ANS-C01 Practice Test 39 — 15 Questions

Question 1

A network engineer is troubleshooting connectivity between an on-premises data center and a VPC over an AWS Site-to-Site VPN. The tunnel status shows UP, but traffic from on-premises to the VPC is intermittently dropped. Which TWO of the following are likely causes? (Choose 2.)

Accepted Answer

Asymmetric routing across multiple tunnels. Incorrect MTU settings can cause fragmentation issues leading to drops, and asymmetric routing can cause stateful firewalls to drop return traffic. Dead Peer Detection (DPD) timeout would cause the tunnel to go down, not intermittent drops; BGP hold timer expiration would cause BGP session reset; IPsec SA lifetime mismatch would cause periodic rekey issues but not typical intermittent drops.

Answer

Dead Peer Detection (DPD) timeout configuration

Answer

BGP hold timer expiration

Answer

IPsec SA lifetime mismatch between peers

Question 2

A company is deploying a new application in a VPC with public and private subnets. The application needs to access an S3 bucket in the same AWS Region. Which configuration provides the MOST secure and cost-effective connectivity?

Accepted Answer

Create an S3 Gateway Endpoint in the VPC and add a route to it.. Option B is correct because an S3 Gateway Endpoint provides private connectivity to S3 without traversing the internet or incurring NAT gateway costs. Option A is wrong because a NAT gateway adds cost and still uses internet. Option C is wrong because Direct Connect is overkill and costly. Option D is wrong because proxy servers add complexity and cost.

Answer

Configure a proxy server in the public subnet to forward requests to S3.

Answer

Set up an AWS Direct Connect connection to S3.

Answer

Create a NAT gateway in the public subnet and route traffic through it.

Question 3

A company has a VPC with an Application Load Balancer (ALB) in front of a fleet of EC2 instances. The security group for the EC2 instances must allow traffic only from the ALB. Which source should be specified in the security group inbound rule?

Accepted Answer

The ID of the ALB's security group. Option B is correct because the ALB's security group ID can be used as the source in the instance security group, allowing traffic only from the ALB. Option A is wrong because the ALB's public IPs can change; using security group IDs is more reliable. Option C is wrong because the VPC CIDR is too broad. Option D is wrong because the subnet CIDR of the ALB is also too broad and not as secure.

Answer

The ALB's public IP address

Answer

The subnet CIDR block of the ALB's subnets

Answer

The VPC CIDR block

Question 4

A company is implementing a hybrid network using AWS Site-to-Site VPN. The on-premises firewall requires that the VPN tunnels use IKEv2 with pre-shared keys and that the tunnels are always active. Which VPN configuration should be used?

Accepted Answer

Two VPN tunnels in active/active mode with BGP. Option C is correct because two tunnels in active/active mode provide high availability and always-on connectivity. Option A is wrong because one tunnel is not redundant. Option B is wrong because active/passive means one tunnel is standby. Option D is wrong because dynamic routing with BGP is typically used, not static routes.

Answer

Two VPN tunnels in active/passive mode

Answer

Two VPN tunnels with static routing

Answer

One VPN tunnel with static routing

Question 5

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the public subnet is configured as a NAT instance. The company wants to replace the NAT instance with a NAT gateway for better availability and maintenance. After creating a NAT gateway in the public subnet and updating the route table of the private subnet, traffic from the private subnet cannot reach the internet. What is the MOST likely cause?

Accepted Answer

The NAT gateway does not have an Elastic IP address associated with it.. The NAT gateway must have an Elastic IP to work. Option A is wrong because the route table should point to the NAT gateway. Option B is wrong because the private subnet's route table destination for 0.0.0.0/0 should be the NAT gateway. Option D is wrong because security groups on the NAT gateway are not applicable (NAT gateway is managed).

Answer

The public subnet's route table still points to the NAT instance for internet traffic.

Answer

The security group attached to the NAT gateway is blocking outbound traffic.

Answer

The private subnet's route table has a route for 0.0.0.0/0 pointing to the NAT instance instead of the NAT gateway.

Question 6

A company is designing a hybrid network using AWS Direct Connect. Which TWO of the following are required to establish a private virtual interface (VIF) to a single VPC?

Accepted Answer

A VLAN ID for the virtual interface.. A private VIF requires a VLAN ID and a BGP session. Option A is optional; Option C is for public VIF; Option E is for transit VIF.

Answer

A Direct Connect Gateway to connect to the VPC.

Answer

A public IP address for the AWS side of the BGP session.

Answer

A BGP session with the AWS Direct Connect endpoint using public IPs.

Question 7

A company is implementing a hybrid network using AWS Direct Connect and VPN backup. They have multiple VPCs in a single AWS Region. Which design minimizes the number of Direct Connect virtual interfaces while providing connectivity to all VPCs?

Accepted Answer

Create one private VIF attached to a Direct Connect gateway and associate the gateway with all VPCs.. Option B is correct because a Direct Connect gateway allows multiple VPCs to connect via a single virtual interface (VIF). Option A is wrong because each VIF is limited to one VPC. Option C is wrong because VPN is a backup, not primary. Option D is wrong because transit VPC adds complexity.

Answer

Set up a transit VPC with EC2-based routers.

Answer

Create a separate private VIF for each VPC.

Answer

Use a single public VIF and route through the internet.

Question 8

A company uses AWS Transit Gateway to connect multiple VPCs and an on-premises network via VPN. The on-premises network advertises a route for 10.0.0.0/8. One VPC has a CIDR of 10.0.1.0/24. How does Transit Gateway handle the overlapping route?

Accepted Answer

The Transit Gateway uses the longest prefix match; the VPC route 10.0.1.0/24 is more specific.. Option B is correct because Transit Gateway uses the longest prefix match, so the more specific 10.0.1.0/24 route from the VPC takes precedence. Option A is wrong because it does not summarise. Option C is wrong because there is no conflict resolution based on attachment type. Option D is wrong because it does not blackhole.

Answer

The Transit Gateway prefers the on-premises route because it is learned via BGP.

Answer

The Transit Gateway drops traffic to 10.0.1.0/24 due to conflict.

Answer

The Transit Gateway summarises the on-premises route to 10.0.0.0/16.

Question 9

Refer to the exhibit. A company has an S3 bucket with the bucket policy shown. An EC2 instance in a VPC with CIDR 10.0.0.0/16 tries to retrieve an object from the bucket using the S3 console, but receives an 'Access Denied' error. The instance's security group allows all outbound traffic. What is the most likely cause?

Accepted Answer

The EC2 instance is accessing the S3 bucket through a NAT Gateway, so the source IP is the public IP of the NAT Gateway, which does not match the condition.. The condition aws:SourceIp evaluates the IP address of the requester. For EC2 instances accessing S3 via a VPC endpoint, the source IP is the private IP, which matches 10.0.0.0/16. However, accessing S3 via the console uses the public IP of the NAT Gateway or internet gateway, which is not in the 10.0.0.0/16 range. Option B is wrong because the policy allows GetObject. Option C is wrong because the policy allows all principals. Option D is wrong because the bucket policy is not too restrictive; it just requires matching IP.

Answer

The bucket policy does not allow the s3:GetObject action.

Answer

The bucket policy does not specify a principal, so it defaults to deny.

Answer

The condition aws:SourceIp is too restrictive and blocks all traffic.

Question 10

A network engineer is designing a Direct Connect solution with a public VIF and a private VIF. The private VIF will connect to a VPC via a Direct Connect Gateway. Which TWO of the following statements are correct regarding this setup? (Choose 2.)

Accepted Answer

The Direct Connect Gateway allows the private VIF to connect to multiple VPCs in different AWS Regions. A public VIF provides access to AWS public services (like S3) over Direct Connect, which is more consistent and lower latency than internet. A private VIF with Direct Connect Gateway allows connections to multiple VPCs in different regions. Option B is wrong because a private VIF does not access public endpoints (that's the public VIF). Option D is wrong because a private VIF requires a virtual interface and a router. Option E is wrong because a public VIF does not connect to VPCs.

Answer

The private VIF can be used without a virtual interface termination device on the customer side

Answer

The public VIF can be used to connect to a VPC via a Direct Connect Gateway

Answer

The private VIF can be used to access Amazon S3 over a private IP address

Question 11

A company is designing a hybrid network architecture that requires high availability and low latency between its on-premises data center and AWS. They have two redundant 1 Gbps AWS Direct Connect connections. The company wants to use BGP to advertise the same prefix from both locations to AWS. How should they configure the BGP attributes to ensure active/passive failover with automatic failback?

Accepted Answer

Prepend the AS path on the secondary connection's BGP advertisements. Option B is correct because setting a shorter AS path prepend on the primary connection makes it preferred; if that path fails, the prepended path becomes active, and when the primary recovers, the shorter AS path is again preferred, providing automatic failback. Option A is wrong because local preference is applied inbound, not outbound. Option C is wrong because MED is not typically used across different AS. Option D is wrong because communities do not directly influence path selection for failover.

Answer

Set a higher MED value on the primary connection's BGP advertisements

Answer

Set a higher local preference on the secondary connection's BGP advertisements

Answer

Use BGP communities to tag routes and manipulate preference on AWS side

Question 12

A company is designing a network architecture for a critical application that requires high availability and low latency. The application will be deployed on EC2 instances in an Auto Scaling group across three Availability Zones in a single region. The instances will communicate with an Amazon RDS database. Which configuration will provide the MOST resilient and performant network connectivity?

Accepted Answer

Create an RDS Multi-AZ cluster with one writer and two reader instances in different AZs, and use the cluster endpoint for writes and reader endpoint for reads.. Placing RDS in a database subnet group across multiple AZs and using a cluster with Multi-AZ provides high availability and low latency by ensuring the database endpoint is always in the same AZ as the application instance when possible. Option A is wrong because a single AZ creates a single point of failure. Option B is wrong because a Network Load Balancer for RDS is not standard. Option D is wrong because a single RDS instance in one AZ is not highly available.

Answer

Launch a single RDS instance in a public subnet and use Route 53 latency-based routing to direct traffic.

Answer

Use a Network Load Balancer in front of the RDS instance to distribute connections across Availability Zones.

Answer

Place the RDS instance in a single Availability Zone and use a read replica in another AZ for failover.

Question 13

A company has multiple VPCs that need to communicate with each other and with an on-premises network via AWS Transit Gateway. Which THREE of the following are valid attachment types for a transit gateway?

Accepted Answer

Direct Connect Gateway. Transit gateway supports attachments to VPCs, VPN connections, and Direct Connect gateways. Option D is incorrect because an internet gateway is attached to a VPC, not to a transit gateway. Option E is incorrect because a network load balancer is not directly attached to a transit gateway.

Answer

Internet Gateway

Answer

Network Load Balancer

Question 14

An organization needs to securely connect its on-premises data center to multiple VPCs in different AWS Regions. The on-premises network uses BGP. Which AWS service should be used to simplify routing and provide a single point of attachment for the on-premises router?

Accepted Answer

AWS Transit Gateway with inter-Region peering attachments.. Option C is correct because Transit Gateway provides a hub for multi-VPC and on-premises connectivity with BGP support. Option A is wrong because VPC peering is point-to-point, not hub. Option B is wrong because Direct Connect gateway doesn't connect multiple regions natively. Option D is wrong because Client VPN is for individual users.

Answer

Direct Connect gateway with a private VIF.

Answer

VPC Peering connections between each VPC and the on-premises network.

Answer

AWS Client VPN endpoint.

Question 15

A company is designing a multi-account AWS environment using AWS Organizations. They need to centralize VPC flow logs and network traffic inspection across all accounts. Which architecture meets these requirements with minimal operational overhead?

Accepted Answer

Deploy a central inspection VPC with AWS Network Firewall and use Transit Gateway to route traffic from all VPCs through it.. Option B is correct because a centralised inspection VPC with Transit Gateway and Network Firewall allows all traffic to be inspected. Option A is wrong because it doesn't centralize inspection. Option C is wrong because VPC peering is not transitive. Option D is wrong because AWS Network Firewall is not available in every account without Transit Gateway.

Answer

Use AWS Network Firewall in each VPC and aggregate logs centrally.

Answer

Enable VPC flow logs in each account and send them to a central S3 bucket. Use Network Access Analyzer for inspection.

Answer

Create VPC peering connections between all VPCs and deploy a third-party firewall in one VPC.