ANS-C01 Practice Test 2 — 30 Questions

Question 1

A network engineer is troubleshooting a Site-to-Site VPN connection between an on-premises network and AWS. The VPN tunnel is up, but traffic is not flowing from the on-premises network to a VPC. The VPC has a virtual private gateway attached, and the route table has a route pointing to the virtual private gateway for the on-premises CIDR (192.168.0.0/16). The on-premises firewall shows that traffic is being sent to the VPN tunnel. What should the engineer check next?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify that the on-premises route table has a route to the VPC CIDR via the VPN tunnel.. Since the VPN tunnel is up and the on-premises firewall confirms traffic is being sent to the tunnel, the issue is likely on the on-premises routing side. For traffic to flow from on-premises to the VPC, the on-premises router must have a route pointing to the VPC CIDR via the VPN tunnel interface. Without this route, packets will not be forwarded into the tunnel, even though the tunnel itself is operational.

Answer

Verify that the virtual private gateway is attached to the VPC.

Answer

Verify that the on-premises firewall is not blocking UDP port 500 for IKE.

Answer

Verify that the VPN tunnel's pre-shared key matches on both sides.

Question 2

A company is planning to connect its on-premises data center to AWS using AWS Direct Connect. The company requires high availability and wants to ensure that if one Direct Connect connection fails, traffic automatically fails over to another. Which THREE design elements should be included?

Accepted Answer

Provision two Direct Connect connections at different AWS Direct Connect locations.. Option A is correct because provisioning two Direct Connect connections at different AWS Direct Connect locations provides physical path diversity, so a failure at one location or its equipment does not take down all connectivity, which is required for high availability. Option D is correct because Direct Connect uses BGP to exchange routes between the on-premises routers and AWS; BGP is what enables dynamic routing and automatic failover when a connection or path becomes unavailable. Option E is correct because advertising the same BGP prefixes from both on-premises routers ensures AWS has redundant paths to the same networks and can fail over to the alternate connection when one path is withdrawn or fails. Option B is not appropriate because a single customer router is a single point of failure, defeating the high-availability goal even if it connects to two locations. Option C is not one of the three required design elements here because a VPN backup is a separate hybrid connectivity option, not a Direct Connect high-availability design element, and the scenario specifically asks for failover between Direct Connect connections.

Answer

Use a single customer router with multiple connections to both Direct Connect locations.

Answer

Configure a VPN connection as a backup to Direct Connect.

Question 3

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. It needs to connect to two other VPCs: VPC B (10.1.0.0/16) and VPC C (10.2.0.0/16). The company wants to use AWS Transit Gateway. Which THREE configurations are required to enable full mesh connectivity between all three VPCs?

Accepted Answer

Associate each VPC attachment with the Transit Gateway route table.. Associating each VPC attachment with the Transit Gateway route table is necessary for the Transit Gateway to know which attachments can communicate. Without this association, the Transit Gateway would not forward traffic between the VPCs, even if routes are present in the route table.

Answer

Create separate Transit Gateway route tables for each VPC to isolate traffic.

Answer

Create a VPN attachment to each VPC for encrypted communication.

Question 4

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. It needs to add an additional non-overlapping CIDR for new workloads. Which CIDR should be used?

Accepted Answer

10.1.0.0/16. (10.1.0.0/16) is correct because it provides a non-overlapping CIDR block that does not conflict with the existing VPC CIDR of 10.0.0.0/16. In AWS, when adding a secondary CIDR to a VPC, the new block must not overlap with the existing VPC CIDR or any of its subnets. The 10.1.0.0/16 range is entirely separate from 10.0.0.0/16, satisfying this requirement.

Answer

10.0.0.0/24

Answer

10.0.1.0/24

Answer

10.0.0.0/8

Question 5

A company has a Direct Connect connection with a private VIF to a VPC. They want to extend this connectivity to multiple VPCs in the same region without creating additional VIFs. Which solution should they implement?

Accepted Answer

Use a Direct Connect Gateway and attach the VPCs. A Direct Connect Gateway (DX Gateway) is a managed service that allows you to associate a single private virtual interface (VIF) with up to 10 VPCs in the same AWS Region (or across Regions with inter-region peering). This enables the company to extend their existing Direct Connect connection to multiple VPCs without provisioning additional VIFs, simplifying management and reducing costs.

Answer

Provision additional private VIFs for each VPC

Answer

Use VPC peering between the VPCs

Answer

Use a Transit VPC with VPN connections

Question 6

A company is designing a multi-account AWS environment using AWS Organizations. They want to restrict the use of certain instance types across all accounts. Which approach should they use to enforce this policy?

Accepted Answer

Create a service control policy (SCP) that denies the ec2:RunInstances action for noncompliant instance types and attach it to the root organizational unit.. Service control policies (SCPs) in AWS Organizations are the correct mechanism to enforce permission guardrails across multiple accounts. An SCP attached to the root organizational unit applies to all member accounts and can deny the ec2:RunInstances action for specific instance types, ensuring centralized, preventive control. SCPs do not grant permissions; they only limit the maximum available permissions.

Answer

Create an IAM policy that denies the ec2:RunInstances action for noncompliant instance types and attach it to each IAM user.

Answer

Set up AWS Config rules to detect noncompliant instances and trigger an AWS Lambda function to terminate them.

Answer

Use AWS CloudTrail to monitor ec2:RunInstances events and send alerts.

Question 7

A company is using AWS Direct Connect to connect its on-premises data center to AWS. The company has a single hosted virtual interface (VIF) with a private VIF to a VPC. The network team notices that traffic from on-premises to AWS is asymmetric—some packets go through the Direct Connect while others use a VPN backup. The team wants all traffic to use Direct Connect when available. What should they do?

Accepted Answer

Advertise more specific prefixes (e.g., /24) over Direct Connect and less specific (e.g., /16) over VPN.. BGP route selection prefers more specific prefixes (longest prefix match) over less specific ones. By advertising a more specific prefix (e.g., /24) over Direct Connect and a less specific prefix (e.g., /16) over the VPN, the on-premises router will prefer the Direct Connect path for the more specific route, ensuring all traffic uses Direct Connect when available. This leverages BGP's prefix-length-based path selection without requiring removal of the VPN backup.

Answer

Disable AS_PATH prepending on the Direct Connect BGP session.

Answer

Convert the private VIF to a public VIF.

Answer

Remove the VPN connection to force all traffic through Direct Connect.

Question 8

A company is designing a VPC with public and private subnets. They need to allow instances in the private subnet to access the internet for software updates while preventing inbound internet traffic. Which AWS service should they use?

Accepted Answer

NAT Gateway. A NAT Gateway allows instances in a private subnet to initiate outbound internet traffic while preventing inbound internet traffic from reaching them. It is deployed in a public subnet and uses an Elastic IP.

Answer

AWS Direct Connect

Answer

VPC Peering

Answer

Internet Gateway

Question 9

A company wants to connect its on-premises data center to AWS using a dedicated, high-bandwidth, low-latency connection. The data center is collocated with an AWS Direct Connect location. Which AWS service should be used to establish this connection?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct service because it provides a dedicated, private, high-bandwidth, low-latency connection from an on-premises data center to AWS. Since the data center is collocated with an AWS Direct Connect location, the company can establish a physical cross-connect directly to the AWS Direct Connect router, bypassing the public internet entirely.

Answer

VPC peering

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Question 10

Refer to the exhibit. A network engineer is analyzing VPC Flow Logs to troubleshoot connectivity issues. The engineer notices that traffic from 10.0.1.5 to 192.168.1.1 on port 80 is logged as ACCEPT, but the application team reports that the web request failed. What is the most likely cause?

Accepted Answer

The destination host 192.168.1.1 is not reachable or does not have a route back to the source.. The VPC Flow Logs record the state of the TCP handshake from the perspective of the network path, but they do not confirm that the destination host successfully processed the request or that a return path exists. If 192.168.1.1 has no route back to 10.0.1.5, the initial SYN-ACK will never reach the source, causing the application to time out even though the forward traffic was accepted by the network ACL and security group.

Answer

The VPC Flow Logs are not capturing all packets due to sampling.

Answer

The network ACL is returning an ICMP unreachable message that is not logged.

Answer

The security group on the ENI is blocking outbound traffic to 192.168.1.1.

Question 11

A company is using AWS Shield Advanced to protect against DDoS attacks. The security team wants to receive notifications when an attack is detected. Which service should be used to send these notifications?

Accepted Answer

Amazon SNS. AWS Shield Advanced integrates with Amazon CloudWatch to publish metrics and events. These events can be routed via Amazon EventBridge to trigger an Amazon SNS topic, which then sends notifications (e.g., email, SMS) to the security team. Option A (AWS Lambda) is a compute service, not a notification service. Option B (AWS Config) is used for configuration auditing and compliance, not notifications. Option C (Amazon SQS) is a message queue service; although it can receive events, it is not the service used to send direct notifications to subscribers. Only Amazon SNS (Option D) provides push-based notifications to endpoints like email, SMS, and mobile devices.

Answer

AWS Lambda

Answer

AWS Config

Answer

Amazon SQS

Question 12

A company has a hybrid network with multiple AWS Direct Connect connections to multiple VPCs. They want to monitor network performance and receive alerts when latency exceeds a threshold. Which combination of AWS services should be used to achieve this?

Accepted Answer

Amazon CloudWatch and Amazon CloudWatch Alarms. Amazon CloudWatch collects metrics from Direct Connect, including latency, and CloudWatch Alarms can trigger notifications via SNS when thresholds are exceeded. Option A is incorrect because CloudTrail logs API calls, not performance metrics. Option B is incorrect because Trusted Advisor provides best practice checks, not real-time latency monitoring, and SES is for email sending, not alerting. Option D is incorrect because VPC Flow Logs capture IP traffic metadata, not latency metrics, and CloudWatch Logs store log data, not metrics.

Answer

AWS CloudTrail and Amazon SNS

Answer

AWS Trusted Advisor and Amazon SES

Answer

VPC Flow Logs and Amazon CloudWatch Logs

Question 13

A company is designing a VPC with public and private subnets. The private subnets need to access Amazon S3 and Amazon DynamoDB. The company wants to minimize data transfer costs and avoid using a NAT gateway. What is the MOST cost-effective solution?

Accepted Answer

Create VPC endpoints for S3 and DynamoDB in the private subnets and update route tables. VPC endpoints for S3 and DynamoDB allow private connectivity without incurring data transfer costs or NAT gateway fees. Option A is wrong because an HTTP proxy adds complexity and cost. Option B is wrong because a NAT instance still incurs instance costs and management overhead. Option D is wrong because a NAT gateway incurs hourly and data processing charges.

Answer

Set up an HTTP proxy in the private subnets and configure the applications to use it

Answer

Use a NAT instance instead of a NAT gateway

Answer

Create a NAT gateway in a public subnet and route private subnet traffic to it

Question 14

A company wants to use Amazon Route 53 to resolve DNS queries for a domain they own. They want to ensure that DNS queries are answered quickly and that there is no single point of failure. Which configuration should they use?

Accepted Answer

Create a hosted zone and let Route 53 automatically handle the DNS resolution.. When you create a hosted zone in Route 53, AWS automatically provisions four authoritative name servers (NS records) distributed across multiple globally redundant data centers. This design inherently provides high availability and low-latency DNS resolution without any additional configuration, as Route 53 uses Anycast routing to direct queries to the nearest healthy name server.

Answer

Deploy Route 53 in multiple AWS Regions.

Answer

Create multiple hosted zones in separate AWS accounts.

Answer

Create a single hosted zone and assign it to one Route 53 name server.

Question 15

A company is deploying a multi-tier web application across three Availability Zones in a single AWS Region. The web tier must be fault-tolerant and scale horizontally. Which network design provides the highest availability and scalability?

Accepted Answer

Use an Application Load Balancer in front of an Auto Scaling group spanning three Availability Zones.. An Application Load Balancer (ALB) distributes incoming HTTP/HTTPS traffic across multiple targets, and when combined with an Auto Scaling group that spans three Availability Zones, it provides both horizontal scalability and fault tolerance. If one AZ fails, the ALB automatically routes traffic only to healthy instances in the remaining AZs, ensuring high availability. This design meets the requirement for a multi-tier web application that must scale horizontally and tolerate failures.

Answer

Deploy a single EC2 instance in one Availability Zone with an Elastic IP address.

Answer

Deploy EC2 instances in a single Availability Zone and use Route 53 weighted routing.

Answer

Use a Network Load Balancer with a single EC2 instance in each AZ.

Question 16

Which TWO actions can be taken to reduce the attack surface of a VPC's public subnets? (Choose 2.)

Accepted Answer

Place web servers in private subnets and use a load balancer in a public subnet. Placing web servers in private subnets and using a load balancer in a public subnet reduces the attack surface by ensuring that the web servers have no direct internet-facing IP addresses. The load balancer acts as a single point of ingress, allowing security groups to tightly control traffic from the load balancer to the web servers, while the public subnet only exposes the load balancer's endpoints. This architecture follows AWS best practices for a multi-tier application, minimizing the number of resources directly accessible from the internet.

Answer

Allow all inbound traffic from the internet to the public subnets

Answer

Use a single subnet for all application tiers

Answer

Disable ICMP traffic on the network ACL

Question 17

A company wants to inspect traffic between VPCs in the same region using a third-party security appliance. Which THREE components are needed? (Choose 3)

Accepted Answer

AWS Transit Gateway. Option C (AWS Transit Gateway) is correct because it acts as a regional hub that connects multiple VPCs and can route inter-VPC traffic through a central inspection point, which is exactly what is needed to steer traffic to a third-party security appliance. Option E (a dedicated inspection VPC for the security appliance) is correct because the appliance must live in its own VPC so that Transit Gateway attachments and route tables can force traffic through it before reaching the destination VPC. Option D (route tables in the inspection VPC directing traffic through the appliance) is correct because without route table entries pointing to the appliance's ENI as the next hop, traffic would bypass inspection; the inspection VPC's route tables are what enforce the traffic flow through the security appliance. Option A (VPC Peering connections between all VPCs) is not needed and would actually bypass the central inspection design, since peering creates direct VPC-to-VPC paths. Option B (NAT Gateways in each VPC) is unrelated to traffic inspection; NAT Gateways only provide outbound internet access for private subnets and do not route or inspect inter-VPC traffic.

Answer

VPC Peering connections between all VPCs

Answer

NAT Gateways in each VPC

Question 18

Which THREE of the following are benefits of using AWS Transit Gateway over VPC peering for inter-VPC connectivity? (Choose three.)

Accepted Answer

Transitive routing between all attached VPCs. Option A is correct because AWS Transit Gateway acts as a regional hub that provides transitive routing, so any attached VPC can reach any other attached VPC through the gateway without needing a full mesh of individual peering connections. Option C is correct because Transit Gateway natively supports attachments for AWS Direct Connect gateways and Site-to-Site VPN, allowing centralized hybrid connectivity to on-premises networks, whereas VPC peering cannot extend to on-premises by itself. Option E is correct because Transit Gateway centralizes connectivity management, letting you attach many VPCs and on-premises links to a single gateway and control routing with a single set of route tables, instead of managing numerous point-to-point peering relationships. Option B is not correct because Transit Gateway adds an extra hop through a central hub, so it does not inherently provide lower latency than direct VPC peering. Option D is not correct because Transit Gateway charges per attachment and per GB of data processed, so it typically costs more than VPC peering, which has no hourly attachment charge.

Answer

Lower latency than VPC peering

Answer

No additional cost compared to VPC peering

Question 19

A company is designing a network for a containerized microservices application running on Amazon ECS. The application consists of several microservices that need to communicate with each other. The company wants to use service discovery so that services can find each other by name. They also want to ensure that traffic between services is encrypted in transit. The microservices are deployed across multiple Availability Zones. Which combination of services should the company use?

Accepted Answer

Use AWS Cloud Map for service discovery and AWS App Mesh for encryption in transit. AWS Cloud Map provides service discovery by registering microservices with DNS names and health checks, allowing ECS tasks to resolve each other by name. AWS App Mesh uses Envoy sidecar proxies to enforce mutual TLS (mTLS) encryption between services, ensuring traffic is encrypted in transit without requiring changes to application code. This combination meets the requirements for name-based discovery and encrypted inter-service communication across multiple Availability Zones.

Answer

Use an Application Load Balancer for each service and configure HTTPS listeners

Answer

Use VPC peering between each service's VPC

Answer

Use Amazon Route 53 private hosted zones for service discovery and enable encryption at the application layer

Question 20

A company needs to securely connect multiple VPCs across different AWS Regions using AWS backbone network infrastructure without traversing the public internet. The solution must be managed centrally and support transitive routing between VPCs. Which service should the company use?

Accepted Answer

AWS Transit Gateway with inter-region peering.. AWS Transit Gateway with inter-region peering allows you to connect VPCs across different AWS Regions using the AWS global backbone, avoiding the public internet. It provides a central hub for managing connectivity and supports transitive routing between all attached VPCs, which is not possible with VPC peering alone. This makes it the correct choice for a centrally managed, transitive, cross-region solution.

Answer

VPC peering connections in a full mesh.

Answer

AWS PrivateLink and VPC Endpoints.

Answer

AWS ClassicLink.