ANS-C01 Practice Test 29 — 15 Questions

Question 1

Order the steps to migrate a VPC from using an Internet Gateway to a NAT gateway for outbound-only internet access:

Accepted Answer

1. Create NAT gateway in a public subnet. 2. Update route tables to point default route to NAT gateway. 3. Remove the Internet Gateway route from route tables. 4. Adjust security group rules for outbound traffic. 5. Test outbound connectivity.. First create the NAT gateway, then update routes to use it, remove the IGW route, adjust security, and test.

Answer

1. Update route tables to point default route to NAT gateway. 2. Remove the Internet Gateway route. 3. Create NAT gateway in a public subnet. 4. Adjust security group rules. 5. Test outbound connectivity.

Answer

1. Remove the Internet Gateway route. 2. Create NAT gateway in a public subnet. 3. Update route tables to point default route to NAT gateway. 4. Adjust security group rules. 5. Test outbound connectivity.

Answer

1. Adjust security group rules. 2. Create NAT gateway. 3. Update routes. 4. Remove IGW route. 5. Test outbound connectivity.

Question 2

A company needs to connect multiple VPCs to a common on-premises network through a single AWS Direct Connect connection. Which AWS service should be used to simplify this architecture?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway acts as a central hub to interconnect multiple VPCs and on-premises networks through a single Direct Connect connection. It simplifies the architecture by replacing complex mesh or star topologies with a single gateway that manages routing and attachments, reducing operational overhead and cost.

Answer

AWS VPN CloudHub

Answer

VPC peering

Answer

Virtual Private Gateway (VGW)

Question 3

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team wants to ensure that traffic between VPCs is inspected by a centralized security appliance running in a security VPC. Which configuration should be used?

Accepted Answer

Attach the VPCs to the Transit Gateway and configure route tables to send inter-VPC traffic to the security VPC via a route pointing to the security VPC's attachment.. The correct approach is to use AWS Transit Gateway route tables to steer inter-VPC traffic through a security VPC. By associating VPC attachments with a TGW route table and adding a route that points to the security VPC's attachment, all traffic between VPCs is forced through the security appliance for inspection. This leverages TGW's native routing capabilities and supports centralized security without modifying individual VPC route tables or using complex peering meshes.

Answer

Configure network ACLs in each VPC to deny traffic directly between VPCs.

Answer

Create VPC peering connections between each VPC and the security VPC, then update route tables.

Answer

Use NAT gateways in each VPC to route traffic through the security VPC.

Question 4

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to establish a site-to-site VPN connection to an on-premises network with a CIDR of 192.168.0.0/16. The VPN tunnel is up, but traffic from the VPC to on-premises is not flowing. Which of the following is the most likely cause?

Accepted Answer

The VPC route table does not have a route for 192.168.0.0/16 pointing to the virtual private gateway.. For traffic from a VPC to an on-premises network over a site-to-site VPN, the VPC route table must contain a route for the on-premises CIDR (192.168.0.0/16) pointing to the virtual private gateway (VGW). Without this route, the VPC has no path to forward packets destined for 192.168.0.0/16, even though the VPN tunnel is up. Security groups and NACLs are stateful or stateless filters, but they do not create routing paths.

Answer

The security groups do not allow outbound traffic.

Answer

The NACLs are blocking outbound traffic.

Answer

The VPN connection is in the wrong AWS region.

Question 5

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to connect to the internet for patching. The security team wants to minimize the attack surface. Which solution should be used?

Accepted Answer

Create a NAT Gateway in the public subnet and update route tables. A NAT Gateway in the public subnet allows the EC2 instance in the private subnet to initiate outbound connections to the internet for patching while preventing unsolicited inbound traffic, thus minimizing the attack surface. Option A is incorrect because a proxy server adds unnecessary complexity and overhead compared to a managed NAT Gateway, and it still requires careful configuration to minimize attack surface. Option B is incorrect because an Internet Gateway cannot be attached directly to a private subnet; it is attached to the VPC and requires a public subnet for route propagation. Option D is incorrect because a VPN connection is designed for hybrid connectivity to on-premises networks, not for general internet access from a VPC.

Answer

Set up a proxy server in the public subnet

Answer

Attach an Internet Gateway to the private subnet

Answer

Use a VPN connection to the on-premises network

Question 6

A company has multiple VPCs connected via AWS Transit Gateway. One VPC contains a shared services endpoint (e.g., Amazon S3) using a VPC Gateway Endpoint. How can other VPCs access this endpoint?

Accepted Answer

Create Gateway Endpoints in each VPC that needs access. A VPC Gateway Endpoint is a regional service that uses route table entries to direct traffic to AWS services like S3 or DynamoDB without leaving the AWS network. Since Gateway Endpoints are not transitive across VPCs, each VPC that needs to access the shared S3 endpoint must have its own Gateway Endpoint created in that VPC, with the appropriate route table entries pointing to the endpoint. The Transit Gateway does not propagate Gateway Endpoint routes, so other VPCs cannot reach the endpoint through the Transit Gateway alone.

Answer

Use AWS PrivateLink to access the S3 endpoint

Answer

Configure Direct Connect to access the endpoint

Answer

Create a route in Transit Gateway pointing to the endpoint

Question 7

A financial services company is designing a VPC with multiple tiers: web, application, and database. The web tier must be accessible from the internet, but the application and database tiers must not have direct internet access. The company needs to allow the application tier to download patches from the internet. Which THREE components should be included in the design? (Choose three.)

Accepted Answer

Internet Gateway (IGW). The web tier must be reachable from the internet, so the design needs an Internet Gateway (C) attached to the VPC to provide that bidirectional internet path, and the web instances must live in a public subnet (E) whose route table points to the IGW. Because the application tier must not have direct inbound internet access yet still needs outbound access to download patches, a NAT Gateway (D) placed in a public subnet is required; it performs source NAT so private-subnet instances can initiate outbound traffic while remaining unreachable from the internet. A Direct Connect virtual interface (A) provides private dedicated connectivity to on-premises networks, not internet patch downloads, and a VPC Peering connection (B) only links two VPCs for private IP traffic, so neither satisfies the internet-access requirements here.

Answer

Direct Connect virtual interface

Answer

VPC Peering connection

Question 8

A company needs to connect its on-premises data center to AWS with a dedicated, private network connection that provides consistent performance. Which AWS service should they use?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet. This ensures consistent, low-latency performance and can reduce bandwidth costs for high-volume data transfer, making it the ideal choice for the stated requirement.

Answer

Internet Gateway

Answer

VPC Endpoint

Answer

Site-to-Site VPN

Question 9

A company wants to establish a dedicated, private connection between their on-premises data center and AWS. They require consistent, low-latency performance and support for multiple VLANs. Which AWS service should they use?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct choice because it provides a dedicated, private network connection from on-premises to AWS, bypassing the public internet to deliver consistent, low-latency performance. It supports multiple VLANs via 802.1Q tagging over a single physical connection, enabling segmentation of traffic (e.g., for private VIFs, public VIFs, and transit VIFs). This meets the requirement for a private, high-performance link with VLAN support.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

VPC Peering

Question 10

A company is deploying a multi-region Active-Active application using Amazon Route 53 latency-based routing. The application runs on EC2 instances behind Network Load Balancers (NLBs) in two AWS regions. The health checks are configured for the NLBs. What should the company do to ensure that traffic is sent only to healthy endpoints?

Accepted Answer

Use Route 53 latency-based routing and associate health checks.. Route 53 latency-based routing directs traffic to the region with the lowest latency for the user. By associating health checks with the latency records, Route 53 automatically excludes any endpoint that fails its health check (e.g., an unhealthy NLB) from DNS responses, ensuring traffic is sent only to healthy endpoints. This meets the requirement for an Active-Active multi-region setup where both regions serve traffic simultaneously.

Answer

Use Route 53 geolocation routing and associate health checks.

Answer

Use Route 53 weighted routing and associate health checks.

Answer

Use Route 53 failover routing with primary and secondary records.

Question 11

Which TWO of the following are benefits of using AWS Global Accelerator? (Choose TWO.)

Accepted Answer

Static anycast IP addresses that serve as a fixed entry point. Option A is correct because AWS Global Accelerator provides two static anycast IPv4 addresses (and optionally IPv6) that act as a fixed entry point to your application, so clients always connect to the same IPs even if you change the underlying endpoints or regions. Option E is correct because Global Accelerator uses the AWS global network and edge locations to route user traffic over the optimized AWS backbone, reducing latency and jitter and improving application performance compared with the public internet. Option B is not correct because AWS WAF is not built into Global Accelerator; WAF is associated with CloudFront, Application Load Balancer, API Gateway, or AppSync. Option C is not correct because Global Accelerator does not cache content at edge locations; caching is a CloudFront feature. Option D is not correct because Global Accelerator does not perform DNS-based load balancing; it uses static anycast IP addresses and health checks to direct traffic to healthy endpoints.

Answer

Built-in AWS WAF capabilities

Answer

Content caching similar to CloudFront

Answer

DNS-based load balancing

Question 12

A global e-commerce company is migrating to AWS and plans to use a hub-and-spoke topology with AWS Transit Gateway. The network team wants to ensure high availability for the connection between the hub VPC and the on-premises data center using AWS Direct Connect with multiple virtual interfaces (VIFs). They need to be able to fail over quickly with minimal packet loss. Which design should meet these requirements?

Accepted Answer

Provision two Direct Connect connections, each with multiple private VIFs, and attach them to the same transit gateway. Use BFD to detect failures and rely on ECMP routing across the VIFs.. It provides true high availability and fast failover by using two separate Direct Connect connections, each with multiple private VIFs, attached to the same transit gateway. BFD (Bidirectional Forwarding Detection) enables sub-second failure detection, and ECMP (Equal-Cost Multi-Path) routing across the VIFs allows active-active load balancing, minimizing packet loss during failover. This design eliminates single points of failure and meets the requirement for rapid convergence with minimal disruption.

Answer

Provision one Direct Connect connection with a single private VIF, and enable BFD on the VIF to detect failures quickly.

Answer

Provision one Direct Connect connection with two private VIFs, and use a second Direct Connect connection as backup with a single VIF. Configure route tables to prefer the primary.

Answer

Provision two Direct Connect connections, each with a single private VIF, and use AWS Site-to-Site VPN as a backup for each.

Question 13

A company wants to securely store and manage secrets such as database passwords and API keys. They need to automatically rotate secrets every 30 days and ensure that only specific IAM roles can access them. Which AWS service should they use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, managing, and automatically rotating secrets such as database passwords and API keys. It supports native rotation with AWS Lambda, enforces fine-grained access control via IAM roles, and can rotate secrets on a schedule (e.g., every 30 days) without custom scripting.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Answer

AWS CloudHSM

Question 14

An application running on EC2 instances in a private subnet needs to download patches from the internet. The VPC has an internet gateway and public subnets. Which resource should be used to provide outbound internet access to the instances?

Accepted Answer

NAT gateway in a public subnet. A NAT gateway in a public subnet provides outbound-only internet access to instances in private subnets by translating their private IP addresses to the NAT gateway's Elastic IP address. This allows the EC2 instances to download patches from the internet while preventing any unsolicited inbound connections from the internet, which is the standard design for secure outbound internet access in a VPC.

Answer

VPC gateway endpoint for S3

Answer

AWS Site-to-Site VPN connection

Answer

Internet gateway in the private subnet

Question 15

A network engineer is troubleshooting an AWS Direct Connect connection that is experiencing high latency. The connection is a 1 Gbps dedicated connection. The engineer notices that the link utilization is at 90%. What is the MOST likely cause of the high latency?

Accepted Answer

High bandwidth utilization causing queuing. High bandwidth utilization (90%) leads to queuing delays as packets wait in buffers, increasing latency. Option A is incorrect: the virtual interface type (private vs public) does not directly cause high latency. Option B is incorrect: BGP keepalive timer misconfiguration affects BGP session stability, not latency. Option D is incorrect: jumbo frames can reduce latency by reducing overhead, not increase it.

Answer

The virtual interface is configured as private instead of public

Answer

BGP keepalive timer misconfiguration

Answer

The use of jumbo frames