ANS-C01 Practice Test 37 — 15 Questions

Question 1

A company is deploying a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB), a fleet of EC2 instances in an Auto Scaling group across three Availability Zones, and an Amazon RDS for MySQL database. The ALB has a target group that routes traffic to the EC2 instances on TCP port 8080. The security group for the EC2 instances allows inbound traffic from the ALB's security group on port 8080. Users report intermittent connectivity issues to the application. A network engineer reviews the VPC Flow Logs and notices that traffic from the ALB to the EC2 instances is being recorded as 'REJECT' for some requests. What is the most likely cause of this issue?

Accepted Answer

The network ACL associated with the EC2 instances' subnet does not have an outbound rule to allow traffic from the EC2 instances to the ALB on ephemeral ports.. Option A is correct because the network ACL is stateless and must allow both inbound and outbound traffic for ephemeral ports. If the outbound rule is missing, SYN-ACK packets from the EC2 instance to the ALB will be dropped, causing the ALB to see a timeout or reject. Option B is incorrect because target group health checks use the same security group rules; if health checks succeed, connectivity should work. Option C is incorrect because the ALB itself does not have a security group that affects traffic to targets; it uses the target group's security group. Option D is incorrect because network ACLs are stateless and require explicit rules for return traffic; the security group stateful behavior does not override ACL rules.

Answer

The ALB's security group is blocking inbound traffic from the EC2 instances on the response path.

Answer

The ALB's target group health check is misconfigured, causing the ALB to mark instances as unhealthy and stop sending traffic.

Answer

The security group on the EC2 instances is stateful and automatically allows return traffic; the issue cannot be security group related.

Question 2

A company is deploying a multi-tier application across multiple VPCs connected via AWS Transit Gateway. The web tier must be able to initiate connections to the app tier, but the app tier must not be able to initiate connections to the web tier. How can this be achieved?

Accepted Answer

Deploy a centralized firewall appliance in a shared VPC and use Transit Gateway to route all inter-VPC traffic through it.. Option D is correct because a stateful network firewall appliance in a central VPC can enforce unidirectional traffic rules. Transit Gateway route tables can direct traffic to the firewall VPC for inspection, and the firewall rules allow only web-to-app traffic. Option A is wrong because NACLs are stateless and cannot track connection state. Option B is wrong because VPC peering does not provide transitive routing. Option C is wrong because security groups are stateful but cannot be applied across VPCs.

Answer

Configure network ACLs on the web tier subnets to allow outbound traffic and deny inbound from app tier.

Answer

Establish VPC peering between the web and app VPCs and restrict routes.

Answer

Use security groups across the VPCs by referencing each other's CIDR blocks.

Question 3

A company has multiple VPCs connected via a transit gateway. Each VPC has a security group that allows traffic from the other VPCs' CIDR blocks. The security group rules are getting complex. How can the company simplify security group management while maintaining the same level of security?

Accepted Answer

Use managed prefix lists in security group rules.. Option D is correct because using prefix lists allows referencing a CIDR collection in security group rules. Option A is wrong because NACLs are stateless and less granular. Option B is wrong because VPC endpoints are for AWS services. Option C is wrong because Network Firewall adds complexity.

Answer

Use VPC endpoints for inter-VPC communication.

Answer

Deploy AWS Network Firewall to centralize rules.

Answer

Replace security groups with network ACLs.

Question 4

A company is deploying a web application across multiple Availability Zones in a VPC. The application tier consists of EC2 instances behind an Application Load Balancer (ALB). The security team requires that all traffic between the ALB and the EC2 instances be encrypted. Which solution meets this requirement?

Accepted Answer

Use an HTTPS listener on the ALB with a target group that uses HTTPS.. Option B is correct because using an HTTPS listener on the ALB with a target group that uses HTTPS ensures end-to-end encryption. Option A is incorrect because TCP listeners do not encrypt traffic. Option C is incorrect because internal ALBs still require HTTPS listeners for encryption. Option D is incorrect because security groups do not provide encryption.

Answer

Use an internal ALB with a TCP listener and a security group that allows only HTTPS.

Answer

Use an HTTP listener on the ALB and enable encryption on the security group.

Answer

Use a TCP listener on the ALB with a target group that uses TCP.

Question 5

A company is using AWS Direct Connect to connect its on-premises data center to a VPC. The company wants to use a single Direct Connect connection to connect to multiple VPCs in different AWS accounts. Which AWS service should be used to achieve this?

Accepted Answer

Direct Connect Gateway. A Direct Connect Gateway allows a single Direct Connect connection to be associated with multiple VPCs across accounts and regions. Option A is wrong because a VPN connection is separate. Option B is wrong because a transit gateway is used for inter-VPC routing but not directly for Direct Connect. Option D is wrong because VPC peering does not extend Direct Connect.

Answer

Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

VPC Peering

Question 6

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They have a VPC with a CIDR of 10.0.0.0/16 and an on-premises network with CIDR 10.0.0.0/8. The Transit Gateway route table has a static route for 10.0.0.0/8 pointing to the VPN attachment. However, traffic from on-premises to the VPC is not working. What is the most likely cause?

Accepted Answer

The VPC route table does not have a route pointing to the Transit Gateway for on-premises traffic.. Option C is correct because the VPC's route table has a local route for 10.0.0.0/16, but a more specific route to the Transit Gateway is needed for return traffic. Option A is incorrect because the TGW route table is correct. Option B is incorrect because overlapping CIDRs cause issues, but the TGW can handle it with more specific routes. Option D is incorrect because the VPN attachment is used.

Answer

The VPN attachment is in the wrong TGW route table.

Answer

The VPC CIDR overlaps with the on-premises CIDR.

Answer

The Transit Gateway route table does not have a route for the VPC CIDR.

Question 7

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company has a NAT gateway in the public subnet. The route table for the private subnet has a route 0.0.0.0/0 pointing to the NAT gateway. However, the EC2 instance cannot reach the internet. Which additional configuration is needed?

Accepted Answer

Ensure the public subnet's route table has a route 0.0.0.0/0 pointing to an internet gateway.. The NAT gateway is in the public subnet, so the public subnet's route table must have a route to an internet gateway for the NAT gateway to function. Option A is wrong because the private subnet already has the correct route. Option C is wrong because security groups on the NAT gateway do not exist. Option D is wrong because the instance might not have a public IP, but it uses the NAT gateway for outbound traffic, so a public IP is not required.

Answer

Assign a public IP address to the EC2 instance.

Answer

Attach a security group to the NAT gateway allowing outbound traffic.

Answer

Add a route to the NAT gateway in the private subnet's route table for destination 0.0.0.0/0.

Question 8

A company has a VPC with a CIDR of 10.0.0.0/16. They need to create subnets for a three-tier application. Which THREE subnet CIDR blocks are valid within this VPC?

Accepted Answer

10.0.1.0/24. Option A is correct because 10.0.1.0/24 is within 10.0.0.0/16. Option C is correct because 10.0.3.0/24 is within the range. Option D is correct because 10.0.5.0/24 is within the range. Option B is incorrect because 10.1.0.0/24 is outside the VPC CIDR. Option E is incorrect because 10.0.0.0/8 is larger and overlaps but is not a subnet.

Answer

10.1.0.0/24

Answer

10.0.0.0/8

Question 9

A network engineer is troubleshooting connectivity between two EC2 instances in the same VPC but different subnets. The instances can ping each other's private IP addresses, but traffic on TCP port 443 fails. What is the most likely cause?

Accepted Answer

Security group or network ACL rules blocking port 443.. Option C is correct because the security group or NACL is blocking port 443. Since ICMP works, the network layer is fine, but application layer port is blocked. Option A is wrong because route tables affect network layer, not port-specific. Option B is wrong because VPC flow logs are for monitoring, not blocking. Option D is wrong because internet gateway is not involved.

Answer

VPC Flow Logs misconfiguration.

Answer

Internet gateway not attached to the VPC.

Answer

Missing route in the route table.

Question 10

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to add an IPv6 CIDR block to the VPC. Which action should they take?

Accepted Answer

Associate an Amazon-provided IPv6 CIDR block with the VPC.. Option C is correct because AWS provides an Amazon-provided IPv6 CIDR block that is automatically assigned. Option A is wrong because you cannot bring your own IPv6 GUA. Option B is wrong because you cannot directly assign a /56; AWS gives a /56 block. Option D is wrong because you must associate an IPv6 CIDR with the VPC, not just subnets.

Answer

Request an IPv6 CIDR block from your regional internet registry and associate it with the VPC.

Answer

Enable IPv6 on the subnets directly without associating a VPC CIDR.

Answer

Manually assign a /56 IPv6 CIDR block to the VPC.

Question 11

A company is deploying a VPC with public and private subnets in two Availability Zones. The workloads in the private subnets need to access the internet for software updates. What is the MOST secure way to provide this internet access?

Accepted Answer

Deploy a NAT gateway in a public subnet and update the private subnets' route table to point default traffic to the NAT gateway.. Using a NAT gateway in a public subnet is the most secure approach because it allows outbound traffic while preventing inbound connections from the internet. Option A is wrong because an internet gateway attached to private subnets would expose them directly. Option C is wrong because a transit gateway is for connecting multiple VPCs, not providing internet access. Option D is wrong because a VPN connection is for private connectivity, not internet access.

Answer

Set up a VPN connection to an on-premises network with internet access.

Answer

Use a transit gateway with a VPC attachment and route internet traffic through a centralized inspection VPC.

Answer

Attach an internet gateway to the VPC and route the private subnets' traffic to it.

Question 12

A company is designing a hybrid network using AWS Direct Connect. They have two Direct Connect connections from different providers to two different AWS Direct Connect locations. They want to configure a virtual interface (VIF) that provides connectivity to multiple VPCs in the same region. Which type of VIF should they use?

Accepted Answer

Transit virtual interface. Option D is correct because a transit virtual interface connects to a Transit Gateway, which can then be attached to multiple VPCs. Option A is incorrect because a private VIF connects to a single VPC. Option B is incorrect because a public VIF is for public services. Option C is incorrect because a hosted VIF is for partner connections.

Answer

Hosted virtual interface

Answer

Public virtual interface

Answer

Private virtual interface

Question 13

A company has a Direct Connect connection with a private virtual interface to a VPC. They want to use the same Direct Connect connection to access another VPC in the same region. Which solution should they implement?

Accepted Answer

Use a Transit Gateway and a transit virtual interface.. Option B is correct because a Transit Gateway can be attached to both VPCs and a transit VIF can be used. Option A is incorrect because a private VIF is for a single VPC. Option C is incorrect because a VPN can be used but is not leveraging Direct Connect fully. Option D is incorrect because a second Direct Connect is unnecessary.

Answer

Create a second private virtual interface to the second VPC.

Answer

Set up a Site-to-Site VPN over the Direct Connect connection to the second VPC.

Answer

Order a second Direct Connect connection.

Question 14

A network engineer is assigned an IAM policy to manage VPC resources. The engineer attempts to create a VPC with CIDR 10.0.0.0/16 and fails. What is the reason?

Accepted Answer

The Deny statement overrides the Allow statement for the specific CIDR.. Option C is correct because the second statement explicitly denies creating a VPC with CIDR 10.0.0.0/16. Option A is incorrect because the first statement allows VPC creation in general. Option B is incorrect because the resource ARN matches all VPCs. Option D is incorrect because the condition is on the CIDR, not region.

Answer

The resource ARN in the Deny statement does not match the VPC being created.

Answer

The condition in the Deny statement is not evaluated correctly.

Answer

The first statement allows only specific actions, not CreateVpc.

Question 15

A company is setting up a Direct Connect connection to AWS. They have a virtual private gateway (VGW) attached to their VPC. They need to establish a single logical connection over the Direct Connect link to access all subnets in the VPC. Which resource should they create on the Direct Connect virtual interface?

Accepted Answer

A private virtual interface (VIF) with a BGP session to the VGW.. Option C is correct. A private virtual interface (VIF) allows access to all subnets in the VPC through the VGW. Option A is wrong because a public VIF provides access to public IP addresses. Option B is wrong because a transit VIF is used with a transit gateway. Option D is wrong because a hosted VIF is a shared connection.

Answer

A hosted virtual interface (VIF) provided by an AWS Partner.

Answer

A public virtual interface (VIF) with a BGP session to the VGW.

Answer

A transit virtual interface (VIF) to the VGW.