ANS-C01 Practice Test 31 — 15 Questions

Question 1

A company is setting up a new VPC with both IPv4 and IPv6 support. They need to ensure that instances in a private subnet can access the Internet for software updates. Which combination of resources is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

NAT gateway and egress-only internet gateway. For IPv6 traffic, an egress-only internet gateway allows outbound-only internet access from private subnets, while a NAT gateway provides similar functionality for IPv4 traffic. Together, they enable instances in a private subnet to initiate outbound connections to the internet for software updates without allowing inbound connections from the internet.

Answer

VPC endpoint and internet gateway

Answer

NAT instance and internet gateway

Answer

Internet gateway and NAT gateway

Question 2

A company wants to securely connect multiple VPCs in the same region to a common on-premises network using a single Direct Connect connection. Which AWS service should they use to simplify the network architecture?

Accepted Answer

Direct Connect Gateway. A Direct Connect Gateway allows you to associate multiple VPCs (in the same or different AWS regions) with a single AWS Direct Connect connection, enabling connectivity to a common on-premises network. This simplifies the architecture by eliminating the need for multiple virtual interfaces or separate Direct Connect connections per VPC. The Direct Connect Gateway acts as a hub that routes traffic between the on-premises network and all associated VPCs via a single private virtual interface (VIF).

Answer

Virtual Private Gateway

Answer

VPC Peering

Answer

Transit Gateway

Question 3

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. They want to ensure that traffic between VPCs is inspected by a third-party firewall appliance deployed in a centralized inspection VPC. Which THREE steps are required? (Choose three.)

Accepted Answer

Configure the firewall appliance to perform stateful inspection and route traffic back to the Transit Gateway.. Option E is required because the inspection VPC must be attached to the AWS Transit Gateway so that traffic from the spoke VPCs and VPN attachments can be routed into it for inspection. Option C is required because you need dedicated Transit Gateway route tables that propagate the inspection VPC attachment's routes and associate those route tables with the other VPC and VPN attachments, so traffic is directed through the inspection VPC instead of directly between spokes. Option A is required because the third-party firewall appliance must perform stateful inspection and then route the inspected traffic back to the Transit Gateway, typically using a separate subnet/attachment or return route, so it can reach its final destination. Option B is not needed because VPC peering bypasses the Transit Gateway and would not provide the centralized inspection path; the spoke VPCs should communicate through the Transit Gateway. Option D is not required because Direct Connect is a separate hybrid connectivity option and is not necessary to inspect VPC-to-VPC traffic that already flows through the Transit Gateway and VPN.

Answer

Set up VPC peering between the inspection VPC and each spoke VPC.

Answer

Establish an AWS Direct Connect connection between the inspection VPC and the on-premises network.

Question 4

A company is deploying an application that must use IPv6 for internet-facing traffic. The VPC is currently using IPv4 only. What is the simplest way to enable IPv6?

Accepted Answer

Associate an IPv6 CIDR block with the VPC and subnets, and update route tables to route IPv6 traffic to an internet gateway.. The simplest way to enable IPv6 in an existing IPv4-only VPC is to associate an IPv6 CIDR block (e.g., an Amazon-provided /56) with the VPC and subnets, then update the route tables to direct IPv6 traffic (::/0) to an internet gateway. This requires no additional translation or complex infrastructure, as the internet gateway is already dual-stack capable and can handle both IPv4 and IPv6 traffic natively.

Answer

Use an egress-only internet gateway for IPv6 traffic.

Answer

Deploy a NAT64 device to translate IPv6 to IPv4.

Answer

Set up a VPN connection to an ISP that provides IPv6.

Question 5

A network engineer is troubleshooting a VPN connectivity issue. The VPN tunnel is up, but traffic is not passing. Which TWO AWS services should the engineer use to diagnose the problem?

Accepted Answer

VPC Flow Logs. VPC Flow Logs (B) is correct because it captures IP traffic metadata for ENIs, subnets, and VPCs, letting the engineer verify whether packets are actually traversing the VPN tunnel and whether they are being ACCEPTed or REJECTed by security groups or NACLs. Amazon CloudWatch (E) is correct because it provides VPN tunnel metrics such as TunnelState, TunnelDataIn, and TunnelDataOut, which reveal whether traffic is flowing through the tunnel even when the tunnel state shows UP. AWS Config (A) only records resource configuration changes and compliance, not live packet flow, so it cannot diagnose why traffic is dropped. AWS CloudTrail (C) logs API activity and management events, not data-plane traffic through a VPN. AWS Direct Connect (D) is a dedicated network connection service, not a diagnostic tool, and is unrelated to troubleshooting an existing VPN tunnel.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

AWS Direct Connect

Question 6

A company is designing a network security architecture for a multi-account environment using AWS Transit Gateway. The security team needs to centralize inspection of all traffic between VPCs using a third-party firewall appliance in a shared services VPC. What is the most scalable and highly available design?

Accepted Answer

Create a Transit Gateway with separate route tables for each VPC and a shared route table for the inspection VPC. Use Gateway Load Balancer to distribute traffic to a fleet of firewall instances.. It combines AWS Transit Gateway with separate route tables per VPC and a shared inspection route table, enabling centralized traffic steering to a fleet of firewall instances behind a Gateway Load Balancer (GWLB). GWLB transparently distributes traffic across multiple firewall instances at the network layer (GENEVE protocol), providing both horizontal scalability and high availability without introducing a single point of failure or requiring complex VPC peering meshes.

Answer

Use VPC peering to connect all VPCs to the shared services VPC and route traffic through the firewall.

Answer

Attach all VPCs to a Transit Gateway and configure a Network Load Balancer in the shared services VPC to distribute traffic to firewall instances.

Answer

Attach all VPCs to a Transit Gateway and use a single firewall instance with elastic network interfaces in each VPC.

Question 7

A company wants to securely connect two VPCs in different AWS regions using AWS infrastructure. Which service should be used?

Accepted Answer

VPC peering. VPC peering is the correct service because it allows direct, private connectivity between two VPCs in different AWS regions using AWS's internal network, without traversing the public internet. It uses the existing AWS infrastructure to route traffic between the VPCs via private IP addresses, and it supports inter-region peering as of 2017, making it the simplest and most cost-effective solution for this specific requirement.

Answer

AWS Direct Connect

Answer

Internet Gateway

Answer

AWS Transit Gateway

Question 8

A company has an on-premises data center connected to AWS via a Site-to-Site VPN. The VPN connection uses BGP for dynamic routing. The company wants to add an additional VPN tunnel for redundancy. What must be configured?

Accepted Answer

Create a second VPN connection to a second customer gateway device.. To add an additional VPN tunnel for redundancy, you must create a second VPN connection that uses a second customer gateway device. This provides a second BGP session and a separate tunnel, ensuring failover if the primary tunnel or customer gateway fails. The existing virtual private gateway can support multiple VPN connections, so no replacement or additional VGW is needed.

Answer

Create a second virtual private gateway and attach it to the VPC.

Answer

Add a transit gateway to replace the virtual private gateway.

Answer

Configure static routes instead of BGP.

Question 9

A company has a multi-account AWS environment using AWS Transit Gateway with a centralized network account. The network team wants to ensure that only specific VPCs can communicate with each other. What is the best practice to achieve this?

Accepted Answer

Create multiple Transit Gateway route tables and associate each VPC attachment with the appropriate route table.. The best practice for segmenting communication between VPCs attached to a centralized Transit Gateway is to create multiple Transit Gateway route tables and associate each VPC attachment with the appropriate route table. This allows the network team to control which VPCs can reach which others by controlling route propagation and association, without relying on per-VPC security groups or point-to-point peering.

Answer

Configure security groups in each VPC to allow traffic only from specific VPC CIDRs.

Answer

Use VPC peering connections between the VPCs that need to communicate.

Answer

Use AWS Network Manager to create routing policies.

Question 10

A company has set up a Direct Connect connection with a private VIF to its VPC. The BGP session is up, but traffic is not passing between the on-premises network and the VPC. Which configuration should be verified?

Accepted Answer

Check the BGP advertised routes and the VPC route tables. For traffic to flow between on-premises and the VPC over a Direct Connect private VIF, the on-premises network must advertise the appropriate routes via BGP, and the VPC route tables must have routes pointing to the virtual private gateway (VGW). Option A is wrong because jumbo frames are not required for basic connectivity. Option B is wrong because the VIF type (private vs public) is not the issue—the BGP session is already up, indicating the VIF is correctly configured as private. Option C is wrong because CloudWatch metrics are for monitoring performance, not for diagnosing routing issues.

Answer

Ensure jumbo frames are enabled on the Direct Connect interface

Answer

Verify that the VIF is a public VIF

Answer

Review the Direct Connect virtual interface metrics in CloudWatch

Question 11

A company has a VPC with public and private subnets. The private subnets need to access the internet through a NAT Gateway. The security team wants to ensure that traffic from the private subnets to the internet is logged and inspected for malicious activity. Which solution meets these requirements?

Accepted Answer

Configure VPC Traffic Mirroring from the private subnet instances to a network security appliance (e.g., partner firewall) for deep packet inspection.. VPC Traffic Mirroring allows you to capture and mirror all traffic from the elastic network interfaces (ENIs) of instances in private subnets to a network security appliance (e.g., partner firewall) for deep packet inspection and logging. This meets the requirement for inspecting traffic for malicious activity. Option A is incorrect because AWS Shield Advanced provides DDoS protection but does not provide deep packet inspection or logging of all traffic. Option B is incorrect because AWS WAF is a web application firewall that inspects HTTP/HTTPS traffic at the application layer, not network-level traffic from private subnets. Option C is incorrect because VPC Flow Logs only capture metadata (IP addresses, ports, protocols) and do not inspect packet payloads for malicious activity.

Answer

Use AWS Shield Advanced to inspect traffic and detect malicious activity.

Answer

Deploy AWS WAF on the NAT Gateway to inspect and filter outgoing traffic.

Answer

Enable VPC Flow Logs on the NAT Gateway and analyze the logs with Amazon Detective.

Question 12

A security engineer is designing a security group configuration for a web application that consists of an Application Load Balancer (ALB), Amazon EC2 instances in an Auto Scaling group, and an Amazon RDS database. Which TWO actions should the engineer take to follow security best practices? (Choose TWO.)

Accepted Answer

Configure the EC2 instance security group to allow inbound traffic on port 443 from the ALB security group.. Referencing the ALB security group as the source in the EC2 security group rule ensures that only traffic originating from the ALB (and not any other source) is allowed on port 443. This follows the security best practice of using security group references instead of IP ranges, providing a tighter, more dynamic access control that automatically scales with the ALB's elastic network interfaces.

Answer

Configure the RDS security group to allow inbound traffic on port 3306 from 0.0.0.0/0.

Answer

Configure the ALB security group to allow inbound traffic on port 443 from the security group of the EC2 instances.

Answer

Configure the ALB security group to allow inbound traffic on port 80 from the security group of the EC2 instances.

Question 13

Which TWO of the following are required to establish a BGP session over a Direct Connect private virtual interface? (Choose TWO.)

Accepted Answer

A VLAN ID. A VLAN ID is required because a Direct Connect private virtual interface operates over a single 802.1Q VLAN trunk. The VLAN ID uniquely identifies the virtual interface on the Direct Connect connection, allowing multiple virtual interfaces to share the same physical link. Without a VLAN ID, the Layer 2 encapsulation cannot be established, and the BGP session cannot form.

Answer

A public IP address for the BGP peer

Answer

A Direct Connect gateway

Answer

A VPN connection to the VPC

Question 14

A company has a VPC with public and private subnets. The public subnet contains a NAT gateway and a bastion host. The private subnet contains application servers. The company wants to ensure that the application servers can download patches from the internet. Which TWO steps should be taken to allow this while maintaining security? (Choose two.)

Accepted Answer

Allow outbound HTTPS (port 443) traffic from the application servers in the security group. The application servers need to initiate outbound HTTPS connections (port 443) to download patches from the internet. By allowing outbound HTTPS traffic in the security group associated with the application servers, you permit the necessary traffic while maintaining stateful filtering and restricting other outbound traffic. This is a security best practice that follows the principle of least privilege.

Answer

Modify the network ACL of the private subnet to allow all outbound traffic

Answer

Add a route in the public subnet route table that points 0.0.0.0/0 to the NAT gateway

Answer

Associate an Elastic IP address with the NAT gateway

Question 15

A company has a global application deployed across multiple AWS regions using Application Load Balancers (ALBs) and AWS Global Accelerator. Users in Asia report high latency. The network team wants to monitor the performance of the Global Accelerator endpoints. Which AWS service should they use to collect and analyze network metrics?

Accepted Answer

Amazon CloudWatch metrics for Global Accelerator. Amazon CloudWatch metrics for Global Accelerator provide endpoint health and performance metrics, such as latency and packet loss, which are essential for monitoring Global Accelerator endpoints. Option B is incorrect because VPC Flow Logs capture IP traffic information but not accelerator-level performance metrics. Option C is incorrect because AWS X-Ray is used for tracing application requests, not network-level metrics. Option D is incorrect because AWS CloudTrail logs API calls for auditing, not performance monitoring.

Answer

AWS VPC Flow Logs

Answer

AWS X-Ray

Answer

AWS CloudTrail