ANS-C01 Practice Test 29 — 15 Questions

Question 1

A company has a Direct Connect connection with a private VIF to a VPC. The VPC has a subnet that hosts an EC2 instance with a sensitive database. The company wants to add an extra layer of encryption for traffic between the on-premises network and the EC2 instance. Which solution should be used?

Accepted Answer

Set up an IPsec VPN tunnel over the Direct Connect private VIF. Option D is correct because IPsec VPN over Direct Connect provides encryption over the private VIF. Option A is incorrect because Direct Connect traffic is not encrypted by default. Option B is incorrect because TLS is for application-level encryption, not network layer. Option C is incorrect because AWS KMS is for encryption keys, not for network encryption.

Answer

Enable TLS on the EC2 instance

Answer

Use an SSL certificate on the on-premises router

Answer

Use AWS Key Management Service (KMS) to encrypt the traffic

Question 2

A company wants to provide internet access to instances in a private subnet while ensuring that traffic is logged and inspected. The solution must be highly available within a single AWS Region. Which approach should the company use?

Accepted Answer

Deploy a NAT Gateway in each Availability Zone and configure the private subnet route tables to point to the NAT Gateway in the same AZ. Use Gateway Load Balancer endpoint for traffic inspection.. Option C is correct because a NAT Gateway in each AZ is managed by AWS, provides high availability, and can be combined with a Gateway Load Balancer and third-party appliances for inspection and logging. Option A is wrong because a single NAT instance is not highly available. Option B is wrong because an Internet Gateway allows inbound traffic. Option D is wrong because VPC endpoints are for private connectivity to AWS services, not internet access.

Answer

Launch a NAT instance in a public subnet and configure it as the default route for the private subnet.

Answer

Create a VPC endpoint for the internet and attach it to the private subnet.

Answer

Attach an Internet Gateway to the VPC and add a default route to it in the private subnet's route table.

Question 3

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. The on-premises network uses BGP to advertise a route for 10.0.0.0/8. The VPC CIDR is 10.1.0.0/16. The company wants to ensure that all traffic from the VPC to on-premises uses the Direct Connect connection, but if the Direct Connect fails, traffic should fail over to a VPN connection. Which configuration achieves this?

Accepted Answer

Configure a BGP local preference of 200 on the Direct Connect VIF and 100 on the VPN connection, and use the same ASN for both.. Option A is correct because a lower BGP local preference on the VPN side makes the Direct Connect route more preferred. Option B is wrong because a higher AS path prepend on the Direct Connect side would make it less preferred. Option C is wrong because a static route with a high metric would be less preferred, not a backup. Option D is wrong because setting a lower MED on the Direct Connect side would make it more preferred, but the question asks for failover order; the VPN should be backup, so VPN MED should be higher.

Answer

Create a static route in the VPC route table pointing to the VPN with a metric of 100, and let BGP propagate the Direct Connect route.

Answer

Set the MED attribute on the Direct Connect VIF to 100 and on the VPN to 200.

Answer

Configure AS path prepend on the Direct Connect side to advertise a longer AS path.

Question 4

A company is deploying an application across multiple Availability Zones in a single AWS Region. The application requires that all traffic between EC2 instances in the same subnet be inspected by a network appliance. Which configuration should be used to meet this requirement?

Accepted Answer

Create a Gateway Load Balancer and configure the appliance as a target. Option B is correct because a Gateway Load Balancer (GWLB) can be deployed in a subnet and configured to route traffic between instances in the same subnet through the network appliance. Option A is incorrect because a Transit Gateway is used for inter-VPC routing, not intra-subnet inspection. Option C is incorrect because a VPC peering connection connects different VPCs. Option D is incorrect because AWS Network Firewall inspects traffic at VPC boundaries, not within a subnet.

Answer

Set up a VPC peering connection between the subnets

Answer

Use a Transit Gateway to route traffic through the appliance

Answer

Deploy AWS Network Firewall in the subnet

Question 5

Which THREE of the following are features of AWS Transit Gateway? (Select THREE.)

Accepted Answer

Multicast support. Options A, B, and D are correct. Transit Gateway supports transitive peering, multicast, and central routing. Option C is incorrect because Transit Gateway does not support edge-to-edge routing for VPN. Option E is incorrect because Transit Gateway does not replace NAT Gateway; NAT Gateway is separate.

Answer

Built-in NAT capabilities

Answer

Edge-to-edge routing for VPN connections

Question 6

A company has a VPC with multiple subnets across three Availability Zones. The company wants to deploy a Network Load Balancer (NLB) to distribute TCP traffic to a fleet of EC2 instances. The NLB must preserve the source IP address of the client. Which configuration is required?

Accepted Answer

Create the NLB with a TCP listener and register the EC2 instances as targets in a target group.. Option A is correct because NLB preserves the source IP address by default when using TCP traffic and target group with instance targets. Option B is wrong because enabling Proxy Protocol would add a proxy header, but NLB still preserves source IP. Option C is wrong because an NLB does not use security groups. Option D is wrong because cross-zone load balancing does not affect source IP preservation.

Answer

Enable Proxy Protocol v2 on the NLB target group.

Answer

Enable cross-zone load balancing on the NLB.

Answer

Attach a security group to the NLB that allows inbound traffic from the client IP range.

Question 7

A company has a VPN connection between an on-premises network and AWS using two tunnels for redundancy. The BGP sessions are established, but traffic is only flowing through one tunnel. The engineer wants to ensure both tunnels are actively used. What should be configured?

Accepted Answer

Advertise the same BGP prefixes over both tunnels from the on-premises router.. Option D is correct because BGP supports load balancing by advertising the same prefixes from both tunnels. AWS VPN supports active/active mode if the customer gateway device is configured to advertise the same BGP routes over both tunnels. Option A is incorrect because static routes do not provide automatic failover. Option B is incorrect because different ASNs would break BGP. Option C is incorrect because the VPN connection itself does not have a load balancer.

Answer

Enable load balancing on the VPN connection in the AWS console.

Answer

Configure static routes for the second tunnel.

Answer

Assign different BGP ASNs to each tunnel.

Question 8

A company is deploying a hybrid network architecture with an AWS Direct Connect connection. They require high availability with redundant connections to two different AWS Direct Connect locations. Which configuration meets the high availability requirement?

Accepted Answer

Two Direct Connect connections at two different AWS Direct Connect locations. Option C is correct because using two separate Direct Connect locations provides physical diversity and redundancy. Option A is wrong because a single location is a single point of failure. Option B is wrong because two connections at the same location lack diversity. Option D is wrong because VPN over internet is not as reliable as dedicated connections.

Answer

One Direct Connect connection and one AWS Site-to-Site VPN as backup

Answer

Two virtual interfaces (VIFs) on the same Direct Connect connection

Answer

Two Direct Connect connections at the same AWS Direct Connect location

Question 9

A company is deploying a new VPC with public and private subnets. The VPC will host web servers in the public subnet and database servers in the private subnet. The web servers need to access the internet for updates, and the database servers need to receive traffic only from the web servers. Which THREE components are essential for this architecture?

Accepted Answer

NAT gateway in the public subnet. Options A, C, and D are correct because an internet gateway provides internet access for public subnets, a NAT gateway provides internet access for private subnets, and security groups act as firewalls for EC2 instances. Option B is wrong because NACLs are stateless and less granular. Option E is wrong because VPC endpoint is not needed for general internet access.

Answer

Network ACL for subnets

Answer

VPC endpoint for S3

Question 10

Which TWO of the following are true about AWS VPC endpoints? (Choose two.)

Accepted Answer

Gateway Endpoints can be used to access Amazon S3 and DynamoDB.. Options B and D are correct. A is wrong because Gateway Endpoint does not use PrivateLink; it uses route table entries. C is wrong because Interface Endpoints are not free; you pay per hour and per GB processed. B: Gateway Endpoints support S3 and DynamoDB. D: Interface Endpoints are powered by PrivateLink.

Answer

Interface Endpoints are free of charge.

Answer

Gateway Endpoints use AWS PrivateLink.

Answer

Both Gateway and Interface Endpoints require a NAT gateway.

Question 11

A company is designing a VPC with public and private subnets in two Availability Zones. The private subnets host EC2 instances that need to download patches from the internet. The company wants to minimize costs while ensuring high availability. Which solution meets these requirements?

Accepted Answer

Create a NAT gateway in a public subnet in each Availability Zone and configure route tables for private subnets to use the NAT gateway in the same AZ.. Option D is correct because two NAT gateways (one per AZ) provide high availability, and each is placed in a public subnet. Option A is wrong because a single NAT gateway is a single point of failure. Option B is wrong because NAT instances are less reliable and require more management. Option C is wrong because a NAT gateway in one AZ provides no cross-AZ high availability if that AZ fails.

Answer

Create a NAT gateway in one public subnet and use a second NAT gateway in a different AZ as a backup, but only route traffic to the primary.

Answer

Create a NAT gateway in one public subnet and configure route tables for private subnets to use it.

Answer

Launch a NAT instance in one public subnet and configure route tables for private subnets to use it.

Question 12

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to access an S3 bucket in the same Region. Which solution provides the most secure and cost-effective connectivity?

Accepted Answer

Create a gateway endpoint for S3 in the VPC and add a route in the private subnet's route table pointing to the endpoint.. Option B is correct because a gateway endpoint for S3 is free and provides private connectivity to S3 without traversing the internet. Option A is wrong because an internet gateway would expose the instance to the internet and incur costs. Option C is wrong because a NAT gateway incurs costs and is less secure than a VPC endpoint. Option D is wrong because an interface endpoint for S3 is not available; S3 uses gateway endpoints.

Answer

Create a NAT gateway in a public subnet and add a route in the private subnet's route table pointing to the NAT gateway.

Answer

Create an interface endpoint for S3 in the private subnet.

Answer

Attach an internet gateway to the VPC and add a route to the internet gateway in the private subnet's route table.

Question 13

A company has a Direct Connect connection with multiple Virtual Interfaces (VIFs) to an on-premises network. The VIFs are associated with a Direct Connect Gateway that is attached to multiple VPCs. The company is experiencing asymmetric routing and wants to ensure that traffic from on-premises to the VPCs always uses the same VIF. Which configuration should be implemented?

Accepted Answer

Configure BGP communities on the VIFs to influence route preference. Option A is correct because BGP communities can be used to influence routing decisions on the on-premises router to prefer a specific VIF. Option B is incorrect because Jumbo Frames do not affect routing. Option C is incorrect because the Local Preference attribute is set on the on-premises router, not in AWS. Option D is incorrect because AS_PATH prepending is used to make a path less preferred, not more.

Answer

Use AS_PATH prepending on the VIFs to make one path more preferred

Answer

Enable Jumbo Frames on the Direct Connect connection

Answer

Set the Local Preference attribute on the AWS side

Question 14

A company is deploying a multi-tier web application in a VPC with public and private subnets. The web servers in the public subnets must be able to initiate outbound connections to the internet for software updates, but must not be directly accessible from the internet. Which configuration meets these requirements?

Accepted Answer

Deploy a NAT Gateway in a public subnet and add a default route to the NAT Gateway in the private subnet's route table.. Option D is correct because a NAT Gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet while remaining unreachable from the internet. Option A is wrong because an Internet Gateway alone would allow inbound traffic. Option B is wrong because a NAT Instance in a private subnet cannot reach the internet. Option C is wrong because an ALB does not provide outbound internet access.

Answer

Deploy a NAT instance in a private subnet and add a default route to the NAT instance in the private subnet's route table.

Answer

Deploy an Application Load Balancer (ALB) in a public subnet and route outbound traffic through the ALB.

Answer

Attach an Internet Gateway to the VPC and add a default route to the Internet Gateway in the public subnet's route table.

Question 15

A company is designing a hybrid network using AWS Direct Connect and a Site-to-Site VPN as a backup. The company has two Direct Connect connections from different providers for redundancy. The company wants to use BGP to automatically fail over to the VPN if both Direct Connect connections fail. Which TWO configurations are required to achieve this?

Accepted Answer

Adjust BGP attributes on the Direct Connect routes to be preferred over the VPN routes.. Option B and Option E are correct. A VPN connection uses BGP to exchange routes, and adjusting BGP attributes (like local preference) can make the VPN route less preferred than Direct Connect routes. Option A is wrong because static routes do not provide dynamic failover. Option C is wrong because the VPN should be a backup, so it should have lower local preference. Option D is wrong because disabling route propagation on the VPN would remove its routes.

Answer

Set a higher local preference on the VPN route to make it preferred over Direct Connect.

Answer

Configure the VPN connection with static routes instead of BGP.

Answer

Disable route propagation on the VPN connection's route table.