ANS-C01 Practice Test 32 — 15 Questions

Question 1

A company wants to connect its on-premises data center to AWS using a dedicated, private network connection. Which AWS service should be used to establish a 1 Gbps dedicated connection?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct service for establishing a dedicated, private network connection from an on-premises data center to AWS. It provides a 1 Gbps (or higher) physical Ethernet link that bypasses the public internet, delivering consistent network performance and reduced bandwidth costs for high-volume data transfer.

Answer

AWS Transit Gateway

Answer

VPC Peering

Answer

AWS Site-to-Site VPN

Question 2

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download software patches from the internet. Which AWS service should be used to provide outbound internet access without allowing inbound traffic?

Accepted Answer

NAT gateway. A NAT gateway enables EC2 instances in a private subnet to initiate outbound IPv4 traffic to the internet (e.g., to download patches) while preventing any unsolicited inbound traffic from the internet. It resides in a public subnet with an Elastic IP and performs source network address translation (SNAT), replacing the private source IP with the gateway's public IP. This satisfies the requirement of outbound-only internet access without exposing the private instances to inbound connections.

Answer

Site-to-Site VPN connection

Answer

VPC endpoint

Answer

Internet gateway

Question 3

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks via Direct Connect and Site-to-Site VPN. The network team wants to ensure that traffic between VPCs does not traverse the on-premises network. Which Transit Gateway feature should be used?

Accepted Answer

Transit Gateway route tables with separate associations and propagations. Transit Gateway route tables with separate associations and propagations allow you to isolate traffic between VPCs and on-premises networks. By associating VPC attachments to one route table and on-premises attachments (Direct Connect, VPN) to another, you can prevent VPC-to-VPC traffic from being routed through the on-premises network. This ensures that inter-VPC traffic stays within AWS, meeting the requirement.

Answer

Transit Gateway Multicast

Answer

Transit Gateway Network Manager

Answer

Transit Gateway BGP over AWS Direct Connect

Question 4

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Direct Connect. They want to ensure that only traffic from specific on-premises IP ranges is allowed into the production VPC. Which approach should they use?

Accepted Answer

Deploy AWS Network Firewall in the production VPC and configure stateful rule groups to allow only the on-premises IP ranges.. The company wants to allow only specific on-premises IP ranges into the production VPC. Transit Gateway handles routing between attachments, but it does not filter traffic based on IP addresses. AWS Network Firewall is a managed firewall service that can be deployed in a VPC to inspect and filter traffic. By deploying Network Firewall in the production VPC and configuring stateful rule groups, the company can allow only traffic from the specified on-premises IP ranges and deny all other traffic. This approach provides granular control and is a recommended practice. Option A is incorrect because a Direct Connect gateway only advertises routes; it does not filter traffic. Option C is incorrect because Transit Gateway route tables control routing, not filtering; they cannot blackhole traffic based on source IP. Option D is incorrect because VPC peering is used for connecting VPCs, not for connecting on-premises networks via Direct Connect.

Answer

Configure the Direct Connect gateway to only advertise specific prefixes to the Transit Gateway.

Answer

Use Transit Gateway route tables to blackhole traffic from other IP ranges.

Answer

Create a VPC peering connection between the on-premises network and the production VPC.

Question 5

A company has a global application deployed across multiple AWS Regions. Users are routed to the nearest Region using Amazon Route 53. The application uses an Application Load Balancer in each Region. The network team wants to ensure that traffic is always routed to a healthy Region in case of a Regional failure. Which Route 53 routing policy should be used?

Accepted Answer

Latency-based routing with health checks. Latency-based routing with health checks directs users to the Region with the lowest latency while automatically removing unhealthy endpoints from DNS responses. When a Regional ALB fails its health check, Route 53 stops returning that Region's records, so users are routed to the next-lowest-latency healthy Region. This satisfies both the 'nearest Region' and 'healthy Region on failure' requirements in a single policy.

Answer

Weighted routing

Answer

Simple routing

Answer

Failover routing

Question 6

A company is migrating an on-premises application to AWS. The application requires low-latency, high-throughput connectivity between the on-premises data center and the AWS VPC. The company wants a dedicated, private connection that bypasses the internet. Which AWS service should they use?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the internet entirely. This ensures low-latency, high-throughput connectivity ideal for latency-sensitive or high-volume workloads, as it uses a physical cross-connect or hosted virtual interface over a private circuit.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

VPC Peering

Question 7

A company has a VPC with multiple subnets. They have an Application Load Balancer (ALB) in a public subnet and a web server fleet in private subnets. The security team wants to ensure that only the ALB can communicate with the web servers. Which security group configuration should be used?

Accepted Answer

Set the web server security group inbound rule to allow traffic from the ALB's security group.. Referencing the ALB's security group as the source allows only traffic from instances or resources associated with that security group, strictly limiting access to the web servers. This follows the principle of least privilege. Option B is wrong because allowing traffic from the public subnet CIDR is too broad and would permit any instance in that subnet, not just the ALB. Option C is wrong because allowing traffic from the VPC CIDR permits any resource in the VPC, which is overly permissive. Option D is wrong because allowing traffic from 0.0.0.0/0 exposes the web servers to the internet.

Answer

Set the web server security group inbound rule to allow traffic from the public subnet CIDR.

Answer

Set the web server security group inbound rule to allow traffic from the VPC CIDR.

Answer

Set the web server security group inbound rule to allow traffic from 0.0.0.0/0.

Question 8

A company has a VPC with public and private subnets in two Availability Zones. The private subnets need to access the internet for software updates. Which configuration meets this requirement securely?

Accepted Answer

Deploy a NAT Gateway in a public subnet and update the private subnet route tables to point 0.0.0.0/0 to the NAT Gateway.. A NAT Gateway placed in a public subnet with an Elastic IP allows instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections. The private subnet route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway's elastic network interface, which translates source private IPs to the NAT Gateway's Elastic IP using SNAT (Source Network Address Translation). This meets the requirement securely by maintaining the private subnets' isolation from direct internet exposure.

Answer

Attach an Internet Gateway to the VPC and add a route to 0.0.0.0/0 in the private subnet route tables pointing to the Internet Gateway.

Answer

Create a VPC Peering connection to a second VPC that has an Internet Gateway and route all traffic through it.

Answer

Configure a Virtual Private Gateway and use an AWS Direct Connect connection to the internet.

Question 9

A company has a Direct Connect connection with a private VIF to a VPC. The network engineer needs to ensure that traffic from the on-premises network to the VPC uses the Direct Connect path, while internet-bound traffic from the VPC uses an Internet Gateway. Which TWO configurations are required? (Select TWO.)

Accepted Answer

Add a route in the VPC route table for the on-premises CIDR pointing to the virtual private gateway (VGW). Option D is correct because the VPC route table must have a route for the on-premises CIDR block with the virtual private gateway (VGW) as the target, so return traffic destined for the on-premises network is sent over the private VIF/Direct Connect path rather than being dropped or misrouted. Option E is correct because a default route (0.0.0.0/0) pointing to the Internet Gateway in the VPC route table ensures that internet-bound traffic originating from the VPC is forwarded to the IGW, satisfying the requirement that internet traffic uses the IGW. Option A is not required because the Direct Connect location prefix is not the on-premises CIDR; routing to on-premises is accomplished by pointing the on-premises CIDR at the VGW, not by adding a route for the Direct Connect location. Option B is unnecessary because a NAT Gateway is used to give private subnets outbound internet access, but the scenario already specifies internet-bound traffic should use an Internet Gateway. Option C is incorrect because configuring the on-premises router to send all internet traffic to the VPC would force on-premises internet traffic through AWS, which is not part of the stated requirement and would be an asymmetric or unintended routing design.

Answer

Add a route in the VPC route table for the Direct Connect location prefix

Answer

Deploy a NAT Gateway in the VPC for internet access

Answer

Configure the on-premises router to send all internet traffic to the VPC

Question 10

A company has a hybrid network with multiple VPCs connected via a Transit Gateway. They need to centralize outbound internet traffic through a single VPC. Which architecture should be used?

Accepted Answer

Designate one VPC as an egress VPC with a NAT Gateway and Internet Gateway, and use Transit Gateway route tables to route 0.0.0.0/0 from other VPCs to the egress VPC.. It uses a dedicated egress VPC with a NAT Gateway and Internet Gateway, and leverages Transit Gateway route tables to direct 0.0.0.0/0 traffic from all other VPCs to this central point. This architecture centralizes outbound internet traffic, avoids overlapping NAT responsibilities, and maintains a clean hub-and-spoke design where only the egress VPC has direct internet access.

Answer

Attach a NAT Gateway to each VPC's private subnets.

Answer

Attach an Internet Gateway to each VPC and route 0.0.0.0/0 to the IGW.

Answer

Use a VPN connection to an on-premises data center for internet access.

Question 11

A company uses AWS WAF to protect its web application. The security team wants to block requests that contain SQL injection attempts. Which WAF rule type should be used?

Accepted Answer

SQL injection match condition. AWS WAF provides a specialized SQL injection match condition that inspects request components (URI, query string, body, headers, cookies) for patterns indicative of SQL injection attacks. This condition uses AWS's managed rule patterns to detect common SQLi payloads like ' OR '1'='1, UNION SELECT, and comment-based evasion techniques. It is the only rule type among the options designed specifically to identify and block SQL injection attempts at the application layer.

Answer

Geographic match rule

Answer

IP set rule

Answer

Rate-based rule

Question 12

A company is designing a hybrid network using AWS Direct Connect. They want to ensure high availability and minimize downtime. Which TWO actions should they take?

Accepted Answer

Set up a site-to-site VPN as a backup for the Direct Connect connection. Option A is correct because a site-to-site VPN over the internet provides a redundant, encrypted backup path that can automatically take over if the Direct Connect connection fails, ensuring continuity and minimizing downtime. Option D is correct because provisioning Direct Connect connections at two different Direct Connect locations provides physical path diversity, so a failure at one location (or its equipment) does not take down all connectivity. Option B is incorrect because a single customer router is a single point of failure, which undermines high availability. Option C is incorrect because a single Direct Connect connection with two virtual interfaces still relies on one physical connection and one location, so it does not provide the required redundancy. Option E is incorrect because using the same BGP ASN on both connections is not a high-availability measure and can complicate routing; diverse connections should be designed with proper BGP configuration, not merely duplicated ASNs.

Answer

Use a single customer router for both connections

Answer

Provision a single Direct Connect connection with two virtual interfaces

Answer

Use the same BGP ASN on both Direct Connect connections

Question 13

A company is designing a network for a multi-account AWS environment using AWS Organizations. The company must centralize internet egress for all accounts. Which TWO solutions should the company use? (Choose two.)

Accepted Answer

Use AWS Transit Gateway to route traffic from all VPCs to the egress VPC.. Option C is correct because AWS Transit Gateway acts as a regional hub that can attach VPCs from multiple accounts within an AWS Organization, allowing all spoke VPCs to route their default traffic to a centralized egress VPC without the complexity of full-mesh peering. Option E is correct because the centralized egress VPC must contain a NAT Gateway for outbound internet access from private subnets and an Internet Gateway to provide the actual path to the internet, which is the standard architecture for centralized egress. Option A is not ideal because VPC Peering is non-transitive and would require a full mesh of peering connections to the egress VPC, which does not scale well in a multi-account environment. Option B is incorrect because AWS Client VPN provides remote user access to AWS, not centralized internet egress for workloads. Option D is incorrect because attaching an Internet Gateway to each VPC and allowing direct internet access defeats the requirement to centralize egress.

Answer

Use VPC Peering to connect all VPCs to the egress VPC.

Answer

Deploy a AWS Client VPN endpoint in each VPC.

Answer

Attach an Internet Gateway to each VPC and allow direct internet access.

Question 14

A company is designing a multi-tier application in a VPC. The web tier must be accessible from the internet, while the application tier must only be accessible from the web tier. The database tier must be isolated from all other tiers except the application tier. Which TWO network architectures meet these requirements? (Choose TWO.)

Accepted Answer

Use a public subnet for an Application Load Balancer and private subnets for web, app, and database tiers. Use security groups to restrict traffic between tiers.. It places the Application Load Balancer in a public subnet to receive internet traffic, while the web, app, and database tiers reside in private subnets. Security groups are used to restrict traffic flows: the ALB security group allows inbound HTTP/HTTPS from the internet, the web tier security group allows inbound only from the ALB, the app tier security group allows inbound only from the web tier, and the database tier security group allows inbound only from the app tier. This ensures the application tier is only accessible from the web tier, and the database tier is isolated except from the application tier.

Answer

Use a single public subnet for all tiers and control access with security groups.

Answer

Use private subnets for all tiers and a NAT gateway for internet access from the web tier. Use security groups to control traffic.

Answer

Use a VPN connection from the on-premises network to access all tiers.

Question 15

A company uses AWS Shield Advanced to protect their web application against DDoS attacks. They have configured automatic application layer DDoS mitigation with AWS WAF. During a recent attack, the application experienced increased latency, and some legitimate users were blocked. The security team reviews the WAF logs and finds that many requests from legitimate IPs were rate-limited. The team had set a rate-based rule with a threshold of 100 requests per 5 minutes. What is the most likely reason legitimate users were blocked?

Accepted Answer

The rate-based rule uses the source IP address as the aggregation key, and legitimate users behind a NAT gateway share the same public IP, causing the aggregate rate to exceed the threshold.. The correct answer is C: the rate-based rule aggregates requests by source IP address, so many legitimate users sharing a single public IP through a NAT gateway can collectively exceed the 100-requests-per-5-minutes threshold and get blocked. This is the classic false-positive scenario for rate-based rules, since AWS WAF cannot distinguish individual users behind the same NAT egress IP. Option A is wrong because rate-based rule blocks are temporary (the IP is blocked only while the rate remains above the threshold, not for 24 hours or indefinitely). Option B is irrelevant because sticky sessions and load balancer distribution do not cause legitimate users to be blocked by a rate-based rule. Option D is wrong because a rule action set to 'count' only logs matches and never blocks traffic, so it cannot explain the blocks.

Answer

The rate-based rule is set to block requests for 24 hours after the threshold is exceeded, and once triggered, all requests from that IP are blocked indefinitely.

Answer

The WAF web ACL is associated with an Application Load Balancer that is not configured for sticky sessions, causing requests from the same user to be distributed across multiple IPs.

Answer

The rate-based rule is evaluating requests before the WAF allows them, and the threshold is too low, but the rule action is set to 'count' instead of 'block', so it should not block traffic.