ANS-C01 Practice Test 38 — 15 Questions

Question 1

A company is designing a multi-Region application with an Application Load Balancer (ALB) in each Region fronting an Auto Scaling group of EC2 instances. The application must be accessible via a single DNS name, and traffic should be routed to the closest healthy Region using a latency-based routing policy. Which AWS service should be used as the DNS endpoint to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon Route 53. Amazon Route 53 is the correct choice because it supports latency-based routing policies, which direct traffic to the AWS Region that provides the lowest latency for the end user. By configuring a single DNS name with latency records pointing to the ALB endpoints in each Region, Route 53 can automatically route requests to the closest healthy Region, meeting the requirement for a single DNS name and latency-based routing.

Answer

Amazon CloudFront

Answer

AWS Global Accelerator

Answer

AWS Network Load Balancer

Question 2

A company wants to centrally manage and enforce VPC security group rules across multiple accounts in AWS Organizations. Which AWS service should be used?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager is the correct service for centrally managing and enforcing VPC security group rules across multiple accounts in AWS Organizations. It provides centralized security policy management, allowing you to define common security group rules and automatically apply them to new and existing accounts. AWS Config (Option A) is primarily for compliance auditing and resource configuration history, not enforcement. AWS CloudFormation StackSets (Option B) can deploy resources across accounts but does not provide ongoing enforcement of security policies. IAM Policies (Option D) control permissions, not security group configurations.

Answer

AWS Config

Answer

AWS CloudFormation StackSets

Answer

IAM Policies

Question 3

A company wants to monitor network traffic between two VPCs that are peered. Which AWS feature can capture IP traffic information for analysis?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including traffic between peered VPCs. They log metadata such as source/destination IPs, ports, protocols, and packet accept/reject decisions, which can be published to CloudWatch Logs or Amazon S3 for analysis. This makes them the correct choice for monitoring network traffic between two peered VPCs.

Answer

AWS X-Ray

Answer

AWS Config

Answer

AWS CloudTrail

Question 4

A company is using AWS Direct Connect with a private VIF to connect to a VPC. The on-premises network team reports that they can ping the VPC's private IP addresses but cannot establish TCP connections to an EC2 instance's private IP. The security groups and NACLs are configured to allow the traffic. What is the most likely cause of this issue?

Accepted Answer

The EC2 instance's operating system firewall is blocking TCP traffic. The fact that ICMP (ping) succeeds proves the Direct Connect private VIF, VPC route tables, and network path are all functional end-to-end. Since security groups and NACLs are confirmed to allow the traffic, the remaining layer where TCP could be blocked is the EC2 instance's own operating system firewall (iptables, Windows Firewall, etc.), which is outside AWS's visibility and control.

Answer

The Direct Connect virtual interface is in a down state

Answer

The on-premises firewall is blocking ICMP but not TCP

Answer

The VPC route table is missing a route for the on-premises CIDR

Question 5

A security engineer needs to centrally manage and enforce rules for network traffic between VPCs in a large AWS environment. Which AWS service provides this capability?

Accepted Answer

AWS Network Firewall. AWS Network Firewall is a managed, stateful network firewall and intrusion prevention service that can be deployed centrally in a VPC (often via AWS Transit Gateway or a shared services VPC) to inspect and filter traffic between many VPCs. It supports Suricata-compatible rules, domain lists, and centralized policy management through Firewall Manager, making it the correct choice for enforcing rules across a large multi-VPC environment.

Answer

VPC peering

Answer

Security groups

Answer

Network ACLs

Question 6

A company has an AWS Transit Gateway with multiple VPC attachments. They want to centralize outbound internet traffic through a single VPC that has a NAT gateway and an internet gateway. All other VPCs should route internet-bound traffic through this central VPC. What configuration is required?

Accepted Answer

Add a route in the transit gateway route table pointing 0.0.0.0/0 to the central VPC's transit gateway attachment. To centralize outbound internet traffic through a single VPC using AWS Transit Gateway, add a route in the transit gateway route table for 0.0.0.0/0 pointing to the central VPC's TGW attachment. The central VPC's subnet route tables then direct traffic to the NAT gateway, which uses the internet gateway for egress. Option A is incorrect because a virtual private gateway is used for VPN or Direct Connect connections, not for centralizing internet traffic through a VPC. Options B and C do not achieve the required centralized routing.

Answer

Attach a virtual private gateway to the central VPC and add a static route in the transit gateway route table pointing 0.0.0.0/0 to the virtual private gateway

Answer

Add a default route in the central VPC's subnet route tables pointing to the internet gateway

Answer

Create a route table in the central VPC and associate it with the transit gateway attachment

Question 7

A company has a VPC with multiple subnets across two AZs. The VPC is connected to an on-premises data center via AWS Direct Connect. The company wants to ensure that traffic between the VPC and on-premises is load-balanced across two Direct Connect virtual interfaces (VIFs) for high availability. Which configuration should be used?

Accepted Answer

Configure two VIFs and use BGP to advertise the same prefixes with equal metrics to enable ECMP.. Configuring two Direct Connect virtual interfaces (VIFs) with BGP and advertising the same prefixes with equal metrics (e.g., equal MED or AS-path length) enables Equal-Cost Multi-Path (ECMP) routing. This allows the VPC and on-premises routers to load-balance traffic across both VIFs, providing high availability and active-active utilization of the Direct Connect connections.

Answer

Configure a VPN connection over each VIF and use equal-cost routes between the VPN tunnels.

Answer

Configure a single Direct Connect VIF with a 10 Gbps connection and a single BGP session.

Answer

Configure two VIFs with static routes pointing to different on-premises IPs.

Question 8

A company wants to deploy a web application on EC2 instances behind an Application Load Balancer (ALB). The application must support sticky sessions (session affinity). What configuration is required on the ALB?

Accepted Answer

Enable stickiness on the target group and specify a cookie duration. Sticky sessions (session affinity) are enabled at the target group level on an Application Load Balancer. By enabling stickiness and specifying a cookie duration, the ALB generates a session cookie (AWSALB) that binds a client's session to a specific target for the duration, ensuring subsequent requests from the same client are routed to the same EC2 instance.

Answer

Use path-based routing

Answer

Configure health checks on the target group

Answer

Enable proxy protocol v2

Question 9

A company is using Amazon Route 53 for DNS resolution. They want to restrict access to a private hosted zone so that only authorized VPCs can query it. Which configuration should they use?

Accepted Answer

Associate the private hosted zone with the authorized VPCs. Amazon Route 53 private hosted zones are only accessible to VPCs that are explicitly associated with them. By associating the private hosted zone with the authorized VPCs, you restrict DNS queries to only those VPCs. This is the intended mechanism for controlling access to private hosted zones.

Answer

Configure a network ACL to block UDP port 53 from other VPCs

Answer

Create an IAM policy to deny DNS queries from other VPCs

Answer

Configure a security group to block DNS traffic from other VPCs

Question 10

A security engineer needs to allow an EC2 instance in a private subnet to access an S3 bucket without traversing the internet. Which solution meets this requirement?

Accepted Answer

Create a VPC Gateway Endpoint for S3.. A VPC gateway endpoint for S3 provides private connectivity from a VPC to S3 without requiring an internet gateway, NAT device, or public IP. It works by adding a prefix list route in the route table that directs S3 traffic to the gateway endpoint, keeping traffic on the AWS network. This meets the requirement of accessing S3 without traversing the internet from a private subnet.

Answer

Attach an Internet Gateway to the VPC.

Answer

Use AWS Direct Connect to connect to S3.

Answer

Deploy a NAT gateway in a public subnet and update the route table.

Question 11

A company is using AWS CloudWatch to monitor network metrics. They want to create a dashboard that shows the total number of bytes sent and received by all EC2 instances in a specific VPC. Which two metrics should they use? (Choose TWO.)

Accepted Answer

NetworkOut. Option C (NetworkOut) is correct because it is the CloudWatch EC2 metric that reports the number of bytes sent out by an instance, which directly represents bytes transmitted for the instances in the VPC. Option E (NetworkIn) is correct because it is the CloudWatch EC2 metric that reports the number of bytes received by an instance, matching the 'bytes received' requirement. Together, NetworkIn and NetworkOut give the total bytes received and sent across the EC2 instances. Option A (TotalNetworkBytes) is not a valid EC2 CloudWatch metric, so it cannot be used. Options B (NetworkPacketsOut) and D (NetworkPacketsIn) measure packet counts, not bytes, so they do not satisfy the byte-based requirement.

Answer

TotalNetworkBytes

Answer

NetworkPacketsOut

Answer

NetworkPacketsIn

Question 12

A company has a VPC with two subnets: a public subnet with a NAT Gateway and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance has a security group that allows all outbound traffic. The private subnet's route table has a default route (0.0.0.0/0) pointing to the NAT Gateway. However, the instance cannot reach the internet. What is the most likely issue?

Accepted Answer

The NAT Gateway is deployed in a private subnet.. The NAT Gateway must be deployed in a public subnet with an Internet Gateway (IGW) attached to its route table to translate private IP addresses to the IGW's public IP. If the NAT Gateway is in a private subnet, it has no route to the internet, so traffic from the private EC2 instance reaches the NAT Gateway but cannot be forwarded to the internet. This is the most likely issue because the route table correctly points to the NAT Gateway, but the gateway itself lacks internet connectivity.

Answer

The security group does not allow inbound traffic from the internet.

Answer

The network ACL on the private subnet blocks outbound traffic.

Answer

The instance's DNS resolution is not configured correctly.

Question 13

A security engineer is designing a hybrid network with an AWS Site-to-Site VPN. The company requires that all traffic between the on-premises network and VPC be encrypted in transit. Which configuration ensures this requirement is met?

Accepted Answer

Use AWS Site-to-Site VPN with IPsec tunnels. AWS Site-to-Site VPN uses IPsec tunnels to encrypt all traffic between the on-premises network and the VPC. This ensures that data in transit is encrypted, meeting the security requirement. The VPN connection consists of two IPsec tunnels for redundancy, and all traffic routed through the VPN is encrypted.

Answer

Use VPC peering instead of VPN

Answer

Use AWS Direct Connect with MACsec

Answer

Deploy a Transit Gateway with route tables

Question 14

A company wants to encrypt data at rest in an S3 bucket. Which AWS service can manage the encryption keys if the company wants to use server-side encryption with AWS KMS?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is the AWS-managed service specifically designed to create, store, rotate, and control access to the customer master keys (CMKs) used for server-side encryption (SSE-KMS) of S3 objects. When you configure an S3 bucket with SSE-KMS, S3 calls KMS to generate and manage the data keys, and KMS enforces key policies and IAM permissions on every encrypt/decrypt operation. This gives the company centralized key management, auditability via CloudTrail, and separation of duties between key administrators and key users.

Answer

AWS Certificate Manager (ACM)

Answer

AWS CloudHSM

Answer

AWS Secrets Manager

Question 15

A network engineer is monitoring a hybrid network with a VPN connection to AWS. The engineer notices periodic packet loss and high latency during peak hours. The VPN tunnel uses static routing. The on-premises bandwidth is 100 Mbps, and the VPN connection is limited to 1.25 Gbps. What is the most likely cause?

Accepted Answer

The on-premises internet connection is saturated.. The VPN connection supports up to 1.25 Gbps, but the on-premises internet connection is only 100 Mbps. During peak hours, the 100 Mbps link saturates, causing packet loss and high latency. The VPN tunnel itself is not the bottleneck; the underlying internet connection is.

Answer

The VPC route table has a blackhole route for the on-premises CIDR.

Answer

The VPN tunnel is using the incorrect encryption algorithm.

Answer

The VPN tunnel is exceeding its maximum bandwidth limit.