ANS-C01 Practice Test 34 — 15 Questions

Question 1

Arrange the steps to configure VPC Flow Logs for a VPC and publish logs to CloudWatch Logs:

Accepted Answer

1. Create a CloudWatch Logs log group. 2. Create an IAM role with permissions to write to CloudWatch Logs. 3. Create the VPC Flow Log, specifying the log group and IAM role. 4. Verify that flow log records are delivered to the log group. 5. Analyze the logs using CloudWatch Logs Insights.. First create the log group, then the IAM role, then the flow log, then verify, then analyze.

Answer

1. Create an IAM role with permissions to write to CloudWatch Logs. 2. Create a CloudWatch Logs log group. 3. Create the VPC Flow Log, specifying the log group and IAM role. 4. Verify that flow log records are delivered to the log group. 5. Analyze the logs using CloudWatch Logs Insights.

Answer

1. Create the VPC Flow Log, specifying a log group and IAM role. 2. Create a CloudWatch Logs log group. 3. Create an IAM role with permissions to write to CloudWatch Logs. 4. Verify that flow log records are delivered to the log group. 5. Analyze the logs using CloudWatch Logs Insights.

Answer

1. Create a CloudWatch Logs log group. 2. Create the VPC Flow Log, specifying the log group but without an IAM role. 3. Create an IAM role with permissions to write to CloudWatch Logs. 4. Verify that flow log records are delivered to the log group. 5. Analyze the logs using CloudWatch Logs Insights.

Question 2

A company wants to connect multiple VPCs in different AWS accounts to on-premises networks using AWS Transit Gateway. Each VPC must be able to communicate with on-premises resources over AWS Direct Connect. What is the MINIMUM number of Transit Gateway attachments required if the company has 5 VPCs and 2 Direct Connect connections from different locations?

Accepted Answer

6. Each VPC requires a Transit Gateway attachment, so 5 VPC attachments are needed. Both Direct Connect connections can be associated with a single Direct Connect Gateway, which then requires only one Transit Gateway attachment (a Direct Connect Gateway attachment) to the Transit Gateway. Therefore, the minimum total is 5 VPC attachments + 1 Direct Connect Gateway attachment = 6 attachments.

Answer

7

Answer

5

Answer

8

Question 3

A company has a VPC with a CIDR of 10.0.0.0/16. They need to connect to a partner's VPC with CIDR 10.0.0.0/16 using a VPC peering connection. What is the issue with this configuration?

Accepted Answer

Overlapping CIDR ranges are not supported for VPC peering. VPC peering requires that the CIDR blocks of the peered VPCs do not overlap. In this case, both VPCs use 10.0.0.0/16, which creates an identical address space. When routes are added to the route tables for the peering connection, the destination CIDR would be ambiguous, and the VPC cannot distinguish between local resources and those in the peered VPC, leading to routing conflicts. AWS explicitly rejects peering requests between VPCs with overlapping or identical CIDR ranges.

Answer

The company has reached the maximum number of VPC peering connections

Answer

VPC peering is only supported within the same region

Answer

VPC peering does not support transitive routing

Question 4

A company is troubleshooting connectivity issues between two VPCs that are peered using an inter-region VPC peering connection. The VPCs have the following CIDR blocks: VPC A (10.0.0.0/16) and VPC B (10.1.0.0/16). Which THREE of the following are possible reasons for the connectivity failure?

Accepted Answer

The route tables in each VPC do not have routes pointing to the peer VPC's CIDR.. For inter-region VPC peering to function, each VPC must have explicit routes in its route tables pointing to the CIDR block of the peer VPC, with the VPC peering connection as the target. Without these routes, traffic destined for the peer VPC will not be forwarded over the peering link, causing connectivity failure.

Answer

The VPC CIDR blocks overlap.

Answer

The VPC peering connection is in a 'pending-acceptance' state.

Question 5

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. Which AWS service should be used to provide internet access to instances in the private subnets without assigning public IP addresses?

Accepted Answer

NAT gateway in a public subnet.. A NAT gateway deployed in a public subnet provides outbound-only internet access for instances in private subnets without exposing them via public IPs. It performs source NAT so return traffic is routed back through it. This is the standard AWS pattern for private subnet egress.

Answer

Internet gateway attached to the VPC.

Answer

VPC Gateway Endpoint for Amazon S3.

Answer

Site-to-Site VPN connection.

Question 6

A company has a VPC with an internet gateway and wants to restrict outbound traffic from a private subnet to only allow traffic to specific AWS services, such as S3 and DynamoDB. Which solution should be used?

Accepted Answer

Create VPC endpoints for S3 and DynamoDB, and attach a policy to the endpoints to restrict access.. VPC endpoints (specifically Gateway Endpoints for S3 and DynamoDB) allow private subnet resources to reach these AWS services without traversing the internet, NAT, or an internet gateway. Attaching an endpoint policy lets you restrict access to specific buckets, tables, or actions, satisfying the requirement to limit outbound traffic to only those AWS services. This is the AWS-recommended pattern for private access to S3 and DynamoDB.

Answer

Configure a security group on the instances in the private subnet to allow outbound traffic only to the IP ranges of the AWS services.

Answer

Use a NAT gateway in the public subnet and add a route to it in the private subnet.

Answer

Attach an internet gateway to the VPC and add a route to it in the private subnet.

Question 7

Refer to the exhibit. A route table shows routes for a VPC. What is the correct interpretation of this route table?

Accepted Answer

The VPC has CIDR 10.0.0.0/16, an internet gateway, and a VPC peering connection to a VPC with CIDR 192.168.0.0/16. The route table shows a local route for 10.0.0.0/16, which is the VPC's CIDR, a default route (0.0.0.0/0) pointing to an internet gateway (igw-xxx), and a specific route for 192.168.0.0/16 pointing to a VPC peering connection (pcx-xxx). This configuration allows traffic destined for the peered VPC's CIDR to be routed over the peering connection, while all other internet-bound traffic goes through the internet gateway.

Answer

The VPC has CIDR 10.0.0.0/16, a NAT gateway, and a VPN connection to 192.168.0.0/16

Answer

The VPC has CIDR 192.168.0.0/16, an internet gateway, and a VPC peering connection to 10.0.0.0/16

Answer

The VPC has CIDR 10.0.0.0/16, a virtual private gateway, and a peering connection

Question 8

A company has a VPC with public and private subnets. The public subnet hosts a NAT gateway. The private subnet hosts EC2 instances that need to download patches from the internet. The EC2 instances have a security group that allows outbound HTTPS to 0.0.0.0/0. What additional configuration is required?

Accepted Answer

Add a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway.. EC2 instances in a private subnet need a route in their route table that directs internet traffic (0.0.0.0/0) to the NAT gateway to access the internet for patch downloads. Option A is incorrect because an internet gateway is attached to the VPC, not a subnet, and private subnets should not have direct internet access. Option B is incorrect because the NAT gateway must be in a public subnet to have internet access via the internet gateway. Option D is incorrect because a VPC endpoint for S3 is used for private connectivity to S3, not for general internet access.

Answer

Attach an internet gateway to the private subnet.

Answer

Move the NAT gateway to the private subnet.

Answer

Create a VPC endpoint for S3.

Question 9

Order the steps to set up a Network Load Balancer with a TCP listener in front of an Auto Scaling group:

Accepted Answer

Create target group → Create load balancer → Register targets → Associate target group with listener → Configure health checks. First create the target group, then the load balancer, register targets, associate the target group with the listener, and configure health checks.

Answer

Create load balancer → Create target group → Register targets → Associate target group with listener → Configure health checks

Answer

Create target group → Create load balancer → Configure health checks → Register targets → Associate target group with listener

Answer

Create target group → Register targets → Create load balancer → Associate target group with listener → Configure health checks

Question 10

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company has set up a NAT gateway in the public subnet. However, instances in the private subnet cannot reach the internet. What is the most likely cause?

Accepted Answer

The private subnet route table does not have a route to the NAT gateway. Instances in a private subnet require a route to the NAT gateway to reach the internet. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT gateway as its target. Without this route, traffic from private instances sent to the internet will not be directed to the NAT gateway, and will instead remain in the VPC or be dropped. Option A is incorrect because the NAT gateway itself resides in a public subnet and uses the internet gateway via that subnet's route table; it does not require its own route to the IGW. Option B is incorrect because security groups by default allow all outbound traffic, so this is unlikely to be the issue. Option C is incorrect because not having an Elastic IP would prevent the NAT gateway from having a public IP, but the question states a NAT gateway is set up, implying it has an Elastic IP; the more fundamental issue is the missing route.

Answer

The NAT gateway does not have a route to the internet gateway

Answer

The security group for the instances blocks outbound traffic

Answer

The NAT gateway is not associated with an Elastic IP

Question 11

Which THREE actions can AWS Config perform to help with network security compliance? (Choose 3)

Accepted Answer

Evaluate whether security groups allow unrestricted SSH access. AWS Config can evaluate whether security groups allow unrestricted SSH access using managed rules like 'restricted-ssh'. Option C is correct because Config records configuration changes to Network ACLs and security groups, enabling tracking. Option D is correct because Config can trigger custom rules or send notifications via Amazon SNS when a security group rule is modified. Option B is incorrect because Config does not block traffic; it only evaluates and can trigger remediation actions via other services. Option E is incorrect because Config evaluates resources after creation; it cannot prevent creation, though it can trigger automated remediation via Lambda or Systems Manager.

Answer

Automatically block non-compliant traffic

Answer

Prevent creation of VPCs that do not have a specific tag

Question 12

A company is deploying a multi-tier web application in a VPC. The architecture includes an internet-facing Application Load Balancer (ALB) in public subnets, a fleet of EC2 instances in private subnets, and an Amazon RDS database in a separate private subnet. The security team requires that the web application logs be stored in an Amazon S3 bucket for compliance. The EC2 instances have an instance profile that grants write access to the S3 bucket. The EC2 instances are in a private subnet that does not have a route to the internet. The company wants to ensure that the EC2 instances can upload logs to the S3 bucket without traversing the internet. Which solution should they implement?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and add a route in the private subnet's route table pointing to the endpoint. A VPC Gateway Endpoint for S3 allows EC2 instances in private subnets to access S3 over the AWS network without traversing the internet. Since the instances have an instance profile granting write access, adding a route in the private subnet's route table pointing to the gateway endpoint enables direct, private connectivity to S3. This meets the security requirement of keeping traffic within the AWS backbone.

Answer

Create a VPC Interface Endpoint for S3

Answer

Deploy a forward proxy server in a public subnet and configure the EC2 instances to use it

Answer

Attach a NAT Gateway to the private subnet and configure a route to the NAT Gateway

Question 13

A network engineer needs to verify the routing path between two EC2 instances in different subnets within the same VPC. Which AWS tool can provide this information?

Accepted Answer

VPC Reachability Analyzer. VPC Reachability Analyzer is purpose-built to analyze the path between a source and destination (including ENIs, subnets, gateways, and security groups) and reports whether the path is reachable and where it breaks. It works without sending actual traffic, making it the correct tool for verifying routing between EC2 instances in different subnets.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Run traceroute from one instance to the other

Question 14

A company is designing a VPC with both IPv4 and IPv6 CIDR blocks. The VPC must support internet-facing applications accessible via IPv6. Which resource must be configured as IPv6-enabled to allow internet traffic?

Accepted Answer

Internet Gateway. An Internet Gateway (IGW) is the only resource that supports both IPv4 and IPv6 traffic and provides a target in the VPC route table for IPv6 default routes (::/0) to enable direct internet access for IPv6-enabled resources. Unlike IPv4, which often requires NAT for private addressing, IPv6 globally unique addresses allow direct communication through the IGW without translation.

Answer

VPC Peering connection

Answer

NAT Gateway

Answer

Transit Gateway

Question 15

A network engineer is troubleshooting high latency on a Direct Connect connection. The engineer notices that the BGP session is flapping intermittently. The connection is a 1 Gbps dedicated connection with a single private VIF. The router configuration uses default BGP timers. What is the most likely cause of the flapping?

Accepted Answer

The link experiences occasional packet loss causing BGP hold timer expiration.. B is correct because the BGP hold timer (default 90 seconds) expires when the link experiences intermittent packet loss, causing the BGP session to flap. This is a common issue on Direct Connect when the underlying physical link has transient errors or congestion, leading to missed keepalive messages and session resets.

Answer

The MTU size is set to 9001 (jumbo frames) on the Direct Connect interface.

Answer

The BGP authentication key is mismatched between the customer router and AWS.

Answer

The Multi-Exit Discriminator (MED) value is set too high on the customer router.