ANS-C01 Practice Test 31 — 15 Questions

Question 1

A company has a Direct Connect connection with a private VIF to a VPC. The company also has a Site-to-Site VPN connection to the same VPC as a backup. During a failover test, traffic from on-premises to the VPC continues to use the Direct Connect even after it is intentionally failed. The BGP timers are set to default values. What is the most likely cause?

Accepted Answer

The BGP session with the Direct Connect router is still established because the physical link is up, but the link is not forwarding traffic.. Option C is correct because even if the Direct Connect fails, the BGP session may remain established if there is still layer 2 connectivity (e.g., the physical link is up but degraded). The route will remain in the routing table until the BGP hold timer expires. Option A is wrong because longer AS path actually makes the route less preferred. Option B is wrong because the VPN route may have a longer AS path or a different prefix length. Option D is wrong because local preference is typically set to favor Direct Connect over VPN.

Answer

The Direct Connect route is more specific than the VPN route.

Answer

The VPN BGP route has a longer AS path than the Direct Connect route.

Answer

The VPN route has a lower local preference than the Direct Connect route.

Question 2

An organization uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. They want to implement traffic inspection between VPCs using a third-party firewall appliance in a central VPC. The firewall must inspect traffic for all inter-VPC flows. Which architecture meets this requirement?

Accepted Answer

Configure Transit Gateway route tables to send inter-VPC traffic to the inspection VPC's attachment, and enable appliance mode on the attachment.. Option D is correct because Transit Gateway with appliance mode (enabling asymmetric routing) and appropriate route tables can force traffic through the inspection VPC. Option A is wrong because VPC peering does not allow centralized inspection without complex routing. Option B is wrong because Network Load Balancer does not support traffic inspection. Option C is wrong because Direct Connect alone does not provide inspection.

Answer

Create VPC peering connections between all VPCs and route traffic through the central VPC.

Answer

Use a Network Load Balancer in the central VPC to distribute traffic to the firewall appliances.

Answer

Set up Direct Connect gateways and route all traffic through the on-premises network for inspection.

Question 3

A company is using AWS Client VPN to provide remote access to their VPC. Users report that they can connect to the VPN but cannot reach resources in the VPC. Which THREE configuration items should the engineer verify?

Accepted Answer

The authorization rules allow access to the VPC's CIDR.. Option B is correct because the subnet association determines which subnets are accessible. Option C is correct because the authorization rules control access to specific networks. Option E is correct because security groups associated with the VPC resources can block traffic. Option A is incorrect because client certificates are for authentication, not routing. Option D is incorrect because the VPN endpoint does not have a public IP; clients connect via a DNS name.

Answer

The Client VPN endpoint has a public IP address.

Answer

The client certificate is issued by a valid CA.

Question 4

A company is deploying a web application across multiple Availability Zones in a single region. They want to distribute incoming traffic evenly across all healthy EC2 instances. Which AWS service should be used as the entry point?

Accepted Answer

Application Load Balancer (ALB). Option B is correct because an Application Load Balancer distributes traffic across targets in multiple AZs and performs health checks. Option A is wrong because NLB is for TCP/UDP, not HTTP. Option C is wrong because Route 53 with simple routing does not load balance across instances. Option D is wrong because CloudFront distributes content, not application traffic.

Answer

Amazon CloudFront

Answer

Network Load Balancer (NLB)

Answer

Amazon Route 53 with simple routing

Question 5

A company is setting up AWS Transit Gateway with multiple VPC attachments and an AWS Direct Connect Gateway. The company wants to control which VPCs can communicate with each other and with the on-premises network. Which THREE actions should the company take to implement this?

Accepted Answer

Associate the Direct Connect Gateway with the Transit Gateway.. Option A is correct because route tables define how traffic is routed between attachments. Option C is correct because transit gateway peering attachments are used for inter-region connectivity, not intra-region. Option D is correct because the Direct Connect Gateway can be associated with the transit gateway to enable on-premises connectivity. Option B is wrong because VPC peering is not needed with Transit Gateway. Option E is wrong because Security Groups are not used to control traffic between VPCs in Transit Gateway.

Answer

Establish VPC peering connections between VPCs that need to communicate.

Answer

Use security groups to control traffic between VPCs.

Answer

Configure Transit Gateway peering attachments for inter-region connectivity.

Question 6

A company wants to allow an EC2 instance in a private subnet to download files from an S3 bucket without traversing the internet. Which AWS service should be used?

Accepted Answer

Create a VPC Gateway Endpoint for S3.. Option D is correct because a VPC Gateway Endpoint for S3 allows private connectivity to S3 without internet. Option A is wrong because NAT gateway uses internet. Option B is wrong because Direct Connect is for on-premises. Option C is wrong because S3 does not support VPC Interface Endpoint by default; Gateway Endpoint is used for S3.

Answer

Establish an AWS Direct Connect connection to the VPC.

Answer

Attach an internet gateway and route through a NAT gateway.

Answer

Create a VPC Interface Endpoint for S3.

Question 7

A company uses AWS Site-to-Site VPN to connect its on-premises network to a VPC. The VPN connection uses static routes. Recently, the on-premises network administrator added a new subnet (10.0.3.0/24) and needs to ensure that traffic to this subnet is routed through the VPN tunnel. What must be done in the AWS VPC to enable this connectivity?

Accepted Answer

Add a static route for 10.0.3.0/24 in the VPN connection's route table. Option C is correct because static routes for the VPN connection must be updated to include the new subnet. Option A is incorrect because route propagation is for dynamic routing. Option B is incorrect because the VPN connection itself does not need to be recreated. Option D is incorrect because the customer gateway represents the on-premises device and only needs to be updated if the device's IP or BGP ASN changes.

Answer

Update the customer gateway configuration

Answer

Enable route propagation on the VPN connection

Answer

Create a new VPN connection for the new subnet

Question 8

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network uses BGP to advertise a specific prefix (10.0.0.0/16) to the VPC. Recently, the company deployed a new VPC with CIDR 10.0.0.0/16 in a different region and established a VPC peering connection between the two VPCs. Now, traffic from on-premises to the new VPC is being routed to the old VPC instead. How should the company resolve this issue?

Accepted Answer

Update the on-premises router to advertise a more specific prefix for the new VPC over Direct Connect, such as 10.0.1.0/24, and ensure the new VPC's route table has a route to the on-premises network.. Option B is correct because the BGP advertisement of 10.0.0.0/16 over Direct Connect is more specific and takes precedence over the VPC peering route. By advertising a more specific prefix (e.g., 10.0.1.0/24) for the new VPC over Direct Connect or adjusting the route propagation, traffic can be directed correctly. Option A is wrong because deleting the peering connection would break connectivity between VPCs. Option C is wrong because VPC peering does not support transitive routing. Option D is wrong because disabling route propagation would remove all propagated routes, including the correct ones.

Answer

Delete the VPC peering connection and use a VPN instead.

Answer

Configure the VPC peering connection to propagate routes to the Direct Connect virtual interface.

Answer

Disable route propagation on the VPC route tables and add static routes.

Question 9

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to an on-premises network using AWS Direct Connect and a Site-to-Site VPN. The on-premises network advertises 10.0.0.0/8 over BGP. The company wants to ensure that traffic to the VPC's specific subnet 10.0.1.0/24 is routed via the VPN, while all other traffic to 10.0.0.0/8 uses Direct Connect. Which THREE actions should the network engineer take?

Accepted Answer

Set a higher BGP local preference on the VPN routes compared to Direct Connect routes for the same prefix.. Option A, Option B, and Option C are correct. A more specific prefix (10.0.1.0/24) is preferred over 10.0.0.0/8. Setting a higher local preference on the VPN route for 10.0.1.0/24 also ensures it is preferred. Additionally, using an AS path prepend on Direct Connect for the specific prefix can make it less preferred. Option D is wrong because disabling propagation on VPN would remove the route. Option E is wrong because the VPN should be used for the specific subnet, not disabled.

Answer

Disable route propagation on the VPN connection's route table.

Answer

Delete the VPN connection and rely solely on Direct Connect.

Question 10

A network engineer is troubleshooting connectivity issues between two VPCs connected via a Transit Gateway. The VPCs are in the same region and have proper route tables. Which TWO actions should the engineer perform to diagnose the problem?

Accepted Answer

Verify that the VPC route tables have routes pointing to the Transit Gateway attachment.. Option B is correct because checking route tables and association ensures traffic is directed to the Transit Gateway. Option D is correct because VPC Flow Logs can show dropped traffic. Option A is incorrect because Transit Gateway does not have a ping command. Option C is incorrect because security groups apply at the instance level, not Transit Gateway. Option E is incorrect because NACLs are stateless and less likely the issue.

Answer

Check the security groups of the Transit Gateway.

Answer

Ping the Transit Gateway to verify its status.

Answer

Examine the network ACLs for the Transit Gateway.

Question 11

A company is implementing a multi-region active-active application. They want to route users to the nearest healthy endpoint using DNS. Which AWS service should be used?

Accepted Answer

Amazon Route 53 latency-based routing. Option C is correct because Route 53 latency-based routing routes traffic to the region with the lowest latency. Option A is wrong because Global Accelerator uses Anycast IPs and does not rely on DNS routing policy. Option B is wrong because CloudFront is for content delivery, not application routing. Option D is wrong because ELB is regional and does not perform latency-based DNS routing.

Answer

Elastic Load Balancer (ELB)

Answer

Amazon CloudFront

Answer

AWS Global Accelerator

Question 12

A company has deployed an application in a VPC with public and private subnets across two Availability Zones. The application uses an Application Load Balancer (ALB) in the public subnets to distribute traffic to EC2 instances in the private subnets. The company wants to use AWS WAF to protect against SQL injection attacks. Where should the AWS WAF web ACL be associated?

Accepted Answer

The Application Load Balancer.. Option B is correct because AWS WAF can be associated with an ALB. Option A is wrong because AWS WAF does not directly protect Route 53. Option C is wrong because AWS WAF does not protect an internet gateway. Option D is wrong because AWS WAF is not associated with security groups.

Answer

Amazon Route 53 hosted zone.

Answer

The security group of the EC2 instances.

Answer

The VPC internet gateway.

Question 13

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. They want to inspect traffic between VPCs using a centralized network virtual appliance (NVA) in a security VPC. What is the most scalable and highly available design to achieve this?

Accepted Answer

Attach all VPCs to a Transit Gateway, use separate route tables for inspection, and deploy NVAs behind a Gateway Load Balancer in the security VPC.. Option B is correct because Transit Gateway route tables can be used to direct traffic to the inspection VPC for east-west traffic. Using a Gateway Load Balancer (GWLB) provides high availability and scaling for the NVAs. Option A is wrong because VPC peering does not support transitive routing. Option C is wrong because Direct Connect is for on-premises, not VPC-to-VPC. Option D is wrong because a single NVA is a single point of failure.

Answer

Place a single NVA in the Transit Gateway and route all inter-VPC traffic through it.

Answer

Create VPC peering connections between each VPC and the security VPC, then configure the NVAs to route traffic.

Answer

Use Direct Connect to connect all VPCs to a central location and route through NVAs there.

Question 14

A company is setting up AWS Client VPN to allow remote employees to access resources in a VPC. The VPC has a CIDR block of 10.0.0.0/16. The Client VPN endpoint is associated with a subnet 10.0.1.0/24. The company wants to assign client IP addresses from a different CIDR range than the VPC to avoid overlap. Which client CIDR range should the company specify?

Accepted Answer

192.168.0.0/16. Option B is correct because the client CIDR range must be different from the VPC CIDR and any connected networks. 192.168.0.0/16 is a valid private range that does not overlap with 10.0.0.0/16. Option A overlaps with the VPC CIDR. Option C is a public range, not recommended. Option D overlaps with the VPC CIDR.

Answer

172.16.0.0/12

Answer

10.0.0.0/16

Answer

10.0.0.0/8

Question 15

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from an S3 bucket in the same region. The company wants to minimize data transfer costs and avoid traversing the internet. Which solution should the company implement?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and attach it to the private subnet's route table.. Option B is correct because a VPC Gateway Endpoint for S3 allows private connectivity to S3 without internet, reducing costs. Option A is wrong because a NAT Gateway incurs costs and uses internet. Option C is wrong because a VPC Interface Endpoint for S3 is also charged per hour and per GB. Option D is wrong because an S3 bucket policy does not provide connectivity.

Answer

Create a VPC Interface Endpoint for S3 and attach it to the private subnet.

Answer

Configure an S3 bucket policy to allow access from the VPC and use an Internet Gateway.

Answer

Create a NAT Gateway in the public subnet and route traffic to the S3 bucket through it.