ANS-C01 Practice Test 41 — 15 Questions

Question 1

A company is designing a multi-region architecture with VPCs in us-east-1 and eu-west-1. The company needs low-latency connectivity between the VPCs and wants to avoid traffic over the public internet. The VPCs have overlapping CIDR blocks (10.0.0.0/16). Which solution should the network engineer recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set up an AWS Transit Gateway in each region and connect them via Transit Gateway peering.. AWS Transit Gateway supports inter-region peering, which uses the AWS global backbone to provide low-latency, private connectivity between VPCs in different regions without traversing the public internet. This solution also handles overlapping CIDRs by using separate route tables per VPC attachment, ensuring isolation. Option B (Direct Connect) is used for on-premises connectivity, not inter-region. Option C (VPC peering) does not support overlapping CIDRs. Option D (single VPC) does not meet the multi-region requirement.

Answer

Use a Direct Connect connection between the regions.

Answer

Use VPC peering between the two VPCs.

Answer

Place all resources in a single VPC with multiple Availability Zones.

Question 2

A company has a VPC with an Application Load Balancer (ALB) in front of a fleet of EC2 instances. The security group for the EC2 instances must allow traffic only from the ALB. Which source should be specified in the security group inbound rule?

Accepted Answer

The ID of the ALB's security group. You can reference the ALB's security group ID as the source in the EC2 instances' security group inbound rule. This allows traffic from any network interface that is associated with the ALB's security group, regardless of the ALB's IP addresses or subnets. This is the recommended AWS best practice for controlling traffic between an ALB and its target instances, as it automatically adapts to changes in the ALB's underlying infrastructure.

Answer

The ALB's public IP address

Answer

The subnet CIDR block of the ALB's subnets

Answer

The VPC CIDR block

Question 3

A company is running a latency-sensitive application in a VPC with a public subnet and a private subnet. The application in the private subnet needs to access an Amazon S3 bucket in the same region. The company wants to minimize latency and avoid using a NAT gateway. Which solution meets these requirements?

Accepted Answer

Create a VPC Gateway Endpoint for Amazon S3 and update the route table for the private subnet. A VPC Gateway Endpoint for Amazon S3 allows instances in a private subnet to access S3 without traversing the internet or requiring a NAT gateway. This minimizes latency by routing traffic over the AWS internal network, and it avoids the cost and complexity of NAT devices. The route table for the private subnet must be updated with a route pointing to the gateway endpoint for the S3 prefix list.

Answer

Use S3 Transfer Acceleration and access the bucket via the public endpoint

Answer

Attach an Internet Gateway to the VPC and route the private subnet traffic through a NAT instance

Answer

Set up a NAT gateway in the public subnet and route traffic to the S3 bucket through it

Question 4

A company has a VPC with multiple subnets. They want to ensure that all outbound traffic from EC2 instances in the VPC goes through a centralized NAT device for inspection. They have deployed a NAT instance in a public subnet and configured the route tables for private subnets to point to the NAT instance. However, traffic is not being routed through the NAT instance. What is the most likely cause?

Accepted Answer

The source/destination check is enabled on the NAT instance.. The source/destination check is a security feature on EC2 instances that prevents them from forwarding traffic unless the instance is the source or destination of the packet. Since a NAT instance must forward traffic that it did not originate (e.g., from private instances to the internet), this check must be disabled. When enabled, the NAT instance drops packets that are not addressed to itself, breaking the routing of outbound traffic through it.

Answer

The NAT instance does not have a public IP address.

Answer

The route table for the private subnets does not have a default route (0.0.0.0/0) pointing to the NAT instance.

Answer

The security group of the NAT instance blocks outbound traffic.

Question 5

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. They need to add IPv6 support for their internet-facing Application Load Balancer. The VPC is already associated with an IPv6 CIDR block. What additional configuration is required? (Choose two.)

Accepted Answer

Add a route in the subnet's route table for ::/0 to the Internet Gateway.. Option B is correct because once the VPC has an IPv6 CIDR, the public subnet's route table must contain a route for ::/0 pointing to the Internet Gateway (igw-xxxxxxxx) to allow IPv6 traffic to and from the internet. Option C is correct because each subnet that will host IPv6 resources must itself be assigned an IPv6 CIDR block (a /64) from the VPC's IPv6 range; the VPC-level association alone does not give the subnet IPv6 capability. Option A is incorrect because NAT64/DNS64 is only needed for IPv4-only resources to reach IPv6 destinations, not for an internet-facing ALB that will have native IPv6. Option D is incorrect because you do not manually assign an IPv6 address to an ALB's network interface; the ALB is configured as dualstack and AWS manages its ENIs and addresses. Option E is incorrect because an Egress-Only Internet Gateway only permits outbound IPv6 traffic and does not support inbound internet-facing IPv6 connectivity required by a public ALB.

Answer

Configure NAT64 and DNS64 on the VPC.

Answer

Assign an IPv6 address to the ALB's network interface.

Answer

Create an Egress-Only Internet Gateway for the VPC.

Question 6

A company has multiple VPCs connected via AWS Transit Gateway. They need to inspect all inter-VPC traffic using a centralized firewall appliance. What is the most efficient way to achieve this?

Accepted Answer

Attach the firewall appliance to the Transit Gateway and configure Transit Gateway route tables to send traffic to the appliance. Attaching the firewall appliance to the Transit Gateway and configuring Transit Gateway route tables to send traffic to the appliance is the most efficient method because it allows the Transit Gateway to act as a central hub, directing all inter-VPC traffic through the firewall for inspection without requiring complex peering or per-VPC routing changes. This leverages the Transit Gateway's route table capabilities to create a single inspection point, minimizing latency and administrative overhead.

Answer

Enable VPC Flow Logs and analyze traffic patterns

Answer

Create VPC Gateway Endpoints for each VPC and route traffic through them

Answer

Use a Network Load Balancer to distribute traffic to the firewall appliance

Question 7

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16 and an IPv6 CIDR of 2001:db8:1234::/56. The company hosts a web application on IPv4-only EC2 instances in a private subnet. The application must be accessible from the internet via IPv6. The company has an internet-facing Application Load Balancer (ALB) with dual-stack IP address type. The ALB is in a public subnet. The target group is configured with IP address type IPv4. Users report that they can access the application via IPv4 but not via IPv6. The ALB security group allows inbound HTTP/HTTPS from ::/0. What is the MOST likely cause?

Accepted Answer

The public subnet does not have an associated IPv6 CIDR.. For an internet-facing dual-stack ALB to serve IPv6 traffic, the public subnet hosting the ALB must have an associated IPv6 CIDR block. Even though the VPC has an IPv6 CIDR (2001:db8:1234::/56), subnets do not automatically inherit IPv6 — each subnet must be explicitly assigned an IPv6 CIDR. Without an IPv6 CIDR on the public subnet, the ALB cannot obtain IPv6 addresses and cannot respond to IPv6 clients, even though its security group allows ::/0.

Answer

The target group is configured with IP address type IPv4, but the ALB must use IPv6 to communicate with the targets.

Answer

The ALB is configured as IPv4-only instead of dual-stack.

Answer

The private subnet's route table does not have an IPv6 route to the NAT gateway or egress-only internet gateway.

Question 8

An organization is using AWS Direct Connect with a private VIF to connect to a VPC. They want to extend connectivity to multiple VPCs in the same region without creating multiple private VIFs. Which solution should they implement?

Accepted Answer

Create a Direct Connect gateway and associate it with a Transit Gateway that is attached to the VPCs.. A Direct Connect gateway allows you to associate a single private VIF with multiple VPCs in the same region by connecting to a Transit Gateway. The Transit Gateway then acts as a hub, enabling transitive routing between all attached VPCs without needing separate VIFs. This solution scales efficiently and avoids the complexity of managing multiple private VIFs.

Answer

Create VPC peering connections from the VPC with the Direct Connect VIF to the other VPCs.

Answer

Provision separate private VIFs for each VPC.

Answer

Use a Transit VIF to connect directly to a Transit Gateway.

Question 9

A company wants to improve the performance and availability of its application that is deployed on EC2 instances in a single Availability Zone. Which architecture should the company implement?

Accepted Answer

Deploy EC2 instances in multiple Availability Zones. Deploying EC2 instances across multiple Availability Zones (AZs) improves both performance and availability by eliminating a single point of failure. If one AZ experiences an outage, traffic can be routed to healthy instances in another AZ using an Elastic Load Balancer or Route 53 DNS failover. This architecture also distributes the load, reducing latency for users in different geographic regions.

Answer

Add more subnets in the same Availability Zone

Answer

Use larger EC2 instances

Answer

Use Auto Scaling in the same Availability Zone

Question 10

A company wants to monitor network traffic between two VPCs connected via a Transit Gateway. Which THREE AWS services can be used to capture and analyze this traffic?

Accepted Answer

VPC Flow Logs. VPC Flow Logs (A) are correct because they capture IP traffic metadata (source/destination IP, ports, protocol, bytes, accept/reject) for ENIs in a VPC, so they can record traffic traversing the VPCs attached to the Transit Gateway. Transit Gateway Flow Logs (D) are correct because AWS specifically supports flow logs on the Transit Gateway attachment, capturing traffic that flows through the TGW between the connected VPCs. A third-party network monitoring appliance deployed in a VPC (C) is correct because a customer-managed instance (e.g., a firewall or IDS/IPS) placed inline or via mirroring can capture and deeply inspect packets between the VPCs. AWS Config (B) is not for traffic capture; it records resource configuration changes and compliance. AWS CloudTrail (E) logs API activity and management events, not network packet or flow data.

Answer

AWS Config

Answer

AWS CloudTrail

Question 11

A company has a VPC with a VPN connection to an on-premises network. The network team reports that the VPN tunnel is flapping intermittently. You need to identify the cause. Which AWS service provides logs that can help troubleshoot the VPN tunnel status?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the correct answer because AWS Site-to-Site VPN automatically publishes tunnel status metrics to CloudWatch, including TunnelState (which indicates whether each tunnel is UP or DOWN) and TunnelDataIn/TunnelDataOut. These metrics allow you to monitor the VPN connection's health and set alarms for flapping tunnels. CloudWatch Logs can also capture detailed VPN tunnel logs if logging is enabled on the VPN connection, providing granular troubleshooting data.

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Answer

AWS Health Dashboard

Question 12

A company has a VPC with multiple subnets. They want to block all traffic from the internet to their private subnets, but allow outbound internet traffic from those subnets through a NAT Gateway. Which configuration should they use?

Accepted Answer

Route table with 0.0.0.0/0 -> NAT Gateway. A route table associated with the private subnets should have a default route (0.0.0.0/0) pointing to the NAT Gateway. This allows outbound internet traffic while blocking inbound internet traffic. Option B (Virtual Private Gateway) is for VPN connections. Option C (VPC Peering) is for connectivity between VPCs. Option D (Internet Gateway) would allow inbound internet traffic, which is not desired.

Answer

Route table with 0.0.0.0/0 -> Virtual Private Gateway

Answer

Route table with 0.0.0.0/0 -> VPC Peering Connection

Answer

Route table with 0.0.0.0/0 -> Internet Gateway

Question 13

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download patches from an S3 bucket in the same AWS region. The company wants to ensure that traffic does not traverse the internet. Which solution is MOST cost-effective?

Accepted Answer

Create a Gateway VPC Endpoint for S3 and add a route in the private subnet's route table to the endpoint.. A Gateway VPC Endpoint for S3 creates a route-table target that lets instances in private subnets reach S3 using private IP addresses within the AWS network, never traversing the internet or a NAT gateway. It is the most cost-effective option because Gateway endpoints for S3 and DynamoDB are free (no hourly or data-processing charges), unlike Interface endpoints or NAT gateways. Adding the endpoint route to the private subnet's route table ensures traffic to S3 is directed through the endpoint.

Answer

Attach an Internet Gateway to the VPC and route the private subnet traffic directly to S3.

Answer

Create an Interface VPC Endpoint for S3 in the private subnet.

Answer

Deploy a NAT Gateway in a public subnet and route the private subnet traffic through it to access S3.

Question 14

A company has a VPC with a CIDR block of 192.168.0.0/16. They have two subnets: Subnet A (192.168.1.0/24) and Subnet B (192.168.2.0/24). They launch an EC2 instance in Subnet A and another EC2 instance in Subnet B. They want to ensure that both instances can communicate with each other. The instances are in the same VPC. What is the simplest way to enable communication between these instances?

Accepted Answer

No additional configuration is needed; instances in the same VPC can communicate by default. By default, all instances within the same VPC can communicate with each other using private IP addresses, regardless of which subnet they reside in. The VPC's implicit router enables this layer-3 connectivity as long as the subnets' route tables do not explicitly block traffic and the instances' security groups or network ACLs permit the traffic. Since both subnets are within the same VPC (192.168.0.0/16), no additional configuration is required for basic IP-level communication.

Answer

Create a VPC Peering connection between Subnet A and Subnet B

Answer

Create a NAT Gateway in each subnet

Answer

Attach an internet gateway to the VPC

Question 15

Which TWO of the following are valid methods to connect an on-premises network to an Amazon VPC? (Select TWO.)

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet for consistent latency and higher bandwidth. This is a valid method for connecting an on-premises network to a VPC, as it establishes a direct physical link that can be associated with a virtual interface to a VPC.

Answer

VPC peering connection

Answer

VPC endpoint

Answer

Internet Gateway