ANS-C01 Practice Test 40 — 15 Questions

Question 1

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team wants to ensure that traffic between VPCs is inspected by a centralized firewall appliance in a inspection VPC. Which architecture meets this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attach all VPCs to a Transit Gateway and create separate route tables for inspection.. Transit Gateway route tables can direct traffic between VPCs through a central inspection VPC by using route propagation and appropriate route table associations. Option A is wrong because VPC peering does not support transitive routing; traffic would need to traverse multiple non-transitive connections, and peering alone cannot force traffic through a centralized firewall. Option B is wrong because deploying AWS Network Firewall in each VPC does not centralize inspection; traffic between VPCs would flow directly unless routing forces it through the firewall, which is not described. Option D is wrong because AWS Direct Connect Gateway is used for connecting on-premises networks to AWS, not for routing traffic between VPCs through an inspection VPC.

Answer

Create VPC peering connections between all VPCs and route traffic through the inspection VPC.

Answer

Deploy AWS Network Firewall in each VPC and allow traffic to flow directly between VPCs.

Answer

Use AWS Direct Connect Gateway to route traffic between VPCs through the inspection VPC.

Question 2

A network engineer is troubleshooting high latency on a VPN connection between an on-premises network and AWS. The VPN uses two tunnels to a virtual private gateway. The engineer notices that traffic is only using one tunnel, and the other tunnel is idle. What should the engineer do to ensure both tunnels are utilized?

Accepted Answer

Create two separate site-to-site VPN connections to two different virtual private gateways and enable ECMP.. Creating two separate site-to-site VPN connections, each to a different virtual private gateway, and enabling ECMP (Equal Cost Multipath Routing) allows traffic to be load-balanced across both tunnels. AWS site-to-site VPN connections by default operate in active/passive mode, using only one tunnel at a time. To achieve active/active usage, you need multiple VPN connections with ECMP. Option B (BGP MED) is incorrect because MED influences path selection but cannot force both tunnels to be used simultaneously when the underlying VPN is active/passive. Option C (static routes with equal metrics) is incorrect because static routes do not enable ECMP for a single VPN connection; AWS still treats tunnels as active/passive. Option D (transit gateway with ECMP) is incorrect because while a transit gateway can use ECMP across multiple VPN connections, the original scenario describes a single VPN connection to a virtual private gateway, not a transit gateway.

Answer

Configure BGP MED values to prefer the idle tunnel.

Answer

Configure static routes with equal metrics on both tunnels.

Answer

Use a transit gateway with equal cost multipath routing.

Question 3

A company uses AWS Direct Connect with a private VIF and a virtual private gateway (VGW) to connect its on-premises data center to a VPC. The on-premises network uses BGP to advertise routes to AWS. The VPC has multiple subnets. The company wants to ensure that only traffic destined for the VPC CIDR (10.0.0.0/16) is sent over Direct Connect, and all other traffic uses the internet. However, after configuration, on-premises users can access the internet through the Direct Connect link, which is unintended. What change should be made to restrict traffic?

Accepted Answer

Configure the on-premises router to only accept the VPC CIDR route from AWS and not a default route.. The issue arises because AWS is advertising a default route (0.0.0.0/0) to the on-premises router over BGP via Direct Connect, causing on-premises users to use Direct Connect for internet traffic. To restrict traffic, the on-premises router should be configured to accept only the VPC CIDR (10.0.0.0/16) from AWS and reject any default route. Option C is correct. Option A is incorrect because adding a static route in the VPC route table does not affect BGP advertisements to on-premises. Option B is incorrect because disabling route propagation affects VPC subnet routing, not the BGP session. Option D is incorrect because removing the virtual private gateway would disconnect the VPC, not solve the issue.

Answer

Add a static route in the VPC route table to send all traffic to the internet gateway.

Answer

Disable route propagation for the private subnet route table.

Answer

Remove the virtual private gateway and use a VPN connection instead.

Question 4

A company is designing a hybrid network using AWS Direct Connect. The company has a single 1 Gbps dedicated connection and wants to connect to multiple VPCs in the same region. Which THREE steps are necessary to achieve this connectivity?

Accepted Answer

Create a Direct Connect gateway.. A Direct Connect gateway acts as a central hub that allows a single private virtual interface to connect to multiple VPCs in the same or different AWS regions. Without a Direct Connect gateway, a private virtual interface can only connect to a single VPC. By using a Direct Connect gateway, you can associate it with multiple VPCs (either directly or via a transit gateway), enabling the desired multi-VPC connectivity over the single 1 Gbps dedicated connection.

Answer

Create a private virtual interface for each VPC.

Answer

Create a public virtual interface for each VPC.

Question 5

A company has a VPC with an internet gateway and wants to restrict outbound traffic from a private subnet to only allow traffic to specific AWS services, such as S3 and DynamoDB. Which solution should be used?

Accepted Answer

Create VPC endpoints for S3 and DynamoDB, and attach a policy to the endpoints to restrict access.. VPC endpoints (Gateway endpoints for S3 and DynamoDB) allow private subnet instances to access these AWS services without traversing the internet, and endpoint policies can restrict access to specific services and actions. Option A is incorrect because security groups cannot filter by destination service; they filter by IP address, and AWS services use dynamic IP ranges. Option B is incorrect because a NAT gateway allows all outbound traffic to the internet, not just to specific services, and would not restrict to only S3 and DynamoDB. Option C is incorrect because an internet gateway would allow unrestricted outbound traffic to the internet, not just to specific AWS services.

Answer

Configure a security group on the instances in the private subnet to allow outbound traffic only to the IP ranges of the AWS services.

Answer

Use a NAT gateway in the public subnet and add a route to it in the private subnet.

Answer

Attach an internet gateway to the VPC and add a route to it in the private subnet.

Question 6

A company is deploying a new VPC with both public and private subnets. The public subnet hosts an internet-facing Application Load Balancer (ALB), and the private subnet hosts EC2 instances running a web application. The EC2 instances need to download updates from the internet, but they must not be directly accessible from the internet. Which combination of steps should a network engineer implement to meet these requirements?

Accepted Answer

Create a NAT Gateway in a public subnet, and add a default route (0.0.0.0/0) to the NAT Gateway in the private subnet's route table.. A NAT Gateway in a public subnet allows EC2 instances in private subnets to initiate outbound traffic to the internet (e.g., for updates) while preventing any unsolicited inbound connections from the internet. Adding a default route (0.0.0.0/0) to the NAT Gateway in the private subnet's route table directs all outbound internet traffic through the NAT Gateway, which translates the private IPs to the NAT Gateway's Elastic IP. This meets the requirement of internet access for downloads without direct internet accessibility.

Answer

Launch a proxy server in the public subnet and configure the private instances to use it for outbound traffic.

Answer

Set up a VPN connection to an on-premises network and route all internet traffic through the VPN.

Answer

Attach an Internet Gateway to the VPC and add a default route (0.0.0.0/0) to the Internet Gateway in the private subnet's route table.

Question 7

A company has a VPC with multiple subnets across Availability Zones. An application uses a Network Load Balancer (NLB) to distribute traffic to instances. The security team notices that traffic from a specific client IP is being dropped. The NLB access logs show the client IP, but the target instances do not receive the traffic. What is the most likely cause?

Accepted Answer

The target group health checks are failing, so the NLB is not sending traffic to those targets. If target group health checks fail, the NLB stops sending traffic to the unhealthy targets, even though the client IP is logged by the NLB. The traffic is dropped because NLB does not forward to unhealthy targets. Options B and C are incorrect because network ACLs or security groups would only affect traffic after NLB sends it, but health check failure prevents traffic from being sent at all. Option D is incorrect because NLB does not have security groups.

Answer

The target subnet network ACL blocks the client IP

Answer

The target instance security group does not allow traffic from the NLB

Answer

The NLB security group blocks the client IP

Question 8

A global e-commerce company operates a production environment on AWS with a VPC (10.0.0.0/16) containing public and private subnets in three Availability Zones. The application runs on EC2 instances in private subnets behind an Application Load Balancer (ALB) in public subnets. The company uses AWS Transit Gateway to connect multiple VPCs and on-premises data centers via Site-to-Site VPN. Recently, the operations team noticed intermittent connectivity issues: users in the Asia-Pacific region experience slow page load times and occasional timeouts, while users in other regions have no issues. The network team suspects packet loss or high latency on the VPN connection to the on-premises data center in Singapore, which hosts a critical database. The AWS Direct Connect connection is not yet available. The team ran a traceroute from an EC2 instance in the production VPC to the database server (IP 203.0.113.50) and observed high latency and packet loss on the fifth hop (a transit gateway attachment). The VPN tunnel status shows 'UP' on both ends. CloudWatch metrics for the VPN tunnel show no errors but high 'TunnelData' bytes. What should the network engineer do FIRST to resolve the issue?

Accepted Answer

Enable jumbo frames on the transit gateway and the EC2 instances in the private subnets.. Enabling jumbo frames on the transit gateway and EC2 instances allows larger MTU, reducing packet fragmentation and the associated packet loss and latency. The high 'TunnelData' bytes and packet loss on the attachment suggest MTU mismatch. Option B is incorrect because adding a second VPN tunnel with ECMP increases bandwidth but does not fix MTU issues. Option C is incorrect because Direct Connect is not available yet and the problem is not routing. Option D is incorrect because stronger encryption does not affect MTU.

Answer

Increase the VPN tunnel bandwidth by creating a second VPN tunnel and enabling ECMP.

Answer

Modify the BGP attributes on the transit gateway to prefer the Direct Connect path once it becomes available.

Answer

Rebuild the VPN connection using a different customer gateway device with stronger encryption.

Question 9

A financial services company has a multi-account AWS environment managed via AWS Organizations. The security team needs to enforce that all Amazon S3 buckets across the organization are encrypted with AWS KMS using a specific customer managed key (CMK) from the security account. Currently, some accounts have S3 buckets with SSE-S3 encryption or no encryption. The security team must not be able to read the data in the buckets, but must be able to detect and remediate non-compliant buckets. The solution must use AWS native services and minimize operational overhead. Which combination of actions should the security team take?

Accepted Answer

Create an AWS Config rule in the security account with an organization conformance pack to check bucket encryption settings, and use an automatic remediation action with AWS Systems Manager Automation to apply the required KMS key.. AWS Config organization conformance packs allow centralized definition of a custom rule to check S3 bucket encryption settings across all accounts. Automatic remediation via Systems Manager Automation can apply the required KMS key to non-compliant buckets without granting the security team data access. Option A is incorrect because it requires per-account AWS Config setup and custom Lambda rules, increasing operational overhead and lacking centralized enforcement. Option B is incorrect because SCPs cannot enforce encryption settings on existing buckets and only apply to IAM principals, not to S3 service actions like bucket configuration; they also cannot detect or remediate non-compliant configurations. Option D is incorrect because CloudTrail trails only log API calls and cannot proactively detect existing bucket encryption settings; metric filters are reactive and not suitable for continuous compliance monitoring.

Answer

Enable AWS Config in each member account individually and create a custom rule using AWS Lambda to check bucket encryption, then send compliance results to the security account via Amazon EventBridge.

Answer

Use a service control policy (SCP) to deny s3:PutObject unless the request includes a specific KMS key ID.

Answer

Enable AWS CloudTrail in the security account and create a metric filter to detect PutBucketEncryption API calls, then trigger a Lambda function to remediate.

Question 10

A company is using AWS Shield Advanced to protect against DDoS attacks. The security team wants to receive notifications when an attack is detected. Which service should be used to send these notifications?

Accepted Answer

Amazon SNS. AWS Shield Advanced integrates with Amazon CloudWatch to publish metrics and events. These events can be routed via Amazon EventBridge to trigger an Amazon SNS topic, which then sends notifications (e.g., email, SMS) to the security team. Option A (AWS Lambda) is a compute service, not a notification service. Option B (AWS Config) is used for configuration auditing and compliance, not notifications. Option C (Amazon SQS) is a message queue service; although it can receive events, it is not the service used to send direct notifications to subscribers. Only Amazon SNS (Option D) provides push-based notifications to endpoints like email, SMS, and mobile devices.

Answer

AWS Lambda

Answer

AWS Config

Answer

Amazon SQS

Question 11

A network engineer is analyzing VPC Flow Logs and notices that some rejected traffic is not logged. Which THREE conditions could cause this?

Accepted Answer

The Flow Logs capture only accepted traffic due to the filter.. Correct options are C, D, and E. Option C: If the Flow Logs are configured to capture only accepted traffic (filter: ACCEPT), then rejected traffic is not logged. Option D: Flow Logs are per network interface; if the traffic does not traverse the monitored interface, it won't be logged. Option E: Security groups operate at the instance level; if a security group blocks traffic before it reaches the network interface, the flow log for that interface will not capture the rejected traffic. Options A and B are incorrect because network ACLs operate at the subnet level and their deny actions are logged by Flow Logs if the traffic reaches the subnet; destination network rejection is also logged as 'REJECT' in the flow log record.

Answer

The traffic is blocked by a network ACL.

Answer

The traffic is rejected by the destination network.

Question 12

A company has a VPC with CIDR 10.0.0.0/16. They have public subnets (10.0.1.0/24, 10.0.2.0/24) and private subnets (10.0.3.0/24, 10.0.4.0/24) in two Availability Zones. An Internet Gateway is attached to the VPC, and a NAT Gateway is in public subnet 10.0.1.0/24. The private subnets route 0.0.0.0/0 to the NAT Gateway. The security team notices that instances in private subnet 10.0.3.0/24 can reach the internet, but instances in private subnet 10.0.4.0/24 cannot. Both private subnets have the same route table configuration. The network ACLs for both private subnets are set to allow all inbound and outbound traffic. What is the most likely cause of the issue?

Accepted Answer

The route table for the public subnet 10.0.1.0/24 does not have a route to the Internet Gateway.. The NAT Gateway is in the public subnet 10.0.1.0/24. For the NAT Gateway to reach the internet, the route table associated with that public subnet must have a default route (0.0.0.0/0) pointing to the Internet Gateway. Without this route, the NAT Gateway cannot forward traffic from private subnets to the internet. Since both private subnets have the same route table configuration pointing to the NAT Gateway, the issue is isolated to the NAT Gateway's inability to reach the internet due to the missing route in the public subnet's route table. Options B, C, and D are incorrect: security groups and network ACLs are configured to allow traffic, and the private subnet route tables are correctly set to route to the NAT Gateway.

Answer

The security group on the instances in private subnet 10.0.4.0/24 is blocking outbound traffic.

Answer

The network ACL for private subnet 10.0.4.0/24 is blocking outbound traffic.

Answer

The route table for private subnet 10.0.4.0/24 does not have a route to the NAT Gateway.

Question 13

A company is designing a network for a three-tier application that must be PCI DSS compliant. The web tier must be accessible from the internet, the application tier must only be accessible from the web tier, and the database tier must only be accessible from the application tier. All tiers are in the same VPC. What is the MOST secure way to implement this?

Accepted Answer

Place web tier in public subnets, application and database tiers in private subnets. Use security groups to allow only necessary traffic between tiers.. The most secure because it places the web tier in public subnets (for internet access) and the application and database tiers in private subnets (no direct internet access). Security groups are used to allow only the necessary traffic between tiers: from web to app on specific ports, and from app to db on specific ports. Security groups are stateful, which simplifies rule management and reduces attack surface. Option A is wrong because a VPN is unnecessary for intra-VPC traffic and adds complexity without improving security. Option B is wrong because placing all tiers in the same private subnet does not provide network isolation between tiers; security groups alone cannot prevent all lateral movement. Option D is wrong because placing all tiers in public subnets exposes the application and database tiers to the internet, and network ACLs are stateless, requiring symmetric rules and increasing management overhead.

Answer

Use a VPN between the web and application tiers and between application and database tiers.

Answer

Place all tiers in the same private subnet and use security groups for isolation.

Answer

Place all tiers in public subnets and use network ACLs to restrict traffic.

Question 14

A company wants to block outgoing traffic from a specific EC2 instance to the internet, except for HTTPS traffic to a specific API endpoint. Which AWS service can enforce this at the instance level?

Accepted Answer

AWS Network Firewall. AWS Network Firewall can be deployed in the VPC to filter outbound traffic based on domain names. Option A (AWS WAF) is wrong because it works at the application layer for inbound web traffic and does not block outbound traffic at the instance level. Option B (Network ACL) is wrong because NACLs are stateless and work at the subnet level. Option C (Security group with outbound rules) is wrong because security groups do not support allowlisting based on domain names.

Answer

AWS WAF

Answer

Network ACL

Answer

Security group with outbound rules

Question 15

A company is using AWS Transit Gateway to connect multiple VPCs and an on-premises network via Direct Connect. They notice that traffic between VPCs is being dropped intermittently. Which TWO actions should the engineer take to diagnose the issue? (Choose two.)

Accepted Answer

Monitor the Transit Gateway's CloudWatch metrics for packets dropped due to route table limits. Monitoring Transit Gateway CloudWatch metrics for dropped packets can identify route table limits or throttling issues. Option C is correct because enabling VPC Flow Logs helps analyze traffic patterns and identify dropped packets. Option B is incorrect because security groups do not apply to Transit Gateway; they apply to ENIs. Option D is incorrect because overlapping VPC CIDRs can be handled with proper routing and do not cause intermittent drops by themselves. Option E is incorrect because creating a VPN connection is a solution, not a diagnostic step.

Answer

Review the security group rules on the Transit Gateway

Answer

Check if the VPC CIDRs are overlapping

Answer

Create a VPN connection for backup