ANS-C01 Practice Test 36 — 15 Questions

Question 1

A company has a VPC with public and private subnets in two Availability Zones. The company hosts a web application on EC2 instances in the private subnets. The application needs to access an S3 bucket. What is the MOST cost-effective and secure way to provide this access?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and attach it to the private subnet route tables.. Option A is correct because a VPC Gateway Endpoint for S3 provides private connectivity without traversing the internet, and it is free of charge (no data transfer costs). Option B is wrong because a NAT Gateway incurs hourly charges and data processing fees. Option C is wrong because a Transit Gateway is not needed for a single VPC. Option D is wrong because an Internet Gateway exposes traffic to the internet and would require public IPs or NAT, increasing cost and risk.

Answer

Deploy a NAT Gateway in each public subnet and route traffic from private subnets through it.

Answer

Use AWS Transit Gateway to route traffic to S3 via a centralized VPN.

Answer

Attach an Internet Gateway to the VPC and assign public IPs to the EC2 instances.

Question 2

A company is migrating on-premises workloads to AWS using AWS Direct Connect. The company has two Direct Connect connections from different providers for redundancy. Which configuration ensures seamless failover with automatic traffic rerouting?

Accepted Answer

Create two Direct Connect gateways, each attached to a separate Transit Gateway, and advertise the same prefixes via BGP.. Option C is correct because using a Transit Gateway with two Direct Connect gateways (one for each connection) and dynamic BGP routing enables automatic failover via BGP path selection. Option A is wrong because both connections to the same VGW do not provide true redundancy if the VGW fails. Option B is wrong because static routes require manual intervention. Option D is wrong because a VPN over the internet defeats the purpose of Direct Connect.

Answer

Use one Direct Connect connection as primary and the other as standby with static routes.

Answer

Connect both Direct Connect connections to the same Virtual Private Gateway (VGW) and enable BGP.

Answer

Use a VPN connection over the internet as a backup for the Direct Connect links.

Question 3

A company is deploying a global application and wants to use AWS Global Accelerator to improve performance. The application runs behind an Application Load Balancer (ALB) in us-east-1. Which THREE components are part of a Global Accelerator deployment?

Accepted Answer

Endpoint groups. Option A, Option C, and Option D are correct. Option A is correct because Global Accelerator uses anycast IP addresses. Option C is correct because it uses edge locations. Option D is correct because endpoint groups are a core component. Option B is wrong because Lambda@Edge is for CloudFront. Option E is wrong because Route 53 is DNS, not part of Global Accelerator.

Answer

Route 53 hosted zones

Answer

Lambda@Edge functions

Question 4

A company needs to connect its on-premises data center to AWS using a site-to-site VPN. The on-premises firewall does not support IPsec. What alternative solution can the company use?

Accepted Answer

Use AWS Client VPN to establish a VPN connection from the on-premises network.. Option B is correct because AWS Client VPN allows individual clients or the entire network to connect using OpenVPN-based software, which can be installed on the firewall if it supports OpenVPN. Option A is wrong because Direct Connect is a physical connection. Option C is wrong because Transit Gateway is a network transit hub, not a VPN endpoint. Option D is wrong because VPC peering is for VPC-to-VPC connectivity.

Answer

Create a VPC peering connection between the on-premises router and the VPC.

Answer

Deploy an AWS Transit Gateway and attach the on-premises network via a VPC attachment.

Answer

Use AWS Direct Connect to establish a dedicated physical link.

Question 5

Which THREE of the following are considerations when designing a Direct Connect implementation for high availability? (Choose three.)

Accepted Answer

Use BGP to advertise the same prefixes over both connections.. Correct: A (redundant connections), C (different locations), and D (BGP routing). B is wrong because single connection cannot provide HA. E is wrong because VPN is a separate backup, not a Direct Connect design consideration.

Answer

Use a single connection with high bandwidth.

Answer

Configure static routes to the on-premises network.

Question 6

A company is connecting their on-premises data center to AWS using a site-to-site VPN. The customer gateway device has a dynamic routing configuration with BGP. The VPN connection is established, but the VPC route table does not contain the on-premises network routes. What is the most likely cause?

Accepted Answer

Route propagation is not enabled on the VPC route table.. Option B is correct. For dynamic VPN, you must enable route propagation on the VPC route table to automatically propagate BGP routes. Option A is wrong because static routes are not needed. Option C is wrong because BGP is used. Option D is wrong because the customer gateway device is configured correctly.

Answer

The customer gateway device is not configured with the correct BGP ASN.

Answer

The VPC route table has static routes pointing to the virtual private gateway.

Answer

The VPN connection is using static routing instead of dynamic routing.

Question 7

A company deployed an Application Load Balancer (ALB) in front of a fleet of EC2 instances. Users report intermittent timeouts. The ALB's target group health checks are failing for some instances. The instances are in private subnets with a single NAT Gateway. What is the most likely cause?

Accepted Answer

The security group on the EC2 instances does not allow inbound traffic from the ALB's security group.. Health checks from the ALB originate from the ALB's subnet and do not require a NAT Gateway. However, if the security group for the instances does not allow inbound traffic from the ALB's security group, health checks will fail. Option A (NAT Gateway) is unrelated; Option B (route table) would affect outbound traffic; Option C (instance type) is unlikely.

Answer

The route tables in the private subnets do not have a default route pointing to the NAT Gateway.

Answer

The EC2 instances are of an unsupported instance type for ALB target groups.

Answer

The NAT Gateway is in a single Availability Zone, causing traffic to fail during an AZ outage.

Question 8

A company is setting up a site-to-site VPN connection between an on-premises network and AWS. The VPN uses two tunnels for high availability. The network engineer needs to ensure that if one tunnel goes down, traffic automatically fails over to the other tunnel. Which THREE steps should the engineer perform? (Choose THREE.)

Accepted Answer

Configure BGP on both VPN tunnels.. Options A, B, and D are correct. Using BGP allows dynamic routing and failover. Two customer gateway devices provide physical redundancy. Enabling route propagation on the VPC route table ensures BGP routes are added. Option C is wrong because static routes do not provide automatic failover. Option E is wrong because a single customer gateway device is a single point of failure.

Answer

Configure static routes pointing to the VPN connection.

Answer

Use a single customer gateway device with multiple BGP sessions.

Question 9

A company needs to provide internet access to a VPC that has both public and private subnets. They have already created an Internet Gateway and attached it to the VPC. What else must be configured for instances in the public subnet to be reachable from the internet?

Accepted Answer

Add a route to the public subnet's route table pointing 0.0.0.0/0 to the Internet Gateway.. For internet access, the public subnet's route table must have a default route to the Internet Gateway. Additionally, the instances must have public IP addresses (auto-assign public IP or Elastic IP) and security groups/NACLs allowing inbound traffic. Option B (NAT Gateway) is for private subnets; Option C (VPN) is not needed; Option D (Transit Gateway) is not required.

Answer

Launch a NAT Gateway in the public subnet.

Answer

Attach the VPC to an AWS Transit Gateway.

Answer

Establish a VPN connection to the Internet Gateway.

Question 10

A company has a VPC with a CIDR block of 10.0.0.0/16 and needs to establish connectivity to an on-premises network via AWS Site-to-Site VPN. The on-premises network uses a CIDR block of 192.168.0.0/16. The VPN connection will be redundant using two tunnels. Which TWO actions are required to enable this connectivity?

Accepted Answer

Create a Virtual Private Gateway (VGW) and attach it to the VPC.. Option A and Option D are correct. Option A is correct because a Virtual Private Gateway must be attached to the VPC. Option D is correct because route tables must have routes for the on-premises CIDR pointing to the VPN gateway. Option B is wrong because Customer Gateway is the on-premises device, not an AWS resource. Option C is wrong because Direct Connect is a different service. Option E is wrong because NAT Gateway is for outbound internet.

Answer

Create a Customer Gateway (CGW) in the same AWS region.

Answer

Create a Direct Connect virtual interface.

Answer

Configure a NAT Gateway in the VPC.

Question 11

A company wants to securely connect their on-premises data center to AWS using a site-to-site VPN. They have multiple branch offices that also need to connect to AWS. Which AWS service should they use to simplify the management of multiple VPN connections?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway acts as a hub for connecting multiple VPCs and on-premises networks, simplifying the management of multiple VPN connections. Option A (Direct Connect) is a dedicated connection but not ideal for multiple branch offices. Option B (VPC Peering) is for VPC-to-VPC connections. Option D (VPN CloudHub) is a feature of Virtual Private Gateway but is less scalable than Transit Gateway.

Answer

VPC Peering

Answer

AWS Direct Connect

Answer

VPN CloudHub

Question 12

A company has a VPC with multiple subnets that are peered with another VPC using a VPC Peering connection. They want to ensure that traffic between the two VPCs is encrypted. What should they do?

Accepted Answer

Use AWS Transit Gateway with a VPN attachment between the VPCs.. VPC Peering does not support encryption of traffic. To add encryption, you can deploy a VPN connection between the VPCs, or use an overlay solution. Option A (Transit Gateway with VPN) is a valid approach. Option B (Internet Gateway) would expose traffic to the internet. Option C (NACL) does not encrypt. Option D (Direct Connect) does not encrypt by default.

Answer

Configure network ACLs to enforce encryption.

Answer

Use AWS Direct Connect with a public VIF.

Answer

Enable encryption on the VPC Peering connection using a security group.

Question 13

Refer to the exhibit. A VPC endpoint for S3 is created as a Gateway endpoint. The route tables rtb-11111111 and rtb-22222222 are associated with the endpoint. An EC2 instance in a subnet associated with rtb-11111111 cannot access S3 via the endpoint. What is the most likely cause?

Accepted Answer

The route table rtb-11111111 does not have a route to the S3 prefix list with the target as the VPC endpoint.. A Gateway endpoint automatically adds a prefix list route to the route table, but the route must point to the endpoint. If the route table already has a route to S3 via an Internet Gateway or NAT, the endpoint route may not be used. However, the most common issue is that the subnet's route table does not have the prefix list route for the S3 endpoint. The exhibit shows the endpoint is associated with the route table, but the route table itself must contain a route to the S3 prefix list (e.g., pl-12345) with the target as the endpoint. Option B (security group) is possible but less likely; Option C (DNS) is not required for Gateway endpoints; Option D (policy) is permissive.

Answer

The endpoint policy denies access to S3 from the instance's IAM role.

Answer

The security group on the EC2 instance does not allow outbound traffic to the S3 prefix list.

Answer

The VPC does not have DNS resolution enabled for the endpoint.

Question 14

A company is deploying a web application that will be accessed over the internet. They want to use an Application Load Balancer (ALB) to distribute traffic across EC2 instances in multiple Availability Zones. Which TWO configurations are required to make the ALB internet-facing? (Choose TWO.)

Accepted Answer

Associate the ALB with public subnets that have a route to an Internet Gateway.. An internet-facing ALB must be in public subnets (with a route to an Internet Gateway) and have a public DNS name. Option A is wrong because the ALB does not need its own public IP; it uses the public subnets. Option C is wrong because the ALB can be in public subnets only. Option D is wrong because security groups do not make it internet-facing.

Answer

Configure a security group that allows inbound traffic from 0.0.0.0/0.

Answer

Assign an Elastic IP address to the ALB.

Answer

Associate the ALB with private subnets only.

Question 15

A company is deploying a fleet of EC2 instances in private subnets. The instances need to download patches from the internet. The company wants to minimize cost and avoid managing NAT instances. The VPC has an internet gateway (IGW) attached. What should the company do?

Accepted Answer

Deploy a NAT Gateway in a public subnet and update the private subnet route tables.. Option C is correct because a NAT Gateway in a public subnet provides outbound internet access for private instances, is managed, and cost-effective. Option A is wrong because private subnets cannot directly use IGW. Option B is wrong because NAT instances require management. Option D is wrong because VPC endpoints are for specific services, not general internet.

Answer

Attach the IGW to the private subnet route table.

Answer

Create a VPC endpoint for internet access.

Answer

Launch a NAT instance and configure routing.