ANS-C01 Practice Test 28 — 15 Questions

Question 1

A company is designing a high-availability architecture for an application that will be deployed across multiple Availability Zones. Which THREE components are recommended for this design? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Application Load Balancer across multiple AZs. Option B (Application Load Balancer across multiple AZs) is correct because an ALB is a regional, highly available load balancer that distributes traffic across targets in multiple Availability Zones, providing fault tolerance if one AZ fails. Option C (NAT Gateway in each AZ) is correct because a NAT Gateway is zonal; deploying one per AZ ensures outbound internet access for private subnets remains available even if a single AZ becomes unavailable, avoiding a single point of failure. Option D (Auto Scaling group with instances in multiple AZs) is correct because an ASG can span multiple AZs and automatically replace unhealthy instances and rebalance capacity across zones, maintaining application availability. Option A is not recommended because a single EC2 instance per AZ without an Auto Scaling group still leaves each instance as an unmanaged single point of failure and cannot self-heal. Option E is not recommended because a single NAT Gateway in one AZ creates a zonal single point of failure for outbound traffic if that AZ is lost.

Answer

One EC2 instance in each AZ

Answer

Single NAT Gateway in one AZ

Question 2

A company is deploying a web application in a VPC. They need to ensure that the web servers can be accessed from the internet and that traffic is encrypted. Which TWO services should they use?

Accepted Answer

Application Load Balancer (ALB). The Application Load Balancer (ALB) is correct because it operates at Layer 7 and can be configured as internet-facing within a public subnet, distributing incoming HTTP/HTTPS traffic from the internet to the backend web servers in the VPC. AWS Certificate Manager (ACM) is correct because it provisions and manages the TLS/SSL certificates that the ALB uses to terminate HTTPS connections, thereby encrypting traffic between clients and the load balancer. Together, the ALB provides the public entry point and ACM supplies the certificate enabling encrypted HTTPS access. AWS WAF is a Layer 7 firewall for filtering malicious requests but does not by itself provide internet access or encryption. NAT Gateway only enables outbound internet access for private subnets and does not accept inbound traffic. Amazon CloudFront is a CDN that can front an application, but it is not required to make the web servers reachable or to encrypt traffic to them.

Answer

AWS WAF

Answer

NAT Gateway

Answer

Amazon CloudFront

Question 3

A company has a Direct Connect connection with a private VIF to a VPC. The VPC has a subnet that hosts an EC2 instance with a sensitive database. The company wants to add an extra layer of encryption for traffic between the on-premises network and the EC2 instance. Which solution should be used?

Accepted Answer

Set up an IPsec VPN tunnel over the Direct Connect private VIF. An IPsec VPN tunnel over a Direct Connect private VIF adds an extra layer of encryption to traffic between on-premises and the EC2 instance. Direct Connect private VIFs provide a private, isolated connection but do not encrypt data by default; IPsec encrypts the IP payload at Layer 3, ensuring confidentiality over the physical link. This meets the requirement for an additional encryption layer without altering the application or network stack on the EC2 instance.

Answer

Enable TLS on the EC2 instance

Answer

Use an SSL certificate on the on-premises router

Answer

Use AWS Key Management Service (KMS) to encrypt the traffic

Question 4

A company has a VPC with public and private subnets in two Availability Zones. The private subnets host EC2 instances that need to access the internet for software updates. The company must ensure that traffic from the private instances uses a single, predictable public IP address. What is the MOST cost-effective solution?

Accepted Answer

Deploy a NAT Gateway in a public subnet in one Availability Zone, and route private subnet traffic to it.. A NAT Gateway in a public subnet provides outbound-only internet access for private instances, and it uses a single Elastic IP address, ensuring a predictable public IP. This is the most cost-effective managed solution, as NAT Gateways are highly available within an Availability Zone and require no manual instance management.

Answer

Attach an Internet Gateway to the VPC and update the private subnet route table with a default route to the Internet Gateway.

Answer

Create a Transit Gateway with a VPC attachment and route traffic through a central egress VPC.

Answer

Launch a NAT instance in a public subnet and configure source/destination check.

Question 5

A company is experiencing intermittent connectivity issues between its on-premises network and AWS via a Direct Connect connection. The link is up, but packet loss is observed. Which test should the network engineer perform first to isolate the issue?

Accepted Answer

Run a traceroute with MTR. MTR (My TraceRoute) combines the functionality of traceroute and ping to provide per-hop latency and packet loss statistics. This allows the engineer to pinpoint whether the packet loss is occurring on the Direct Connect link itself, the customer gateway, or somewhere in the transit path, rather than just confirming end-to-end reachability.

Answer

Ping the virtual private gateway

Answer

Perform a DNS lookup

Answer

Run a speed test

Question 6

A company has a VPC with CIDR 10.0.0.0/16 and two subnets: 10.0.1.0/24 (public) and 10.0.2.0/24 (private). The company wants to add a new subnet for a third tier. Which of the following are valid subnet CIDRs that can be added? (Select TWO.)

Accepted Answer

10.0.3.0/24. (10.0.3.0/24) is correct because it falls within the VPC CIDR 10.0.0.0/16 and does not overlap with the existing subnets (10.0.1.0/24 and 10.0.2.0/24). The /24 prefix length matches the existing subnet structure, and the third octet (3) is outside the range of the first two subnets, ensuring no IP address conflict.

Answer

10.0.1.128/25

Answer

10.1.0.0/16

Answer

10.0.2.64/26

Question 7

Which THREE components are required to establish a site-to-site VPN connection between an on-premises network and AWS? (Choose THREE.)

Accepted Answer

Virtual Private Gateway. To build a site-to-site VPN between on-premises and AWS, you must create a Virtual Private Gateway (C) and attach it to the target VPC; it is the AWS-side VPN endpoint that terminates the IPSec tunnels. You also need a Customer Gateway (D), which is the AWS resource representing the on-premises VPN device's public IP address and BGP ASN, so AWS knows the remote peer. Finally, the VPN Connection (E) is the actual IPSec tunnel resource that binds the Virtual Private Gateway and Customer Gateway together, providing the encrypted link. AWS Direct Connect (A) is a dedicated private circuit, not an IPSec VPN, and AWS Transit Gateway (B) is a hub for connecting VPCs/VPNs at scale but is not required for a basic site-to-site VPN.

Answer

AWS Direct Connect

Answer

AWS Transit Gateway

Question 8

A company is designing a network architecture for a multi-tier web application. The application includes a public-facing Application Load Balancer (ALB) in a public subnet, web servers in private subnets, and an Amazon RDS database in a private subnet. The company requires that the database is not directly accessible from the application servers except through specific ports, and that traffic between the web servers and the database is encrypted. Which TWO actions should the company take to meet these requirements? (Choose two.)

Accepted Answer

Enable SSL/TLS encryption for connections between the web servers and the RDS database. Option C is correct because enabling SSL/TLS encryption on the RDS connection ensures that data in transit between the web servers and the database is encrypted, satisfying the requirement that traffic between them is encrypted; this is done by requiring SSL/TLS in the RDS parameter group and connecting with the RDS CA certificate. Option D is correct because configuring the RDS security group to allow inbound traffic only from the web servers' security group on the database port (for example, 3306 for MySQL or 5432 for PostgreSQL) enforces least-privilege access and ensures the database is reachable only through the specific database port by the application tier. Option A is incorrect because placing the RDS database in a public subnet exposes it to the internet and contradicts the requirement that it not be directly accessible except through specific ports from the application servers. Option B is incorrect because a VPC peering connection is unnecessary when the web servers and RDS are already in the same VPC, and it does not by itself restrict access to specific ports or encrypt traffic. Option E is incorrect because a network ACL is stateless and subnet-level, and restricting inbound traffic by the web servers' IP range is less precise and less secure than referencing the web servers' security group; it also does not provide encryption.

Answer

Place the RDS database in a public subnet with a security group that allows only the web servers' IP addresses

Answer

Establish a VPC peering connection between the web servers' VPC and the RDS VPC

Answer

Use a network ACL to restrict inbound traffic to the RDS subnet to only the web server's IP range

Question 9

A company is designing a multi-region architecture with an active-active setup. They need to route traffic to the nearest healthy endpoint. Which AWS service should they use?

Accepted Answer

Amazon Route 53 latency-based routing. Amazon Route 53 latency-based routing directs traffic to the AWS Region that provides the lowest latency for the end user, based on measurements between the user's DNS resolver and AWS endpoints. It also supports health checks, automatically excluding unhealthy endpoints from the routing pool, which enables an active-active multi-region architecture by routing each request to the nearest healthy endpoint. AWS Global Accelerator also routes to the nearest healthy endpoint but uses anycast IPs at the network layer, making it more suitable for optimizing TCP/UDP traffic rather than general DNS-level routing.

Answer

Application Load Balancer (ALB)

Answer

AWS Global Accelerator

Answer

Amazon CloudFront

Question 10

A company is deploying a VPC with public and private subnets in two Availability Zones. They need to ensure that instances in private subnets can access the internet for software updates while remaining unreachable from the internet. Which solution meets these requirements?

Accepted Answer

Deploy a NAT Gateway in a public subnet and add a route to the NAT Gateway in the private subnet route tables.. A NAT Gateway deployed in a public subnet provides outbound-only internet access for instances in private subnets. The private subnet route table directs 0.0.0.0/0 traffic to the NAT Gateway, which translates the private IPs to the NAT Gateway's Elastic IP, allowing internet access while preventing any unsolicited inbound connections from the internet.

Answer

Attach an internet gateway to the private subnets and configure route tables.

Answer

Use a transit gateway to connect the VPC to the internet.

Answer

Establish a VPN connection to an on-premises network and route traffic through it.

Question 11

A network engineer is troubleshooting a VPN connection that is not passing traffic. The tunnel status shows as 'UP'. Which THREE steps should the engineer take to diagnose the issue?

Accepted Answer

Ensure that the security groups for instances allow inbound traffic from the on-premises network. Option A is correct because even when a VPN tunnel is UP, security groups on the instances act as stateful firewalls and must explicitly permit inbound traffic sourced from the on-premises CIDR range, otherwise packets are silently dropped. Option B is correct because the tunnel being UP only proves IKE/IPsec Phase 1 and Phase 2 succeeded; if the on-premises router is not advertising the correct prefixes via BGP (or the BGP session is down), the VPC will have no learned routes and traffic cannot return. Option D is correct because the VPC route table must contain a route pointing the on-premises CIDR to the virtual private gateway; without it, instances have no path to send traffic into the VPN. Option C is not the best step here since IKE/IPsec mismatches would typically prevent the tunnel from reaching UP status, and the scenario states the tunnel is already UP. Option E is incorrect because an internet gateway route table is irrelevant to VPN traffic, which traverses the virtual private gateway, not the IGW.

Answer

Check the IKE and IPSEC settings on the customer gateway

Answer

Check the internet gateway route table for the VPC

Question 12

A company has a global application that uses Amazon Route 53 for DNS. The application is deployed in us-east-1 and eu-west-1. The company wants to route users to the Region with the lowest latency, but also provide failover if one Region becomes unhealthy. Which Route 53 routing policy should be used?

Accepted Answer

Latency-based routing with health checks. Latency-based routing with health checks is correct because it directs users to the Region that provides the lowest latency for each individual request, while health checks automatically remove unhealthy endpoints from the routing pool. This combination meets both the latency optimization and failover requirements without requiring a static primary/secondary configuration.

Answer

Weighted routing with equal weights

Answer

Failover routing with primary in us-east-1

Answer

Geoproximity routing

Question 13

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company wants to use a single NAT Gateway for all private subnets to reduce costs, but the NAT Gateway is in a single Availability Zone (AZ). The network architect is concerned about single points of failure. Which design best addresses high availability while still using the minimum number of NAT Gateways?

Accepted Answer

Deploy one NAT Gateway in each AZ that contains private subnets, and update the route tables accordingly.. Deploying one NAT Gateway per Availability Zone (AZ) that contains private subnets ensures that if an AZ fails, the private subnets in other AZs still have internet access via their local NAT Gateway. This design provides high availability while using the minimum number of NAT Gateways necessary to cover all AZs with private subnets, avoiding a single point of failure without over-provisioning.

Answer

Deploy a single NAT Gateway in one AZ and use a VPN to an on-premises internet gateway as backup.

Answer

Use a NAT instance in an Auto Scaling group across multiple AZs instead of a NAT Gateway.

Answer

Create a second VPC with a NAT Gateway and peer the VPCs to share the NAT Gateway.

Question 14

A company is deploying a hybrid network architecture with an AWS Direct Connect connection. They require high availability with redundant connections to two different AWS Direct Connect locations. Which configuration meets the high availability requirement?

Accepted Answer

Two Direct Connect connections at two different AWS Direct Connect locations. Deploying two Direct Connect connections at two different AWS Direct Connect locations provides physical and logical redundancy. This ensures that if one location experiences an outage, the other location can continue to handle traffic, meeting the high availability requirement. AWS recommends this architecture for production workloads requiring resilient hybrid connectivity.

Answer

One Direct Connect connection and one AWS Site-to-Site VPN as backup

Answer

Two virtual interfaces (VIFs) on the same Direct Connect connection

Answer

Two Direct Connect connections at the same AWS Direct Connect location

Question 15

A company wants to securely store database credentials and automatically rotate them every 90 days. Which TWO AWS services can work together to achieve this? (Choose TWO.)

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager (A) is correct because it is purpose-built to store and manage secrets such as database credentials, and it includes native, built-in rotation support that can automatically rotate secrets on a schedule (for example, every 90 days) using a rotation Lambda function. AWS Lambda (D) is correct because Secrets Manager invokes a Lambda rotation function to perform the actual rotation logic, connecting to the database and updating both the credential and the stored secret value. Together, Secrets Manager schedules and stores the secret while Lambda executes the rotation, satisfying the 90-day automatic rotation requirement. AWS CloudHSM (B) provides dedicated hardware security modules for cryptographic key operations but does not store or rotate database credentials on a schedule. AWS KMS (C) is an encryption key management service used to encrypt secrets at rest, not a credential store with rotation scheduling. AWS Systems Manager Parameter Store (E) can store parameters and SecureString values, but it lacks native automatic credential rotation, so it cannot meet the 90-day rotation requirement on its own.

Answer

AWS CloudHSM

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store