ANS-C01 Practice Test 32 — 15 Questions

Question 1

A company is implementing a multi-region architecture with VPCs in us-east-1 and eu-west-1. They want to connect these VPCs using a Transit Gateway and ensure that traffic between regions can be inspected by a firewall in us-east-1. Which configuration is required?

Accepted Answer

Create a Transit Gateway in each region, peer them, and configure route tables to send inter-region traffic through the inspection VPC in us-east-1.. Option B is correct because Transit Gateway peering attachments between regions allow cross-region connectivity. To route traffic through the inspection VPC in us-east-1, the route tables in both regions must be configured accordingly. Option A is incorrect because VPC peering does not support transitive routing across regions. Option C is incorrect because Direct Connect gateway is not designed for inter-region VPC connectivity. Option D is incorrect because VPN connections do not inherently provide inspection capability.

Answer

Establish a VPN connection between the two VPCs and route traffic through the firewall.

Answer

Create a VPC peering connection between the two VPCs and update route tables.

Answer

Use a Direct Connect gateway to connect the two VPCs directly.

Question 2

An engineer is reviewing VPC Flow Logs for connectivity issues between two EC2 instances (10.0.1.5 and 10.0.2.10) on TCP port 443. The first log entry shows ACCEPT, the second shows REJECT. What is the most likely cause of the REJECT?

Accepted Answer

A security group rule is blocking the return traffic.. Option A is correct because the REJECT indicates that the packet was dropped by a security group or NACL. Since the first packet was accepted, a stateful security group might be blocking the return traffic if the session is not tracked. Option B is incorrect because REJECT is not due to routing. Option C is incorrect because the log shows the traffic as OK. Option D is incorrect because Flow Logs do not indicate interface issues.

Answer

The destination instance has an incorrect network interface configuration.

Answer

The network ACL is blocking the traffic due to an incorrect inbound rule.

Answer

The route table for the subnet does not have a route to the destination.

Question 3

A company needs to establish a dedicated, private, high-bandwidth connection between its on-premises data center and AWS. Which AWS service should be used?

Accepted Answer

AWS Direct Connect. Option B is correct because AWS Direct Connect provides dedicated private connectivity. Option A is wrong because VPN uses the public internet. Option C is wrong because Transit Gateway is a network hub, not a connection type. Option D is wrong because VPC peering connects VPCs, not on-premises.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

VPC peering

Question 4

A network engineer runs the above command to list VPC endpoints. The engineer notices that the second endpoint (vpce-0b2c3d4e5f6g7h8i9) does not have a policy document displayed. What does this indicate?

Accepted Answer

The endpoint has the default full-access policy.. Option B is correct because by default, a Gateway endpoint for DynamoDB uses a full-access policy if no custom policy is specified. Option A is wrong because the endpoint is active. Option C is wrong because the missing policy field indicates no custom policy was set. Option D is wrong because DynamoDB endpoints do not require a policy; the default allows all actions.

Answer

The endpoint is configured to use an AWS managed policy that is not shown.

Answer

The endpoint is not active and needs to be recreated.

Answer

The endpoint is for DynamoDB, which does not support endpoint policies.

Question 5

A company uses AWS Client VPN for remote access. Users report intermittent disconnections. The network engineer notices that the Client VPN endpoint is associated with a single subnet. What change should be made to improve reliability?

Accepted Answer

Associate the Client VPN endpoint with subnets in at least two Availability Zones.. Option C is correct because associating the Client VPN endpoint with subnets in multiple AZs provides high availability. Option A is wrong because increasing subnet size does not improve availability. Option B is wrong because multiple route tables are not needed; Client VPN uses one route table per subnet association. Option D is wrong because splitting the CIDR does not add redundancy.

Answer

Split the client CIDR into smaller ranges for each Availability Zone.

Answer

Create multiple route tables for the same subnet.

Answer

Increase the subnet CIDR size to accommodate more clients.

Question 6

A company is deploying a VPC with IPv6 support. The VPC has a CIDR block of 10.0.0.0/16 and an assigned IPv6 CIDR block of 2600:1f16:xxxx:xxxx::/56. The company wants EC2 instances in a public subnet to be able to communicate with the internet using IPv6. Which configuration is necessary?

Accepted Answer

Attach an egress-only internet gateway to the VPC and add a route for ::/0 to the egress-only internet gateway in the public subnet route table.. Option A is correct because an egress-only internet gateway allows outbound IPv6 traffic from EC2 instances while preventing inbound connections, similar to a NAT gateway for IPv4. Option B is wrong because an internet gateway with route 0.0.0.0/0 is for IPv4. Option C is wrong because NAT64 is for translating IPv6 to IPv4, not required here. Option D is wrong because a NAT gateway is for IPv4 only.

Answer

Attach a NAT gateway to the VPC and add a route for ::/0 to the NAT gateway in the public subnet route table.

Answer

Attach an internet gateway to the VPC and add a route for 0.0.0.0/0 to the internet gateway in the public subnet route table.

Answer

Set up a NAT64 translation service to convert IPv6 requests to IPv4.

Question 7

A company wants to deploy a web application on EC2 instances behind an Application Load Balancer (ALB). The application must support sticky sessions (session affinity). What configuration is required on the ALB?

Accepted Answer

Enable stickiness on the target group and specify a cookie duration. Option B is correct because enabling stickiness on the ALB target group with a cookie duration ensures requests from the same client are sent to the same target. Option A is for client IP preservation. Option C is for health checks. Option D is for routing.

Answer

Use path-based routing

Answer

Configure health checks on the target group

Answer

Enable proxy protocol v2

Question 8

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network advertises the prefix 10.0.0.0/8 to AWS. The VPC has a CIDR of 10.0.0.0/16. A network engineer wants to ensure that traffic from on-premises to a specific subnet 10.0.1.0/24 in the VPC is routed via a dedicated VPN connection instead of Direct Connect for testing purposes. Which TWO actions should the engineer take?

Accepted Answer

Advertise the specific prefix 10.0.1.0/24 from the VPN connection to the VPC.. Option A and Option D are correct. A more specific route (10.0.1.0/24) will be preferred over the less specific 10.0.0.0/8. Additionally, setting a lower MED on the VPN route (lower is better) can influence the path selection. Option B is wrong because disabling route propagation on the VPN would remove the VPN route. Option C is wrong because changing AS path prepend on Direct Connect would make it less preferred, but the Direct Connect may still be used. Option E is wrong because BGP communities do not apply in this context.

Answer

Prepend the AS path on the Direct Connect BGP advertisement.

Answer

Disable route propagation on the VPN connection's route table.

Answer

Use a BGP community to tag the Direct Connect route as no-export.

Question 9

An organization is using AWS Direct Connect with a private VIF to connect to a VPC. They want to extend connectivity to multiple VPCs in the same region without creating multiple private VIFs. Which solution should they implement?

Accepted Answer

Create a Direct Connect gateway and associate it with a Transit Gateway that is attached to the VPCs.. Option A is correct because a Direct Connect gateway allows a single private VIF to connect to multiple VPCs via Transit Gateway or virtual private gateways. Option B is incorrect because Transit VIF is for transit gateways, but Direct Connect gateway is the key. Option C is incorrect because VPC peering does not use Direct Connect. Option D is incorrect because multiple VIFs would be needed without a Direct Connect gateway.

Answer

Create VPC peering connections from the VPC with the Direct Connect VIF to the other VPCs.

Answer

Provision separate private VIFs for each VPC.

Answer

Use a Transit VIF to connect directly to a Transit Gateway.

Question 10

A company is troubleshooting high latency on an AWS Direct Connect connection. The network team notices that the latency increases during peak hours. The connection uses a single virtual interface (VIF) with a 1 Gbps capacity. What is the MOST likely cause of the latency?

Accepted Answer

The bandwidth limit of the virtual interface is being exceeded. Option B is correct because traffic can be dropped if it exceeds the bandwidth limit, causing retransmissions and increased latency. Option A is wrong because jumbo frames typically reduce latency. Option C is wrong because BGP timers affect convergence, not latency. Option D is wrong because VLAN mismatch would cause connectivity loss, not just latency.

Answer

The VLAN ID is mismatched between the customer router and AWS

Answer

Jumbo frames are not enabled on the customer router

Answer

BGP keepalive timers are set too high

Question 11

A company is using AWS Transit Gateway to connect multiple VPCs and an on-premises network via Direct Connect. The network team wants to isolate traffic between VPCs while allowing all VPCs to reach the on-premises network. Which TWO configurations should be implemented?

Accepted Answer

Attach the Direct Connect virtual interface to a VPN attachment on the Transit Gateway. Options B and C are correct because Transit Gateway route tables can be used to isolate traffic, and VPN attachments can be used for segmentation. Option A is wrong because VPC peering is not needed if Transit Gateway is used. Option D is wrong because a single route table would allow all VPCs to communicate. Option E is wrong because Direct Connect gateway does not isolate traffic between VPCs.

Answer

Use a Direct Connect gateway to propagate routes to all VPCs

Answer

Use a single Transit Gateway route table for all attachments

Answer

Create VPC peering connections between each VPC

Question 12

A company is deploying a VPC with public and private subnets in two Availability Zones. The public subnets are used for NAT gateways and an Application Load Balancer (ALB). The private subnets host EC2 instances running a web application. What is the most cost-effective and highly available configuration for internet access from the private instances?

Accepted Answer

Deploy a NAT gateway in each public subnet and configure private route tables with a default route to the NAT gateway in the same AZ.. Option D is correct because using a NAT gateway in each AZ provides high availability and cost-effectiveness compared to NAT instances (which require management) or a single NAT gateway (single point of failure). Option A is wrong because NAT instances are less reliable and require maintenance. Option B is wrong because a single NAT gateway lacks high availability. Option C is wrong because internet gateway is not used for private instances; it's for public subnets.

Answer

Create a single NAT gateway in one public subnet and route all private traffic to it.

Answer

Attach an internet gateway to the VPC and add a default route to it in the private subnets.

Answer

Launch a NAT instance in each public subnet and configure the private route tables.

Question 13

Which THREE of the following are valid considerations when designing a multi-VPC architecture using AWS Transit Gateway? (Choose three.)

Accepted Answer

You can route internet-bound traffic from multiple VPCs through a single shared VPC with a NAT gateway.. Options A, D, and E are correct. A: Transit Gateway supports transitive routing, but route tables control which VPCs can communicate. B is wrong because each VPC needs a unique CIDR to avoid routing conflicts. C is wrong because Transit Gateway supports multicast. D is correct: you can attach Direct Connect Gateway to Transit Gateway for on-premises connectivity. E is correct: you can centralize internet access via a NAT gateway in a shared VPC.

Answer

Transit Gateway does not support multicast traffic.

Answer

VPCs attached to the same Transit Gateway can have overlapping CIDR blocks.

Question 14

A company is setting up a Site-to-Site VPN connection to AWS. The customer gateway device is behind a NAT device that performs address translation. Which tunnel option must be enabled to ensure the VPN tunnel establishes correctly?

Accepted Answer

NAT Traversal (NAT-T). Option A is correct because NAT traversal (NAT-T) is required when the customer gateway is behind a NAT device to encapsulate IPsec packets in UDP. Option B is wrong because dead peer detection is for monitoring, not for NAT. Option C is wrong because perfect forward secrecy is a security feature. Option D is wrong because IKEv2 is a protocol version, not specifically for NAT traversal.

Answer

Perfect Forward Secrecy (PFS)

Answer

Dead Peer Detection (DPD)

Answer

IKEv2

Question 15

A company wants to restrict outbound traffic from a VPC to only allow HTTPS traffic to a specific list of domains. Which AWS service can be used to achieve this?

Accepted Answer

AWS Network Firewall. Option D is correct because Network Firewall can inspect and filter outbound traffic based on domain names. Option A is for inbound traffic distribution. Option B is for instance-level filtering. Option C is for domain registration.

Answer

Security groups

Answer

Amazon Route 53

Answer

Application Load Balancer