ANS-C01 Practice Test 30 — 15 Questions

Question 1

A company has a VPC with a public subnet and a private subnet. They launch an EC2 instance in the private subnet with a private IP only. The instance needs to download patches from the internet. Which configuration is required?

Accepted Answer

Create a NAT gateway in the public subnet and add a default route to the NAT gateway in the private subnet's route table.. Option B is correct because a NAT gateway in the public subnet allows instances in private subnets to initiate outbound traffic to the internet. Option A is incorrect because an internet gateway alone does not allow private instances to access the internet. Option C is incorrect because a NAT instance requires manual configuration. Option D is incorrect because a VPC endpoint is for specific AWS services, not general internet access.

Answer

Launch a NAT instance in the private subnet and configure source/destination check.

Answer

Create a VPC endpoint for the patch service.

Answer

Attach an internet gateway to the VPC and add a default route to it in the private subnet's route table.

Question 2

A company needs to connect multiple VPCs to a common on-premises network through a single AWS Direct Connect connection. Which AWS service should be used to simplify this architecture?

Accepted Answer

AWS Transit Gateway. Option D is correct because Transit Gateway allows connecting multiple VPCs and on-premises networks via a single Direct Connect connection using a transit VIF. Option A is wrong because VPC peering is point-to-point and does not scale to many VPCs. Option B is wrong because VPN CloudHub connects VPNs, not Direct Connect. Option C is wrong because VGW is per-VPC.

Answer

AWS VPN CloudHub

Answer

VPC peering

Answer

Virtual Private Gateway (VGW)

Question 3

A company needs to connect its on-premises data center to AWS using AWS Direct Connect. The company has two redundant connections and wants to use BGP as the routing protocol. Which BGP attribute should be manipulated to influence outbound traffic from AWS to the on-premises network?

Accepted Answer

Prepend AS_PATH on routes advertised to AWS.. Option C is correct because the AS_PATH prepend attribute can be used to influence outbound traffic from AWS by making one path less preferred. Option A is wrong because MED influences inbound traffic. Option B is wrong because Local Preference is used within an AS to influence outbound traffic, but it is not sent to peers. Option D is wrong because the community attribute can be used for various routing policies but not directly for outbound traffic influence in this context.

Answer

Set the Local Preference attribute on routes received from AWS.

Answer

Set the MED attribute on routes advertised to AWS.

Answer

Apply a BGP community tag to routes received from AWS.

Question 4

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. The VPC uses a virtual private gateway (VGW). The on-premises network advertises a route to a specific subnet (10.0.0.0/24) via BGP. However, traffic from the VPC to that subnet is failing. What should the network engineer check first?

Accepted Answer

Verify that route propagation is enabled on the VPC's route tables associated with the subnets.. Option B is correct because the route propagation from the VGW to the VPC route tables must be enabled for the learned BGP routes to be used. Option A is wrong because the VGW is the correct attachment. Option C is wrong because the VIF state being up doesn't guarantee route propagation. Option D is wrong because the customer gateway (CGW) is configured on the AWS side; the on-premises router is separate.

Answer

Verify that the customer gateway device is advertising the subnet route.

Answer

Verify that the virtual interface is in the 'available' state and BGP session is established.

Answer

Verify that the VGW is attached to the VPC.

Question 5

A company has a Direct Connect connection with a public virtual interface (VIF) to access AWS public services. They want to ensure that all traffic to Amazon S3 from on-premises uses the Direct Connect connection instead of the internet. Which configuration is required?

Accepted Answer

Use the public virtual interface and configure a route filter to only accept routes for the S3 service.. Option B is correct because using a public VIF with a route filter that only allows S3 prefixes ensures traffic to S3 uses Direct Connect. Option A is wrong because a private VIF is for private IP connectivity to VPCs, not public services. Option C is wrong because a VPN over Direct Connect is unnecessary and adds complexity. Option D is wrong because a Direct Connect gateway is used for private VIFs to multiple VPCs, not public VIFs.

Answer

Establish a VPN connection over the Direct Connect private VIF and route S3 traffic through the VPN.

Answer

Create a private virtual interface and attach it to the VPC.

Answer

Create a Direct Connect gateway and associate the public VIF with it.

Question 6

A company is migrating a legacy application to AWS. The application requires multicast communication between instances. The company needs to implement a multicast solution within a VPC. Which AWS service or feature should be used to support multicast?

Accepted Answer

Create a Transit Gateway multicast domain. Option D is correct because AWS Transit Gateway supports multicast groups. Option A is incorrect because VPC does not natively support multicast. Option B is incorrect because AWS Global Accelerator is for anycast, not multicast. Option C is incorrect because VPC peering does not support multicast.

Answer

Configure multicast in the VPC's route tables

Answer

Use AWS Global Accelerator for multicast distribution

Answer

Set up VPC peering to enable multicast between subnets

Question 7

A company has deployed an application across multiple AWS Regions using Application Load Balancers (ALBs). The company wants to route traffic to the nearest healthy endpoint using latency-based routing. Which AWS service should be used to distribute traffic across the ALBs?

Accepted Answer

Amazon Route 53 with latency routing policy.. Option A is correct because Amazon Route 53 supports latency-based routing policies to route traffic to the endpoint with the lowest latency. Option B is wrong because AWS Global Accelerator uses Anycast IPs and directs traffic to the nearest edge location, not necessarily latency-based routing. Option C is wrong because CloudFront is a CDN and not designed for routing to ALBs based on latency. Option D is wrong because Network Load Balancer is a regional service and does not route across regions.

Answer

Amazon CloudFront with multiple origins.

Answer

AWS Network Load Balancer with cross-zone load balancing.

Answer

AWS Global Accelerator.

Question 8

A network engineer is setting up a Direct Connect connection from an on-premises data center to AWS. The connection uses a private VIF to connect to a VPC via a Direct Connect gateway. The on-premises network is advertising a BGP prefix 10.0.0.0/16, which overlaps with the VPC CIDR 10.0.0.0/16. What is the expected behavior?

Accepted Answer

The BGP session will be established, but the overlapping prefix will be ignored and not programmed into the VPC route tables.. Option A is correct because AWS Direct Connect with a private VIF will not accept BGP prefixes that overlap with the VPC CIDR. Option B, C, and D are incorrect as they describe behaviors that do not occur in this scenario.

Answer

The VPC will automatically reassign a new CIDR to avoid the conflict.

Answer

The BGP session will fail to establish due to the prefix conflict.

Answer

The on-premises prefix will take precedence and override the VPC route.

Question 9

A company is deploying an application across multiple VPCs using AWS Transit Gateway. They need to ensure that only specific VPCs can communicate with each other. Which TWO methods can be used to isolate traffic?

Accepted Answer

Use Transit Gateway Network Manager to create a network segmentation design.. Option A is correct because separate route tables can control which VPCs can communicate. Option D is correct because Transit Gateway Network Manager can create segmentation. Option B is incorrect because NACLs are per subnet, not per VPC. Option C is incorrect because security groups are instance-level. Option E is incorrect because VPC endpoints are for accessing services, not inter-VPC traffic.

Answer

Configure network ACLs on the VPC subnets to allow or deny traffic.

Answer

Use security groups on the Transit Gateway attachments.

Answer

Implement VPC endpoints for inter-VPC communication.

Question 10

A company is setting up a new VPC with both IPv4 and IPv6 support. They need to ensure that instances in a private subnet can access the Internet for software updates. Which combination of resources is required?

Accepted Answer

NAT gateway and egress-only internet gateway. Option B is correct because a NAT gateway provides IPv4 internet access, and an egress-only internet gateway provides IPv6 internet access for private instances. Option A is wrong because internet gateway is for public subnets. Option C is wrong because NAT instance is outdated and more complex. Option D is wrong because VPC endpoint is for AWS services, not internet.

Answer

VPC endpoint and internet gateway

Answer

NAT instance and internet gateway

Answer

Internet gateway and NAT gateway

Question 11

A company is designing a multi-region active-active application using Application Load Balancers (ALBs) and AWS Global Accelerator. Which TWO configurations are required to route traffic to the correct regional endpoint based on the client's location?

Accepted Answer

Define endpoint groups in Global Accelerator for each region.. Option B is correct because Global Accelerator uses anycast IPs to route traffic to the nearest healthy endpoint. Option D is correct because endpoint groups in Global Accelerator define the regional endpoints and traffic distribution. Option A is wrong because Route 53 latency routing is not used with Global Accelerator. Option C is wrong because target groups are within a region, not across regions. Option E is wrong because AWS Shield Advanced provides DDoS protection, not traffic routing.

Answer

Enable AWS Shield Advanced on the ALBs.

Answer

Configure cross-region load balancing in the ALB target groups.

Answer

Configure Amazon Route 53 latency-based routing to the ALBs.

Question 12

A company is designing a multi-region architecture with two AWS Regions. They need to connect VPCs in each region to an on-premises data center using AWS Direct Connect. They want to minimize latency and use the same BGP ASN on both sides. Which solution meets these requirements?

Accepted Answer

Use a Direct Connect gateway and create a private virtual interface from each region's Direct Connect connection to the Direct Connect gateway. Use the same BGP ASN on AWS side.. Option A is correct because a Direct Connect gateway allows you to associate multiple virtual interfaces from different regions to a single gateway, and you can use the same BGP ASN. Option B is wrong because transit VIFs connect to Transit Gateway, but Direct Connect gateway is needed for multi-region. Option C is wrong because each Direct Connect connection must use different ASNs if not using Direct Connect gateway. Option D is wrong because VPN over internet adds latency and does not meet Direct Connect requirement.

Answer

Establish two separate private virtual interfaces from each region to the on-premises router using different BGP ASNs.

Answer

Use AWS Site-to-Site VPN over the internet as a backup and the Direct Connect as primary.

Answer

Create a transit virtual interface from each region to a Transit Gateway in each region and peer the Transit Gateways.

Question 13

A company is deploying a VPC with public and private subnets. The private subnets need outbound internet access for updates, but must not be directly reachable from the internet. Which AWS service should be used to achieve this?

Accepted Answer

NAT Gateway. Option C is correct because a NAT Gateway enables instances in private subnets to initiate outbound traffic to the internet while preventing inbound traffic from the internet. Options A and B are for VPN and Direct Connect, which are private connections. Option D is for inbound traffic management.

Answer

AWS Site-to-Site VPN

Answer

AWS Direct Connect

Answer

Internet Gateway

Question 14

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to an on-premises network using AWS Site-to-Site VPN. The on-premises network uses 10.0.0.0/8. The company wants to ensure that traffic to on-premises from VPC does not overlap with VPC's own CIDR. Which action should be taken?

Accepted Answer

Create a more specific route in the VPC route table for the on-premises network that is within the 10.0.0.0/8 range but not overlapping with the VPC's subnets.. Option A is correct because splitting the VPC into smaller subnets and using more specific routes can avoid overlap. Option B is wrong because NAT is used for internet access, not for route overlap. Option C is wrong because VPC CIDR cannot be changed without recreation. Option D is wrong because overlay network is not a standard solution for route overlap.

Answer

Change the VPC CIDR to a non-overlapping range such as 172.16.0.0/16.

Answer

Use a NAT gateway to translate the VPC's IP addresses to a different IP range when communicating with on-premises.

Answer

Use AWS Transit Gateway with a network overlay to encapsulate traffic.

Question 15

A company needs to connect its on-premises network to a VPC using AWS Direct Connect. The company wants to use a single Direct Connect connection to connect to multiple VPCs in the same region. Which configuration should be used?

Accepted Answer

Create a Direct Connect Gateway and associate it with multiple VPCs. Option C is correct because a Direct Connect Gateway can be associated with multiple VPCs, allowing a single Direct Connect connection to connect to multiple VPCs. Option A is incorrect because a single VIF can only connect to a single VPC (unless using a Direct Connect Gateway). Option B is incorrect because Transit Gateway is for inter-VPC routing, not Direct Connect. Option D is incorrect because a VPN connection is a separate service.

Answer

Create a private VIF for each VPC

Answer

Use a VPN connection to extend the Direct Connect to other VPCs

Answer

Use a Transit Gateway to connect the Direct Connect to multiple VPCs