ANS-C01 Practice Test 30 — 15 Questions

Question 1

A network engineer is designing a hybrid network using AWS Transit Gateway with multiple VPCs and an on-premises data center connected via AWS Direct Connect. The VPCs need to communicate with each other and with on-premises, but must isolate development VPCs from production VPCs. What is the MOST scalable and cost-effective approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a single Transit Gateway with separate route tables for development and production VPCs, and a shared route table for on-premises attachment.. A single Transit Gateway with separate route tables allows you to isolate development and production VPCs from each other while sharing a common route table for the Direct Connect attachment to reach on-premises. This design is highly scalable (no mesh of peering connections) and cost-effective (no per-VPN-tunnel charges), leveraging Transit Gateway’s native segmentation and centralized routing.

Answer

Use a single Transit Gateway with one route table for all VPCs and on-premises, and use network ACLs for isolation.

Answer

Create VPC peering connections between all VPCs and a Direct Connect gateway for on-premises connectivity.

Answer

Use a VPN connection from each VPC to on-premises over Direct Connect, and allow VPC communication via VPN.

Question 2

A network engineer needs to monitor the network traffic between EC2 instances in a VPC. Which AWS service should be used to capture IP traffic information?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including source/destination IP, ports, protocol, and packet/byte counts. This is the appropriate service for monitoring network traffic between EC2 instances.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Question 3

A security engineer needs to audit all changes to security group rules in an AWS account. Which AWS service should be used to record these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls, including changes to security group rules. Option A (VPC Flow Logs) is wrong because it captures network traffic, not API calls. Option C (AWS Config) is wrong because it records configuration changes, but not the API call history. Option D (Amazon CloudWatch Logs) is wrong because it is used for log storage and monitoring, not for recording API calls.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 4

A global company is designing a multi-region architecture with an Active-Passive setup. They want to use Amazon Route 53 to route traffic to the active region and fail over to the passive region during an outage. They need to ensure that the failover is automatic based on health checks. Which routing policy should they use?

Accepted Answer

Failover routing policy. The Failover routing policy in Amazon Route 53 is specifically designed for active-passive configurations. It allows you to designate one record as primary (active) and another as secondary (passive), and Route 53 automatically routes traffic to the secondary record only when the health check associated with the primary record fails. This meets the requirement for automatic failover based on health checks without manual intervention.

Answer

Weighted routing policy

Answer

Latency routing policy

Answer

Geolocation routing policy

Question 5

Which TWO measures can be taken to protect an AWS account's root user credentials? (Choose two.)

Accepted Answer

Create an IAM user with administrative privileges and use that instead of the root user. Option A is correct because creating an IAM user with administrative privileges and using that identity for everyday work removes the need to sign in as the root user, whose credentials grant unrestricted access to the entire account and cannot be scoped down. Option D is correct because enabling MFA on the root user adds a second authentication factor, so a leaked root password alone is insufficient to compromise the account, and AWS strongly recommends MFA on the root user. Option B is wrong because using the root user for daily administrative tasks maximizes exposure of the most powerful credentials in the account. Option C is wrong because the root user account cannot be deleted; it is permanently tied to the account. Option E is wrong because storing root credentials in a shared password manager increases the attack surface and does not provide the strong, account-level protection that MFA and IAM-based access do.

Answer

Use the root user for daily administrative tasks

Answer

Delete the root user account after creating IAM users

Answer

Store the root user credentials in a shared password manager

Question 6

A company wants to audit all network traffic to and from EC2 instances for security analysis. Which AWS service should they enable?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, bytes, packets, action) for network interfaces in a VPC, subnet, or ENI, and publish it to CloudWatch Logs or S3. This is the native AWS mechanism for auditing network traffic to and from EC2 instances. It provides the raw flow data security analysts need for anomaly detection and forensic review.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Config

Question 7

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to access an S3 bucket in the same Region. Which solution provides the most secure and cost-effective connectivity?

Accepted Answer

Create a gateway endpoint for S3 in the VPC and add a route in the private subnet's route table pointing to the endpoint.. A gateway endpoint for S3 uses Amazon's private network to connect the VPC to S3 without traversing the internet, providing the most secure and cost-effective solution. It avoids NAT gateway hourly charges and data processing fees, and it does not require public IPs or internet access for the private subnet EC2 instance.

Answer

Create a NAT gateway in a public subnet and add a route in the private subnet's route table pointing to the NAT gateway.

Answer

Create an interface endpoint for S3 in the private subnet.

Answer

Attach an internet gateway to the VPC and add a route to the internet gateway in the private subnet's route table.

Question 8

A company is designing a network for a critical application that requires high availability across multiple Availability Zones. Which TWO design choices ensure that the application remains available if an entire AZ fails?

Accepted Answer

Deploy resources in at least two Availability Zones.. Option B is correct because deploying resources in at least two Availability Zones provides redundancy, so if one AZ fails, the application can continue serving traffic from the surviving AZ. Option D is correct because an Application Load Balancer is a regional, highly available service that spans multiple AZs by design, automatically routing traffic to healthy targets in other AZs when one AZ becomes unavailable. Option A is wrong because a single AZ is a single point of failure with no redundancy. Option C is wrong because a Network Load Balancer confined to a single AZ cannot survive the loss of that AZ. Option E is wrong because a single EC2 instance, even with an Elastic IP, is a single point of failure and the Elastic IP does not provide cross-AZ failover.

Answer

Deploy resources in a single Availability Zone.

Answer

Use a Network Load Balancer in a single AZ.

Answer

Use a single EC2 instance with an Elastic IP address.

Question 9

A company is designing a global application that will serve users across North America and Europe. The application consists of a static website hosted on Amazon S3, a REST API hosted on Amazon API Gateway, and a backend application running on EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The company wants to minimize latency for users by serving content from the closest AWS region. They also want to ensure high availability and automatic failover if a region becomes unavailable. The company is considering using Amazon Route 53 with a latency-based routing policy. However, they are concerned about DNS caching and propagation delays during failover. Which additional service should they use to improve the failover experience and provide a single endpoint for users?

Accepted Answer

Use AWS Global Accelerator to provide a static IP address and route traffic to the ALB in the closest healthy region. AWS Global Accelerator uses the AWS global network to route traffic to the closest healthy endpoint via the Anycast static IP addresses, bypassing DNS caching and propagation delays. It provides a single fixed endpoint for users and integrates with the ALB in each region, automatically failing over to the next healthy region within seconds when health checks fail.

Answer

Use a Network Load Balancer in each region and configure Route 53 with failover routing

Answer

Use Amazon CloudFront with multiple origins pointing to the S3 bucket and the ALB in each region

Answer

Use Lambda@Edge to dynamically route traffic based on the user's location

Question 10

Which THREE services can be used to detect and protect against DDoS attacks? (Choose THREE.)

Accepted Answer

AWS Firewall Manager. AWS Shield Advanced (C) is the primary AWS service purpose-built for DDoS detection and mitigation, providing enhanced protection for resources like CloudFront, Route 53, and ELB with 24/7 access to the AWS DDoS Response Team and real-time attack diagnostics. AWS WAF (D) protects against application-layer (Layer 7) DDoS attacks such as HTTP floods by filtering malicious web requests using customizable rules, rate-based rules, and managed rule groups. AWS Firewall Manager (A) centrally manages and enforces AWS WAF, Shield Advanced, and security group policies across accounts in an AWS Organization, enabling consistent DDoS protection deployment at scale. AWS Config (B) is a configuration compliance and auditing service that records resource changes but does not detect or mitigate DDoS traffic. VPC Flow Logs (E) capture IP traffic metadata for network monitoring and forensics, but they are a logging feature, not a protective or DDoS-mitigation service.

Answer

AWS Config

Answer

VPC Flow Logs

Question 11

A network engineer is troubleshooting connectivity issues from an on-premises network to an AWS VPC over a Direct Connect private VIF. The VPC has a virtual private gateway attached. The on-premises router can ping the private IP of an EC2 instance in the VPC, but application traffic (TCP port 443) fails. What is the most likely cause?

Accepted Answer

The security group for the EC2 instance does not allow inbound HTTPS traffic.. Since the on-premises router can ping the EC2 instance's private IP, Layer 3 connectivity is working, which rules out routing and BGP issues. The failure of TCP port 443 specifically points to a firewall or access control blocking the application traffic. A security group acts as a virtual firewall at the instance level, and by default it denies all inbound traffic unless explicitly allowed. Therefore, the most likely cause is that the security group for the EC2 instance does not have an inbound rule permitting HTTPS (TCP 443) traffic.

Answer

The network ACL in the VPC is blocking outbound traffic.

Answer

The BGP session is in the 'Idle' state.

Answer

The route table associated with the virtual private gateway does not have a route to the on-premises network.

Question 12

A company wants to encrypt data in transit between an on-premises data center and AWS. Which service provides a dedicated encrypted connection?

Accepted Answer

AWS Direct Connect with MACsec. AWS Direct Connect provides a dedicated private network connection from on-premises to AWS, and enabling MACsec (IEEE 802.1AE) on the dedicated connection encrypts data in transit at Layer 2. This satisfies the requirement for a dedicated encrypted connection without relying on IPsec over the public internet.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

AWS Client VPN

Question 13

A company is designing a multi-region architecture with an Application Load Balancer (ALB) in each region. They need to route traffic to the closest healthy endpoint. Which AWS service should be used for global load balancing?

Accepted Answer

Use AWS Global Accelerator with an endpoint group in each region.. AWS Global Accelerator uses the AWS global network to route traffic to the closest healthy endpoint via Anycast IP addresses and endpoint groups in each region. It provides static IP addresses and intelligent traffic distribution based on latency, health, and geography, making it ideal for multi-region ALB architectures requiring global load balancing.

Answer

Use a single Application Load Balancer in one region with cross-region VPC peering.

Answer

Use Route 53 latency-based routing with health checks.

Answer

Use a Network Load Balancer in each region and Route 53 weighted routing.

Question 14

A company is designing a multi-region architecture with an Application Load Balancer (ALB) in each region. They want to route users to the nearest healthy ALB using latency-based routing. Which AWS service should be used?

Accepted Answer

Amazon Route 53 latency-based routing. Amazon Route 53 latency-based routing directs user traffic to the AWS region with the lowest network latency for the end user, based on latency measurements between the user and each region's resources. This matches the requirement to route users to the nearest healthy ALB, as Route 53 can evaluate health checks on the ALBs and only route to healthy endpoints.

Answer

Amazon CloudWatch

Answer

VPC Traffic Mirroring

Answer

AWS Global Accelerator

Question 15

A company has a VPC with a CIDR of 172.16.0.0/16. They have a subnet 172.16.1.0/24 for web servers and another subnet 172.16.2.0/24 for database servers. The web servers need to access the database servers on port 3306. Which configuration is required?

Accepted Answer

Web SG: outbound to DB SG on port 3306. DB SG: inbound from web SG on port 3306.. Security groups are stateful and control traffic at the instance level. The web server security group needs an outbound rule allowing traffic to the database security group on port 3306, and the database security group needs an inbound rule allowing traffic from the web security group on port 3306. This ensures that only the web servers can initiate connections to the database servers on the required port.

Answer

Configure network ACLs to allow inbound on port 3306 from web subnet.

Answer

Web SG: inbound from 0.0.0.0/0 on port 3306. DB SG: outbound to web SG on port 3306.

Answer

Web SG: outbound to DB SG on all ports. DB SG: inbound from web SG on all ports.