ANS-C01 Practice Test 28 — 15 Questions

Question 1

A network engineer is troubleshooting connectivity issues between an on-premises network and a VPC over a Direct Connect private VIF. The on-premises network can reach EC2 instances in the VPC, but cannot reach an RDS database in the same VPC. The VPC has a single subnet. What is the MOST likely cause?

Accepted Answer

The RDS database security group is not allowing inbound traffic from the on-premises CIDR. Option C is correct because the RDS security group likely does not allow inbound traffic from the on-premises CIDR. Option A is wrong because VPC route table would affect all traffic to the subnet. Option B is wrong if the security group is not the issue; NACLs are stateless and could be the cause but security group is more likely for RDS. Option D is wrong because Direct Connect routing is working for EC2.

Answer

The VPC network ACL is blocking inbound traffic from on-premises

Answer

The direct connect virtual interface is configured for a different VLAN

Answer

The VPC route table does not have a route to the on-premises network

Question 2

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network uses BGP to advertise its prefixes. Recently, the on-premises router started advertising a more specific route (10.0.0.0/24) that overlaps with the VPC's CIDR (10.0.0.0/16). What is the impact on traffic destined to 10.0.0.5?

Accepted Answer

Return traffic from the instance to on-premises is routed through Direct Connect instead of staying within the VPC.. Option C is correct because when a Direct Connect virtual interface advertises a more specific route that overlaps with the VPC CIDR, AWS prefers the more specific route from Direct Connect, causing traffic from the VPC to the on-premises network to be routed via Direct Connect instead of locally. Option A is wrong because the instance remains reachable from on-premises. Option B is wrong because BGP does not cause route flapping in this scenario. Option D is wrong because the traffic is not blackholed; it goes to on-premises.

Answer

The instance becomes unreachable from on-premises.

Answer

Traffic destined to the instance is blackholed.

Answer

Traffic is load-balanced between the VPC and Direct Connect.

Question 3

Which TWO of the following are valid methods to connect multiple VPCs together in a hub-and-spoke topology while maintaining centralized control? (Choose two.)

Accepted Answer

Establish VPC peering connections in a full mesh and manage routes centrally.. Correct: A (Transit Gateway with central VPC) and D (VPC peering with full mesh) are valid hub-and-spoke methods. B is wrong because VPNs are not typically used for VPC-to-VPC. C is wrong because VPC endpoints are for connecting to AWS services, not VPCs. E is wrong because Direct Connect is for on-premises, not VPC-to-VPC.

Answer

Create a VPN connection between each VPC and a central VPN appliance.

Answer

Use Direct Connect to connect VPCs.

Answer

Use VPC Gateway Endpoints to connect VPCs.

Question 4

A company is designing a multi-tier application in a VPC. The web tier must be accessible from the internet, while the application tier must only be accessible from the web tier. The database tier must be isolated from all other tiers except the application tier. Which TWO network architectures meet these requirements? (Choose TWO.)

Accepted Answer

Use a public subnet for an Application Load Balancer and private subnets for web, app, and database tiers. Use security groups to restrict traffic between tiers.. Options B and D are correct. Option B uses public subnets for web, private subnets for app, and isolated subnets for database, with security groups controlling access. Option D uses a single private subnet with security groups and an ALB in a public subnet to expose the web tier. Option A is wrong because a single public subnet does not isolate tiers. Option C is wrong because placing all tiers in private subnets with a NAT gateway does not provide inbound access from the internet. Option E is wrong because a VPN connection is not needed.

Answer

Use a single public subnet for all tiers and control access with security groups.

Answer

Use private subnets for all tiers and a NAT gateway for internet access from the web tier. Use security groups to control traffic.

Answer

Use a VPN connection from the on-premises network to access all tiers.

Question 5

An application running on EC2 instances in a private subnet needs to send logs to Amazon CloudWatch Logs. Which step is essential to allow this communication without traversing the internet?

Accepted Answer

Create a VPC Gateway Endpoint for CloudWatch Logs and update the route table.. Option A is correct because a VPC Gateway Endpoint for CloudWatch Logs provides private connectivity. Option B is wrong because a NAT Gateway is needed only for internet traffic. Option C is wrong because a VPC Interface Endpoint is not the only way; Gateway Endpoints are simpler for CloudWatch Logs. Option D is wrong because an Internet Gateway is not needed.

Answer

Create a VPC Interface Endpoint for CloudWatch Logs and attach it to the subnet.

Answer

Assign a public IP to the EC2 instance and route directly to the internet.

Answer

Attach a NAT Gateway to the private subnet and route traffic to the internet.

Question 6

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16 and needs to add IPv6 support for its public-facing web application. The application must be accessible via both IPv4 and IPv6. The VPC already has an Internet Gateway attached. What is the correct set of steps to enable IPv6?

Accepted Answer

Associate an Amazon-provided IPv6 CIDR block to the VPC, add a route for ::/0 to the Internet Gateway, and allocate IPv6 addresses to the subnets.. Option D is correct because to enable IPv6, you must associate an Amazon-provided IPv6 CIDR block with the VPC, update the route table to include a route for ::/0 to the Internet Gateway, and ensure the subnet has an IPv6 CIDR. Option A is wrong because you cannot assign a /64 block to a VPC. Option B is wrong because Egress-Only Internet Gateway is for outbound-only IPv6, not inbound. Option C is wrong because you cannot assign a custom IPv6 block without requesting it.

Answer

Assign a custom IPv6 CIDR block from your own range to the VPC and add a route to the Internet Gateway.

Answer

Associate an IPv6 CIDR block, create an Egress-Only Internet Gateway, and route ::/0 to it.

Answer

Associate a /64 IPv6 CIDR block to the VPC, add a route for ::/0 to the Internet Gateway, and assign IPv6 addresses to instances.

Question 7

A company wants to securely connect multiple VPCs in the same region to a common on-premises network using a single Direct Connect connection. Which AWS service should they use to simplify the network architecture?

Accepted Answer

Direct Connect Gateway. Option B is correct. A Direct Connect gateway allows you to associate multiple VPCs (via virtual private gateways or transit gateways) to a single Direct Connect connection. Option A is wrong because a transit gateway alone does not include Direct Connect. Option C is wrong because a VPC peering connection is for VPC-to-VPC, not Direct Connect. Option D is wrong because a VPN gateway is for VPN, not Direct Connect.

Answer

Virtual Private Gateway

Answer

VPC Peering

Answer

Transit Gateway

Question 8

A network engineer is troubleshooting connectivity from an EC2 instance in a private subnet to an S3 bucket. The VPC has a VPC endpoint for S3 configured. The instance can access the internet via a NAT Gateway. Which configuration is MOST likely causing the connection to S3 to fail?

Accepted Answer

The route table for the private subnet is missing a route to the S3 VPC endpoint.. If a VPC endpoint for S3 is configured, traffic to S3 should use the endpoint and not go through the NAT Gateway. If the route table for the private subnet does not have a route to the S3 endpoint, traffic will go through the NAT Gateway, which may have security group restrictions or other issues. Option A is wrong because S3 endpoints do not use IAM roles for network connectivity. Option C is wrong because VPC endpoints do not require a public IP. Option D is wrong because S3 endpoints work across AZs.

Answer

The S3 VPC endpoint is in a different Availability Zone than the instance.

Answer

The S3 bucket policy does not allow access from the VPC endpoint.

Answer

The EC2 instance does not have a public IP address.

Question 9

A network engineer is setting up a site-to-site VPN connection between an on-premises network and an AWS VPC. The engineer configures the customer gateway device with the correct parameters. However, the VPN tunnel status remains 'DOWN'. What is the most likely cause?

Accepted Answer

The pre-shared key on the customer gateway device does not match the pre-shared key configured in the VPN connection.. Option B is correct because the VPN tunnel pre-shared keys (PSK) must match exactly between the customer gateway and the AWS VPN endpoint. Option A is wrong because security groups do not affect VPN tunnel establishment; they control traffic within the VPC. Option C is wrong because the virtual private gateway (VGW) is attached to the VPC, not the customer gateway. Option D is wrong because the VPN connection must be associated with the VGW, not a subnet.

Answer

The virtual private gateway is not attached to the customer gateway.

Answer

The VPN connection is not associated with a subnet.

Answer

The security group associated with the VPN endpoint is blocking the traffic.

Question 10

A company runs a critical application on EC2 instances behind an Application Load Balancer. They need to ensure that if an instance fails health checks, it is automatically terminated and replaced. Which AWS service should they use?

Accepted Answer

Auto Scaling group. The correct answer is D because Auto Scaling groups can automatically replace unhealthy instances based on health checks from the load balancer. Option A (EC2) does not provide automatic replacement. Option B (CloudWatch) can monitor but not replace. Option C (Lambda) could be used with custom logic but is not the standard solution.

Answer

AWS Lambda

Answer

EC2 Instance Connect

Answer

Amazon CloudWatch

Question 11

A company is running a two-tier application with a web tier and a database tier. The web tier must be accessible from the internet, but the database tier should only be accessible from the web tier. Which architecture should they use?

Accepted Answer

Web tier in public subnet, database tier in private subnet with a security group allowing only web tier.. The correct answer is C because placing the web tier in a public subnet with an Internet Gateway and the database tier in a private subnet with a security group that allows traffic only from the web tier provides the required security. Option A (both in public) exposes the database. Option B (both in private) prevents internet access. Option D (database in public) is insecure.

Answer

Both tiers in public subnets with security groups restricting database access.

Answer

Both tiers in private subnets with a NAT Gateway for internet access.

Answer

Web tier in private subnet, database tier in public subnet with a security group.

Question 12

A company is deploying a new application in a VPC with public and private subnets. The application servers in the private subnets need to access the internet to download patches. Which configuration meets this requirement without allowing inbound internet traffic?

Accepted Answer

Create a NAT gateway in a public subnet and add a route to the NAT gateway from the private subnets' route tables.. Option B is correct because a NAT gateway in a public subnet provides outbound internet access for instances in private subnets while blocking unsolicited inbound connections. Option A is wrong because an internet gateway attached to the private subnet would allow inbound traffic. Option C is wrong because a VPC endpoint is for private connectivity to AWS services, not general internet. Option D is wrong because a VPN connection is for private connectivity to a remote network, not internet access.

Answer

Attach an internet gateway to the private subnets and configure route tables accordingly.

Answer

Establish a site-to-site VPN connection to an on-premises internet gateway.

Answer

Configure a VPC endpoint for the internet in the private subnets.

Question 13

A company has a VPC with an application load balancer (ALB) in public subnets and EC2 instances in private subnets. The EC2 instances must only accept traffic from the ALB. Which security group configuration achieves this?

Accepted Answer

Allow inbound traffic from the ALB's security group on the application port.. Option C is correct because a security group rule referencing the ALB's security group allows traffic only from the ALB. Option A is wrong because allowing 0.0.0.0/0 allows all traffic. Option B is wrong because allowing the VPC CIDR allows all instances in the VPC, not just the ALB. Option D is wrong because allowing the private subnet CIDR allows all instances in those subnets.

Answer

Allow inbound traffic from 0.0.0.0/0 on the application port.

Answer

Allow inbound traffic from the VPC CIDR on the application port.

Answer

Allow inbound traffic from the private subnet CIDR on the application port.

Question 14

Which THREE of the following are considerations when designing a VPC with multiple Availability Zones for high availability? (Choose THREE.)

Accepted Answer

Use an Application Load Balancer to distribute traffic across instances in different Availability Zones.. Options B, D, and E are correct. Using NAT gateways in each AZ ensures availability if one AZ fails. Spreading subnets across AZs provides redundancy. Using an Application Load Balancer distributes traffic across AZs. Option A is wrong because a single NAT gateway in one AZ is a single point of failure. Option C is wrong because a single public subnet across all AZs is not possible; subnets are per AZ.

Answer

Create a single public subnet that spans all Availability Zones.

Answer

Use a single NAT gateway in one Availability Zone to reduce cost.

Question 15

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company wants to ensure that traffic can only go out to the internet and not be initiated from the internet. Which configuration should be used?

Accepted Answer

Deploy a NAT Gateway in a public subnet and update the private subnet route table. Option B is correct because a NAT Gateway in a public subnet allows private instances to initiate outbound traffic to the internet while blocking inbound traffic. Option A is incorrect because an Internet Gateway allows both inbound and outbound traffic. Option C is incorrect because a VPC endpoint is for accessing AWS services, not the internet. Option D is incorrect because a VPN connection is for private connectivity to on-premises.

Answer

Attach an Internet Gateway to the private subnets

Answer

Set up a VPN connection to an on-premises network

Answer

Create a VPC endpoint for S3