ANS-C01 Practice Test 33 — 15 Questions

Question 1

A company is deploying a VPC with public and private subnets in two Availability Zones. The public subnets are used for NAT gateways and an Application Load Balancer (ALB). The private subnets host EC2 instances running a web application. What is the most cost-effective and highly available configuration for internet access from the private instances?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy a NAT gateway in each public subnet and configure private route tables with a default route to the NAT gateway in the same AZ.. Deploying a NAT gateway in each public subnet (one per Availability Zone) ensures that private instances in each AZ can route outbound traffic through a NAT gateway in the same AZ, providing both high availability (no single point of failure) and cost efficiency (no cross-AZ data transfer charges). This configuration uses the default route (0.0.0.0/0) in the private route tables pointing to the NAT gateway in the same AZ, which avoids the per-GB data transfer costs that would occur if traffic crossed AZs to reach a single NAT gateway.

Answer

Create a single NAT gateway in one public subnet and route all private traffic to it.

Answer

Attach an internet gateway to the VPC and add a default route to it in the private subnets.

Answer

Launch a NAT instance in each public subnet and configure the private route tables.

Question 2

Which THREE of the following are considerations when designing a Direct Connect implementation for high availability? (Choose three.)

Accepted Answer

Use BGP to advertise the same prefixes over both connections.. Using BGP to advertise the same prefixes over both Direct Connect connections enables active-active or active-passive load balancing and automatic failover. BGP’s route selection and AS_PATH prepending allow you to control traffic flow, ensuring that if one connection fails, the other continues to advertise the same prefixes, maintaining connectivity without manual intervention.

Answer

Use a single connection with high bandwidth.

Answer

Configure static routes to the on-premises network.

Question 3

A company has a VPC with a Transit Gateway (TGW) connected to multiple VPCs and an on-premises network via Direct Connect. The network team wants to implement centralized inspection of all traffic between VPCs and between VPCs and on-premises. Which architecture should they use?

Accepted Answer

Create a Gateway Load Balancer (GWLB) in a dedicated inspection VPC and attach it to the Transit Gateway.. Centralized inspection of traffic between VPCs and between VPCs and on-premises through a Transit Gateway requires a Gateway Load Balancer (GWLB) deployed in a dedicated inspection VPC, with the GWLB endpoint attached to the TGW. This allows all traffic routed through the TGW to be redirected to third-party firewall appliances (or AWS Network Firewall) for inspection before reaching its destination, using GENEVE encapsulation on port 6081. This is the AWS-recommended hub-and-spoke inspection architecture.

Answer

Attach a Direct Connect Gateway to the Transit Gateway and configure route propagation.

Answer

Use AWS Network Firewall in each VPC.

Answer

Deploy a third-party firewall in each VPC and use VPC peering.

Question 4

A company is designing a VPC for a three-tier application (web, application, database). The database tier should not be accessible from the internet, but the web tier must be accessible. Which subnet design should the network engineer use?

Accepted Answer

Place web servers in public subnets with an internet gateway, and app and database servers in private subnets.. It places the web servers in a public subnet with an Internet Gateway (IGW) to allow inbound HTTP/HTTPS traffic from the internet, while the application and database servers are placed in private subnets with no direct internet path. This design ensures the database tier is isolated from the internet, meeting the security requirement, while the web tier remains accessible. The application servers can communicate with the database via private IP addresses within the VPC, and outbound internet access for the private subnets (if needed) can be provided through a NAT Gateway in a public subnet.

Answer

Place web and app servers in public subnets, and database servers in private subnets.

Answer

Place all servers in private subnets and use a NAT Gateway for internet access.

Answer

Place all servers in public subnets and rely on security group rules to restrict access.

Question 5

A company is deploying a VPC with public and private subnets in two Availability Zones. The private subnets need outbound internet access for software updates but must not be reachable from the internet. Which AWS service should be used to achieve this?

Accepted Answer

NAT Gateway. A NAT Gateway enables instances in private subnets to initiate outbound IPv4 traffic to the internet (e.g., for software updates) while preventing the internet from initiating connections back to those instances. It resides in a public subnet with an Elastic IP and uses source network address translation (SNAT) to translate private source IPs to the gateway's public IP, ensuring the private instances remain unreachable from external hosts.

Answer

VPC Peering

Answer

Virtual Private Gateway

Answer

Internet Gateway

Question 6

A network engineer is monitoring network performance and needs to collect and analyze network metrics from multiple AWS services in a centralized dashboard. Which AWS service should be used to aggregate and visualize these metrics?

Accepted Answer

Amazon CloudWatch Dashboards. Amazon CloudWatch Dashboards is the correct service because it aggregates metrics from multiple AWS services (EC2, RDS, Lambda, ELB, etc.) into a single customizable, visual dashboard with graphs, alarms, and cross-account/cross-region views. It is purpose-built for centralized metric visualization and operational monitoring.

Answer

AWS VPC Flow Logs

Answer

AWS CloudTrail

Answer

AWS Config

Question 7

A company has an AWS account with multiple VPCs. The security team wants to ensure that no VPC has an internet gateway attached. Which AWS service can be used to automatically detect and remediate non-compliant VPCs?

Accepted Answer

AWS Config with a managed rule to detect internet gateways and an automatic remediation action to detach them.. AWS Config with a managed rule (e.g., vpc-internet-gateway-check or internet-gateway-authorized) can continuously evaluate VPCs and detect any with an internet gateway attached. Config supports automatic remediation actions via SSM Automation documents, which can detach the internet gateway automatically, satisfying the detect-and-remediate requirement.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

Service control policies (SCPs)

Question 8

A company wants to enforce that all Amazon S3 buckets in an AWS account are encrypted at rest. Which AWS service can be used to automatically detect and report unencrypted buckets?

Accepted Answer

AWS Config. AWS Config is the correct service because it continuously evaluates resource configurations against desired policies. You can enable the managed rule 's3-bucket-server-side-encryption-enabled' to automatically detect S3 buckets that lack default encryption and report them as noncompliant. It provides a detailed compliance dashboard and can trigger remediation actions via SSM Automation. This directly addresses the requirement to detect and report unencrypted buckets.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Question 9

A network engineer needs to monitor network traffic to an Amazon RDS instance for security analysis. Which AWS service should be used to capture and analyze network traffic?

Accepted Answer

VPC Traffic Mirroring. VPC Traffic Mirroring allows capturing and inspecting network traffic from an RDS instance (full packet capture). Option A is wrong because Amazon Inspector is for vulnerability assessment, not network traffic capture. Option B is wrong because VPC Flow Logs provide metadata (IP, port, etc.) about traffic, not full packet capture. Option D is wrong because AWS CloudTrail records API activity, not network traffic.

Answer

Amazon Inspector

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Question 10

A company has a VPC with multiple subnets that are peered with another VPC using a VPC Peering connection. They want to ensure that traffic between the two VPCs is encrypted. What should they do?

Accepted Answer

Use AWS Transit Gateway with a VPN attachment between the VPCs.. VPC Peering does not support encryption of traffic in transit. To encrypt traffic between VPCs, you can use AWS Transit Gateway with a VPN attachment, which establishes an IPsec VPN tunnel that encrypts all traffic between the VPCs. This solution meets the requirement for encrypted inter-VPC communication while still allowing connectivity across multiple subnets.

Answer

Configure network ACLs to enforce encryption.

Answer

Use AWS Direct Connect with a public VIF.

Answer

Enable encryption on the VPC Peering connection using a security group.

Question 11

A network engineer runs the above command and sees that VPC Flow Logs are configured for a VPC. The engineer wants to analyze rejected traffic to troubleshoot a connectivity issue. Which field in the flow log records should they examine?

Accepted Answer

action. The 'action' field in VPC Flow Logs indicates whether traffic was ACCEPTED or REJECTED by the security group or network ACL. To analyze rejected traffic for troubleshooting connectivity, the engineer should filter on action=REJECT. This field directly tells whether the packet was allowed or denied.

Answer

protocol

Answer

srcaddr

Answer

dstport

Question 12

A company is implementing a multi-region active-active application. They want to route users to the nearest healthy endpoint using DNS. Which AWS service should be used?

Accepted Answer

Amazon Route 53 latency-based routing. Amazon Route 53 latency-based routing directs traffic based on the lowest network latency between the user and the endpoint, making it ideal for routing users to the nearest healthy endpoint in a multi-region active-active setup. It continuously monitors endpoint health via health checks and only routes to healthy endpoints, ensuring high availability and performance.

Answer

Elastic Load Balancer (ELB)

Answer

Amazon CloudFront

Answer

AWS Global Accelerator

Question 13

Match each AWS networking monitoring or troubleshooting tool to its primary purpose.

Accepted Answer

VPC Flow Logs: Captures information about IP traffic to and from network interfaces.. The correct matches are: VPC Flow Logs ↔ IP traffic capture, AWS CloudWatch Logs ↔ centralized log monitoring, AWS CloudTrail ↔ API activity recording. Common confusions include swapping VPC Flow Logs with CloudTrail, or CloudWatch Logs with VPC Reachability Analyzer.

Answer

VPC Flow Logs: Records API calls made in the AWS environment.

Answer

AWS CloudWatch Logs: Analyzes network paths between resources.

Question 14

A company's security team is investigating a potential data exfiltration incident. They notice that an EC2 instance in a private subnet is making HTTPS connections to an unknown external IP address. The instance's security group only allows outbound HTTPS to a specific set of IPs. What is the MOST likely cause of the traffic?

Accepted Answer

The instance is routing traffic through a NAT Gateway that has a route to the internet. A NAT Gateway in a public subnet can allow outbound traffic to any destination, bypassing security group restrictions if the security group allows traffic to the NAT Gateway. Option B is wrong because security groups are stateful; outbound rules apply regardless. Option C is wrong because an Internet Gateway is not in a private subnet. Option D is wrong because a VPC Endpoint is for AWS services, not external IPs.

Answer

The instance is using a VPC Endpoint to connect to the external IP

Answer

The security group outbound rules are being overridden by a Network ACL

Answer

The instance has a public IP address and is using an Internet Gateway directly

Question 15

Refer to the exhibit. A VPN connection is established between an on-premises network (10.0.0.0/16) and an AWS VPC (172.16.0.0/16). The on-premises network can ping the VPC's private IP addresses, but the VPC cannot ping the on-premises network's IP addresses. The VPC route table has a route to 10.0.0.0/16 pointing to the VGW. What is the MOST likely cause?

Accepted Answer

The on-premises network does not have a route to the VPC CIDR (172.16.0.0/16) pointing to the customer gateway. The on-premises network can ping the VPC because the VPC route table has a route to 10.0.0.0/16 pointing to the virtual private gateway (VGW), so return traffic from the VPC is correctly forwarded. However, the VPC cannot ping the on-premises network because the on-premises router lacks a route back to the VPC CIDR (172.16.0.0/16) pointing to the customer gateway (CGW). Without this return route, traffic from the VPC reaches the on-premises network, but the on-premises router drops the response packets as it does not know how to reach 172.16.0.0/16.

Answer

The VPN tunnels are not both in UP state

Answer

The VPN acceleration is disabled, causing high latency

Answer

The VPN connection is configured with static routes only and BGP is not used