ANS-C01 Practice Test 1 — 30 Questions

Question 1

A company wants to allow its employees to securely access internal applications hosted in a VPC without traversing the internet. The company also wants to be able to enforce security policies at the user level. Which AWS service should the company use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Client VPN. AWS Client VPN is a managed, cloud-based VPN service that allows employees to securely access internal applications hosted in a VPC from any location without traversing the internet. It uses OpenVPN-based client software and integrates with AWS Identity and Access Management (IAM) and Active Directory to enforce security policies at the user level, such as group-based access controls and multi-factor authentication.

Answer

Bastion host in a public subnet

Answer

AWS Direct Connect

Answer

AWS Site-to-Site VPN

Question 2

A company is setting up a Direct Connect connection between its on-premises data center and AWS. The company wants to use a single virtual interface (VIF) to access multiple VPCs in the same AWS Region. Which AWS service should be used to achieve this?

Accepted Answer

Direct Connect gateway. A Direct Connect gateway allows you to associate multiple Virtual Private Clouds (VPCs) in the same AWS Region with a single Direct Connect virtual interface (VIF). This is achieved by creating a Direct Connect gateway and attaching it to the VIF, then associating the desired VPCs with the gateway via virtual private gateways (VGWs) or transit gateways. This enables centralized, private connectivity from on-premises to multiple VPCs without needing separate VIFs per VPC.

Answer

VPC peering connection

Answer

AWS VPN CloudHub

Answer

Transit VPC

Question 3

Which TWO of the following are best practices for securing a VPC with AWS Network Firewall? (Choose two.)

Accepted Answer

Deploy firewall endpoints in at least two Availability Zones for high availability.. Option A is correct because AWS Network Firewall firewall endpoints are Availability Zone–scoped, so deploying endpoints in at least two AZs ensures high availability and prevents a single-AZ failure from taking down inspection. Option C is correct because stateful rule groups allow deep packet inspection and application-layer (Layer 7) filtering using Suricata-compatible rules, which is essential for detecting and blocking sophisticated threats. Option B is incorrect because stateless rules alone cannot perform application-layer inspection and are not a best practice for comprehensive security. Option D is incorrect because Network Firewall can inspect both inbound and outbound traffic, not just outbound. Option E is incorrect because the firewall should be deployed in a dedicated subnet (typically a firewall subnet) rather than the same subnet as workloads, to maintain proper traffic segmentation and routing.

Answer

Use only stateless rules to minimize processing overhead.

Answer

Use Network Firewall only for outbound traffic filtering.

Answer

Deploy the firewall in the same subnet as the workload for low latency.

Question 4

Which TWO of the following are valid methods to connect a VPC to an on-premises network? (Choose TWO.)

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN creates an encrypted tunnel over the public internet between a VPC and an on-premises network using IPsec. It is a fully managed, quick-to-deploy method that supports both static routes and BGP dynamic routing via the virtual private gateway.

Answer

VPC endpoints

Answer

AWS Transit Gateway

Answer

VPC peering

Question 5

Which THREE AWS services can be used to improve the availability of a web application across multiple AWS Regions? (Choose 3.)

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator improves availability across multiple AWS Regions by using the AWS global network to route user traffic to the optimal regional endpoint based on health, latency, and geography. It provides static anycast IP addresses and automatically reroutes traffic to healthy endpoints during a regional failure, thereby enhancing fault tolerance and performance for global web applications.

Answer

VPC peering

Answer

AWS Direct Connect

Question 6

A company uses AWS Direct Connect with a private VIF to connect to a VPC. The network team wants to monitor the bandwidth utilization of the Direct Connect connection in real time. Which AWS service should be used?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the AWS service that collects and displays Direct Connect metrics such as ConnectionBpsEgress, ConnectionBpsIngress, and VirtualInterfaceBpsEgress/Ingress, allowing real-time bandwidth utilization monitoring. These metrics are published automatically to CloudWatch under the AWS/DX namespace. CloudWatch dashboards and alarms can then be built on top of them.

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Answer

AWS Config

Question 7

Which THREE of the following are considerations when designing a multi-account VPC architecture using AWS Transit Gateway? (Choose 3.)

Accepted Answer

Transit Gateway can be integrated with Direct Connect Gateway. AWS Transit Gateway acts as a central hub for interconnecting VPCs and on-premises networks. It can be integrated with Direct Connect Gateway, allowing a single Direct Connect connection to reach multiple VPCs attached to the Transit Gateway, simplifying hybrid network design and reducing operational overhead.

Answer

Each VPC must have a unique route table

Answer

VPCs with overlapping CIDR blocks can be attached

Question 8

A company has a VPC with public and private subnets. An application running in a private subnet needs to access an S3 bucket to read and write data. The security team wants to ensure that traffic to S3 does not traverse the internet. Which solution should the team implement?

Accepted Answer

Create a gateway VPC endpoint for S3 and add a route to the endpoint in the private subnet route table.. A gateway VPC endpoint for S3 allows instances in a private subnet to access S3 privately using AWS's internal network, without traversing the internet. By adding a route to the endpoint's prefix list in the private subnet route table, traffic destined for S3 is directed through the endpoint, which uses AWS PrivateLink to provide highly available, redundant connectivity.

Answer

Establish a VPN connection to AWS and route S3 traffic through the VPN.

Answer

Configure a NAT gateway in the public subnet and update the private subnet route table with a default route pointing to the NAT gateway.

Answer

Attach an internet gateway to the VPC and add a route to the S3 prefix list in the private subnet route table.

Question 9

A company is deploying a critical application across multiple AWS accounts. The network team wants to simplify IP address management and ensure that VPCs in different accounts can communicate securely. The company has a centralized network account with a transit gateway. Which architecture should the company use?

Accepted Answer

Use AWS Resource Access Manager to share the transit gateway in the network account with other accounts and attach their VPCs.. AWS Resource Access Manager (RAM) allows you to share a transit gateway from a centralized network account with other AWS accounts, enabling VPCs in those accounts to attach to the shared transit gateway. This simplifies IP address management by providing a single hub for inter-VPC routing and avoids the complexity of managing multiple VPC peering connections. The transit gateway supports transitive routing, so VPCs in different accounts can communicate securely through the centralized gateway without needing direct peering.

Answer

Create VPC peering connections between each VPC in different accounts.

Answer

Configure VPC endpoints in each account to communicate through the network account.

Answer

Set up AWS Direct Connect between accounts and route through the network account.

Question 10

Refer to the exhibit. A flow log record shows ACCEPT for traffic from 10.0.1.5 to 10.0.2.10 on port 443. Which AWS service is most likely the destination?

Accepted Answer

Application Load Balancer. An Application Load Balancer (ALB) terminates HTTPS (port 443) connections and forwards traffic to targets. Flow logs showing ACCEPT for traffic to port 443 on an ALB's internal IP (10.0.2.10) are expected because the ALB listens on that port for incoming client connections. The ALB operates at Layer 7 and is the only listed service that natively accepts HTTPS traffic on port 443 within a VPC.

Answer

Amazon RDS instance

Answer

NAT Gateway

Answer

Amazon S3

Question 11

A company is designing a network for a multi-tier application. The web tier must be accessible from the internet, the application tier must be accessible only from the web tier, and the database tier must be accessible only from the application tier. Which architecture meets these requirements?

Accepted Answer

Place each tier in a separate subnet and use security groups to allow traffic between tiers. Security groups act as a stateful virtual firewall at the instance level, allowing you to specify inbound and outbound rules based on source/destination security group IDs. By placing each tier in a separate subnet and referencing the web tier's security group as the source for the application tier's inbound rule, and the application tier's security group as the source for the database tier's inbound rule, you achieve the required least-privilege access without exposing the application or database tiers to the internet.

Answer

Place each tier in a separate subnet and use network ACLs to allow traffic between tiers

Answer

Place all tiers in the same subnet and use security groups to control traffic

Answer

Place all tiers in a public subnet and use a NAT gateway for the application and database tiers

Question 12

Arrange the steps to configure an AWS Transit Gateway with attachments to multiple VPCs:

Accepted Answer

Step 1: Create the transit gateway. Step 2: Create transit gateway attachments to VPCs. Step 3: Associate attachments with a transit gateway route table. Step 4: Update VPC route tables to point to the transit gateway. Step 5: Test connectivity.. First create the transit gateway, then create attachments, associate them with a route table, update VPC routes, and test connectivity.

Answer

Step 1: Create transit gateway attachments to VPCs. Step 2: Create the transit gateway. Step 3: Update VPC route tables. Step 4: Associate attachments with a route table. Step 5: Test connectivity.

Answer

Step 1: Create the transit gateway. Step 2: Update VPC route tables. Step 3: Create transit gateway attachments. Step 4: Associate attachments with a route table. Step 5: Test connectivity.

Answer

Step 1: Create the transit gateway. Step 2: Create transit gateway attachments. Step 3: Update VPC route tables. Step 4: Associate attachments with a route table. Step 5: Test connectivity.

Question 13

A company's security team notices that a VPC flow log record shows an outbound connection from a private EC2 instance to an IP address in a restricted country. The security group allows outbound 0.0.0.0/0 for TCP 443. The network ACL allows outbound traffic to 0.0.0.0/0 on ephemeral ports. The company uses AWS Network Firewall with a firewall policy that has a stateful rule group that denies traffic to the restricted country. The flow log shows the traffic was accepted. What is the most likely cause?

Accepted Answer

The subnet's route table does not have a route that sends traffic to the AWS Network Firewall endpoint.. AWS Network Firewall's stateful rules are only evaluated for traffic that is routed through the firewall endpoint. If the subnet's route table does not include a route directing traffic to the firewall endpoint, the traffic bypasses the firewall entirely, allowing the outbound connection even though the firewall policy denies it. Option A is incorrect because VPC Flow Logs capture all accepted and rejected traffic after security group and NACL evaluation. Option C is incorrect because the network ACL allows outbound traffic on ephemeral ports, so inbound return traffic is permitted by the default ephemeral port rule. Option D is incorrect because the security group explicitly allows outbound HTTPS (TCP 443) to 0.0.0.0/0, which is permissive.

Answer

VPC Flow Logs are not capturing all traffic.

Answer

The network ACL inbound rule blocks the return traffic.

Answer

The security group outbound rule is not configured correctly.

Question 14

A company wants to block inbound SSH traffic to all EC2 instances in a VPC while allowing all other traffic. Which security group rule should be configured?

Accepted Answer

Remove any inbound rule that allows TCP port 22. Security groups are stateful and act as a virtual firewall. By default, all inbound traffic is denied unless explicitly allowed. Therefore, to block SSH traffic, you simply remove any inbound rule that permits TCP port 22. This is option B. Option A is incorrect because security groups do not support 'deny' rules; they only support allow rules. Option C is incorrect because the question specifically asks about security group configuration, not network ACLs. Option D is incorrect because outbound rules do not affect inbound traffic, and security groups are stateful, so blocking outbound SSH would not block incoming SSH connections.

Answer

Add an inbound rule to deny TCP port 22

Answer

Add an inbound deny rule for TCP port 22 to the network ACL

Answer

Add an outbound rule to deny TCP port 22

Question 15

A startup is launching a new web application on AWS and needs to design a highly available and secure network architecture. The application will run on EC2 instances in an Auto Scaling group across two Availability Zones in a single region. The application must be accessible from the internet over HTTPS. The company expects variable traffic and wants to reduce costs where possible. They also need to protect against common web exploits like SQL injection and cross-site scripting. Which combination of AWS services should be used for the network design?

Accepted Answer

Use an Application Load Balancer (ALB) in public subnets. Enable AWS WAF on the ALB. Place EC2 instances in private subnets with a NAT gateway for outbound traffic.. An Application Load Balancer (ALB) in public subnets can terminate HTTPS and distribute traffic to EC2 instances in private subnets, which enhances security by removing direct internet access from the instances. Enabling AWS WAF on the ALB protects against common web exploits like SQL injection and cross-site scripting. A NAT gateway in public subnets provides outbound internet access for instances in private subnets, which is cost-effective for variable traffic as it scales automatically and incurs charges only when used.

Answer

Use an Application Load Balancer (ALB) in private subnets. Enable AWS WAF on the ALB. Place EC2 instances in public subnets with a VPC endpoint for outbound traffic.

Answer

Use an Application Load Balancer (ALB) in public subnets. Use a VPC endpoint for outbound traffic. Place EC2 instances in public subnets with Elastic IPs.

Answer

Use a Network Load Balancer (NLB) in public subnets. Enable AWS Shield Advanced for DDoS protection. Place EC2 instances in private subnets with a NAT gateway for outbound traffic.

Question 16

A company has a VPC with multiple subnets across three Availability Zones. They are deploying an NFS file system using Amazon EFS. They need high availability and low latency from all subnets. Which EFS deployment option meets these requirements?

Accepted Answer

Use EFS Standard storage class with Multi-AZ and create mount targets in each Availability Zone.. The EFS Standard storage class provides Multi-AZ durability and availability, and creating mount targets in each Availability Zone ensures that EC2 instances in any subnet can connect to EFS with low latency by using a mount target in the same AZ. This architecture avoids cross-AZ data transfer charges and minimizes latency, meeting both high availability and low latency requirements.

Answer

Use EFS One Zone storage class with a single mount target in the same Availability Zone as the application.

Answer

Use EFS Standard storage class with Multi-AZ and create a single mount target in one Availability Zone.

Answer

Use EFS One Zone storage class and create mount targets in each Availability Zone.

Question 17

A company is deploying a VPC with both public and private subnets. They have an EC2 instance in a private subnet that needs to access the internet for software updates. Which AWS service should be placed in a public subnet to enable this?

Accepted Answer

NAT gateway. A NAT gateway is correct because it enables EC2 instances in a private subnet to initiate outbound connections to the internet (e.g., for software updates) while preventing the internet from initiating inbound connections to those instances. The NAT gateway must be placed in a public subnet with an associated Internet Gateway to translate private IP addresses to the public IP of the NAT gateway for outbound traffic.

Answer

Internet gateway

Answer

VPC endpoint

Answer

Direct Connect virtual interface

Question 18

A network engineer is troubleshooting connectivity between an EC2 instance in a VPC and an on-premises server connected via AWS Site-to-Site VPN. The ping from the EC2 instance to the on-premises server fails. The VPN tunnel status shows 'UP'. Which configuration should the engineer check first?

Accepted Answer

Check the route table associated with the EC2 instance's subnet for a route to the on-premises network. Even when the VPN tunnel is UP, traffic from the EC2 instance to the on-premises server will be dropped if the VPC route table associated with the instance's subnet does not contain a route pointing to the on-premises network via the virtual private gateway (VGW). The ping failure in this scenario is most likely due to missing routing, not tunnel misconfiguration, since the tunnel status is UP.

Answer

Ensure the customer gateway device is configured with the correct public IP address

Answer

Check that the pre-shared key matches on both sides

Answer

Verify that the VPN tunnel is using the correct encryption algorithms

Question 19

A company is using AWS Client VPN for remote access. Users can authenticate and establish a VPN connection, but they cannot access resources in the VPC. The Client VPN endpoint is associated with a subnet in the VPC. The security group for the Client VPN endpoint allows all traffic. What is the most likely cause?

Accepted Answer

There is no authorization rule to allow access to the VPC CIDR.. AWS Client VPN requires authorization rules to permit access to the VPC CIDR. Without an authorization rule, even if authentication and connection succeed, the client cannot access VPC resources. The security group allowing all traffic is irrelevant because the authorization rule is a separate access control layer. Therefore, the missing authorization rule is the most likely cause.

Answer

The Client VPN endpoint is not associated with the correct subnet.

Answer

The route table for the subnet does not have a route to the Client VPN endpoint.

Answer

The Client VPN endpoint's server certificate is expired.

Question 20

A financial services company is designing a hybrid network architecture using AWS Direct Connect. They have a Direct Connect connection with a public VIF and a private VIF. The private VIF is associated with a Direct Connect gateway that is attached to a Transit Gateway in us-east-1. The Transit Gateway has attachments to a production VPC and a shared services VPC. The company wants to ensure that all traffic from the on-premises network to the production VPC flows through a centralized inspection appliance in the shared services VPC for security compliance. Additionally, traffic from the production VPC to the internet must use a NAT gateway in the shared services VPC. The inspection appliance in the shared services VPC performs stateful inspection and must see both directions of traffic. The network engineer configured the following route tables: In the Transit Gateway route table associated with the Direct Connect gateway attachment, a static route for 0.0.0.0/0 points to the shared services VPC attachment. In the Transit Gateway route table associated with the production VPC attachment, a static route for the on-premises CIDR (10.0.0.0/8) points to the shared services VPC attachment. In the Transit Gateway route table associated with the shared services VPC attachment, a static route for the on-premises CIDR points to the Direct Connect gateway attachment, and a static route for 0.0.0.0/0 points to the Direct Connect gateway attachment (for outbound internet traffic, the shared services VPC has its own internet gateway and NAT gateway). The production VPC has a default route (0.0.0.0/0) pointing to the Transit Gateway. The shared services VPC has a default route pointing to the NAT gateway. However, traffic from on-premises to the production VPC is not being inspected; it goes directly to the production VPC. What is the most likely reason?

Accepted Answer

The Transit Gateway route table associated with the Direct Connect gateway attachment has propagation enabled, which installs a more specific route for the production VPC CIDR directly to the production VPC attachment, bypassing the shared services VPC.. When propagation is enabled on the Transit Gateway route table associated with the Direct Connect gateway attachment, the production VPC CIDR is automatically learned as a more specific route (e.g., 10.1.0.0/16) pointing directly to the production VPC attachment. This more specific route overrides the static 0.0.0.0/0 route that was intended to force traffic through the shared services VPC, causing on-premises traffic to bypass the inspection appliance.

Answer

The shared services VPC has a default route pointing to the NAT gateway, which is not a valid next hop for traffic coming from the Transit Gateway.

Answer

The production VPC route table has a default route pointing to the Transit Gateway, but the NAT gateway is in the shared services VPC, causing asymmetric routing.

Answer

The Transit Gateway route table associated with the shared services VPC attachment does not have a route for the production VPC CIDR pointing to the production VPC attachment, so return traffic cannot reach production.