ANS-C01 Practice Test 27 — 15 Questions

Question 1

An organization is designing a hybrid network using AWS Direct Connect with a private VIF. They want to ensure high availability and failover. Which THREE components should be part of the design?

Accepted Answer

Two separate Direct Connect connections from different providers or locations.. Using two separate Direct Connect connections from different providers or locations ensures physical diversity, eliminating single points of failure. This design meets the high availability requirement by providing redundant paths for traffic, even if one connection or provider experiences an outage.

Answer

A NAT gateway in each Availability Zone.

Answer

A single Direct Connect connection with multiple VLANs.

Question 2

A company has a Direct Connect connection with a private VIF to a VPC. They want to use the same connection to access another VPC in a different region. What is the simplest way to achieve this?

Accepted Answer

Use a Direct Connect Gateway. A Direct Connect Gateway (DX Gateway) allows you to associate a single private virtual interface (VIF) with multiple VPCs, even across different AWS regions. This is the simplest solution because it avoids creating additional VIFs or complex inter-VPC connectivity, and it supports transitive routing between the on-premises network and all associated VPCs via the same Direct Connect connection.

Answer

Create a new private VIF for the second VPC

Answer

Use a VPN over the internet to connect the VPCs

Answer

Set up VPC peering between the two VPCs

Question 3

A company is designing a network security architecture for a multi-account AWS environment using AWS Organizations. They need to centrally manage and enforce VPC security group rules across all accounts. Which service should they use?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager is designed to centrally manage and enforce security group rules, AWS WAF rules, AWS Shield Advanced protections, and Network Firewall policies across all accounts in an AWS Organization. It integrates with AWS Organizations to apply policies organization-wide, which is exactly what the company needs for centralized VPC security group rule management.

Answer

AWS CloudFormation StackSets

Answer

AWS Config

Answer

AWS Service Catalog

Question 4

A company is designing a network architecture for a multi-account AWS environment using AWS Transit Gateway. They need to meet the following requirements: (1) Centralized inspection of traffic between VPCs using a firewall appliance. (2) Isolated development environments that cannot communicate with each other but can access the internet via a centralized NAT gateway. (3) Compliance with PCI DSS for production workloads, requiring encryption in transit between VPCs. Which TWO actions should they take?

Accepted Answer

Create a dedicated inspection VPC with a firewall appliance and attach it to the Transit Gateway. Use Transit Gateway route tables to route traffic from all VPCs through the inspection VPC.. It enables centralized traffic inspection by attaching a dedicated inspection VPC with a firewall appliance to the Transit Gateway and using separate route tables to force all inter-VPC traffic through that inspection VPC. This design meets the requirement for centralized inspection without requiring complex peering or VPN configurations.

Answer

Use VPC Peering for all inter-VPC communication

Answer

Use AWS Site-to-Site VPN between each VPC and a central VPN hub

Answer

Use AWS Client VPN to connect development VPCs to the production VPC

Question 5

A company is using AWS Shield Advanced to protect against DDoS attacks. They want to receive notifications when an attack is detected. Which AWS service should they integrate with to receive notifications?

Accepted Answer

Amazon CloudWatch and Amazon Simple Notification Service (SNS). AWS Shield Advanced sends metrics to CloudWatch, and you can create CloudWatch alarms to trigger SNS notifications. Option A (SQS) is for queuing. Option B (Lambda) can be triggered but SNS is simpler. Option D (Kinesis) is for streaming.

Answer

Amazon Simple Queue Service (SQS)

Answer

AWS Lambda

Answer

Amazon Kinesis Data Streams

Question 6

Which TWO statements about AWS Direct Connect are correct? (Select TWO.)

Accepted Answer

Direct Connect supports multiple virtual interfaces (VIFs) over a single connection. Option B is correct because a single AWS Direct Connect connection can host multiple virtual interfaces (VIFs) — private VIFs for VPC access, public VIFs for AWS public services, and transit VIFs for Transit Gateway — each with its own VLAN ID and BGP peering. Option E is correct because Direct Connect uses dedicated, private physical links (1 Gbps, 10 Gbps, or 100 Gbps) that bypass the public internet, delivering more consistent latency, jitter, and throughput than an internet-based IPsec VPN. Option A is wrong because Direct Connect does not encrypt traffic by default; encryption requires running an IPsec VPN over the Direct Connect link (or MACsec on supported connections). Option C is wrong because Direct Connect is a dedicated private network connection service, not a managed VPN service like AWS Site-to-Site VPN. Option D is wrong because Direct Connect requires physical cross-connects at an AWS Direct Connect location or through an AWS Direct Connect Partner, so it cannot be provisioned in minutes purely in software.

Answer

Direct Connect traffic is encrypted by default

Answer

Direct Connect is a managed VPN service

Answer

Direct Connect can be provisioned in minutes without any physical infrastructure

Question 7

Which TWO scenarios are best suited for using AWS Transit Gateway over VPC peering? (Select TWO.)

Accepted Answer

Connecting hundreds of VPCs across multiple accounts. Option C is correct because AWS Transit Gateway acts as a central hub that supports thousands of VPC attachments across multiple AWS accounts via AWS Resource Access Manager, avoiding the O(n²) mesh of VPC peering connections that becomes unmanageable at hundreds of VPCs. Option D is correct because Transit Gateway natively integrates with AWS Direct Connect through a Direct Connect gateway and Transit VIF, allowing many VPCs to share a single connection to on-premises networks, whereas VPC peering cannot attach to Direct Connect at all. Option A is not the best fit because VPC peering itself supports cross-account connections, so cross-account connectivity alone does not justify Transit Gateway. Option B is not the best fit because a single VPC to on-premises connection is typically handled by a VPN or Direct Connect with a virtual private gateway, which is simpler and cheaper than Transit Gateway. Option E is not the best fit because two VPCs in the same account and region are easily connected with a single VPC peering connection, making Transit Gateway unnecessary overhead.

Answer

Connecting VPCs in different AWS accounts

Answer

Connecting a single VPC to an on-premises network

Answer

Connecting two VPCs in the same account and region

Question 8

A company is designing a VPC architecture for a web application that must be highly available across multiple Availability Zones. Which TWO components should be deployed in at least two Availability Zones to meet this requirement?

Accepted Answer

NAT Gateway. Option C (NAT Gateway) is correct because a NAT Gateway is created in a specific subnet within a single Availability Zone, so to keep outbound internet access highly available for private-subnet instances, you must deploy a NAT Gateway in at least two AZs (one per AZ) and route each AZ's traffic to its local NAT Gateway. Option D (Application Load Balancer with subnets in multiple AZs) is correct because an ALB requires you to enable at least two subnets in different Availability Zones, and it distributes incoming traffic across those AZs to provide high availability for the web application. Option A (Transit Gateway) is not AZ-specific in this way; it is a regional, highly available hub that does not need to be deployed per-AZ to meet the requirement. Option B (Internet Gateway) is a horizontally scaled, redundant, and highly available VPC component that attaches at the VPC level, not per-AZ. Option E (VPN connection) is a site-to-site connection to on-premises and is not an AZ-scoped component that must be duplicated across AZs for this design.

Answer

Transit Gateway

Answer

Internet Gateway

Answer

VPN connection

Question 9

Which TWO of the following are valid methods to connect an on-premises data center to a VPC in AWS? (Choose 2.)

Accepted Answer

AWS Direct Connect. AWS Direct Connect is a correct answer because it provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet for consistent latency and higher bandwidth. This service uses industry-standard 802.1Q VLANs to create virtual interfaces, enabling direct access to VPCs via private virtual interfaces (VIFs) or transit virtual interfaces for use with Transit Gateway.

Answer

VPC endpoint

Answer

Transit Gateway

Answer

VPC peering

Question 10

A company has a VPC with public and private subnets. They want to allow instances in the private subnet to download software updates from the internet while preventing inbound traffic from the internet. Which AWS service should they use?

Accepted Answer

NAT Gateway. A NAT Gateway allows outbound internet traffic from private subnets while blocking inbound traffic, making it the correct choice. Option A (VPC Peering) is incorrect because it does not provide internet access. Option C (Internet Gateway) is incorrect because it allows inbound traffic from the internet. Option D (VPN Connection) is incorrect because it typically provides private connectivity to an on-premises network, not direct internet access.

Answer

VPC Peering

Answer

Internet Gateway

Answer

VPN Connection

Question 11

A company is deploying a web application across multiple Availability Zones in a single AWS Region. The application consists of an Application Load Balancer (ALB) in front of EC2 instances in an Auto Scaling group, and an Amazon RDS Multi-AZ database. The company needs to ensure that the application can survive the loss of an entire Availability Zone. Which THREE actions should they take? (Select THREE.)

Accepted Answer

Configure the Auto Scaling group to launch instances in at least two Availability Zones. Configuring the Auto Scaling group to launch instances in at least two Availability Zones ensures that if one AZ fails, the remaining AZ(s) still have healthy EC2 instances to serve traffic. This is a fundamental requirement for multi-AZ high availability, as the Auto Scaling group will automatically replace failed instances in the remaining AZs.

Answer

Use larger EC2 instance types to handle the load

Answer

Deploy a single NAT Gateway in one AZ for outbound traffic

Question 12

Which THREE factors should be considered when designing a VPC for a multi-tier application that requires high availability and security? (Choose three.)

Accepted Answer

Provision subnets in at least two Availability Zones. Option A is correct because high availability in a VPC requires spreading resources across at least two Availability Zones, so that a failure of one AZ does not take down the entire multi-tier application. Option C is correct because using separate subnets for the web, application, and database tiers enables tier-specific security controls such as security groups and NACLs, and limits lateral movement between tiers. Option E is correct because NAT Gateways placed in public subnets allow instances in private subnets to initiate outbound internet traffic (for patching, updates, or external API calls) without exposing them to inbound internet access. Option B is not appropriate because assigning public IP addresses to all instances, especially application and database tiers, unnecessarily exposes them to the internet and violates least-privilege network design. Option D is not appropriate because using a single Availability Zone reduces latency only marginally while eliminating fault tolerance, which contradicts the high availability requirement.

Answer

Assign public IP addresses to all instances for direct access

Answer

Use a single Availability Zone to reduce latency

Question 13

A company is designing a hybrid network using AWS Direct Connect. They have a VPC with CIDR 10.0.0.0/16 and an on-premises network with CIDR 192.168.0.0/16. They want to establish a Direct Connect private virtual interface with a virtual private gateway. Which THREE steps are required to complete the connectivity? (Choose three.)

Accepted Answer

Create a virtual private gateway and attach it to the VPC.. Option B is correct because a Direct Connect private virtual interface must terminate on a virtual private gateway (or Direct Connect gateway) attached to the VPC, so creating and attaching the VGW to the VPC is a required step. Option C is correct because after the VGW is attached, the VPC route table must have a route for the on-premises CIDR 192.168.0.0/16 pointing to the virtual private gateway so return traffic can reach the on-premises network. Option D is correct because the private VIF is the actual Layer 2/3 connection over the Direct Connect link, and it must be configured and associated with the VGW to carry traffic for the VPC. Option A is not required because a Transit Gateway is only needed when centralizing multiple VPCs/VPNs or using a Direct Connect gateway in a hub-and-spoke design; a single VPC with a VGW works without it. Option E is not required because a customer gateway object is used for Site-to-Site VPN or for the AWS side of a VPN terminating on a VGW, not for a Direct Connect private VIF.

Answer

Create a Transit Gateway and attach the VPC to it.

Answer

Create a customer gateway object in the AWS account.

Question 14

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download patches from the internet. The company has a NAT gateway in a public subnet. The EC2 instance can connect to other instances in the VPC but cannot reach the internet. What is the most likely cause?

Accepted Answer

The route table in the private subnet does not have a default route to the NAT gateway.. For an EC2 instance in a private subnet to reach the internet via a NAT gateway, the private subnet's route table must include a default route (0.0.0.0/0) pointing to the NAT gateway as the target. Without this route, traffic destined for the internet has no path to the NAT gateway, so the instance can communicate within the VPC but cannot reach external hosts. Option D correctly identifies this missing route as the most likely cause.

Answer

The security group of the EC2 instance blocks outbound HTTPS traffic.

Answer

The NAT gateway does not have an Elastic IP address.

Answer

The network ACL of the private subnet blocks inbound traffic from the NAT gateway.

Question 15

A company has several VPCs in the same AWS account and region. They want to centrally manage and monitor network traffic between these VPCs and also to on-premises networks. Which AWS service should they use?

Accepted Answer

Transit Gateway. AWS Transit Gateway (C) is the correct choice because it acts as a central hub to interconnect multiple VPCs and on-premises networks using a single gateway, simplifying network management and enabling centralized monitoring. It supports transitive routing between all attached networks, which is essential for the company's requirement to manage and monitor traffic across many VPCs and their on-premises environment.

Answer

AWS Direct Connect

Answer

VPC Peering

Answer

AWS VPN CloudHub