ANS-C01 Practice Test 27 — 15 Questions

Question 1

A company is using AWS Direct Connect with a public virtual interface to access Amazon S3. The on-premises network has a firewall that only allows traffic to specific IP prefixes. What is the best practice to ensure connectivity while maintaining security?

Accepted Answer

Use the S3 IP prefix list from AWS to create firewall rules.. Option C is correct because using the S3 public IP prefix list from AWS allows you to restrict traffic to known S3 IPs. Option A is wrong because S3 does not have a single IP. Option B is wrong because a private VIF is for VPC access, not S3. Option D is wrong because a VPN does not replace Direct Connect.

Answer

Allow all traffic to the AWS region's IP range.

Answer

Set up a Site-to-Site VPN tunnel over Direct Connect.

Answer

Use a private virtual interface and connect through a VPC endpoint.

Question 2

A company has a multi-account AWS Organizations setup with hundreds of VPCs across multiple regions. The network team needs to centralize outbound internet traffic through a set of inspection VPCs for security monitoring. Which solution is MOST scalable and cost-effective?

Accepted Answer

Create a Transit Gateway with a central inspection VPC that has a NAT Gateway and route all VPCs to the inspection VPC for egress.. Option B is correct because AWS Transit Gateway with central VPC attachment allows routing all egress traffic through inspection VPCs, and using a single NAT Gateway per AZ in the inspection VPC is scalable and cost-effective. Option A is wrong because each VPC with its own NAT Gateway is not centralized. Option C is wrong because Network Load Balancer is not designed for internet egress. Option D is wrong because VPC peering does not scale to hundreds of VPCs and lacks transitive routing.

Answer

Use a Network Load Balancer in each VPC to distribute traffic to inspection appliances.

Answer

Deploy a NAT Gateway in each VPC and route traffic directly to the internet.

Answer

Set up VPC peering between all VPCs and route traffic through a single VPC with an Internet Gateway.

Question 3

A company uses AWS Transit Gateway to connect multiple VPCs. The network team notices that traffic between two VPCs is taking a suboptimal path through a third VPC. What is the most likely cause?

Accepted Answer

Incorrect route table associations and propagations in the Transit Gateway.. Option A is correct because Transit Gateway route tables control the path of inter-VPC traffic. If routes are not correctly configured, traffic may be forwarded to an unintended attachment. Option B is wrong because ECMP is for load balancing, not path selection. Option C is wrong because security groups do not affect routing. Option D is wrong because BGP is not used between VPCs in Transit Gateway.

Answer

Security groups are blocking the direct path, forcing traffic through a third VPC.

Answer

BGP is not configured between the VPCs, so traffic defaults through a transit VPC.

Answer

ECMP routing is enabled, causing traffic to be load-balanced across multiple paths.

Question 4

A company has a VPC with multiple subnets. They want to centrally control outbound traffic to the internet and log all traffic. Which AWS service should they use?

Accepted Answer

VPC Traffic Mirroring. The correct answer is D because VPC Traffic Mirroring allows you to capture and inspect network traffic for analysis. Option A (NAT Gateway) provides outbound internet access but does not log all traffic. Option B (VPC Flow Logs) captures IP traffic metadata but does not control traffic. Option C (Network ACL) controls traffic at the subnet level but does not log all traffic.

Answer

NAT Gateway

Answer

Network ACL

Answer

VPC Flow Logs

Question 5

A company has multiple AWS accounts and wants to centrally manage network security using AWS Network Firewall. The firewall must inspect traffic between VPCs in the same Region. Which deployment model achieves this with minimal latency?

Accepted Answer

Use AWS Transit Gateway and attach AWS Network Firewall as a VPC attachment to the transit gateway.. Option D is correct because an AWS Network Firewall in the transit VPC can inspect traffic between VPCs when using Transit Gateway and route tables to steer traffic through the firewall. Option A is wrong because firewall per VPC would not inspect inter-VPC traffic unless routing is configured, and it adds overhead. Option B is wrong because a firewall in each VPC is not centralized. Option C is wrong because the firewall must be in the path of traffic; simply inspecting at the egress point of each VPC would not catch all inter-VPC traffic.

Answer

Deploy AWS Network Firewall in each VPC and configure VPC peering between VPCs.

Answer

Deploy AWS Network Firewall in a shared services VPC and use VPC peering to connect all VPCs.

Answer

Use a centralized inspection VPC with a Gateway Load Balancer and third-party appliances.

Question 6

A company has set up a site-to-site VPN connection between its on-premises network and AWS. The tunnel status shows 'UP' on both sides, but traffic from on-premises cannot reach EC2 instances in the VPC. What is the most likely cause?

Accepted Answer

The VPC route tables do not have a route pointing to the virtual private gateway for the on-premises CIDR.. The correct answer is C because the tunnel being up indicates Layer 3 connectivity, but traffic may be blocked by VPC route tables or security group rules. Option A is incorrect because tunnel status is up. Option B is incorrect because a mismatch in pre-shared keys would prevent the tunnel from establishing. Option D is incorrect because the VPN gateway is the target, not a route table entry.

Answer

The pre-shared keys are mismatched.

Answer

The VPN tunnel has been idle for too long and needs to be re-initiated.

Answer

The security group associated with the EC2 instances does not allow inbound traffic from the VPN gateway.

Question 7

Which TWO of the following are characteristics of an AWS Network Load Balancer (NLB)?

Accepted Answer

Preserves the source IP address of the client. The correct answers are B and D. NLB operates at Layer 4, handles millions of requests per second, and preserves source IP. Option A (Layer 7) is for ALB. Option C (HTTP header) is Layer 7. Option E (SSL offloading) is Layer 7.

Answer

Supports SSL offloading

Answer

Supports routing based on HTTP headers

Answer

Operates at Layer 7 of the OSI model

Question 8

Which TWO of the following are valid methods to connect a VPC to an on-premises network? (Choose TWO.)

Accepted Answer

AWS Site-to-Site VPN. Options A and D are correct. AWS Site-to-Site VPN and AWS Direct Connect are both valid methods. Option B is wrong because VPC peering is for VPC-to-VPC. Option C is wrong because AWS Transit Gateway is a network transit hub, not a direct connection method. Option E is wrong because VPC endpoints are for accessing AWS services.

Answer

VPC endpoints

Answer

AWS Transit Gateway

Answer

VPC peering

Question 9

A company has a VPC with an Application Load Balancer (ALB) that distributes traffic to EC2 instances in private subnets. The ALB needs to be accessible from the internet. The security team requires that all traffic to the ALB be inspected by AWS WAF. Which configuration meets these requirements?

Accepted Answer

Associate AWS WAF with the ALB and make the ALB internet-facing. Option B is correct because AWS WAF can be integrated with an ALB to inspect HTTP/HTTPS traffic. Option A is incorrect because a Network Load Balancer does not support AWS WAF. Option C is incorrect because Security Groups are stateful firewalls but do not support WAF rules. Option D is incorrect because CloudFront can have WAF, but it is a CDN, not a regional load balancer.

Answer

Use a Network Load Balancer with AWS WAF attached

Answer

Place the ALB behind a Security Group that inspects traffic

Answer

Use Amazon CloudFront in front of the ALB with AWS WAF

Question 10

A company needs to securely connect multiple VPCs across different AWS Regions using AWS backbone network infrastructure without traversing the public internet. The solution must be managed centrally and support transitive routing between VPCs. Which service should the company use?

Accepted Answer

AWS Transit Gateway with inter-region peering.. Option D is correct because AWS Transit Gateway supports transitive routing between VPCs across regions and uses the AWS backbone. Option A is wrong because VPC peering does not support transitive routing. Option B is wrong because VPC endpoints are for service access. Option C is wrong because ClassicLink is obsolete and does not support transitive routing.

Answer

VPC peering connections in a full mesh.

Answer

AWS PrivateLink and VPC Endpoints.

Answer

AWS ClassicLink.

Question 11

A company has a VPC with an IPv6 CIDR block and wants to provide internet access to instances in a private subnet using an egress-only internet gateway. Which of the following must be configured correctly?

Accepted Answer

Add a default route (::/0) in the private subnet's route table pointing to the egress-only internet gateway.. Option C is correct because an egress-only internet gateway is used for IPv6 outbound-only internet access, and the private subnet's route table must have a default route (::/0) pointing to the egress-only internet gateway. Option A is incorrect because IPv6 addresses are not assigned to the egress-only internet gateway. Option B is incorrect because NAT64 is not required. Option D is incorrect because the egress-only internet gateway does not use route propagation.

Answer

Configure NAT64 on the VPC to translate IPv6 to IPv4.

Answer

Enable route propagation for the egress-only internet gateway in the route table.

Answer

Assign an IPv6 address to the egress-only internet gateway.

Question 12

A company is deploying a latency-sensitive application across multiple AWS Regions. They want to use the AWS global network to route traffic to the nearest edge location for fast content delivery. Which service should they use?

Accepted Answer

AWS Global Accelerator. The correct answer is A because AWS Global Accelerator uses the AWS global network to direct traffic to the optimal endpoint, improving latency. Option B (CloudFront) is a CDN for caching static content. Option C (Route 53) is a DNS service. Option D (Direct Connect) is for dedicated connections.

Answer

Amazon Route 53

Answer

AWS Direct Connect

Answer

Amazon CloudFront

Question 13

A company wants to enable DNS resolution for hybrid network using Route 53 Resolver. The on-premises DNS servers are reachable via Direct Connect. The company wants to forward queries for a custom domain (example.corp) from VPC to on-premises. Which resource should be created in the VPC?

Accepted Answer

Route 53 Resolver outbound endpoint and associate a resolver rule.. Option C is correct because a Route 53 Resolver outbound endpoint forwards DNS queries from VPC to on-premises DNS servers. Option A is wrong because an inbound endpoint allows on-premises to query VPC DNS. Option B is wrong because a resolver rule is used to specify which domains to forward, but it must be associated with an endpoint. Option D is wrong because a VPC endpoint for Route 53 Resolver is not a service; you create endpoints for the resolver service.

Answer

A VPC endpoint for Route 53 Resolver service.

Answer

Route 53 Resolver rule that forwards example.corp to on-premises DNS servers.

Answer

Route 53 Resolver inbound endpoint.

Question 14

A company has multiple VPCs connected via a Transit Gateway. The security team wants to centrally inspect all traffic between VPCs using a third-party firewall appliance. The appliance must be deployed in a single VPC and all inter-VPC traffic must be routed through it. Which architecture should be used?

Accepted Answer

Configure the Transit Gateway with a central inspection VPC that hosts the firewall appliance. Option C is correct because a Transit Gateway with a central inspection VPC allows all inter-VPC traffic to be routed through the firewall appliance. Option A is incorrect because VPC peering does not provide central inspection. Option B is incorrect because a Network Load Balancer does not route traffic through a firewall. Option D is incorrect because AWS Network Firewall is a managed service, not a third-party appliance.

Answer

Create a Network Load Balancer in each VPC and point to the firewall

Answer

Deploy AWS Network Firewall in each VPC

Answer

Use VPC peering connections between all VPCs and route traffic through the inspection VPC

Question 15

A company is designing a multi-region architecture using AWS Direct Connect. Which TWO of the following are valid configurations for connecting to multiple regions? (Select TWO.)

Accepted Answer

Set up separate Direct Connect connections in each region. Options B and D are correct. A Direct Connect Gateway allows connections to multiple VPCs in different regions, and multiple Direct Connect connections can be used to different regions. Option A is incorrect because a single VIF cannot be associated with multiple regions. Option C is incorrect because a Direct Connect connection is tied to a specific AWS region. Option E is incorrect because a Transit Gateway is regional.

Answer

Use a single Direct Connect connection to connect to all regions

Answer

Use a Transit Gateway to connect to multiple regions

Answer

Use a single private VIF associated with multiple regions