ANS-C01 Practice Test 26 — 15 Questions

Question 1

A financial services company is designing a VPC with multiple tiers: web, application, and database. The web tier must be accessible from the internet, but the application and database tiers must not have direct internet access. The company needs to allow the application tier to download patches from the internet. Which THREE components should be included in the design? (Choose three.)

Accepted Answer

Internet Gateway (IGW). An internet gateway allows inbound traffic to the public subnet. NAT Gateway enables outbound internet access for private subnets. A public subnet for the web tier is necessary for internet-facing ALB. VPC Peering is for connecting VPCs, not internet access. Direct Connect is for dedicated on-premises connection. Egress-only Internet Gateway is for IPv6 only.

Answer

Direct Connect virtual interface

Answer

VPC Peering connection

Question 2

A company has a VPC with public and private subnets. They launch an Amazon RDS for MySQL DB instance in a private subnet. The DB instance needs to be accessible from an on-premises application that connects via an AWS Site-to-Site VPN. What is the MOST secure way to allow the on-premises application to connect to the DB instance?

Accepted Answer

Place the DB instance in a private subnet and configure a security group to allow inbound traffic from the on-premises CIDR.. Option C is correct. The most secure approach is to place the RDS instance in a private subnet with a security group that only allows inbound traffic from the on-premises network's CIDR range. Since the connection comes over the VPN (private network), it is not necessary to expose the database to the internet. Option A is incorrect because making the DB instance publicly accessible is a security risk. Option B is incorrect because a network ACL is stateless and less granular than a security group; also, allowing all traffic to the DB subnet is overly permissive. Option D is incorrect because a NAT gateway is for outbound traffic, not inbound.

Answer

Assign a public IP address to the DB instance and restrict access using a security group.

Answer

Place the DB instance in a private subnet and use a NAT gateway to allow inbound traffic.

Answer

Place the DB instance in a public subnet and configure a network ACL to allow traffic from the on-premises CIDR.

Question 3

A solutions architect is designing a VPC with public and private subnets. The application in the private subnet needs to download patches from the internet. Which TWO options allow outbound internet access while keeping the EC2 instance in the private subnet without a public IP address?

Accepted Answer

Create a VPC endpoint for Amazon S3 and update the route table.. Options A and D are correct. A NAT Gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet. A VPC endpoint for S3 allows private access to S3 buckets. Option B (Internet Gateway) requires a public IP. Option C (Direct Connect) is for dedicated private connections. Option E (VPN) is for hybrid connectivity.

Answer

Attach an Internet Gateway to the VPC and assign a public IP to the instance.

Answer

Set up a Direct Connect connection to an on-premises data center.

Answer

Establish a VPN connection to a third-party proxy service.

Question 4

A company is designing a VPC with public and private subnets. They want EC2 instances in private subnets to be able to access the internet for software updates. Which AWS service should they use?

Accepted Answer

NAT Gateway. The correct answer is C because a NAT Gateway allows instances in private subnets to initiate outbound traffic to the internet while preventing inbound traffic from the internet. Option A (Internet Gateway) is for public subnets. Option B (VPC Peering) is for connecting VPCs. Option D (Direct Connect) is a dedicated connection to on-premises.

Answer

AWS Direct Connect

Answer

Internet Gateway (IGW)

Answer

VPC Peering connection

Question 5

A global company wants to connect multiple VPCs across different AWS Regions using a hub-and-spoke model. The hub VPC contains shared services such as Active Directory and DNS. Which AWS service provides the most scalable and maintainable solution for this architecture?

Accepted Answer

AWS Transit Gateway with inter-Region peering attachments.. Option D is correct because AWS Transit Gateway is designed for hub-and-spoke connectivity across many VPCs and Regions, providing scalability and centralized management. Option A is wrong because VPC peering is point-to-point and does not scale well for many VPCs. Option B is wrong because VPN CloudHub is for VPN-based connectivity, not VPC-to-VPC. Option C is wrong because Direct Connect gateway is for connecting Direct Connect to multiple VPCs, not for VPC-to-VPC peering.

Answer

AWS VPN CloudHub to interconnect all VPCs.

Answer

AWS Direct Connect gateway with virtual interfaces to each VPC.

Answer

VPC peering between each spoke VPC and the hub VPC.

Question 6

Which TWO of the following are required to establish a BGP session over a Direct Connect private virtual interface? (Choose TWO.)

Accepted Answer

A VLAN ID. Options A and C are correct. A VLAN ID is required to tag the traffic on the physical connection. BGP session with Autonomous System Numbers (ASN) is required for routing. Option B is wrong because a public IP is not used on private VIF; private IP addresses are used. Option D is wrong because a VPN connection is separate. Option E is wrong because a Direct Connect gateway is optional for connecting to multiple VPCs.

Answer

A public IP address for the BGP peer

Answer

A Direct Connect gateway

Answer

A VPN connection to the VPC

Question 7

Which TWO of the following are valid methods to connect an on-premises network to an Amazon VPC? (Select TWO.)

Accepted Answer

AWS Direct Connect. Options A and D are correct. AWS Site-to-Site VPN and AWS Direct Connect are the primary methods for connecting on-premises networks to VPCs. Option B is incorrect because VPC peering connects VPCs, not on-premises. Option C is incorrect because an Internet Gateway is for internet access. Option E is incorrect because VPC endpoints are for accessing AWS services privately.

Answer

VPC peering connection

Answer

VPC endpoint

Answer

Internet Gateway

Question 8

A network engineer is troubleshooting high latency on a Direct Connect connection. The engineer notices that the BGP session is flapping intermittently. The connection is a 1 Gbps dedicated connection with a single private VIF. The router configuration uses default BGP timers. What is the most likely cause of the flapping?

Accepted Answer

The link experiences occasional packet loss causing BGP hold timer expiration.. Option D is correct because BGP hold timers (default 90 seconds) may cause the session to drop if the link has high latency or occasional packet loss. Increasing the hold timer can prevent flapping. Option A is wrong because jumbo frames are unrelated to BGP flapping. Option B is wrong because BGP authentication errors would cause persistent failures, not intermittent flaps. Option C is wrong because the MED attribute is used for inbound traffic engineering, not session stability.

Answer

The MTU size is set to 9001 (jumbo frames) on the Direct Connect interface.

Answer

The BGP authentication key is mismatched between the customer router and AWS.

Answer

The Multi-Exit Discriminator (MED) value is set too high on the customer router.

Question 9

A developer wants to allow an EC2 instance in a VPC to access an Amazon S3 bucket without traversing the public internet. Which AWS service should be used?

Accepted Answer

VPC Gateway Endpoint for S3.. Option D is correct because a VPC Gateway Endpoint allows private access to S3 without requiring an internet gateway or NAT device. Option A is incorrect because S3 does not use an interface endpoint directly (it uses gateway endpoint). Option B is incorrect because NAT gateway provides internet access but not private access to S3. Option C is incorrect because S3 does not support Direct Connect privately without a VPC endpoint.

Answer

AWS PrivateLink with an interface VPC endpoint.

Answer

NAT gateway in the public subnet.

Answer

AWS Direct Connect with a public VIF.

Question 10

An EC2 instance with the attached IAM role is unable to download objects from an S3 bucket. The instance is in a VPC with CIDR 10.0.0.0/16. The S3 bucket policy allows access from the VPC. What is the most likely reason for the failure?

Accepted Answer

The IAM role does not have permission to list the bucket, which is required for the download operation.. Option B is correct because the condition aws:SourceIp compares the source IP of the request, but when using a VPC Gateway Endpoint, the source IP is the private IP of the instance, which is within 10.0.0.0/16, so that should work. However, the condition is problematic because the aws:SourceIp condition is not effective when the request comes through a VPC endpoint; the source IP is the endpoint's private IP, not the instance's IP. Actually, the correct answer is that the condition is not met because the source IP is the endpoint's IP, not the instance's. But wait, for Gateway Endpoint, the source IP is the instance's private IP. Let me reconsider: For Gateway Endpoints, the source IP is preserved as the instance's private IP. So the condition should be met. The issue might be that the bucket policy also needs to allow access. However, the question states the bucket policy allows access from the VPC. Possibly the IAM policy's condition is using aws:SourceIp which works, but maybe the instance is not using the endpoint? Actually, the most likely reason is that the IAM policy does not authorize the s3:ListBucket action, but the error is about download, which is GetObject. Let me think: The policy allows GetObject, but the condition requires source IP in 10.0.0.0/16. If the instance is using a Gateway Endpoint, the source IP is the instance's private IP, so it should match. However, if the S3 bucket policy denies access from outside the VPC, or if the instance does not have a route to the endpoint, it might fail. But the exhibit shows IAM policy, so the issue is likely the IAM policy itself. Option D is correct because the IAM policy lacks permission for s3:ListBucket, but that is not needed for downloading a specific object if you know the key. However, many S3 operations require ListBucket for the console or SDK. But the question says 'unable to download objects', which could be due to the condition not matching. Actually, I think the correct answer is that the aws:SourceIp condition is not effective because the traffic goes through the VPC endpoint, and the source IP seen by S3 is the endpoint's private IP, which is not the instance's IP. For Gateway Endpoints, the source IP is the instance's private IP. So that should work. Wait, there is a nuance: For Gateway Endpoints, the source IP is the instance's private IP, so the condition should work. But if the VPC endpoint is not used, the traffic goes through the internet and the source IP is the public IP, which would not match. However, the question implies the instance is in the VPC. I think the most plausible cause is that the IAM role does not have permission to access the bucket because the condition is not satisfied. But since the instance is in the VPC, its private IP is within the range. So maybe the issue is that the S3 bucket policy is not allowing the IAM role. Option A is incorrect because the bucket policy is not shown. Option C is incorrect because there is no explicit deny. Option B is the most likely: the condition does not match because the source IP is not the instance's IP when using a VPC endpoint? Actually, I recall that for Gateway Endpoints, the source IP is the instance's private IP. So the condition should work. Let me think again: The correct answer is D because the IAM policy only allows GetObject, but the SDK might first call ListObjects, which is denied. That is a common issue. So Option D.

Answer

The IAM policy does not include an Allow for the s3:GetObject action.

Answer

The condition aws:SourceIp does not match the source IP of the request because the traffic is routed through a VPC Gateway Endpoint.

Answer

The S3 bucket policy has an explicit deny for the IAM role.

Question 11

A company is designing a highly available network in AWS. They have two Direct Connect connections from different providers to two different AWS Direct Connect locations. They want to use BGP as the routing protocol. Which TWO actions should be taken to ensure high availability?

Accepted Answer

Advertise the same on-premises prefixes over both connections with different AS_PATH prepend values. Options A and B are correct because using separate BGP sessions and advertising the same prefixes with different AS_PATH prepending provides path selection and redundancy. Option C is wrong because same community values do not help with path selection. Option D is wrong because only one VIF per connection is needed. Option E is wrong because jumbo frames do not affect availability.

Answer

Use the same BGP community values for both connections

Answer

Enable jumbo frames on both connections

Answer

Configure multiple virtual interfaces on a single Direct Connect connection

Question 12

A company is setting up a Direct Connect connection to AWS. The on-premises router is configured with a BGP ASN of 65000. The AWS side uses a public ASN of 64512. Which configuration change is required for BGP peering to establish?

Accepted Answer

Change the customer ASN to a value in the 64512-65534 range.. Option D is correct because Direct Connect requires private ASNs (64512-65534) for the customer side; 65000 is private. Option A is wrong because public ASNs are not required. Option B is wrong because MD5 is optional. Option C is wrong because eBGP multihop is not needed for directly connected routers.

Answer

Increase the eBGP multihop TTL to 2.

Answer

Configure the BGP peer with a public ASN on the customer side.

Answer

Enable BGP authentication with MD5 password.

Question 13

A company is deploying a public-facing web application on EC2 instances behind an Application Load Balancer. The ALB is configured to terminate HTTPS using a certificate from AWS Certificate Manager. What additional step is required to ensure the ALB can validate the certificate?

Accepted Answer

Ensure the certificate is in the same AWS region as the ALB.. Option B is correct because ACM certificates must be in the same region as the ALB. Option A is wrong because DNS validation is not required for ALB. Option C is wrong because private CA is not needed. Option D is wrong because CloudFront is a different service.

Answer

Attach the certificate to an Amazon CloudFront distribution.

Answer

Create a DNS record to validate domain ownership.

Answer

Import the certificate into AWS Certificate Manager Private Certificate Authority.

Question 14

A company is deploying a new web application on AWS. They need to distribute incoming HTTPS traffic across multiple EC2 instances in different Availability Zones. Which AWS service should they use?

Accepted Answer

Application Load Balancer (ALB). The correct answer is B because an Application Load Balancer (ALB) operates at Layer 7 and can route HTTPS traffic based on content, and it supports cross-zone load balancing. Option A (NLB) operates at Layer 4 and does not support native HTTPS termination. Option C (CloudFront) is a CDN, not a regional load balancer. Option D (Route 53) is a DNS service.

Answer

Amazon Route 53

Answer

Amazon CloudFront

Answer

Network Load Balancer (NLB)

Question 15

Which THREE of the following are valid methods to connect a VPC to an on-premises network?

Accepted Answer

AWS Direct Connect. The correct answers are A, C, and E. VPN, Direct Connect, and Transit Gateway are valid connection methods. Option B (VPC Peering) connects VPCs, not on-premises. Option D (VPC Endpoint) connects to AWS services.

Answer

VPC Peering

Answer

VPC Endpoint