ANS-C01 Practice Test 40 — 15 Questions

Question 1

A company has a Direct Connect connection with a private VIF to a VPC. They also have a site-to-site VPN as a backup. The on-premises network advertises the same prefix via BGP over both connections. The company wants to prefer the Direct Connect path. What configuration achieves this?

Accepted Answer

Configure the Direct Connect BGP session with a higher local preference (e.g., 200) than the VPN BGP session.. Option A is correct because AWS assigns a local preference of 100 by default to Direct Connect routes, while VPN routes have a lower local preference (e.g., 0 or lower). Option B is wrong because AS path prepending on the Direct Connect side would make it less preferred. Option C is wrong because the MED is not commonly used in this scenario; local preference is standard. Option D is wrong because the VPN should have higher AS path prepending to be less preferred.

Answer

Set the Multi-Exit Discriminator (MED) on the VPN advertisement to a lower value.

Answer

Prepend the AS path on the Direct Connect advertisement to make it longer.

Answer

Configure the VPN BGP session with a higher local preference than the Direct Connect session.

Question 2

A company has a VPC with public and private subnets in two Availability Zones. They have a NAT gateway in each AZ for outbound internet access. They recently added a third AZ and created a new private subnet. Instances in the new private subnet cannot reach the internet. The route table for the new subnet has a default route (0.0.0.0/0) pointing to a NAT gateway in the same AZ. What is the most likely cause?

Accepted Answer

The NAT gateway in the new AZ does not have an Elastic IP address attached. Option A is correct because the NAT gateway must have an Elastic IP (EIP) to provide internet connectivity. Without an EIP, the NAT gateway cannot translate private IPs for internet access. Option B is wrong because NAT gateways are not assigned to subnets; they are placed in public subnets. Option C is wrong because the route table is correctly configured. Option D is wrong because security group rules are for inbound/outbound traffic, but the NAT gateway itself does not have security groups.

Answer

The security group attached to the NAT gateway blocks outbound traffic

Answer

The route table in the new private subnet does not have a route to the NAT gateway

Answer

The NAT gateway is not in a public subnet in the new AZ

Question 3

A company is configuring a site-to-site VPN connection between its on-premises network and AWS. The VPN tunnel is up, but traffic is not passing. The company has verified that routes are correct on both sides. Which TWO actions should the company take to troubleshoot the issue?

Accepted Answer

Check the security group rules for the EC2 instances in the VPC.. Options A and D are correct because checking security group and NACL rules is essential for traffic flow. B is irrelevant as tunnel is up. C is not applicable. E is already done.

Answer

Verify that the virtual private gateway is attached to the VPC.

Answer

Ensure that the on-premises firewall is configured to allow IPSec traffic.

Answer

Verify that the VPN tunnel is using the correct encryption algorithm.

Question 4

A company is designing a highly available architecture for a web application using an Application Load Balancer (ALB) across multiple Availability Zones. Which TWO actions should be taken to ensure high availability?

Accepted Answer

Register EC2 instances in multiple Availability Zones.. Option A is correct because the ALB must be internet-facing to receive traffic from users. Option D is correct because the EC2 instances should be in multiple AZs to survive an AZ failure. Option B is incorrect because an internal ALB is not accessible from the internet. Option C is incorrect because a single AZ is not highly available. Option E is incorrect because a Network Load Balancer is for TCP/UDP, not HTTP.

Answer

Use a Network Load Balancer instead of an ALB.

Answer

Place the EC2 instances in a single Availability Zone.

Answer

Configure the ALB as internal.

Question 5

A company is troubleshooting connectivity between two VPCs (VPC-A and VPC-B) that are peered together. Both VPCs are in the same region. VPC-A has a CIDR of 10.0.0.0/16 and VPC-B has a CIDR of 10.0.0.0/16. The peering connection is established and the route tables are updated. However, EC2 instances in VPC-A cannot ping EC2 instances in VPC-B. What is the most likely cause?

Accepted Answer

The VPCs have overlapping CIDR blocks.. Option C is correct. VPC peering does not support overlapping CIDR blocks. The routes cannot distinguish between the two VPCs. Option A is wrong because security groups can allow ICMP. Option B is wrong because private IP addresses are reachable if routes exist. Option D is wrong because same region peering works.

Answer

The route tables do not have routes to the private IP addresses of the instances.

Answer

The security groups in VPC-B do not allow inbound ICMP traffic from VPC-A.

Answer

The VPCs are in different regions and peering does not work across regions.

Question 6

A company is setting up a VPC with both public and private subnets. The private subnets need outbound internet access for software updates. Which component is required to enable this?

Accepted Answer

A NAT gateway in a public subnet.. Option A is correct because a NAT gateway in a public subnet provides outbound internet access to instances in private subnets. Option B is wrong because an internet gateway does not provide outbound access for private subnets without a NAT device. Option C is wrong because VPC peering is for connecting VPCs, not internet access. Option D is wrong because a VPN connection is for site-to-site connectivity, not internet access.

Answer

A VPN connection to an on-premises network that has internet access.

Answer

A VPC peering connection to a VPC that has internet access.

Answer

An internet gateway attached to the VPC with a route in the private subnet's route table pointing to the internet gateway.

Question 7

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to establish a site-to-site VPN connection to an on-premises network with a CIDR of 192.168.0.0/16. The VPN tunnel is up, but traffic from the VPC to on-premises is not flowing. Which of the following is the most likely cause?

Accepted Answer

The VPC route table does not have a route for 192.168.0.0/16 pointing to the virtual private gateway.. Option A is correct because the VPC route table must have a route pointing to the virtual private gateway for the on-premises CIDR. Without it, traffic is dropped. B, C, D are possible but less likely initial checks.

Answer

The security groups do not allow outbound traffic.

Answer

The NACLs are blocking outbound traffic.

Answer

The VPN connection is in the wrong AWS region.

Question 8

A company is deploying a web application across multiple Availability Zones in a VPC. The application needs to be highly available and scale based on traffic. The architecture includes an Application Load Balancer (ALB) in front of EC2 instances in an Auto Scaling group. The company wants to ensure that if an Availability Zone fails, the ALB can still route traffic to healthy instances in other zones. What should the network engineer implement to meet this requirement?

Accepted Answer

Enable cross-zone load balancing on the ALB.. Option D is correct because enabling cross-zone load balancing on the ALB allows it to distribute traffic across all registered targets in all enabled Availability Zones. Option A is wrong because a Network Load Balancer does not support cross-zone load balancing by default. Option B is wrong because multiple ALBs per AZ would introduce complexity and is not the simplest solution. Option C is wrong because it does not address cross-zone load balancing.

Answer

Configure a Network Load Balancer instead of an ALB, and enable cross-zone load balancing.

Answer

Use an ALB with a target group that contains instances from only one Availability Zone, and use Route 53 health checks.

Answer

Deploy one ALB in each Availability Zone and use Route 53 latency-based routing.

Question 9

A company has a VPC with multiple subnets. They want to monitor all network traffic entering and leaving the VPC for security analysis. Which AWS service should they use?

Accepted Answer

VPC Flow Logs. Option D is correct. VPC Flow Logs capture IP traffic information. Option A is wrong because CloudTrail logs API calls. Option B is wrong because Config records resource changes. Option C is wrong because GuardDuty is a threat detection service that uses flow logs but does not capture traffic itself.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon GuardDuty

Question 10

A company uses AWS Direct Connect with a private VIF to connect to a VPC. They have an on-premises application that needs to resolve private hosted zone names in Amazon Route 53. The on-premises DNS server forwards queries for the private domain to the VPC's DNS resolver. However, resolution fails. What is the most likely cause?

Accepted Answer

A Route 53 Resolver outbound endpoint is not configured to forward queries from on-premises to the VPC.. Option D is correct because the Route 53 Resolver outbound endpoint is required to forward DNS queries from on-premises to the Route 53 private hosted zones. Without it, the VPC resolver does not accept queries from external sources. Option A is wrong because the private hosted zone is associated with the VPC. Option B is wrong because the VPC's DHCP option set typically uses the default VPC resolver (or custom), but the issue is inbound queries. Option C is wrong because security groups apply to instances, not to the VPC DNS resolver.

Answer

The private hosted zone is not associated with the VPC.

Answer

The VPC's DHCP option set is not configured to use the Route 53 Resolver.

Answer

The security group for the VPC DNS resolver is blocking inbound UDP port 53 from the on-premises network.

Question 11

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The company wants to centralize network security by inspecting all traffic between VPCs and between VPCs and on-premises. Which architecture should be used?

Accepted Answer

Attach all VPCs to a Transit Gateway and use route tables to send traffic through a firewall appliance in one VPC.. Option D is correct because Transit Gateway supports appliance mode to force traffic through a security appliance VPC. A and B do not provide centralized inspection. C is manual and not scalable.

Answer

Use VPN connections between all VPCs and on-premises.

Answer

Use VPC peering between all VPCs and configure security groups.

Answer

Use Network Load Balancer to distribute traffic across VPCs.

Question 12

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access an S3 bucket. The company wants to ensure that traffic to S3 does not traverse the internet. Which solution should a network engineer implement?

Accepted Answer

Create a VPC gateway endpoint for S3 and add a route to the S3 prefix list via the endpoint.. Option B is correct. A VPC gateway endpoint for S3 allows private connectivity to S3 without internet. Option A is wrong because a NAT gateway still traverses the internet. Option C is wrong because a VPC interface endpoint for S3 is not supported (S3 uses gateway endpoints). Option D is wrong because an S3 VPN endpoint is not an AWS service.

Answer

Create a VPC interface endpoint for S3 and attach it to the private subnet.

Answer

Deploy an S3 VPN endpoint in the VPC.

Answer

Set up a NAT gateway in the public subnet and add a route to the S3 prefix list via the NAT gateway.

Question 13

A security team wants to block traffic from a specific IP address (203.0.113.5) from reaching an EC2 instance. The instance is in a public subnet with a security group that allows all traffic from the internet. A network ACL is associated with the subnet. The team adds a DENY rule for the IP in the network ACL. However, traffic from that IP still reaches the instance. What is the most likely reason?

Accepted Answer

The network ACL has an ALLOW rule with a lower rule number that matches the IP, so the DENY rule is never evaluated.. Option D is correct because network ACLs are stateless and require both inbound and outbound rules to allow return traffic. The DENY rule on inbound will block incoming traffic, but if the ACL also has an inbound ALLOW rule for the IP, the DENY rule might be evaluated after the ALLOW rule if the rule numbers are ordered incorrectly. However, the question states they added a DENY rule; if the ALLOW rule has a lower rule number, it will be evaluated first. Option A is wrong because security groups are stateful, but they do not override network ACLs. Option B is wrong because network ACLs apply to the subnet, not the instance. Option C is wrong because the internet gateway operates at layer 3 and does not filter by IP.

Answer

The security group allows traffic from the IP, overriding the network ACL.

Answer

The network ACL is applied to the wrong subnet.

Answer

The internet gateway is ignoring the network ACL.

Question 14

Which TWO scenarios are best suited for using AWS Transit Gateway over VPC peering? (Select TWO.)

Accepted Answer

Connecting hundreds of VPCs across multiple accounts. Options B and D are correct. Transit Gateway is ideal for many VPCs and for connecting VPCs with Direct Connect. Option A is wrong because one-to-one is simpler with peering. Option C is wrong because VPC peering can also be used for cross-account. Option E is wrong because a single VPC does not need Transit Gateway.

Answer

Connecting VPCs in different AWS accounts

Answer

Connecting a single VPC to an on-premises network

Answer

Connecting two VPCs in the same account and region

Question 15

A company has a VPC with a CIDR block of 10.0.0.0/16. The VPC has three subnets: 10.0.1.0/24, 10.0.2.0/24, and 10.0.3.0/24. An EC2 instance in subnet 10.0.1.0/24 needs to send traffic to an on-premises server at 10.0.0.5/32 via a VPN connection. The VPC route table has a route to the VPN gateway for 10.0.0.0/8. What is the expected behavior?

Accepted Answer

Traffic to 10.0.0.5 stays within the VPC.. Option C is correct because the VPC has a more specific route (10.0.0.0/16) for local traffic, which takes precedence over the VPN route (10.0.0.0/8) due to longest prefix match. Traffic from the EC2 instance to 10.0.0.5 is within the VPC CIDR, so it stays local.

Answer

Traffic to 10.0.0.5 is sent to the internet gateway.

Answer

Traffic to 10.0.0.5 is routed through the VPN gateway.

Answer

Traffic to 10.0.0.5 is dropped because there is no matching route.