ANS-C01 Practice Test 35 — 15 Questions

Question 1

A company is designing a multi-region architecture for disaster recovery. They need to use Route 53 to route traffic to the nearest healthy endpoint. Which routing policy should they use?

Accepted Answer

Latency-based routing with health checks. Latency-based routing with health checks is the correct choice because it directs traffic to the endpoint with the lowest latency for the user, while health checks ensure that traffic is only sent to healthy endpoints. This combination meets the requirement to route to the nearest healthy endpoint in a multi-region disaster recovery setup, as it dynamically adapts to both network conditions and endpoint availability.

Answer

Failover routing

Answer

Geolocation routing

Answer

Latency-based routing without health checks

Question 2

Refer to the exhibit. A CloudFormation template creates a VPC with public and private subnets. The template includes an Internet Gateway and a route table with a default route to the IGW, associated with the public subnet. An EC2 instance launched in the public subnet cannot be reached from the internet. The security group allows inbound HTTP from 0.0.0.0/0. What is the MOST likely missing resource?

Accepted Answer

An Elastic IP address assigned to the instance or auto-assign public IP enabled on the subnet. The EC2 instance in the public subnet cannot be reached from the internet because it lacks a publicly routable IP address. Even though the subnet has a default route to the Internet Gateway (IGW) and the security group allows inbound HTTP from 0.0.0.0/0, the instance must have either an Elastic IP address assigned directly or the subnet must have the 'Auto-assign public IPv4 address' attribute enabled. Without a public IP, the IGW cannot perform 1-to-1 NAT to translate the instance's private IP to a public IP, making it unreachable from the internet.

Answer

A VPN connection to the VPC

Answer

A NAT Gateway in the public subnet

Answer

A route table for the private subnet

Question 3

A company has a VPC with public and private subnets. The public subnet hosts a web server that must be accessible from the internet. The private subnet hosts a database that should only be accessible from the web server. Which security group configuration should be used?

Accepted Answer

Database security group: inbound rule allowing traffic from the web server security group on the database port. Security groups can reference other security groups as sources. Option A is correct because it allows traffic from the web server's security group, which ensures only the web server can access the database. Option B is wrong because it allows all traffic from the VPC CIDR, which is too permissive. Option C is wrong because it allows traffic from a specific private IP, but that IP might change and is less flexible than using the security group. Option D is wrong because it allows traffic from 0.0.0.0/0, which permits inbound traffic from any IP address, making the database publicly accessible.

Answer

Database security group: inbound rule allowing traffic from the VPC CIDR on the database port

Answer

Database security group: inbound rule allowing traffic from the web server's private IP on the database port

Answer

Database security group: inbound rule allowing traffic from 0.0.0.0/0 on the database port

Question 4

Arrange the steps to configure an AWS Client VPN endpoint for remote access:

Accepted Answer

First create server and client certificates, then create the Client VPN endpoint, then associate the endpoint with a target network, then authorize ingress rules, then download and distribute the client configuration.. First create certificates, then the endpoint, associate with network, authorize access, then distribute client config.

Answer

First create the Client VPN endpoint, then create server and client certificates, then associate with a target network, then authorize ingress rules, then distribute client configuration.

Answer

First create server and client certificates, then create the Client VPN endpoint, then authorize ingress rules, then associate with a target network, then distribute client configuration.

Answer

First create the Client VPN endpoint, then associate with a target network, then create server and client certificates, then authorize ingress rules, then distribute client configuration.

Question 5

A company wants to restrict access to their S3 bucket so that only users from their corporate network (with a specific IP range) can read objects. They also want to ensure that the objects are encrypted in transit. Which combination of bucket policy and encryption should they use?

Accepted Answer

Bucket policy with a condition that denies access unless the source IP is within the corporate range, and require HTTPS for all requests.. A bucket policy with a condition key `aws:SourceIp` can restrict access to the corporate IP range, and requiring HTTPS (via a `aws:SecureTransport` condition) ensures encryption in transit. This combination directly meets both requirements without relying on additional infrastructure like VPC endpoints or CloudFront.

Answer

Use a VPC endpoint with a bucket policy that restricts access to the VPC endpoint.

Answer

Use an IAM policy that restricts access to the corporate IP range and enable default encryption on the bucket.

Answer

Enable CloudFront with geographic restrictions and use HTTPS.

Question 6

A network engineer is troubleshooting connectivity issues. The route table shows a blackhole route for 10.0.0.0/8 pointing to a VPC endpoint (vpce-12345678). What is the most likely cause of the blackhole state?

Accepted Answer

The VPC endpoint (vpce-12345678) has been deleted.. A blackhole route in a VPC route table indicates that the target for the route (in this case, a VPC endpoint) is not in a valid state. When a VPC endpoint (vpce-12345678) is deleted, all routes pointing to it become blackhole routes because the target no longer exists. This causes traffic destined for 10.0.0.0/8 to be dropped silently.

Answer

The VPC CIDR 10.0.0.0/16 is overlapping with the endpoint route.

Answer

The route table does not have a route to the internet.

Answer

The internet gateway is not attached to the VPC.

Question 7

A company has a VPC with public and private subnets. The security team wants to block all outbound traffic to the internet from the private subnets except for traffic to an AWS service like Amazon S3. Which configuration should be used?

Accepted Answer

Create a VPC endpoint for Amazon S3 and add a route to the endpoint in the private subnet route table.. Creating a VPC endpoint for Amazon S3 and adding a route to the endpoint in the private subnet route table allows private subnets to access S3 without traversing the internet. This configuration blocks all other outbound internet traffic because the private subnet route table does not have a route to an internet gateway or NAT gateway. VPC endpoints use AWS PrivateLink to provide private connectivity to S3.

Answer

Attach an internet gateway to the VPC and add a route to the internet gateway in the private subnet route table.

Answer

Place a proxy server in the private subnet and configure all instances to use it.

Answer

Configure a NAT gateway in the public subnet and update the route table to send 0.0.0.0/0 traffic to the NAT gateway.

Question 8

A company has a VPC with public and private subnets. An application in the private subnet needs to access an S3 bucket. Which design meets security best practices without exposing the application to the internet?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and update the route table. A VPC Gateway Endpoint for S3 allows private subnet resources to access S3 without internet exposure. Option B (NAT Gateway) would provide internet access but is unnecessary and could expose the application indirectly. Option C (VPN) is overkill and not needed for S3 access within AWS. Option D (Internet Gateway) would expose the application to the internet, violating security best practices.

Answer

Use a NAT Gateway in the public subnet and route traffic through it

Answer

Set up a VPN connection to AWS and route through it

Answer

Attach an Internet Gateway to the VPC and update route tables

Question 9

A network engineer has configured an AWS Site-to-Site VPN connection between a VPC and an on-premises network. The engineer checks the VPN status and sees the output above. What is the MOST likely cause of Tunnel2 being down?

Accepted Answer

The IPsec encryption or integrity algorithms do not match between the AWS VPN endpoint and the on-premises device.. Tunnel2 is down while Tunnel1 is up, indicating a per-tunnel configuration mismatch. The most common cause is a mismatch in IPsec security parameters (encryption, integrity, or DH group) between the AWS VPN endpoint and the on-premises device for that specific tunnel. AWS uses separate pre-shared keys and IPsec settings per tunnel, so a mismatch in algorithms would affect only the misconfigured tunnel.

Answer

The BGP ASN on the on-premises device is misconfigured.

Answer

The route tables in the VPC do not have a route to the on-premises network.

Answer

The IKE pre-shared key used for Tunnel2 is incorrect.

Question 10

A company has a production VPC with CIDR 10.0.0.0/16. They have an internet-facing Application Load Balancer (ALB) in public subnets across two Availability Zones. The ALB distributes traffic to a fleet of EC2 instances in private subnets. The EC2 instances need to access an Amazon S3 bucket to retrieve configuration files. The company wants to minimize data transfer costs and ensure that traffic to S3 does not traverse the internet. A network engineer created a Gateway VPC Endpoint for S3 in the VPC and added a route in the public subnet route tables pointing to the endpoint. However, the EC2 instances still cannot access the S3 bucket. The security groups for the EC2 instances allow outbound HTTPS to 0.0.0.0/0. The NACLs are default (allow all). The S3 bucket policy allows access from the VPC endpoint. What is the MOST likely reason the EC2 instances cannot access S3?

Accepted Answer

The route to the Gateway VPC Endpoint was added only to public subnets, not to private subnets. Gateway VPC Endpoints are route table targets that must be added to the route tables of the subnets where the instances reside. The engineer added the route only to the public subnet route tables, but the EC2 instances are in private subnets, so their route tables lack the endpoint route. Consequently, traffic to S3 from the instances still goes through the NAT gateway or internet gateway, and if no NAT is present, it fails.

Answer

The Gateway VPC Endpoint is in a different region than the S3 bucket

Answer

The security group for the EC2 instances does not allow outbound traffic to the S3 prefix list

Answer

The S3 bucket policy does not include a condition for the VPC endpoint

Question 11

A company wants to ensure that all IAM users have multi-factor authentication (MFA) enabled. Which AWS service can be used to enforce this policy?

Accepted Answer

IAM policy with a condition for aws:MultiFactorAuthPresent. An IAM policy with a condition on aws:MultiFactorAuthPresent (and often aws:MultiFactorAuthAge) enforces MFA by denying actions unless the principal authenticated with MFA. This is the standard, granular way to require MFA for IAM users, and it can be applied to users, groups, or roles. The condition key evaluates to true only when the request is signed with MFA.

Answer

AWS Organizations SCP

Answer

AWS Config

Answer

AWS CloudTrail

Question 12

A company has a multi-VPC architecture using AWS Transit Gateway (TGW). They have a central inspection VPC with a Gateway Load Balancer (GWLB) and third-party firewall appliances. All other VPCs are attached to the TGW and have route tables that send traffic to the inspection VPC for inspection. Recently, the network team deployed a new VPC (VPC-D) and attached it to the TGW. They configured the VPC-D route table to send all inter-VPC traffic to the TGW. However, traffic from VPC-D to other VPCs is not being inspected. The team confirmed that the firewall appliances are healthy and the GWLB is correctly configured. Which action should the network team take to ensure traffic from VPC-D is inspected?

Accepted Answer

Associate VPC-D's TGW attachment with the correct TGW route table that routes traffic to the inspection VPC.. The issue is that VPC-D's TGW attachment is not associated with the correct TGW route table that routes traffic to the inspection VPC. In a Transit Gateway, route tables control how traffic is forwarded between attachments. Even if VPC-D's subnet route tables point to the TGW, the TGW must have a route table that directs traffic from VPC-D to the inspection VPC's attachment. Therefore, associating VPC-D's attachment with the correct TGW route table ensures inspection.

Answer

Enable route propagation on VPC-D's TGW attachment.

Answer

Add a route in VPC-D's subnet route tables pointing to the TGW for all traffic.

Answer

Create a new TGW route table and associate all VPC attachments to it.

Question 13

A company has a VPC with public and private subnets. The private subnets need internet access for updates, but must not be directly reachable from the internet. Which AWS service should be used?

Accepted Answer

NAT gateway. A NAT gateway enables instances in a private subnet to initiate outbound IPv4 traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet. It resides in a public subnet with an Elastic IP and uses the internet gateway for outbound traffic, but it does not allow inbound traffic to reach the private instances directly.

Answer

Internet gateway

Answer

VPN connection

Answer

VPC endpoint

Question 14

A security engineer needs to block traffic from a specific country from reaching an Application Load Balancer. Which AWS service should be used to accomplish this?

Accepted Answer

AWS WAF web ACL associated with the ALB. AWS WAF is the only service in the list that operates at Layer 7 and supports geographic (geo-match) conditions to block traffic from specific countries. A WAF web ACL is associated directly with the ALB, so requests from the blocked country are denied before reaching the backend. Network ACLs and security groups work at Layers 3/4 and cannot match on country of origin.

Answer

Network ACLs on the VPC subnet

Answer

Security groups associated with the ALB

Answer

Route 53 Resolver DNS Firewall

Question 15

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team notices that traffic between two VPCs is taking a suboptimal path, going through the on-premises network instead of staying within AWS. What is the most likely cause?

Accepted Answer

The Transit Gateway route table has a propagated route from the on-premises network with a longer prefix. Transit Gateway route tables use longest prefix match, so if a propagated route from on-premises has a longer prefix (e.g., /24) than the VPC-to-VPC route (e.g., /16), traffic will be routed to on-premises even though a more direct path exists. This is the most likely cause of suboptimal routing between VPCs.

Answer

The VPCs are also peered directly, creating a conflict

Answer

VPC Flow Logs are enabled, causing latency

Answer

Security groups are blocking direct traffic between VPCs