ANS-C01 Practice Test 34 — 15 Questions

Question 1

A company has deployed a VPC with public and private subnets. The private subnets need outbound internet access for software updates. Which service should be used to provide this access without exposing the instances to inbound traffic?

Accepted Answer

Deploy a NAT Gateway in a public subnet and add a default route to it from the private subnets.. A NAT Gateway allows instances in private subnets to initiate outbound traffic to the internet but prevents inbound traffic from the internet. Option A is wrong because an Internet Gateway alone would expose instances to inbound traffic. Option C is wrong because a VPN connection is for private connectivity. Option D is wrong because a Direct Connect connection is for dedicated private connectivity.

Answer

Attach an Internet Gateway to the VPC and add a default route to it from the private subnets.

Answer

Set up a VPN connection to an on-premises network that has internet access.

Answer

Use a Direct Connect connection to route traffic through an on-premises internet gateway.

Question 2

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance is associated with a security group that allows outbound HTTPS (443) traffic. The route table for the private subnet has a default route pointing to a NAT Gateway in the public subnet. Which additional configuration is required to ensure the NAT Gateway can route the traffic?

Accepted Answer

Add a route in the public subnet route table to the Internet Gateway.. The NAT Gateway must be in a public subnet with an Internet Gateway route. The security group of the NAT Gateway does not control traffic; it's a managed service. The NAT Gateway's Elastic IP is automatically assigned. The route table of the public subnet must have a default route to the Internet Gateway. The private subnet route is already correct.

Answer

Configure the security group of the NAT Gateway to allow inbound traffic from the private subnet.

Answer

Add a route in the private subnet route table to the NAT Gateway's private IP.

Answer

Assign an Elastic IP address to the NAT Gateway.

Question 3

A network engineer runs the above command and sees an ENI (eni-0a1b2c3d4e5f6g7h8) with status 'in-use' but no InstanceId attached. What AWS service is most likely using this ENI?

Accepted Answer

An Amazon RDS database instance.. Option C is correct because RDS uses managed ENIs that appear 'in-use' without an InstanceId. Option A is wrong because NAT Gateway ENIs have specific descriptions. Option B is wrong because VPC Endpoints use ENIs with descriptions like 'VPC Endpoint'. Option D is wrong because Transit Gateway does not use ENIs directly.

Answer

A VPC endpoint (Interface type).

Answer

A NAT gateway.

Answer

An AWS Transit Gateway.

Question 4

A company has a VPC with both IPv4 and IPv6 CIDRs. They need to allow outbound IPv6 traffic from private subnets to the internet. What should they use?

Accepted Answer

An egress-only internet gateway.. Option B is correct because an egress-only internet gateway allows outbound IPv6 traffic from private subnets while preventing inbound traffic. Option A is wrong because NAT gateway is for IPv4 only. Option C is wrong because internet gateway allows inbound traffic. Option D is wrong because the prefix list is for route targets, not a device.

Answer

An internet gateway attached to the VPC.

Answer

A customer-managed prefix list.

Answer

A NAT gateway in a public subnet.

Question 5

A company is running a stateful firewall appliance in an EC2 instance in a VPC. The appliance inspects traffic between subnets. The company needs to ensure that traffic from the web tier subnet to the application tier subnet passes through the firewall, but the firewall itself must not affect other traffic. Which configuration should the company implement?

Accepted Answer

Use a Gateway Load Balancer to deploy the firewall appliance in a separate subnet, and configure route tables to send inter-subnet traffic to the Gateway Load Balancer endpoint.. Option C is correct because using a Gateway Load Balancer with the firewall appliance in a separate subnet and configuring route tables with a route to the GWLBe endpoint for inter-subnet traffic is the recommended pattern. Option A is wrong because a security group cannot route traffic; it only filters. Option B is wrong because a network ACL is stateless and not suitable for stateful inspection. Option D is wrong because a transit gateway with appliance mode could work but is more complex than GWLB.

Answer

Place the firewall in the same subnet as the web tier and use security groups to redirect traffic.

Answer

Place the firewall in a separate subnet and use network ACLs to force traffic through it.

Answer

Use a transit gateway with appliance mode and attach all subnets to it, then configure routing to send traffic through the firewall.

Question 6

A company is migrating a legacy application that requires static IP addresses for its clients' firewall whitelisting. The application will be hosted on EC2 instances behind a Network Load Balancer (NLB) in a private subnet. Which approach should the company use to provide static IP addresses for outbound traffic?

Accepted Answer

Deploy a NAT Gateway in a public subnet with an Elastic IP. Option D is correct because a NAT Gateway in a public subnet with an Elastic IP provides static IPs for outbound traffic from private instances. Option A is for inbound traffic. Option B is for internet-facing NLB. Option C would not provide static IPs.

Answer

Assign Elastic IPs to the EC2 instances

Answer

Use an internet-facing NLB with Elastic IPs

Answer

Use a VPC endpoint for the application

Question 7

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download patches from the internet. The company has a NAT gateway in a public subnet. The EC2 instance can connect to other instances in the VPC but cannot reach the internet. What is the most likely cause?

Accepted Answer

The route table in the private subnet does not have a default route to the NAT gateway.. Option C is correct because the route table associated with the private subnet must have a default route (0.0.0.0/0) pointing to the NAT gateway. Option A is incorrect because the NAT gateway itself does not require a public IP for outbound traffic (though it needs one for inbound). Option B is incorrect because security group rules are stateful and allow outbound traffic. Option D is incorrect because the NACL must allow outbound traffic, but the route is the primary issue.

Answer

The security group of the EC2 instance blocks outbound HTTPS traffic.

Answer

The NAT gateway does not have an Elastic IP address.

Answer

The network ACL of the private subnet blocks inbound traffic from the NAT gateway.

Question 8

A company has a VPC with multiple subnets. An EC2 instance in a private subnet needs to access an S3 bucket. Which AWS service should be used to allow this access without traversing the internet?

Accepted Answer

VPC Gateway Endpoint for S3. Option C is correct because a VPC Gateway Endpoint for S3 allows private access. Option A is incorrect because a NAT gateway is for internet access. Option B is incorrect because an Internet Gateway is for internet access. Option D is incorrect because a Transit Gateway is for connecting networks.

Answer

Transit Gateway

Answer

NAT gateway

Answer

Internet gateway

Question 9

A company is setting up a Site-to-Site VPN connection between an on-premises network and AWS. The VPN tunnel is established, but traffic is not flowing. Which THREE configuration items should be checked?

Accepted Answer

Route tables in the VPC and on-premises router.. Option A is correct because route tables must have routes to the remote network. Option C is correct because security group rules must allow traffic. Option E is correct because network ACLs must allow traffic. Option B is incorrect because a NAT gateway is not required for VPN. Option D is incorrect because an internet gateway is not needed for VPN traffic.

Answer

NAT gateway configuration in the VPC.

Answer

Internet gateway attachment to the VPC.

Question 10

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access the internet to download software updates. The company has a NAT gateway in the public subnet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT gateway. However, the EC2 instance cannot access the internet. The network engineer verifies that the NAT gateway has an Elastic IP, the security group for the EC2 instance allows outbound HTTPS traffic, and the network ACL for the private subnet allows inbound and outbound ephemeral ports. What is the most likely cause of the issue?

Accepted Answer

The route table for the public subnet does not have a route to an internet gateway.. Option B is correct because the NAT gateway resides in the public subnet, and for it to route traffic to the internet, the public subnet's route table must have a default route pointing to an internet gateway. Without that, the NAT gateway cannot forward traffic. Option A is wrong because NAT gateways do not have security groups. Option C is wrong because the private subnet route table is correctly configured. Option D is wrong because the NAT gateway supports UDP as well.

Answer

The security group attached to the NAT gateway does not allow outbound traffic.

Answer

The route table for the private subnet does not have a route to the NAT gateway.

Answer

The NAT gateway does not support UDP traffic.

Question 11

A network engineer examines the route table above. The VPC has a CIDR of 10.0.0.0/16. There is a VPC peering connection (pcx-...) to a VPC with CIDR 192.168.0.0/16. However, instances in this route table's subnet cannot communicate with the peered VPC. What is the most likely cause?

Accepted Answer

The security group or network ACL in the source subnet is blocking traffic.. Option D is correct because the route table shows a route to the peered VPC via pcx, so routing seems configured. The issue is likely that the security groups or NACLs in the source subnet are blocking traffic. Option A is wrong because the route exists. Option B is wrong because the peering connection may be active; the issue is not shown. Option C is wrong because the route table is associated with the subnet (implied by the question).

Answer

The route table is not associated with the subnet.

Answer

The VPC peering connection is in 'pending-acceptance' state.

Answer

The route to the peered VPC is missing from the route table.

Question 12

Which TWO of the following are requirements for establishing an AWS Direct Connect private virtual interface? (Choose two.)

Accepted Answer

A BGP session between the customer router and the AWS device.. Options A and C are correct. A: You need a VLAN ID that matches on both sides. C: BGP session is required for routing. B is wrong because you can use a private virtual interface without a public ASN; private ASNs are allowed. D is wrong because public virtual interfaces are for public services. E is wrong because Jumbo frames are optional.

Answer

Jumbo frames support (MTU 9001).

Answer

A public IP address for the VIF.

Answer

A public BGP ASN.

Question 13

A company has multiple VPCs connected via AWS Transit Gateway. Each VPC has its own route table in the transit gateway. The company wants to restrict traffic between certain VPCs. For example, VPC A should be able to send traffic to VPC B but not to VPC C. VPC B should be able to send traffic to VPC C. Which configuration should the company use?

Accepted Answer

Create separate transit gateway route tables for each VPC and add only the desired routes for other VPCs.. Option C is correct because each VPC has its own route table, and you can add routes for specific VPC attachments. By not adding a route for VPC C in VPC A's route table, traffic is blocked. Option A is wrong because a single shared route table would allow all VPCs to communicate. Option B is wrong because network ACLs are not applied at transit gateway attachments. Option D is wrong because security groups are not used for inter-VPC routing decisions.

Answer

Use network ACLs on the transit gateway attachments to filter traffic.

Answer

Use security groups on the VPC attachments to allow or deny traffic.

Answer

Create a single transit gateway route table and associate all VPC attachments with it.

Question 14

A company has a Direct Connect connection with a private VIF to a VPC. They want to extend this connectivity to multiple VPCs in the same region without creating additional VIFs. Which solution should they implement?

Accepted Answer

Use a Direct Connect Gateway and attach the VPCs. Option B is correct because a Direct Connect Gateway allows a single private VIF to connect to multiple VPCs in the same region. Option A is for hybrid connectivity but not for multi-VPC. Option C is for inter-VPC routing. Option D is for additional VIFs.

Answer

Provision additional private VIFs for each VPC

Answer

Use VPC peering between the VPCs

Answer

Use a Transit VPC with VPN connections

Question 15

A network engineer is designing a VPC with public and private subnets. The private subnets must have outbound internet access but not be directly reachable from the internet. Which AWS service should be used?

Accepted Answer

NAT Gateway. Option C is correct because a NAT Gateway enables outbound internet access for private subnets while preventing inbound traffic. Option A is wrong because an Internet Gateway provides bidirectional access. Option B is wrong because a VPN connection is for hybrid connectivity. Option D is wrong because an EIP is used with NAT Gateway or Internet Gateway, not alone.

Answer

Elastic IP Address (EIP)

Answer

Internet Gateway (IGW)

Answer

Virtual Private Gateway (VGW)