ANS-C01 Practice Test 37 — 15 Questions

Question 1

A company is designing a multi-VPC architecture in the same region. The VPCs need to communicate with each other using private IP addresses. The company must minimize cost and operational overhead. Which solution should the company use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create VPC peering connections between each pair of VPCs.. VPC peering connections provide direct, private IP connectivity between VPCs using the AWS global network, with no bandwidth bottlenecks or single points of failure. It is the most cost-effective solution for a small number of VPCs (e.g., fewer than 10) as there are no hourly charges for the peering connection itself—only data transfer costs. This minimizes operational overhead compared to managing VPN tunnels or a Transit Gateway, as peering is a simple, one-to-one relationship that does not require additional appliances or complex routing policies.

Answer

Set up AWS Site-to-Site VPN connections between each VPC.

Answer

Use ClassicLink to connect the VPCs.

Answer

Create a Transit Gateway and attach all VPCs.

Question 2

A company is designing a network for a real-time financial trading application. The application requires deterministic low-latency connectivity between two EC2 instances in different Availability Zones within the same VPC. Which placement group type and networking feature should the company use?

Accepted Answer

Cluster placement group and Elastic Fabric Adapter (EFA). For deterministic low-latency, high-throughput networking between EC2 instances, use a cluster placement group with Elastic Fabric Adapter (EFA). Cluster placement groups pack instances close together in a single AZ, providing low-latency networking. EFA adds OS-bypass and reliable transport for HPC and latency-sensitive workloads. Spread placement groups are for reducing correlated failures, not latency, and jumbo frames alone do not provide deterministic low latency.

Answer

Partition placement group and Elastic Network Adapter (ENA) with SR-IOV

Answer

Spread placement group and EC2 networking with jumbo frames

Answer

Cluster placement group and standard TCP/IP networking

Question 3

Refer to the exhibit. A network engineer reviews the NACL entries for a subnet. What is the effect of this NACL on inbound traffic?

Accepted Answer

Only SSH from the internal network and HTTPS from any IP are allowed.. Inbound rules: Rule 100 allows SSH from 10.0.0.0/16 (internal network). Rule 200 allows HTTPS from 0.0.0.0/0 (any IP). Rule 300 (implicit deny) denies all other inbound traffic. Therefore, only SSH from the internal network and HTTPS from any IP are allowed. Option B is incorrect because not all inbound traffic is allowed; SSH from external networks is denied. Option C is incorrect because HTTPS is allowed from anywhere. Option D is incorrect because the NACL does not deny all traffic; it allows specific traffic.

Answer

All inbound traffic is allowed.

Answer

Only HTTPS traffic is allowed from any IP.

Answer

All inbound traffic is denied.

Question 4

A company is deploying a global application and wants to use AWS Global Accelerator to improve performance. The application runs behind an Application Load Balancer (ALB) in us-east-1. Which THREE components are part of a Global Accelerator deployment?

Accepted Answer

Endpoint groups. Endpoint groups are a core component of AWS Global Accelerator that define the AWS Region and traffic routing for a listener. Each endpoint group contains one or more endpoints (such as an ALB, NLB, or EC2 instance) and allows you to control traffic distribution and health checking. In this scenario, the ALB in us-east-1 would be added to an endpoint group associated with that region.

Answer

Route 53 hosted zones

Answer

Lambda@Edge functions

Question 5

A company wants to monitor network traffic between its EC2 instances and determine which IP addresses are generating the most traffic. Which AWS service should be used to capture and analyze this traffic?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information to and from network interfaces in a VPC, including source and destination IP addresses, ports, protocol, and bytes transferred. This data can be used to analyze which IP addresses are generating the most traffic. VPC Flow Logs can be published to CloudWatch Logs or S3 for further analysis.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

AWS Config

Question 6

A company has deployed a VPC with a public subnet and a private subnet in each of two Availability Zones. They have an Application Load Balancer (ALB) in the public subnets and EC2 instances in the private subnets. The EC2 instances need to access an external API over HTTPS. What is the MOST secure way to provide this access?

Accepted Answer

Deploy a NAT Gateway in each public subnet and add a default route in the private subnet route tables pointing to the NAT Gateway.. A NAT Gateway in each public subnet provides a managed, highly available path for EC2 instances in private subnets to initiate outbound HTTPS connections to the internet while preventing inbound connections from reaching them. Adding a default route (0.0.0.0/0) in the private subnet route tables pointing to the NAT Gateway ensures traffic destined for the external API is forwarded through the NAT Gateway, which performs source network address translation (SNAT) using its Elastic IP. This is the most secure method because it avoids exposing the EC2 instances directly to the internet and leverages AWS-managed infrastructure for scalability and fault tolerance.

Answer

Create a VPC endpoint for the external API service.

Answer

Assign public IP addresses to the EC2 instances and allow outbound traffic in the security group.

Answer

Set up a VPN connection to an on-premises network that has internet access.

Question 7

A company wants to provide its employees with secure access to internal applications hosted in a VPC. The employees work remotely and use personal laptops. The solution must authenticate users against the company's existing identity provider (IdP) and must support both Windows and macOS clients. Which AWS service should be used?

Accepted Answer

AWS Client VPN. AWS Client VPN is a fully managed, cloud-based VPN solution that allows remote employees to securely access resources in a VPC using their personal laptops. It supports both Windows and macOS clients natively and can integrate with the company's existing identity provider (IdP) via SAML-based authentication, meeting all stated requirements.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

AWS Direct Connect

Question 8

A company is designing a network security architecture for a multi-tier application. The web tier must be accessible from the internet, but the application and database tiers must not. Which TWO design choices meet these requirements? (Choose two.)

Accepted Answer

Use a security group on the web tier to allow HTTP/HTTPS from 0.0.0.0/0, and security groups on the app and database tiers that only allow traffic from the web tier security group.. The correct answers are C and E. Option C uses security groups to control traffic between tiers: the web tier security group allows HTTP/HTTPS from 0.0.0.0/0, and the app and database tier security groups only allow traffic from the web tier security group. This ensures that the application and database tiers are not directly accessible from the internet. Option E places the web tier in a public subnet with an internet gateway in its route table, so it can receive inbound traffic from the internet. The app and database tiers are placed in private subnets without a direct route to the internet gateway, so they cannot be accessed from the internet. Option A is incorrect because a VPC Gateway Endpoint is used for private connectivity to AWS services like S3 or DynamoDB, not for internet access. Option B is incorrect because a NAT gateway provides outbound internet access for private subnets, not inbound internet access to the web tier. Option D is incorrect because placing all tiers in a public subnet exposes the application and database tiers to the internet, even with restrictive security groups, because they would still have a route to the internet gateway.

Answer

Use a VPC Gateway Endpoint for the web tier to access the internet.

Answer

Use a NAT gateway in a public subnet to provide internet access to the app and database tiers for updates.

Answer

Place all tiers in a public subnet with a security group that restricts access to the app and database tiers.

Question 9

A company is deploying a multi-tier web application across two AWS Regions with an active-passive failover architecture. The application uses Application Load Balancers (ALBs) in each Region, and traffic must be directed to the active Region using DNS. Which routing policy should be used for the Amazon Route 53 record set to achieve this?

Accepted Answer

Failover routing policy. The failover routing policy in Amazon Route 53 is designed specifically for active-passive failover architectures. It uses health checks to monitor the primary endpoint (active Region) and automatically routes traffic to the secondary endpoint (passive Region) only when the primary health check fails. This matches the requirement of directing traffic to the active Region using DNS.

Answer

Geolocation routing policy

Answer

Weighted routing policy

Answer

Latency routing policy

Question 10

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team needs to inspect all traffic between VPCs and on-premises using a centralized firewall appliance. Which architecture meets this requirement?

Accepted Answer

Use Transit Gateway with a central inspection VPC that hosts the firewall appliance.. AWS Transit Gateway acts as a central hub that connects multiple VPCs and on-premises networks. To inspect all traffic between VPCs and on-premises, you can create a central inspection VPC that hosts the firewall appliance (e.g., AWS Network Firewall or a third-party firewall) and associate it with the Transit Gateway. Traffic between spokes is then routed through the inspection VPC via Transit Gateway route tables, ensuring all inter-VPC and VPN/Direct Connect traffic is inspected. This is the recommended centralized inspection architecture.

Answer

Deploy AWS Network Firewall in each VPC and route all traffic through it.

Answer

Connect all VPCs to on-premises via AWS Direct Connect and inspect traffic on-premises.

Answer

Create VPC peering connections between each VPC and the firewall VPC.

Question 11

A healthcare company is deploying a new VPC for a patient portal. The VPC uses CIDR block 10.0.0.0/16. The company has an existing on-premises network using 10.0.0.0/8. A network engineer must establish connectivity between the VPC and on-premises without IP address conflicts, and must ensure that the on-premises network can reach specific services in the VPC. Which solution should the engineer implement?

Accepted Answer

Create a new VPC with a non-overlapping CIDR block, such as 172.16.0.0/16, and establish an AWS Site-to-Site VPN with static routing.. Overlapping CIDR blocks between a VPC and an on-premises network prevent proper routing because the same IP ranges exist in both locations. The only reliable solution is to ensure the VPC CIDR does not overlap with the on-premises CIDR. Creating a new VPC with a non-overlapping range, such as 172.16.0.0/16, and then establishing connectivity via VPN or Direct Connect resolves the conflict. Other options do not address the fundamental IP overlap issue.

Answer

Keep the existing VPC and use AWS PrivateLink to expose the services to the on-premises network.

Answer

Keep the existing VPC and configure a Transit Gateway with inter-Region peering to route traffic around the overlap.

Answer

Keep the existing VPC and use AWS Direct Connect with a private virtual interface and BGP to advertise the VPC CIDR.

Question 12

A company is using AWS CloudFormation to deploy a multi-tier application. The template includes an Amazon VPC with public and private subnets, NAT gateways, and route tables. After deployment, the EC2 instances in the private subnet cannot access the internet. The NAT gateway is in a public subnet with an Internet Gateway attached. What is the most likely cause?

Accepted Answer

The route table of the private subnet does not have a default route pointing to the NAT Gateway. The most likely cause is that the route table of the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT Gateway. For EC2 instances in a private subnet to access the internet, the private subnet's route table must contain a route that directs internet-bound traffic to the NAT Gateway. Option B is incorrect because the Internet Gateway is already attached to the VPC as stated. Option C is incorrect because security groups are stateful and by default allow all outbound traffic; the question does not indicate any security group changes. Option D is incorrect because network ACLs are stateless and by default allow all outbound traffic; the scenario does not mention any NACL modifications.

Answer

The Internet Gateway is not attached to the VPC

Answer

The security group of the EC2 instances blocks outbound traffic to the internet

Answer

The network ACL of the private subnet blocks outbound traffic

Question 13

A company is using AWS Client VPN to provide remote access to its VPC. Users report that they can connect but cannot access any resources. The VPN is configured with a security group that allows all traffic. What should the administrator check?

Accepted Answer

The client VPN authorization rules. The administrator should check the client VPN authorization rules. AWS Client VPN uses authorization rules to grant access to network resources; even if the security group allows all traffic, without an authorization rule allowing the user's group access to the VPC CIDR, users cannot reach resources. This is a common misconfiguration.

Answer

The client VPN security group inbound rules

Answer

The client VPN endpoint certificate

Answer

The client VPN route table

Question 14

Which TWO of the following are valid methods to provide outbound internet access to instances in a private subnet?

Accepted Answer

Deploy a NAT instance in a public subnet and configure routing. Option C is correct because a NAT instance placed in a public subnet can perform source NAT for instances in a private subnet, and the private subnet's route table can point its default route (0.0.0.0/0) to that NAT instance's ENI, allowing outbound-only internet access. Option D is correct because an AWS NAT gateway is a managed NAT service deployed in a public subnet with an Elastic IP, and the private subnet's route table can direct 0.0.0.0/0 to the NAT gateway, providing scalable outbound internet access without exposing the private instances. Option A is not valid because VPC endpoints (interface or gateway) only provide private connectivity to specific AWS services or supported partner services, not general outbound internet access. Option B is not valid because an internet gateway is attached at the VPC level, not to a subnet, and a private subnet by definition has no route to an internet gateway. Option E is not valid because a VPN connection links to a remote network (such as on-premises) and does not by itself provide general internet egress for private-subnet instances.

Answer

Use a VPC endpoint for internet access

Answer

Attach an internet gateway directly to the private subnet

Answer

Use a VPN connection to the internet

Question 15

A company needs to meet compliance requirements that mandate encryption of all data in transit between EC2 instances in the same VPC. The instances are in different subnets and communicate using TCP port 443. Which solution should a network engineer implement?

Accepted Answer

Configure the application to use TLS for communication.. Encryption of data in transit between EC2 instances is an application-layer concern; the most direct and compliant solution is to configure the application to use TLS on TCP port 443. TLS provides end-to-end encryption regardless of network path, subnet, or VPC constructs, and satisfies the compliance mandate without relying on network-level overlays.

Answer

Enable VPC Flow Logs to monitor for unencrypted traffic.

Answer

Use AWS Certificate Manager (ACM) to provision certificates and enable encryption automatically.

Answer

Deploy a VPN connection between the instances.