?

Accepted Answer

Use IPsec VPN between the instances.. An IPsec VPN between EC2 instances creates an encrypted tunnel at Layer 3, ensuring that all traffic between the instances is encrypted regardless of the underlying network path. This is necessary because traffic within a VPC traversing different subnets is not encrypted by default, even though it stays within the AWS network.

Answer

Use security groups to allow traffic.

Answer

Use VPC Peering.

Answer

Use network ACLs to allow traffic.

Question 9

A company is designing a network for a real-time trading application that requires extremely low latency (sub-millisecond) between two EC2 instances located in the same AWS region. The instances are in different Availability Zones. The trading application uses a proprietary protocol over TCP. The company wants to minimize latency as much as possible. They are considering using a placement group. Which type of placement group should they use, and what network optimization should they apply?

Accepted Answer

Use a cluster placement group for both instances and enable enhanced networking (SR-IOV). A cluster placement group is the only placement group type that provides low-latency, high-bandwidth network performance by placing instances in a single Availability Zone within the same rack. Enhanced networking using SR-IOV (Single Root I/O Virtualization) bypasses the hypervisor's network stack, reducing per-packet processing latency and jitter, which is critical for sub-millisecond trading traffic over TCP.

Answer

Use a spread placement group and enable dedicated tenancy

Answer

Use a partition placement group and enable EBS-optimized instances

Answer

Use a cluster placement group but launch instances in different Availability Zones

Question 10

A company wants to connect its VPC to an on-premises data center using AWS Direct Connect. The company has two Direct Connect locations in the same AWS region. For high availability, they plan to establish two separate connections. Which configuration ensures that if one connection fails, traffic automatically fails over to the other?

Accepted Answer

Establish two Direct Connect connections from different Direct Connect locations to the same VPC, each with a private VIF attached to the same virtual private gateway.. It provides true high availability by using two Direct Connect connections from different geographic locations, each with a private virtual interface (VIF) attached to the same virtual private gateway (VGW). This configuration ensures that if one connection fails, BGP sessions automatically withdraw the affected routes, and traffic is rerouted over the remaining connection via the VGW's active/active or active/passive routing behavior.

Answer

Establish one Direct Connect connection and one AWS Site-to-Site VPN connection as backup.

Answer

Establish two Direct Connect connections from the same Direct Connect location to the same VPC.

Answer

Establish a single Direct Connect connection with two virtual interfaces (VIFs) to the same VPC.

Question 11

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance is behind a NAT gateway in the public subnet. The security team wants to allow only outbound HTTPS traffic from the instance. Which configuration should be used?

Accepted Answer

Security group on the instance with outbound rule allowing HTTPS. A security group on the EC2 instance with an outbound rule allowing HTTPS (port 443) is the correct configuration. Security groups are stateful, so the outbound rule automatically permits the return traffic, requiring no explicit inbound rule. This ensures only outbound HTTPS is allowed from the instance. Option C is incorrect because network ACLs are stateless and would require explicit inbound rules for return traffic, but more importantly, NACLs are subnet‑level controls and are not the best practice for restricting traffic from a single instance. Option B is incorrect because VPC gateway endpoints are for private connectivity to AWS services, not for internet access. Option D is incorrect because a security group on the NAT gateway would control the NAT gateway's own traffic, not the instance behind it.

Answer

VPC gateway endpoint for S3

Answer

Network ACL on the private subnet with outbound rule allowing HTTPS and inbound rule allowing return traffic

Answer

Security group on the NAT gateway with outbound rule allowing HTTPS

Question 12

A network engineer needs to monitor network traffic to an Amazon RDS instance for security analysis. Which AWS service should be used to capture and analyze network traffic?

Accepted Answer

VPC Traffic Mirroring. VPC Traffic Mirroring allows capturing and inspecting network traffic from an RDS instance (full packet capture). Option A is wrong because Amazon Inspector is for vulnerability assessment, not network traffic capture. Option B is wrong because VPC Flow Logs provide metadata (IP, port, etc.) about traffic, not full packet capture. Option D is wrong because AWS CloudTrail records API activity, not network traffic.

Answer

Amazon Inspector

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Question 13

An organization needs to securely connect its on-premises data center to multiple VPCs in different AWS Regions. The on-premises network uses BGP. Which AWS service should be used to simplify routing and provide a single point of attachment for the on-premises router?

Accepted Answer

AWS Transit Gateway with inter-Region peering attachments.. AWS Transit Gateway with inter-Region peering attachments is the correct choice because it provides a single point of attachment for the on-premises router, simplifying routing and connectivity to multiple VPCs across different AWS Regions. The Transit Gateway supports BGP over VPN connections or Direct Connect, allowing the on-premises network to peer with a single Transit Gateway, which then centrally manages inter-VPC and inter-Region traffic through peering attachments, eliminating the need for multiple separate connections.

Answer

Direct Connect gateway with a private VIF.

Answer

VPC Peering connections between each VPC and the on-premises network.

Answer

AWS Client VPN endpoint.

Question 14

A company is deploying a multi-tier web application in a VPC. The web tier must be accessible from the internet, while the application tier must only be accessible from the web tier. The database tier must only be accessible from the application tier. Which design best meets these requirements?

Accepted Answer

Place the web tier in public subnets with an internet gateway, and the application and database tiers in private subnets. Use security groups to allow traffic from the web tier to the application tier, and from the application tier to the database tier.. It places the web tier in a public subnet with an Internet Gateway (IGW) for direct internet access, while the application and database tiers reside in private subnets with no direct internet path. Security groups act as stateful virtual firewalls at the instance level, allowing you to specify inbound rules that permit traffic only from the web tier security group to the application tier, and from the application tier security group to the database tier. This layered approach enforces the principle of least privilege and meets the access requirements without exposing the internal tiers to the internet.

Answer

Place all tiers in public subnets and use security groups to control traffic between tiers.

Answer

Place all tiers in the same subnet and use network ACLs to restrict traffic between tiers.

Answer

Place the web tier in a private subnet and use a NAT gateway for outbound internet access. Place the application and database tiers in public subnets.

Question 15

A company has a VPC with an AWS Transit Gateway connecting multiple VPCs and an on-premises network via AWS Direct Connect. The network team needs to ensure that only specific VPCs can communicate with each other. They create a transit gateway route table for each VPC and attach the VPC to the route table. They also propagate routes from the Direct Connect virtual interface. However, after configuration, traffic between two VPCs that should not communicate is still flowing. What is the MOST likely cause?

Accepted Answer

The VPC attachments are using the default transit gateway route table instead of custom route tables.. The most likely cause is that the VPC attachments are using the default transit gateway route table instead of custom route tables. By default, a transit gateway has a default route table that is shared among all attachments, which can allow unintended inter-VPC traffic if the team did not explicitly associate each VPC attachment with a dedicated route table. The correct approach is to create individual route tables for each VPC and associate the respective VPC attachment with its custom route table, ensuring isolation. Option A is incorrect because VPC route tables pointing to the transit gateway are necessary for VPCs to communicate via the transit gateway; they do not cause unintended traffic by themselves. Option B is incorrect because the issue is about which route table the attachments are associated with, not whether route tables exist. Option D is incorrect because propagating Direct Connect routes into all route tables would affect on-premises connectivity, but the issue is specifically inter-VPC traffic.

Answer

The VPC route tables have a route for the other VPC CIDR pointing to the transit gateway.

Answer

The transit gateway route tables are not associated with the VPC attachments.

Answer

The Direct Connect virtual interface is propagating routes into all route tables.