ANS-C01 Practice Test 26 — 15 Questions

Question 1

Which THREE of the following are valid ways to restrict access to an S3 bucket that is accessed by EC2 instances in a VPC?

Accepted Answer

Use an S3 bucket policy that restricts access to the VPC or VPC endpoint.. Option A is correct because an S3 bucket policy can include conditions such as aws:sourceVpce or aws:sourceVpc to deny or allow requests only when they originate from a specific VPC endpoint or VPC, effectively restricting bucket access to that network path. Option C is correct because a VPC endpoint policy is an IAM resource policy attached to the gateway or interface endpoint that controls which S3 buckets (and actions) can be reached through that endpoint, so it can allow access only to the specific bucket. Option D is correct because attaching an IAM role (instance profile) to the EC2 instance grants scoped, least-privilege permissions to the S3 bucket via temporary credentials, which is the standard identity-based control for EC2-to-S3 access. Option B is not correct because network ACLs filter traffic by CIDR/IP and port, not by S3 prefix lists, and S3 gateway endpoints use prefix lists in route tables and security groups rather than NACLs. Option E is not correct because security groups control traffic to and from the instance's ENI, but outbound HTTPS to S3 does not by itself restrict which bucket or objects can be accessed, so it is not an access-restriction mechanism for the bucket.

Answer

Use a network ACL to restrict access to the S3 prefix list.

Answer

Use a security group to allow outbound traffic from the EC2 instance to the S3 bucket.

Question 2

Which THREE are best practices for managing network security in a multi-VPC AWS environment using AWS Transit Gateway?

Accepted Answer

Use separate Transit Gateway route tables for different environments (e.g., production, development).. Option A is correct because separate Transit Gateway route tables provide segmentation and isolation between environments such as production and development, preventing unintended cross-environment routing and enforcing least-privilege connectivity. Option B is correct because centralizing internet egress through a shared VPC with a NAT gateway or proxy enables consistent inspection, logging, and control of outbound traffic while reducing the number of internet-facing entry points. Option D is correct because enabling VPC Flow Logs on all VPCs and centralizing them in a security account supports centralized monitoring, auditing, and incident response across the multi-VPC environment. Option C is not recommended because attaching all VPCs to a single Transit Gateway route table removes segmentation and increases blast radius. Option E is not a best practice for inter-VPC filtering because network ACLs are stateless and subnet-level, whereas security groups and Transit Gateway route table segmentation provide more precise, stateful control for VPC-to-VPC traffic.

Answer

Attach all VPCs to a single Transit Gateway route table for simplicity.

Answer

Use network ACLs on every subnet to filter traffic between VPCs.

Question 3

A company is designing a network for a multi-account AWS environment using AWS Organizations. They need to centralize network management and enable VPC connectivity across accounts. Which THREE services should they consider? (Choose THREE.)

Accepted Answer

AWS Resource Access Manager. AWS Resource Access Manager (RAM) is correct because it enables you to share centrally managed resources, such as Transit Gateways and VPC subnets, across multiple AWS accounts within an AWS Organization. This eliminates the need to create duplicate resources in each account and allows for centralized network management without requiring cross-account IAM roles or complex peering configurations.

Answer

VPC Peering

Answer

AWS Direct Connect

Question 4

A company is using AWS Client VPN to provide remote access to their VPC. Users report that they can connect to the VPN but cannot reach resources in the VPC. Which THREE configuration items should the engineer verify?

Accepted Answer

The authorization rules allow access to the VPC's CIDR.. Authorization rules in AWS Client VPN define which networks (CIDRs) users are allowed to access. If the rule does not include the VPC's CIDR, traffic to resources in the VPC will be dropped even though the VPN tunnel is established. This is a common misconfiguration that prevents resource reachability.

Answer

The Client VPN endpoint has a public IP address.

Answer

The client certificate is issued by a valid CA.

Question 5

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. They need to add an additional non-overlapping CIDR to the VPC. What is a valid CIDR block they can add?

Accepted Answer

10.1.0.0/16. (10.1.0.0/16) is correct because it is a non-overlapping IPv4 CIDR block that does not conflict with the existing VPC CIDR of 10.0.0.0/16. In AWS, when adding a secondary CIDR to a VPC, the new block must be from the private IP address ranges (RFC 1918) and must not overlap with any existing CIDR blocks in the VPC. The 10.1.0.0/16 range is entirely separate from 10.0.0.0/16, as they are different /16 subnets within the 10.0.0.0/8 space.

Answer

10.0.1.0/24

Answer

10.0.0.0/8

Answer

10.0.0.0/16

Question 6

A company needs to resolve DNS names within a VPC using a custom domain. Which AWS service should be used?

Accepted Answer

Amazon Route 53 Resolver. Amazon Route 53 Resolver provides recursive DNS resolution for VPCs and supports custom domain names via inbound and outbound endpoints. It integrates with on-premises DNS through conditional forwarding, enabling resolution of custom private domains within the VPC without exposing them to the internet.

Answer

Elastic Load Balancing

Answer

Amazon CloudFront

Answer

AWS WAF

Question 7

Which THREE components are necessary to enable encryption in transit for traffic between an on-premises data center and an Amazon VPC over AWS Site-to-Site VPN? (Choose three.)

Accepted Answer

A customer gateway (CGW) in the on-premises network. Option A is correct because the customer gateway (CGW) is the AWS resource representing the on-premises VPN device that terminates the Site-to-Site VPN connection and participates in the IPsec negotiation. Option D is correct because the virtual private gateway (VGW) is the AWS-side VPN concentrator attached to the VPC that terminates the other end of the tunnel. Option E is correct because encryption in transit over a Site-to-Site VPN is provided by the IPsec VPN tunnel established between the VGW and the CGW, which encrypts and authenticates the traffic. Option B is not required because an internet gateway (IGW) is used for direct internet access to a VPC, not for terminating Site-to-Site VPN tunnels. Option C is not required because Site-to-Site VPN uses IPsec (IKE) with pre-shared keys and does not rely on an SSL/TLS certificate for the tunnel.

Answer

An internet gateway (IGW) attached to the VPC

Answer

An SSL/TLS certificate for the VPN tunnel

Question 8

A company is designing a network security architecture for a multi-account AWS environment. They need to centrally inspect and filter traffic between VPCs using a third-party firewall appliance. Which AWS service should they use to route traffic through the inspection VPC?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway acts as a central hub that connects multiple VPCs and on-premises networks, allowing traffic to be routed through a centralized inspection VPC. It supports route tables and appliance mode, enabling traffic to be redirected to a third-party firewall appliance for inspection.

Answer

VPC Peering

Answer

AWS Direct Connect

Answer

VPC Endpoints

Question 9

A company has deployed an application across multiple AWS Regions using Application Load Balancers (ALBs). The company wants to route traffic to the nearest healthy endpoint using latency-based routing. Which AWS service should be used to distribute traffic across the ALBs?

Accepted Answer

Amazon Route 53 with latency routing policy.. Amazon Route 53 with a latency routing policy is the correct choice because it directs traffic to the ALB endpoint that provides the lowest latency for the end user, based on measured round-trip times between the user and each AWS Region. This aligns with the requirement to route traffic to the nearest healthy endpoint using latency-based routing, as Route 53 evaluates health checks on the ALBs and only considers healthy endpoints when determining the lowest latency.

Answer

Amazon CloudFront with multiple origins.

Answer

AWS Network Load Balancer with cross-zone load balancing.

Answer

AWS Global Accelerator.

Question 10

Which THREE are best practices for designing a highly available AWS Direct Connect connection? (Choose 3.)

Accepted Answer

Use multiple Direct Connect connections to different AWS Direct Connect locations. Option B is correct because terminating Direct Connect connections in two or more different AWS Direct Connect locations provides physical path diversity, so a failure at one location (fiber cut, device failure, or provider outage) does not take down all connectivity. Option C is correct because BGP with graceful restart and aggressive/fast failover timers (e.g., lower keepalive/hold timers) allows traffic to reconverge quickly and minimizes packet loss when a link or virtual interface fails. Option D is correct because connecting to multiple AWS Direct Connect routers within the same location gives device-level redundancy, so the failure of a single AWS router does not drop the connection. Option A is not a best practice because a single Direct Connect connection is a single point of failure regardless of how many virtual interfaces it carries. Option E is not a best practice because using one large connection instead of multiple smaller ones reduces redundancy and does not address failover at all.

Answer

Use a single Direct Connect connection with redundant virtual interfaces

Answer

Use a single large Direct Connect connection instead of multiple smaller ones

Question 11

Which THREE of the following are valid considerations when designing a multi-Region active-active application using AWS Global Accelerator?

Accepted Answer

You can assign different weights to endpoints in different Regions to control traffic distribution.. AWS Global Accelerator allows you to assign different weights to endpoints in different Regions, enabling granular control over traffic distribution for active-active architectures. This is achieved through endpoint group weights, where you can adjust the proportion of traffic sent to each Regional endpoint group, supporting scenarios like gradual rollouts or load balancing across Regions.

Answer

Global Accelerator supports sticky sessions (session affinity) based on client IP.

Answer

Global Accelerator provides a set of static IP addresses that are unique to each Region.

Question 12

A company has a multi-account AWS environment using AWS Organizations. They need to enforce that all newly created S3 buckets are encrypted with SSE-KMS using a specific KMS key. Which policy should they use?

Accepted Answer

SCP in AWS Organizations. Service Control Policies (SCPs) in AWS Organizations can enforce permissions across all accounts, including denying the creation of S3 buckets without SSE-KMS encryption using a specific key. SCPs are the only option that provides centralized, preventive control across multiple accounts.

Answer

S3 bucket policy on each bucket

Answer

IAM policy in each account

Answer

AWS Config rule with auto-remediation

Question 13

Which THREE considerations are important when implementing a multi-region Direct Connect architecture? (Choose 3)

Accepted Answer

Ensure Direct Connect connections are in at least two separate geographic locations.. Option A is correct because a resilient multi-region Direct Connect architecture requires at least two Direct Connect connections in separate geographic locations, so a single location failure (e.g., a facility outage or fiber cut) cannot take down all private connectivity. Option D is correct because using diverse paths and providers for the Direct Connect connections avoids a shared physical or carrier failure; diversity at the network layer is what actually delivers the redundancy that separate locations imply. Option E is correct because a VPN connection over the internet can serve as a backup path to Direct Connect, providing failover if the dedicated connections are disrupted, and it can also be used during maintenance windows. Option B is not correct because a single Direct Connect connection is a single point of failure and does not meet the high-availability goal of a multi-region architecture. Option C is not correct because connecting all Direct Connect connections to the same AWS Direct Connect device concentrates risk on one device and eliminates the redundancy that diverse connections are meant to provide.

Answer

Use a single Direct Connect connection to reduce complexity.

Answer

Connect all Direct Connect connections to the same AWS Direct Connect device.

Question 14

A company runs a critical application on EC2 instances in a VPC. The application needs to send data to an S3 bucket and an SQS queue, both in the same AWS account. The security team requires that all traffic to these AWS services must stay within the AWS network and not traverse the internet. The VPC has private subnets with no NAT gateway or Internet Gateway. The EC2 instances have an IAM role that grants necessary permissions. The S3 bucket and SQS queue are configured with bucket policies and queue policies that deny all access except from the VPC. However, the application is failing to send data to both S3 and SQS. What should the network engineer do to resolve this issue?

Accepted Answer

Create a gateway endpoint for S3 and an interface endpoint for SQS in the VPC, and update the route tables for S3 and the security groups for SQS. VPC endpoints for S3 (Gateway endpoint) and SQS (Interface endpoint) provide private connectivity within the AWS network, meeting the security requirement. Option D is correct because it creates the necessary endpoints and updates route tables and security groups. For the Gateway endpoint, route tables must be updated to direct S3 traffic through the endpoint. For the Interface endpoint, security groups must allow inbound traffic from the EC2 instances. Option A is wrong because CloudFront is a content delivery service, not a private connectivity solution for S3 or SQS. Option B is wrong because a NAT gateway would route traffic over the internet, violating the requirement. Option C is wrong because Direct Connect is an overkill and does not directly provide VPC endpoint connectivity for S3 and SQS.

Answer

Deploy an Amazon CloudFront distribution in front of S3 and use its public endpoint

Answer

Create a NAT gateway in a public subnet and update the route tables to send traffic to it

Answer

Set up an AWS Direct Connect connection and route traffic through it

Question 15

Which TWO options are valid methods to connect a VPC to an on-premises network? (Choose 2)

Accepted Answer

AWS Direct Connect. AWS Direct Connect (B) is correct because it establishes a dedicated private network connection from an on-premises data center to AWS over a standard Ethernet fiber-optic cable, bypassing the public internet and providing consistent latency and bandwidth for hybrid connectivity. AWS Site-to-Site VPN (E) is also correct because it creates an IPsec VPN tunnel over the public internet between an on-premises customer gateway and an AWS virtual private gateway or transit gateway, securely connecting the on-premises network to the VPC. An Internet gateway (A) only enables communication between a VPC and the public internet, not a private on-premises network. A VPC endpoint (C) provides private connectivity to AWS services (such as S3 or DynamoDB) within the AWS network, not to on-premises networks. A VPC peering connection (D) connects two VPCs to each other, not a VPC to an on-premises network.

Answer

Internet gateway

Answer

VPC endpoint

Answer

VPC peering connection