ANS-C01 Practice Test 40 — 15 Questions

Question 1

A software company runs a two-tier web application in a VPC. The web tier is in public subnets behind an Application Load Balancer, and the database tier is in private subnets. A security review finds that database instances can initiate outbound connections to the internet through a NAT gateway, which violates policy. The company still needs the database instances to receive software updates from an Amazon S3 bucket and to be administered from a bastion host in a public subnet. Which change should the engineer make?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Remove the NAT gateway route from the database subnet route tables and add a gateway endpoint for Amazon S3, while allowing SSH from the bastion security group in the database security group.. Removing the NAT gateway route from the database subnets stops outbound internet initiation, while a gateway endpoint for Amazon S3 preserves private access for updates. Allowing SSH from the bastion's security group keeps administration working without exposing the database tier, satisfying both the security policy and operational needs.

Answer

Move the database instances into the public subnets and rely on security groups to prevent inbound internet access, removing the NAT gateway.

Answer

Keep the NAT gateway route but attach a network ACL to the database subnets that denies outbound traffic to 0.0.0.0/0 except for the S3 prefix list.

Answer

Replace the NAT gateway with an internet gateway and add a route from the database subnets to the internet gateway, restricting access with security groups.

Question 2

A company has a Direct Connect connection with a private VIF to a VPC. The network team notices intermittent packet loss on the link. CloudWatch metrics show no errors on the connection. What should the team do next to isolate the issue?

Accepted Answer

Run a traceroute from an on-premises device to an EC2 instance in the VPC.. Running a traceroute from on-premises to an EC2 instance in the VPC is the best next step to isolate where packet loss occurs along the path. Since CloudWatch shows no errors on the Direct Connect connection, the issue may be in the network path beyond the connection, and traceroute reveals the hop-by-hop latency and loss. This helps determine whether the loss is on the customer side, the AWS side, or an intermediate network.

Answer

Check the BGP session status on the customer router.

Answer

Enable VPC Flow Logs on the VPC.

Answer

Increase the bandwidth of the Direct Connect connection.

Question 3

A company has a multi-account AWS environment using AWS Transit Gateway. The network team wants to centralize network logging from all accounts into a single account for analysis. Which combination of services should be used to achieve this?

Accepted Answer

Amazon S3 and Amazon Athena. Centralizing network logging across many accounts is best achieved by sending VPC Flow Logs (and Transit Gateway Flow Logs) to a central Amazon S3 bucket, then querying them with Amazon Athena. S3 provides durable, low-cost, cross-account storage, and Athena lets analysts run SQL directly against the log files without loading them into a database. This combination is the standard AWS pattern for centralized, queryable network telemetry.

Answer

AWS CloudTrail and Amazon CloudWatch Logs

Answer

Amazon Kinesis Data Streams and Amazon Redshift

Answer

AWS Config and Amazon DynamoDB

Question 4

Match each AWS service or feature to its primary function in network architecture.

Accepted Answer

VPC: Isolated virtual network in AWS where you can launch resources. Correct matches: VPC is an isolated virtual network; Direct Connect is a dedicated physical connection; VPN is an encrypted internet-based connection; Route 53 is a DNS service. Common confusions include mixing Direct Connect with VPN and VPC with Direct Connect.

Answer

VPC: Dedicated physical connection from on-premises to AWS

Answer

Direct Connect: Encrypted connection over the internet to AWS

Question 5

Match each AWS networking feature to its purpose for high availability or fault tolerance.

Accepted Answer

Elastic Load Balancer: Distributes incoming traffic across multiple targets to increase fault tolerance.. Correct matches: Elastic Load Balancer distributes traffic, Route 53 provides DNS health checks, and Global Accelerator uses anycast routing. Common confusions: ELB does not handle DNS; Route 53 does not direct traffic over the global network; Global Accelerator does not log traffic.

Answer

Elastic Load Balancer: Routes traffic based on DNS health checks.

Answer

Amazon Route 53: Improves application availability by directing traffic over the AWS global network.

Answer

AWS Global Accelerator: Captures network traffic logs for analysis.

Question 6

A network engineer is troubleshooting connectivity between two VPCs that are peered. The route tables are correct, and security groups allow traffic. However, ICMP ping fails. What is the most likely cause?

Accepted Answer

The security groups are blocking ICMP. VPC peering supports ICMP, so option B is incorrect. The stem states that security groups allow traffic, but this should be interpreted as common TCP/UDP traffic; ICMP is a separate protocol. Security groups are protocol-specific and default to deny inbound traffic unless explicitly allowed. A rule allowing TCP/UDP does not permit ICMP. Therefore, the most likely cause of ping failure is that the security groups do not have an inbound ICMP rule, making D the correct answer.

Answer

The route tables are not propagated

Answer

VPC peering does not support ICMP

Answer

The VPCs are in different regions

Question 7

Which TWO of the following are characteristics of an AWS Network Load Balancer (NLB)?

Accepted Answer

Preserves the source IP address of the client. Network Load Balancers operate at Layer 4 and preserve the client source IP address by default. When a client sends a request, the NLB forwards the packet with the original source IP intact, unlike Application Load Balancers which replace it with their own IP. This is critical for applications that require client IP logging or security filtering.

Answer

Supports SSL offloading

Answer

Supports routing based on HTTP headers

Answer

Operates at Layer 7 of the OSI model

Question 8

A network engineer has created a VPC endpoint for a VPC endpoint service. The endpoint is 'available' but the application cannot connect to the service using the private DNS name. The engineer checks the Route 53 private hosted zone and finds that no record exists for the endpoint. What is the most likely cause?

Accepted Answer

The 'PrivateDnsEnabled' flag is set to false on the VPC endpoint. When the 'PrivateDnsEnabled' flag is set to false on a VPC endpoint, AWS does not automatically create a Route 53 private hosted zone for the endpoint, so the private DNS name does not resolve. This is the most likely cause given that no DNS record exists. Option D is correct. Options A, B, and C could cause connectivity issues but would not prevent the DNS record from being created.

Answer

The VPC endpoint service is not accepting connections

Answer

The VPC endpoint policy is blocking connectivity

Answer

The security group for the endpoint does not allow inbound traffic

Question 9

Which TWO of the following are valid methods to connect multiple VPCs in the same AWS region using AWS native services? (Choose two.)

Accepted Answer

VPC peering. VPC peering (B) is correct because it is an AWS-native networking feature that directly connects two VPCs in the same region (or across regions) using private IPv4/IPv6 addresses, with no gateway, VPN, or single point of failure, and it supports intra-region VPC-to-VPC connectivity. AWS Transit Gateway (E) is also correct because it is a regional AWS-native hub-and-spoke transit hub that attaches multiple VPCs (and VPN/Direct Connect) in the same region, allowing transitive routing between all attached VPCs without full-mesh peering. A Software VPN appliance (A) is not an AWS-native service — it is a customer-managed EC2 instance running third-party VPN software, so it does not qualify. AWS Direct Connect (C) is a dedicated private network link between on-premises and AWS, not a method for connecting VPCs to each other within a region. Amazon ClassicLink (D) was a legacy feature for linking EC2-Classic instances to a VPC, not for connecting multiple VPCs, and it has been retired.

Answer

Software VPN appliance

Answer

AWS Direct Connect

Answer

Amazon ClassicLink

Question 10

A company has a VPC with a CIDR block of 10.0.0.0/16 and wants to create a subnet that can host a large number of instances. The network engineer needs to choose a subnet CIDR block from the VPC range. Which subnet CIDR block is valid for use within this VPC?

Accepted Answer

10.0.0.0/24. A subnet CIDR block must be a subset of the VPC CIDR block and must not overlap with other subnets. Because the VPC uses 10.0.0.0/16, only a block such as 10.0.0.0/24 falls within that range and is valid for subnet creation.

Answer

192.168.0.0/24

Answer

10.1.0.0/24

Answer

10.0.0.0/15

Question 11

A company has a Direct Connect connection with a private VIF to a VPC. They also have a Site-to-Site VPN connection to the same VPC as a backup. The on-premises router is advertising the same prefixes over both connections. The company wants to ensure that traffic uses Direct Connect when available and fails over to VPN if Direct Connect goes down. Which configuration should be applied?

Accepted Answer

Prepend AS path on the BGP advertisements over the VPN connection to make the path less preferred.. AS path prepending on the VPN BGP advertisements makes the VPN route less preferred because BGP selects the path with the shortest AS path length. Since Direct Connect advertisements have a shorter AS path, traffic will use Direct Connect when available. If Direct Connect fails, the VPN path becomes the only option and is used for failover.

Answer

Set a higher MED value on the Direct Connect BGP advertisements.

Answer

Disable BGP on the VPN connection to force traffic to Direct Connect.

Answer

Set a higher local preference on the VPN BGP advertisements.

Question 12

A network engineer is troubleshooting connectivity issues between an EC2 instance in a VPC and an on-premises server over a Direct Connect connection. The engineer has verified that the VPC route tables, Direct Connect virtual interface, and on-premises routing are correctly configured. Which tool should be used to verify the path MTU and identify fragmentation issues?

Accepted Answer

Use the ping command with the DF flag set to test MTU. The ping command with the Don't Fragment (DF) flag set (e.g., `ping -M do -s <size>` on Linux) is the correct tool to verify path MTU because it forces the packet not to be fragmented. If the packet size exceeds the MTU of any link along the path, the router will drop the packet and send an ICMP Fragmentation Needed message back, allowing the engineer to pinpoint the maximum supported MTU and identify fragmentation issues.

Answer

Use the netstat command

Answer

Use the nslookup command

Answer

Use the traceroute command

Question 13

A network engineer needs to troubleshoot high latency between two EC2 instances in the same VPC but in different Availability Zones. Which tool should be used to measure network performance?

Accepted Answer

Use iperf to measure throughput and latency. iperf is a network performance measurement tool that actively generates TCP or UDP traffic to measure throughput, latency, jitter, and packet loss between two endpoints. For troubleshooting high latency between EC2 instances in different AZs, iperf provides quantitative bandwidth and latency measurements that ping and traceroute cannot. It is the correct tool for performance benchmarking.

Answer

Use traceroute to identify the path

Answer

Use ping to test connectivity

Answer

Use netstat to check network statistics

Question 14

A company is designing a multi-account AWS environment using AWS Transit Gateway. They want to centralize network management and ensure that VPCs in different accounts can communicate. Which THREE steps are required to achieve this? (Select THREE.)

Accepted Answer

Create a Transit Gateway in the central networking account. Option A is correct because the Transit Gateway must first be created in the central networking account, which serves as the hub for centralized network management. Option B is correct because AWS Resource Access Manager (RAM) is the mechanism used to share the Transit Gateway with other AWS accounts so their VPCs can attach to it. Option D is correct because Transit Gateway route tables are required to control routing, and VPC attachments must be associated with a route table for traffic to flow between VPCs. Option C is not correct because creating and peering separate Transit Gateways per account is unnecessary and does not provide the centralized single-hub design described. Option E is not correct because VPC peering connects VPCs directly and does not attach a VPC to a Transit Gateway; Transit Gateway VPC attachments are used instead.

Answer

Create a separate Transit Gateway in each account and peer them together

Answer

Create a VPC peering connection between each VPC and the Transit Gateway

Question 15

A company is using AWS Direct Connect to connect on-premises to AWS. The security team wants to encrypt all traffic traversing the Direct Connect link. Which TWO options can achieve this?

Accepted Answer

Establish an IPsec VPN tunnel over the Direct Connect virtual interface. Option A is correct because you can run an IPsec VPN over a Direct Connect virtual interface (public or transit VIF), which encrypts traffic end-to-end using IPsec while still leveraging the dedicated Direct Connect link. Option B is correct because MACsec (IEEE 802.1AE) provides link-layer encryption on Direct Connect dedicated connections at 10 Gbps or 100 Gbps, encrypting traffic between the on-premises router and the AWS Direct Connect endpoint. Option C is not sufficient because TLS only encrypts specific application traffic and does not encrypt all traffic traversing the link. Option D is incorrect because VPC gateway endpoints for S3 only provide private connectivity to S3 and do not encrypt the Direct Connect link. Option E is incorrect because physical security of the Direct Connect facility does not provide encryption of data in transit.

Answer

Use TLS on all applications

Answer

Use VPC gateway endpoints for S3

Answer

Rely on Direct Connect's physical security