ANS-C01 Practice Test 39 — 15 Questions

Question 1

A company wants to use Amazon Route 53 to resolve DNS queries for a domain they own. They want to ensure that DNS queries are answered quickly and that there is no single point of failure. Which configuration should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a hosted zone and let Route 53 automatically handle the DNS resolution.. When you create a hosted zone in Route 53, AWS automatically provisions four authoritative name servers (NS records) distributed across multiple globally redundant data centers. This design inherently provides high availability and low-latency DNS resolution without any additional configuration, as Route 53 uses Anycast routing to direct queries to the nearest healthy name server.

Answer

Deploy Route 53 in multiple AWS Regions.

Answer

Create multiple hosted zones in separate AWS accounts.

Answer

Create a single hosted zone and assign it to one Route 53 name server.

Question 2

A network engineer runs the above command and sees that VPC Flow Logs are configured for a VPC. The engineer wants to analyze rejected traffic to troubleshoot a connectivity issue. Which field in the flow log records should they examine?

Accepted Answer

action. The 'action' field in VPC Flow Logs indicates ACCEPT or REJECT. Option A is wrong because 'srcaddr' is source IP. Option C is wrong because 'dstport' is destination port. Option D is wrong because 'protocol' is the protocol number.

Answer

protocol

Answer

srcaddr

Answer

dstport

Question 3

A company has a VPC with a CIDR block of 10.0.0.0/16 and needs to establish connectivity to an on-premises network via AWS Site-to-Site VPN. The on-premises network uses a CIDR block of 192.168.0.0/16. The VPN connection will be redundant using two tunnels. Which THREE actions are required to enable this connectivity?

Accepted Answer

Create a Customer Gateway (CGW) in the same AWS region.. To establish an AWS Site-to-Site VPN, three actions are required: creating a Customer Gateway (CGW), creating a Virtual Private Gateway (VGW) and attaching it to the VPC, and adding a route in the VPC route tables pointing to the VGW for the on-premises CIDR. The correct answers are A, C, and E.

Answer

Create a Direct Connect virtual interface.

Answer

Configure a NAT Gateway in the VPC.

Question 4

Match each AWS Direct Connect virtual interface type to its use case.

Accepted Answer

Private VIF: Used to access VPCs using private IP addresses. Correct matches: Private VIF accesses VPCs via private IPs, Public VIF accesses AWS public services, Transit VIF connects multiple VPCs via Transit Gateway. Common confusions involve swapping public/private access or confusing Transit VIF with Private VIF.

Answer

Private VIF: Used to access AWS public services using public IPs

Answer

Public VIF: Used to access VPCs using private IP addresses

Answer

Transit VIF: Used to connect directly to a single VPC

Question 5

Match each AWS networking monitoring or troubleshooting tool to its primary purpose.

Accepted Answer

VPC Flow Logs: Captures information about IP traffic to and from network interfaces.. The correct matches are: VPC Flow Logs ↔ IP traffic capture, AWS CloudWatch Logs ↔ centralized log monitoring, AWS CloudTrail ↔ API activity recording. Common confusions include swapping VPC Flow Logs with CloudTrail, or CloudWatch Logs with VPC Reachability Analyzer.

Answer

VPC Flow Logs: Records API calls made in the AWS environment.

Answer

AWS CloudWatch Logs: Analyzes network paths between resources.

Question 6

A company is expanding its on-premises data center to AWS using a hybrid cloud architecture. They have established an AWS Direct Connect connection with a private virtual interface to a VPC. The on-premises network uses BGP to exchange routes with the VPC. The network engineer notices that the on-premises network can reach some EC2 instances in the VPC but not others. All EC2 instances are in the same subnet (10.0.1.0/24) and have private IP addresses. The Direct Connect virtual interface is configured with the VPC CIDR (10.0.0.0/16) advertised to on-premises. The on-premises firewall logs show that traffic to the unreachable instances is being dropped. What is the most likely cause?

Accepted Answer

The security group attached to the unreachable instances is not allowing inbound traffic from the on-premises network.. Security groups are stateful and control inbound traffic; if the security group does not allow inbound traffic from on-premises, it will be dropped. Option A is wrong because the subnet route table has a route to the virtual private gateway, which is correct. Option B is wrong because the VPC CIDR is advertised. Option C is wrong because network ACLs are stateless and need both inbound and outbound rules; but if they were misconfigured, all instances would be affected.

Answer

The subnet route table does not have a route to the on-premises network.

Answer

The BGP session is not advertising the on-premises routes to the VPC.

Answer

The network ACL on the subnet is blocking inbound traffic from on-premises.

Question 7

Match each AWS security feature to its description.

Accepted Answer

Security Groups: Acts as a virtual firewall for an EC2 instance at the instance level, controlling inbound and outbound traffic.. These are core security services for network protection. Security Groups are instance-level, NACLs are subnet-level, WAF protects web apps, and Shield provides DDoS protection.

Answer

Security Groups: Acts as a firewall at the subnet level.

Answer

Network ACLs: Acts as a virtual firewall for an EC2 instance.

Question 8

Match each BGP attribute to its role in route selection.

Accepted Answer

AS_PATH: Used to determine the shortest path to a destination. BGP attributes influence route selection in a specific order: Weight, LOCAL_PREF, AS_PATH, MED, and others. AS_PATH measures path length, LOCAL_PREF directs outbound traffic, MED directs inbound traffic, and Weight is a Cisco-proprietary local preference.

Answer

AS_PATH: Used to influence outbound traffic from an AS

Answer

LOCAL_PREF: Used to determine the shortest AS path

Question 9

A company is deploying a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB is internet-facing and uses a public subnet. The EC2 instances are in private subnets. The application needs to be accessible from the internet. The security group for the ALB allows inbound HTTP and HTTPS from 0.0.0.0/0. The security group for the EC2 instances allows inbound traffic from the ALB's security group. The route tables for the private subnets have a default route to a NAT gateway. Users report that they cannot access the application. The ALB target group shows the instances as unhealthy. What is the MOST likely cause?

Accepted Answer

The security group for the EC2 instances does not allow inbound traffic from the ALB's security group on the health check port.. When using an Application Load Balancer (ALB), the target group health checks originate from the ALB's nodes. The security group for the EC2 instances must allow inbound traffic from the ALB's security group on the health check port, typically port 80 or 443. If this rule is missing, the health checks fail and the instances are marked unhealthy, preventing traffic from being forwarded. Option B is wrong because the ALB is described as internet-facing and deployed in a public subnet. Option C is wrong because an internet gateway route is attached to the public subnet where the ALB resides, not to the ALB itself. Option D is wrong because the NAT gateway handles outbound traffic from the private subnets, not inbound health check traffic from the ALB.

Answer

The ALB is deployed in a private subnet instead of a public subnet.

Answer

The ALB does not have an associated internet gateway route.

Answer

The NAT gateway is not correctly routing traffic from the instances to the internet.

Question 10

A company has a Direct Connect connection with a private virtual interface (VIF) attached to a Virtual Private Gateway (VGW) that is associated with a single VPC (10.0.0.0/16). The on-premises network uses BGP to exchange routes. The company has recently acquired another company and needs to connect to their VPC (172.16.0.0/16) in the same region. They want to use the existing Direct Connect connection to access both VPCs. The network engineer creates a Transit Gateway, attaches both VPCs, and creates a transit virtual interface (VIF) to the Transit Gateway. The engineer also deletes the private VIF. However, after the change, on-premises users cannot reach either VPC. What should the engineer do to restore connectivity?

Accepted Answer

Configure BGP on the on-premises router to peer with the Transit Gateway over the transit VIF.. When the private VIF was replaced with a transit VIF to the Transit Gateway, the on-premises router lost its BGP peering with the VGW. To restore connectivity, the on-premises router must be configured to establish BGP peering with the Transit Gateway over the transit VIF. This allows route exchange between on-premises and both VPCs attached to the Transit Gateway. Option A is correct. Option B is incorrect because attaching VPCs with different route tables is not the issue; the VPCs are already attached. Option C is incorrect because creating separate private VIFs would be unnecessary and defeats the purpose of using a Transit Gateway. Option D is incorrect because route propagation is already enabled by default when VPCs are attached to a Transit Gateway; the missing piece is the BGP session from on-premises.

Answer

Attach the VPCs to the Transit Gateway with different route tables.

Answer

Create a new private VIF to each VPC.

Answer

Enable route propagation on the Transit Gateway route tables.

Question 11

A company uses AWS Direct Connect with a private VIF to connect to a VPC. The VPC has a virtual private gateway (VGW). The on-premises network uses BGP to exchange routes with the VGW. The company wants to route traffic from the VPC to an on-premises subnet 192.168.1.0/24. The on-premises router advertises 192.168.1.0/24 over BGP. However, instances in the VPC cannot reach that subnet. The VPC route table has the local route and a route to the VGW for 0.0.0.0/0. What is the most likely cause?

Accepted Answer

The 192.168.1.0/24 subnet overlaps with the VPC CIDR, causing the local route to take precedence. If the on-premises subnet 192.168.1.0/24 overlaps with the VPC CIDR (e.g., VPC CIDR 192.168.0.0/16), the VPC's local route takes precedence over any propagated BGP routes. Traffic destined for 192.168.1.0/24 stays within the VPC and never reaches the virtual private gateway, even though the on-premises router is advertising the route. Option A is incorrect because BGP route propagation is enabled by default for Direct Connect private VIFs, and even if disabled, a static route to the VGW would be needed. Option C is incorrect because if the subnet overlaps, a specific route to the VGW would be ignored due to the local route's higher priority. Option D is incorrect because allowed prefixes are configured on the Direct Connect gateway, not the VIF, and the route is being advertised successfully.

Answer

BGP route propagation is disabled on the VPC route table

Answer

The VPC route table does not have a specific route for 192.168.1.0/24 pointing to the virtual private gateway

Answer

The Direct Connect virtual interface does not have the allowed prefixes configured

Question 12

A company has a Direct Connect connection with a private VIF attached to a Direct Connect Gateway. The Direct Connect Gateway is associated with a Transit Gateway. The on-premises network advertises a prefix via BGP, but the prefix does not appear in the Transit Gateway route table. What is the most likely cause?

Accepted Answer

The prefix is not included in the allowed prefixes list for the Direct Connect Gateway.. The Direct Connect Gateway has an allowed prefixes list that filters which BGP prefixes are accepted from the on-premises network. If the prefix is not in that list, it will not be propagated to the Transit Gateway route table. Option A is incorrect because route propagation on the Transit Gateway route table is used for VPC attachments, not for Direct Connect prefixes. Option B is incorrect because BGP community attributes are used for tagging and influencing routing policies, not as a prerequisite for prefix acceptance. Option C is incorrect because the Transit Gateway association with the Direct Connect Gateway is already present as stated in the question, so this cannot be the cause.

Answer

Route propagation is not enabled on the Transit Gateway route table.

Answer

The on-premises router is not sending the BGP community attribute.

Answer

The Transit Gateway is not associated with the Direct Connect Gateway.

Question 13

A company has a VPC with multiple subnets and an internet gateway. The security team wants to detect and block malicious traffic patterns. Which AWS service should be used to provide intrusion detection and prevention?

Accepted Answer

AWS Network Firewall. AWS Network Firewall is a managed service that provides both intrusion detection and intrusion prevention capabilities, with stateful inspection of network traffic. Option B (Network ACLs) is incorrect because NACLs are stateless and do not provide intrusion prevention; they only provide basic allow/deny rules. Option C (Security Groups) is incorrect because Security Groups are stateful but only provide instance-level filtering without IPS functionality. Option D (AWS WAF) is incorrect because WAF protects web applications at Layer 7 and does not provide network-level intrusion prevention.

Answer

Network ACLs

Answer

Security Groups

Answer

AWS WAF

Question 14

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance has a NAT Gateway in the public subnet. However, the instance cannot reach the internet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway. What is the most likely cause?

Accepted Answer

The NAT Gateway does not have an Elastic IP address attached.. A NAT Gateway requires an Elastic IP address to translate private IP addresses to a public IP for internet access. Without it, outbound traffic cannot be routed to the internet. Option B is incorrect because the private subnet route table correctly has a default route pointing to the NAT Gateway. Option C is incorrect because the security group is stateful and allows return traffic; outbound traffic would only be blocked if explicitly denied. Option D is incorrect because network ACLs are stateless but the question does not indicate any blocking rules; the default NACL allows all outbound traffic.

Answer

The security group for the EC2 instance blocks outbound traffic.

Answer

The network ACL for the private subnet blocks outbound traffic.

Answer

The private subnet route table does not have a route to the internet gateway.

Question 15

A company is designing a security group configuration for a three-tier application. The web servers must be accessible from the internet on ports 80 and 443. The application servers must only communicate with the web servers on port 8080. The database servers must only communicate with the application servers on port 3306. Which TWO of the following are best practices for implementing this with security groups? (Choose TWO.)

Accepted Answer

Use the security group ID of the web tier as the source in the app tier inbound rule.. Options A and D are correct. Using security group IDs as source in inbound rules ensures that only instances with the specified security group can communicate, providing fine-grained control. Option A allows web servers to communicate with app servers on port 8080. Option D allows app servers to communicate with database servers on port 3306. Option B is incorrect because using CIDR blocks is less secure and less granular than using security group IDs. Option C is incorrect because network ACLs are stateless and operate at the subnet level, not at the instance level; security groups are more appropriate for this requirement. Option E is incorrect because assigning the same security group to all instances would allow all instances to communicate with each other, violating the principle of least privilege.

Answer

Use the CIDR block of the subnet for the source security group rules.

Answer

Use network ACLs to enforce rules at the subnet level instead of security groups.

Answer

Assign the same security group to all instances to simplify management.