ANS-C01 Practice Test 36 — 15 Questions

Question 1

A company has a VPC with an internet gateway and a NAT Gateway. The private subnet route table has a default route to the NAT Gateway. The company wants to enable instances in the private subnet to access an S3 bucket in the same region without traversing the internet. Which TWO actions should the company take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a route to the S3 prefix list via the gateway endpoint in the private subnet route table.. Adding a route to the S3 prefix list via the gateway endpoint directs traffic destined for S3 through the VPC endpoint, keeping it within the AWS network. Option C is correct because a gateway VPC endpoint for S3 provides a private, scalable connection to S3 without requiring internet access or a NAT Gateway. Together, these actions allow private subnet instances to access S3 privately and efficiently.

Answer

Remove the default route to the NAT Gateway from the private subnet route table.

Answer

Add a route to the S3 prefix list via the NAT Gateway in the private subnet route table.

Answer

Create an interface VPC endpoint for S3.

Question 2

A company has a global application deployed across multiple AWS Regions. They use an Amazon Route 53 latency-based routing policy to direct users to the closest region. Recently, users in Asia are experiencing high latency even though traffic is being directed to the nearest region. The network team reviews the latency measurements and notices that the Route 53 latency values are based on the region where the resources are hosted, but the actual application performance is poor. What is the most likely cause?

Accepted Answer

The application in the Asian region is overloaded, causing increased response times.. Route 53 latency-based routing directs users to the region with the lowest latency based on AWS's network measurements, but it does not account for application-level performance or server load. If the Asian region's application is overloaded, response times will be high even though the network latency to that region is low. The most likely cause is that the application in the Asian region is overloaded, causing increased response times despite optimal routing.

Answer

The Route 53 health checks are failing, causing traffic to be routed to a different region.

Answer

The company has not enabled DNSSEC, causing additional DNS resolution time.

Answer

The Route 53 latency routing policy is not using anycast, causing suboptimal routing.

Question 3

A company wants to design a multi-region active-active architecture with Amazon Route 53 latency-based routing and failover using health checks. Which TWO configurations are necessary? (Choose two.)

Accepted Answer

Configure a latency alias record for each region's resource. Latency-based routing in Route 53 uses alias records to route traffic based on the lowest latency for the end user. Configuring a latency alias record for each regional resource (e.g., an Application Load Balancer) allows Route 53 to respond with the IP of the resource that provides the best latency. Option D is correct because health checks must be associated with each latency record to enable failover; if a resource fails its health check, Route 53 removes it from the pool of healthy endpoints, ensuring traffic is only routed to healthy regions.

Answer

Use geolocation routing to direct users to the nearest region

Answer

Assign a weight to each record for traffic distribution

Answer

Set the failover record type to 'Active-Active'

Question 4

A company has deployed a web application on an EC2 instance that needs to access an S3 bucket and a DynamoDB table. The instance is in a private subnet. Which approach meets the security best practice of avoiding long-lived credentials on the instance?

Accepted Answer

Create an IAM role with policies granting access to S3 and DynamoDB, and attach the role to the EC2 instance profile.. Creating an IAM role with the necessary policies and attaching it to the EC2 instance profile is the AWS best practice for granting AWS service access without embedding long-lived credentials. The instance profile allows the EC2 instance to assume the role and receive temporary credentials via the Instance Metadata Service (IMDS). This eliminates the need to store access keys on the instance.

Answer

Store IAM user access keys in the application configuration file.

Answer

Configure security group rules to allow outbound traffic to S3 and DynamoDB endpoints.

Answer

Use AWS Systems Manager Parameter Store to store credentials and retrieve them at runtime using the instance's IAM role.

Question 5

A company has a VPC with public and private subnets. An EC2 instance in the private subnet needs to access the internet. The instance has a route table with a default route to a NAT gateway. However, the instance cannot reach the internet. What is the most likely cause?

Accepted Answer

The NAT gateway is placed in a private subnet.. A NAT gateway must reside in a public subnet and have an Elastic IP so it can route traffic to the internet gateway. If the NAT gateway is placed in a private subnet, it has no path to the internet gateway, so instances routing through it cannot reach the internet. This is the most likely cause given the scenario.

Answer

The instance does not have a public IP address assigned.

Answer

The security group attached to the instance does not allow outbound HTTPS traffic.

Answer

The network ACL on the private subnet blocks outbound HTTP traffic.

Question 6

A security engineer is designing a network ACL for a public subnet. The subnet hosts a web server on port 443. Which inbound and outbound rules should be configured to allow HTTPS traffic from the internet? (Assume default deny all rule.)

Accepted Answer

Inbound: allow TCP 443 from 0.0.0.0/0; Outbound: allow TCP 1024-65535 to 0.0.0.0/0.. NACLs are stateless, requiring explicit inbound and outbound rules. The inbound rule allows HTTPS (TCP 443) from the internet. The outbound rule allows return traffic on ephemeral ports (1024-65535) back to the internet. Option B is wrong because the outbound rule only allows TCP 443, which is too restrictive for return traffic. Option C is wrong because the inbound rule only allows ephemeral ports, not HTTPS. Option D is wrong because it incorrectly states 'for responses' and the outbound rule is still too restrictive.

Answer

Inbound: allow TCP 443 from 0.0.0.0/0; Outbound: allow TCP 443 to 0.0.0.0/0.

Answer

Inbound: allow TCP 1024-65535 from 0.0.0.0/0; Outbound: allow TCP 443 to 0.0.0.0/0.

Answer

Inbound: allow TCP 443 from 0.0.0.0/0; Outbound: allow TCP 443 to 0.0.0.0/0 for responses.

Question 7

A company is designing a VPC with a public subnet for web servers and a private subnet for database servers. The web servers must be able to access the internet for software updates, but the database servers must not have direct internet access. Which solution meets these requirements?

Accepted Answer

Deploy a NAT gateway in the public subnet and add a route to it in the private subnet's route table.. A NAT gateway deployed in the public subnet allows instances in the private subnet to initiate outbound internet traffic (e.g., software updates) while preventing inbound connections from the internet. The private subnet's route table must have a route (0.0.0.0/0) pointing to the NAT gateway. This satisfies both requirements: web servers in the public subnet use the internet gateway directly, and database servers in the private subnet use the NAT gateway for outbound-only access.

Answer

Use a VPC endpoint for Amazon S3 to provide internet access to the database servers.

Answer

Set up a VPN connection to an on-premises data center and route traffic through it.

Answer

Attach an internet gateway to the VPC and add a route to it in the private subnet's route table.

Question 8

A security engineer notices that a security group allows inbound SSH from 0.0.0.0/0. Which immediate action should be taken to reduce risk?

Accepted Answer

Modify the security group inbound rule to allow SSH only from the company's public IP range. The immediate, least-disruptive remediation for an overly permissive SSH rule is to edit the existing security group inbound rule to scope the source to the company's trusted public IP range. Security groups are stateful and evaluated at the instance ENI level, so tightening the source CIDR instantly blocks unauthorized SSH attempts without altering network topology. This preserves legitimate administrative access while eliminating the 0.0.0.0/0 exposure.

Answer

Add a network ACL deny rule for SSH from 0.0.0.0/0

Answer

Move the instances to a different subnet with a restrictive NACL

Answer

Delete the security group and create a new one with the correct rules

Question 9

A company wants to allow their employees to access internal web applications hosted on EC2 instances in a private subnet. The employees are outside the corporate network and connect via the internet. Which AWS service would provide secure, managed remote access without requiring a VPN client on each employee's device?

Accepted Answer

AWS Application Load Balancer with AWS WAF and Cognito authentication. An Application Load Balancer with AWS WAF and Cognito authentication provides secure, managed access to internal web applications without requiring a VPN client. Cognito handles user authentication (including integration with corporate identity providers), WAF filters malicious traffic, and the ALB routes requests to EC2 instances in private subnets. Employees simply use a browser, so no client software is needed on each device.

Answer

AWS Direct Connect

Answer

AWS Client VPN

Answer

AWS Site-to-Site VPN

Question 10

A company is designing a hybrid network with multiple AWS Direct Connect connections to multiple on-premises data centers. They want to maximize availability and use all available bandwidth. They have two Direct Connect connections terminated at two different Direct Connect locations. They plan to use a single Virtual Private Gateway (VGW) for each VPC. Which configuration should be used to meet these requirements?

Accepted Answer

Create a Direct Connect Gateway. Attach both Direct Connect connections to the Direct Connect Gateway. Associate the Direct Connect Gateway with the VGW. Configure the on-premises routers to use BGP with equal-cost multipath (ECMP).. It uses a Direct Connect Gateway to aggregate multiple Direct Connect connections into a single logical endpoint, allowing both connections to be associated with a single VGW. By configuring BGP with ECMP on the on-premises routers, traffic is load-balanced across both connections, maximizing bandwidth utilization while providing high availability through redundant paths.

Answer

Create two VGWs and attach each to a separate Direct Connect connection. Use a Transit Gateway to connect the VGWs to the VPC.

Answer

Create two Virtual Private Gateways, one for each Direct Connect connection. Attach each VGW to the VPC. Configure BGP on both connections for active-active.

Answer

Create a single virtual interface and associate it with both Direct Connect connections. Attach the virtual interface to the VGW.

Question 11

Which TWO statements are correct regarding the use of AWS Network Firewall? (Choose 2)

Accepted Answer

It supports stateful inspection using Suricata-compatible rules. A: Correct. AWS Network Firewall supports stateful inspection using Suricata-compatible rules, allowing deep packet inspection for threat detection. B: Correct. Network Firewall can be integrated with AWS Transit Gateway to enable centralized inspection of traffic across multiple VPCs. C: Incorrect. Network Firewall is deployed within a VPC, not as a standalone service, and it requires a VPC to inspect traffic; it cannot inspect traffic between on-premises and AWS without a VPC. D: Incorrect. Network Firewall does not provide automatic SSL/TLS decryption; it can only inspect traffic that is not encrypted or after decryption is performed by another service. E: Incorrect. Network Firewall is a managed service, but it is always deployed inside a VPC, not outside.

Answer

It can be used to inspect traffic between on-premises and AWS without a VPC

Answer

It provides automatic SSL/TLS decryption

Answer

It is a managed service that can be deployed outside of a VPC

Question 12

A company has deployed a web application behind an Application Load Balancer (ALB) in a VPC. The security team wants to block a list of known malicious IP addresses from accessing the application. Which service should they use to implement this protection?

Accepted Answer

AWS WAF with an IP set rule that blocks the malicious IPs. AWS WAF integrates directly with ALB and supports IP set match rules that can block specified IP addresses at Layer 7. The security team can create an IP set containing the malicious addresses and attach a WAF Web ACL to the ALB with a block action. This is the native, scalable way to block IPs on an ALB.

Answer

Network ACLs on the ALB subnet with deny rules

Answer

AWS Shield Advanced with automatic IP blocking

Answer

Security Groups for the ALB with deny rules

Question 13

A company has a VPC with public and private subnets in three Availability Zones. They want to provide outbound internet access to instances in private subnets while preventing inbound traffic from the internet. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Create a NAT Gateway in a public subnet and add a default route in the private subnet route table pointing to the NAT Gateway.. A NAT Gateway is a fully managed AWS service that provides outbound internet access for instances in private subnets while blocking unsolicited inbound connections. By placing the NAT Gateway in a public subnet and adding a default route (0.0.0.0/0) in the private subnet route table pointing to the NAT Gateway, traffic from private instances is source NATed to the NAT Gateway's Elastic IP, ensuring inbound traffic from the internet cannot reach the private instances. This solution offers the least operational overhead as AWS handles scaling, patching, and availability, unlike a self-managed NAT instance.

Answer

Deploy a NAT instance in a public subnet and configure the private subnet route table to point to it.

Answer

Attach an Internet Gateway to the VPC and add a default route to it in the private subnet route table.

Answer

Create a VPC Gateway Endpoint for Amazon S3 and route outbound traffic through it.

Question 14

A company has a VPN connection between an on-premises network and AWS using two tunnels for redundancy. The BGP sessions are established, but traffic is only flowing through one tunnel. The engineer wants to ensure both tunnels are actively used. What should be configured?

Accepted Answer

Advertise the same BGP prefixes over both tunnels from the on-premises router.. When both tunnels advertise the same BGP prefixes, the AWS VPN endpoint will see equal-cost paths and load-balance traffic across both tunnels using ECMP (Equal-Cost Multi-Path) routing. This ensures active-active utilization of both tunnels, which is the standard design for AWS VPN redundancy.

Answer

Enable load balancing on the VPN connection in the AWS console.

Answer

Configure static routes for the second tunnel.

Answer

Assign different BGP ASNs to each tunnel.

Question 15

A company is designing a network security architecture for a multi-account environment using AWS Organizations. Which TWO services can be used to centrally manage security policies across all accounts?

Accepted Answer

AWS Organizations Service Control Policies (SCPs). AWS Firewall Manager provides centralized management of firewall rules (including AWS WAF, AWS Shield Advanced, and security groups) across all accounts in AWS Organizations. AWS Organizations Service Control Policies (SCPs) allow you to centrally define and enforce permission boundaries and security policies across all member accounts. In contrast, AWS Config and AWS CloudTrail operate per account and do not provide centralized policy management across multiple accounts. Amazon VPC is a per-account networking service. Therefore, the correct answers are C (SCPs) and D (Firewall Manager).

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon VPC