ANS-C01 Practice Test 3 — 30 Questions

Question 1

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to an on-premises network with CIDR 172.16.0.0/12. They are using an AWS Transit Gateway with a VPN attachment to the on-premises network. The transit gateway route table has a static route for 172.16.0.0/12 pointing to the VPN attachment. Which THREE of the following are necessary for traffic to flow from the VPC to on-premises?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The VPC route tables include a route for 172.16.0.0/12 pointing to the transit gateway. Option B is correct because the VPC must have a Transit Gateway attachment (a VPC attachment) before any traffic can be sent to or received from the transit gateway; without this attachment, the TGW cannot route packets into the VPC. Option A is correct because the VPC's route tables must contain a route for 172.16.0.0/12 targeting the transit gateway; otherwise instances in the VPC have no path toward the on-premises CIDR. Option C is correct because the transit gateway route table must have a route for 172.16.0.0/12 pointing to the VPN attachment, which is exactly the static route described in the scenario and is required for the TGW to forward traffic to the VPN. Option D is not required because the scenario already states a static route exists on the TGW, so BGP advertisement from the on-premises router is unnecessary for the TGW to know the route. Option E is not required because the VPN can use static routing; dynamic BGP is optional and not mandated by the scenario.

Answer

The on-premises router is advertising the 172.16.0.0/12 route over BGP

Answer

The VPN tunnel is configured with dynamic BGP routing

Question 2

A company has a VPC with an IPv6 CIDR block and wants to provide internet access to instances in a private subnet using an egress-only internet gateway. Which of the following must be configured correctly?

Accepted Answer

Add a default route (::/0) in the private subnet's route table pointing to the egress-only internet gateway.. An egress-only internet gateway (EIG) is a horizontally scaled, redundant VPC component that allows outbound-only IPv6 traffic from instances in a private subnet to the internet, while preventing unsolicited inbound connections. To use it, you must add a default route (::/0) in the private subnet's route table pointing to the EIG, which directs all outbound IPv6 traffic through the gateway. This configuration ensures that instances can initiate outbound IPv6 connections (e.g., to download updates) but cannot be reached from the internet.

Answer

Configure NAT64 on the VPC to translate IPv6 to IPv4.

Answer

Enable route propagation for the egress-only internet gateway in the route table.

Answer

Assign an IPv6 address to the egress-only internet gateway.

Question 3

A company wants to provide internet access to instances in a private subnet without using a NAT Gateway, due to cost constraints. They have a public subnet with a bastion host that has a public IP. They also have a VPC with an Internet Gateway. What is the most cost-effective way to allow outbound internet access for instances in the private subnet?

Accepted Answer

Launch a NAT instance in the public subnet and configure the private subnet route table to point 0.0.0.0/0 to the NAT instance.. Launch a NAT instance in the public subnet and configure the private subnet route table to point 0.0.0.0/0 to the NAT instance. A NAT instance is a cost-effective alternative to NAT Gateway, as it uses an EC2 instance with IP forwarding enabled and can be run on a low-cost instance type. It requires management but avoids NAT Gateway hourly charges. Option B is incorrect because a VPN connection to a third-party proxy introduces unnecessary complexity and cost. Option C is incorrect because VPC endpoints only provide access to specific AWS services (e.g., S3), not general internet access. Option D is incorrect because the bastion host is typically used for SSH access, and while it could be configured for NAT, it is not recommended for security reasons; a dedicated NAT instance in a public subnet is the proper approach.

Answer

Use a VPN connection to a third-party internet proxy.

Answer

Create a VPC endpoint for Amazon S3 and configure the private subnet to use it.

Answer

Configure the bastion host as a NAT instance by enabling IP forwarding.

Question 4

A company runs a multi-tier web application on AWS. The web servers in public subnets need to send traffic to the application servers in private subnets. The application servers must only accept traffic from the web servers. Both tiers are in the same VPC. Which design meets these requirements without introducing a single point of failure or unnecessary complexity?

Accepted Answer

Place the web servers in a public subnet with a security group that allows inbound from 0.0.0.0/0 on port 443. Place the app servers in a private subnet with a security group that allows inbound from the web server security group on the application port.. It uses security group referencing, which allows the app servers' security group to dynamically allow traffic from any instance associated with the web servers' security group, regardless of IP address changes. This design avoids a single point of failure by not introducing any load balancer or gateway, and it minimizes complexity by leveraging native VPC security group behavior within the same VPC.

Answer

Place the web servers and app servers in the same private subnet behind an internal Network Load Balancer. Route web traffic through the NLB.

Answer

Place the web servers in a public subnet with an Internet Gateway. Place the app servers in a private subnet with a NAT Gateway for outbound traffic. Use NACLs to allow inbound from the web subnet CIDR.

Answer

Place the web servers in a public subnet with a NACL allowing inbound on port 443. Place the app servers in a private subnet with a NACL allowing inbound from the web subnet CIDR on the application port.

Question 5

A company has an Amazon RDS for MySQL database in a private subnet. The database should only be accessible from a specific fleet of EC2 instances in the same VPC. Which combination of security controls should be used to meet this requirement?

Accepted Answer

Use a security group for the RDS instance that allows inbound MySQL traffic from the security group of the EC2 instances.. A security group on the RDS instance that allows inbound MySQL traffic from the security group of the EC2 instances restricts access to only those instances that are members of that security group. Option A is incorrect because network ACLs are stateless and operate at the subnet level, requiring explicit inbound and outbound rules; they cannot reference security groups. Option B is incorrect because a VPN connection is used for connectivity to external networks, not for communication within the same VPC. Option D is incorrect because IAM database authentication controls user authentication to the database, not network-level access from EC2 instances.

Answer

Use a network ACL on the private subnet that allows MySQL traffic from the EC2 instances' IP addresses.

Answer

Set up a VPN connection between the EC2 instances and the RDS instance.

Answer

Enable IAM database authentication for the RDS instance and require EC2 instances to use IAM credentials.

Question 6

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to add a new CIDR block 10.1.0.0/16 to accommodate more subnets. The VPC already has multiple subnets and route tables. What is the impact of adding this secondary CIDR?

Accepted Answer

Existing subnets and route tables remain unchanged; new subnets can be created in the new CIDR.. Adding a secondary CIDR block to an existing VPC is a non-disruptive operation. The existing subnets and route tables remain completely unchanged because the secondary CIDR is an additional IP address space, not a modification of the existing one. New subnets can be created within the new CIDR block, and you must explicitly associate them with route tables as needed.

Answer

The secondary CIDR will be automatically advertised to all route tables.

Answer

The VPC will experience a brief outage while the new CIDR is being associated.

Answer

Existing subnets will automatically be extended to include IPs from the new CIDR.

Question 7

A company is designing a multi-region architecture using AWS Transit Gateway inter-region peering. They need to ensure that traffic between VPCs in different regions can traverse the TGW peering attachment without being inspected by a central security appliance. Which configuration should be used?

Accepted Answer

Create TGW peering attachments and configure the route tables to point to each other's TGW attachment.. Transit Gateway inter-region peering attachments connect two TGWs across regions, and each TGW's route table must have a route pointing to the peering attachment to forward traffic. This creates a direct path between the TGWs without forcing traffic through a centralized inspection VPC, satisfying the requirement that traffic not be inspected.

Answer

Route all inter-region traffic through a centralized inspection VPC in one region.

Answer

Set up a VPN connection between the two TGWs for encrypted traffic.

Answer

Use VPC peering between the VPCs instead of TGW peering.

Question 8

An organization has a multi-account setup using AWS Organizations. The security team wants to centrally manage and enforce security group rules across all VPCs in all accounts. Which solution should they implement?

Accepted Answer

Use AWS Firewall Manager to create common security group policies.. AWS Firewall Manager allows centralized management of security group policies across all accounts in an AWS Organization. It can enforce common security group rules, automatically remediate non-compliant resources, and apply policies to existing and new VPCs. This meets the requirement for central enforcement across all VPCs in all accounts.

Answer

Deploy a centralized network ACL in each VPC.

Answer

Enable VPC Flow Logs and analyze using Amazon Detective.

Answer

Use AWS Config rules to remediate non-compliant security groups.

Question 9

A company wants to connect multiple VPCs across different AWS Regions using AWS Transit Gateway. Which feature allows the VPCs to communicate with each other using private IP addresses without creating peering connections?

Accepted Answer

Transit Gateway inter-Region peering. Transit Gateway inter-Region peering allows VPCs in different AWS Regions to communicate using private IP addresses through a central Transit Gateway, without requiring individual VPC peering connections. This feature uses the AWS global network to route traffic between peered Transit Gateways, enabling cross-region connectivity with a hub-and-spoke architecture.

Answer

AWS Direct Connect gateway

Answer

AWS PrivateLink

Answer

VPC Peering

Question 10

A company has a VPC with CIDR 10.0.0.0/16 and needs to connect to an on-premises network with CIDR 10.0.0.0/8. They plan to use AWS Direct Connect with a private virtual interface. What should they do to resolve the overlapping CIDR conflict?

Accepted Answer

Change the VPC CIDR to a non-overlapping range, such as 172.16.0.0/16, and re-create the VPC with the new CIDR.. AWS does not support network address translation (NAT) for overlapping CIDRs on a Direct Connect private virtual interface. The only way to resolve the conflict is to change the VPC CIDR to a non-overlapping range (e.g., 172.16.0.0/16) and recreate the VPC, as the VPC CIDR cannot be modified after creation. This ensures that routes between the VPC and on-premises network do not conflict.

Answer

Create a VPN connection with dynamic routing and use BGP to advertise the VPC CIDR.

Answer

Create a VPC peering connection between the VPC and the on-premises network.

Answer

Use a NAT Gateway in the VPC to translate the on-premises IP addresses.

Question 11

A company uses AWS Direct Connect to connect their on-premises network to a VPC. They have a private virtual interface (VIF) with a BGP session. The on-premises router is advertising a default route (0.0.0.0/0) to the VPC. The company wants to ensure that traffic from the VPC to the internet does not use the Direct Connect connection, but instead uses a NAT gateway. However, they still want to use Direct Connect for traffic to specific on-premises prefixes. What should they do?

Accepted Answer

Advertise a more specific route for on-premises prefixes from the on-premises router, and configure the VPC route table with a static route for 0.0.0.0/0 to the NAT gateway. Ensure that the on-premises router does not advertise a default route.. The VPC route table uses longest prefix match. If the on-premises router advertises a default route (0.0.0.0/0), it will be propagated to the VPC route table and compete with the NAT gateway route. To ensure internet traffic uses the NAT gateway, the on-premises router must not advertise a default route. Instead, it should advertise only specific on-premises prefixes. Then, a static default route to the NAT gateway will handle internet traffic, and the more specific on-premises routes will direct traffic over Direct Connect. This provides the desired split.

Answer

Create a route in the VPC route table for 0.0.0.0/0 pointing to the virtual private gateway, and a more specific route for on-premises prefixes pointing to the NAT gateway.

Answer

Configure a route in the VPC route table for 0.0.0.0/0 pointing to the NAT gateway, and remove the default route propagation from the Direct Connect virtual private gateway.

Answer

Use a prefix list for on-premises prefixes and associate it with the Direct Connect gateway. Configure the VPC route table to use the prefix list for on-premises traffic and a default route to the NAT gateway.

Question 12

A company has a VPC with a NAT gateway in a public subnet. The security team wants to log all outbound traffic from private subnets to the internet. Which AWS service should be used to capture this traffic?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, bytes, action) for network interfaces in a VPC, including traffic traversing a NAT gateway from private subnets to the internet. They can be published to CloudWatch Logs or S3 and are the correct tool for logging outbound traffic flows. This directly satisfies the requirement to log all outbound traffic from private subnets.

Answer

AWS CloudTrail

Answer

Amazon S3 Access Logs

Answer

AWS Config

Question 13

A company wants to ensure that all traffic to and from its Amazon EC2 instances in a VPC is inspected by a third-party security appliance. The instances are in private subnets and must maintain their private IP addresses. Which solution should be used?

Accepted Answer

Configure a Gateway Load Balancer and Gateway Load Balancer endpoints in the VPC. Gateway Load Balancer (GWLB) with Gateway Load Balancer endpoints (GWLBe) allows you to insert third-party appliances inline for traffic inspection without changing the instances' private IP addresses. The GWLB acts as a transparent layer between the VPC and the appliance, inspecting all traffic. Option A is incorrect because a Transit Gateway with a site-to-site VPN does not provide inline inspection without modifying the routing and IP addresses. Option C is incorrect because VPC Peering does not inherently provide traffic inspection; you would still need to route traffic through an appliance. Option D is incorrect because a Network Load Balancer is designed for load balancing, not for inline inspection of all traffic.

Answer

Deploy a Transit Gateway with a site-to-site VPN to the appliance

Answer

Use VPC Peering to connect to a central inspection VPC

Answer

Set up a Network Load Balancer in front of the instances

Question 14

A company needs to block traffic from a specific IP address range in their VPC. Which component should be used?

Accepted Answer

Network ACL. Network ACLs (NACLs) are stateless, subnet-level firewalls that support both allow and deny rules, making them the only VPC component that can explicitly block traffic from a specific IP range. Security groups are stateful and only support allow rules, so they cannot deny traffic. Route tables and internet gateways control routing, not filtering. Thus, to block a CIDR range, you must use a NACL with a deny rule for that range.

Answer

Route table

Answer

Internet gateway

Answer

Security group

Question 15

A network engineer manages a VPC that uses a NAT gateway in a public subnet for outbound internet access from private subnets. After a new application was deployed, users report that outbound HTTPS requests from the private subnets intermittently fail with connection timeouts, while some requests succeed. The NAT gateway's CloudWatch metrics show high ActiveConnectionCount and ErrorPortAllocation spikes. Which action should the engineer take to resolve the intermittent failures?

Accepted Answer

Distribute outbound traffic across multiple NAT gateways in different Availability Zones and reduce connection reuse in the application.. ErrorPortAllocation occurs when a NAT gateway cannot allocate a source port for a new connection, typically because of many simultaneous connections to the same destination. Distributing egress across multiple NAT gateways in different AZs expands the source port capacity, and reducing connection reuse in the application lowers the concurrent demand that exhausts the port pool.

Answer

Increase the NAT gateway's bandwidth by enabling a second elastic IP address on the same NAT gateway.

Answer

Replace the NAT gateway with a NAT instance and configure a larger connection tracking table.

Answer

Add a route to the private subnet route table pointing the destination CIDR to an internet gateway.

Question 16

A company runs a hybrid workload where an on-premises application server must reach an EC2 instance in a VPC over an AWS Site-to-Site VPN. The VPN uses a virtual private gateway, and the on-premises router advertises 10.10.0.0/16 while the VPC CIDR is 10.20.0.0/16. The on-premises server can ping the EC2 instance, but TCP connections to port 443 time out. The VPC route table has a route for 10.10.0.0/16 pointing to the virtual private gateway, and the EC2 security group allows 10.10.0.0/16 on port 443. Which is the most likely cause?

Accepted Answer

The network ACL on the subnet containing the EC2 instance is blocking inbound TCP port 443 from the on-premises CIDR.. The protocol-specific failure is the key clue: ICMP succeeds while TCP 443 times out. Network ACLs are stateless and evaluated per direction, so an inbound rule that omits TCP 443 from the on-premises CIDR drops the SYN while allowing ICMP. Security groups are stateful and already permit the source, so the ACL is the most likely culprit.

Answer

The EC2 instance is in a private subnet and therefore cannot accept traffic from on-premises networks.

Answer

The virtual private gateway does not support BGP, so the on-premises prefix is not learned.

Answer

The VPN tunnel is down, so no traffic can pass between the on-premises network and the VPC.

Question 17

A company has a large AWS environment with hundreds of VPCs connected via a Transit Gateway. The network team is implementing a new hub-and-spoke architecture where all traffic between VPCs must be inspected by a centralized firewall appliance in a shared services VPC. The firewall appliance is a third-party virtual appliance that supports VRF-like segmentation. The network engineer has configured the Transit Gateway with separate route tables for each VPC, and the shared services VPC is associated with all route tables. The firewall appliance is deployed in the shared services VPC with two ENIs: one in a 'trust' subnet and one in an 'untrust' subnet. The trust subnet is used for traffic coming from spoke VPCs, and the untrust subnet is used for traffic going to other spoke VPCs. The firewall appliance performs stateful inspection and returns traffic to the Transit Gateway via the correct ENI. However, after implementation, traffic between two spoke VPCs (VPC A and VPC B) is being dropped. The engineer verifies that the Transit Gateway route tables have static routes for each spoke VPC CIDR pointing to the shared services VPC attachment. The spoke VPCs have routes to each other's CIDR via the Transit Gateway. The firewall logs show that traffic from VPC A reaches the trust ENI, but the firewall is unable to send traffic to VPC B because it does not have a route to VPC B's CIDR. What is the most likely cause?

Accepted Answer

The route table for the untrust subnet does not have a route to VPC B's CIDR pointing to the Transit Gateway.. The firewall's untrust subnet route table must have a route pointing to the Transit Gateway for VPC B's CIDR. The firewall receives traffic from VPC A on its trust ENI, processes it, and then sends it out the untrust ENI. Without a route in the untrust subnet's route table directing traffic for VPC B's CIDR to the Transit Gateway, the firewall cannot forward the traffic back to the Transit Gateway for delivery to VPC B, causing the drop.

Answer

The shared services VPC attachment is not propagating routes to the Transit Gateway route tables.

Answer

The security group for the firewall's untrust ENI is blocking outbound traffic.

Answer

The Transit Gateway route table for VPC A does not have a route for VPC B's CIDR.

Question 18

A company is designing a multi-VPC architecture with VPC peering. They need to ensure that traffic between VPCs is encrypted. What should they do?

Accepted Answer

Use a third-party VPN appliance in each VPC to create an IPsec tunnel between them. VPC peering does not encrypt traffic natively. To ensure encryption between VPCs, you need to establish an IPsec tunnel, which can be achieved by deploying a third-party VPN appliance in each VPC. Option B is incorrect because a VPN connection using virtual private gateways is typically used to connect a VPC to an on-premises network, not directly between VPCs. Option C is incorrect because VPC peering does not support enabling encryption on the peering connection itself; encryption must be added via an overlay. Option D is incorrect because AWS Direct Connect is used for dedicated connections to on-premises data centers, not for inter-VPC traffic.

Answer

Establish a VPN connection between the VPCs using virtual private gateways

Answer

Enable encryption on the VPC peering connection

Answer

Use AWS Direct Connect to connect the VPCs

Question 19

A company wants to use AWS Direct Connect to connect their on-premises network to a VPC. They have two Direct Connect locations and want high availability. What is the minimum number of Direct Connect virtual interfaces needed?

Accepted Answer

Two private VIFs. For high availability across two Direct Connect locations, you need at least two private virtual interfaces (VIFs), one at each location, each connecting to the same VPC. This ensures that if one Direct Connect connection or location fails, traffic can still flow through the other private VIF. A single private VIF provides no redundancy, and public VIFs are used for accessing public AWS services, not VPC connectivity.

Answer

One public VIF and one private VIF

Answer

Four private VIFs

Answer

One private VIF

Question 20

A company needs to encrypt data at rest in Amazon S3. Which AWS service manages the encryption keys?

Accepted Answer

AWS KMS. AWS KMS (Key Management Service) is the AWS service that manages encryption keys for Amazon S3. AWS KMS allows you to create, rotate, and control access to encryption keys used to encrypt data at rest in S3. Option A (AWS Secrets Manager) is incorrect because it manages secrets like database credentials, not encryption keys for S3. Option B (AWS Certificate Manager) is incorrect because it manages SSL/TLS certificates, not encryption keys. Option C (AWS CloudHSM) is incorrect because while it provides hardware security modules for key storage, it is not the default or primary key manager for S3; AWS KMS is the integrated service for S3 encryption.

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager

Answer

AWS CloudHSM