ANS-C01 Practice Test 41 — 15 Questions

Question 1

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. The on-premises network team reports that they can ping the VPC's private IP addresses, but they cannot reach an internet-facing application hosted on an EC2 instance in a public subnet. The EC2 instance has a public IP and a security group allowing HTTP/HTTPS from 0.0.0.0/0. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The private VIF does not route traffic to public IP addresses; the on-premises traffic to the public IP must traverse the internet.. The issue is that the private VIF (private virtual interface) is designed to route traffic only between private IP addresses, not public IP addresses. Even though the EC2 instance has a public IP and the security group allows HTTP/HTTPS from anywhere, traffic from on-premises destined for the public IP of the EC2 instance will not traverse the Direct Connect private VIF because the private VIF does not route public IP traffic. Instead, that traffic would need to go over the internet. Therefore, the most likely cause is that the private VIF does not route traffic to public IP addresses, as stated in option D. Option A is incorrect because the route table in the public subnet can have a default route to an internet gateway; that is not the issue. Option B is incorrect because the security group allows all inbound HTTP/HTTPS. Option C is incorrect because BGP exchanges routes for prefixes advertised over the VIF, but even if routes were exchanged, the private VIF would not route public IP traffic.

Answer

The route table in the public subnet does not have a default route to an internet gateway.

Answer

The security group is blocking traffic from the on-premises IP range.

Answer

The BGP session is not exchanging routes for the public IP range.

Question 2

An administrator needs to create an interface VPC endpoint for Amazon S3 in a VPC and attach an elastic network interface (ENI) to an EC2 instance. The administrator applies the IAM policy shown in the exhibit. Which action will be DENIED by this policy?

Accepted Answer

Create the VPC endpoint. The IAM policy allows ec2:CreateVpcEndpoint, but the Resource is set to "*" which does not satisfy the resource requirement for this action. The ec2:CreateVpcEndpoint action requires the resource to be the VPC endpoint service (e.g., arn:aws:ec2:region:account-id:vpc-endpoint-service/*). Without a specific resource ARN, the policy does not grant permission to create the endpoint, so the action will be denied. In contrast, ec2:AttachNetworkInterface, ec2:DescribeVpcEndpoints, and ec2:ModifyVpcEndpoint are allowed by the policy with the wildcard resource.

Answer

Attach the ENI to the EC2 instance

Answer

Describe VPC endpoints

Answer

Modify the VPC endpoint

Question 3

A company is designing a network architecture for a multi-tier web application. The application consists of web servers, application servers, and database servers. The web servers must be accessible from the internet. The application servers should only be accessible from the web servers. The database servers should only be accessible from the application servers. Which TWO actions should the company take to meet these requirements? (Choose two.)

Accepted Answer

Place the web servers in a public subnet and the application and database servers in private subnets. The correct answers are C and D. Option C: Placing web servers in a public subnet (with an internet gateway) enables internet access, while placing application and database servers in private subnets prevents direct internet access, ensuring they are only reachable from within the VPC. Option D: Security groups act as stateful firewalls at the instance level, allowing fine-grained control over traffic between tiers (e.g., allowing only HTTP from web to app servers, and only database port from app to database servers). Option A is incorrect because a NAT gateway provides outbound internet access for private instances, not inbound access for web servers. Option B is incorrect because network ACLs are stateless and less granular; while they can restrict traffic between subnets, security groups are the recommended approach for tier-to-tier access control. Option E is incorrect because placing all servers in public subnets exposes application and database servers to the internet unnecessarily, increasing security risk.

Answer

Use a NAT gateway to allow the web servers to access the internet

Answer

Use network ACLs to restrict traffic between the tiers

Answer

Place all servers in public subnets and use security groups to restrict traffic

Question 4

An application running on EC2 instances in a VPC needs to access an Amazon S3 bucket to read configuration files. The VPC has an S3 VPC endpoint configured. The instances are in a private subnet and have a security group that allows all outbound traffic. The bucket policy allows access from the VPC endpoint. However, the application fails to access the S3 bucket. What is the most likely cause?

Accepted Answer

The VPC endpoint's route table does not include the subnet's route table, so traffic to S3 is not routed through the endpoint.. The most likely cause is that the VPC endpoint's route table does not include the subnet's route table, meaning traffic from the private subnet to S3 is not routed through the endpoint. Option B is correct because if the subnet's route table lacks a route for the S3 prefix list pointing to the VPC endpoint, traffic will go via a NAT gateway or internet gateway (if configured) or fail if no such connectivity exists. Option A is incorrect because network ACLs are not mentioned and typically allow outbound HTTPS. Option C is incorrect since the security group allows all outbound traffic. Option D is incorrect because the bucket policy already permits access from the VPC endpoint.

Answer

The network ACL for the private subnet is blocking outbound HTTPS traffic.

Answer

The security group for the EC2 instances has an outbound rule that blocks HTTPS traffic to S3.

Answer

The S3 bucket policy does not grant access to the VPC endpoint's ID.

Question 5

A company needs to ensure that all outbound internet traffic from a VPC goes through a centralized inspection appliance. The VPC has multiple subnets. Which THREE steps are required to implement this?

Accepted Answer

Configure security groups to allow outbound traffic from the instances. To ensure all outbound internet traffic goes through a centralized inspection appliance, the required steps are: configure security groups to allow outbound traffic (Option A) and launch a NAT gateway in a public subnet with an Elastic IP (Option B) to provide outbound connectivity. The third step, which is not listed among the options, is to route private subnet traffic to the inspection appliance rather than directly to the NAT gateway. Option E is incorrect because routing 0.0.0.0/0 to a NAT gateway would bypass the inspection appliance, failing the requirement.

Answer

Attach an Internet Gateway to the VPC and route all traffic to it

Answer

Create VPC endpoints for all required AWS services

Answer

Configure route tables in each private subnet to send 0.0.0.0/0 traffic to a NAT gateway in a public subnet

Question 6

A security engineer needs to audit all changes to security group rules in an AWS account. Which AWS service should be used to record these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls, including changes to security group rules. Option A (VPC Flow Logs) is wrong because it captures network traffic, not API calls. Option C (AWS Config) is wrong because it records configuration changes, but not the API call history. Option D (Amazon CloudWatch Logs) is wrong because it is used for log storage and monitoring, not for recording API calls.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 7

A company needs to audit network traffic in a VPC for compliance. Which THREE AWS services can be used to capture and analyze network traffic?

Accepted Answer

Traffic Mirroring. Traffic Mirroring captures and inspects traffic. Option C is correct because VPC Flow Logs capture IP traffic information. Option D is correct because AWS Network Firewall can log traffic. Option A is wrong because AWS Config monitors resource configurations, not traffic. Option E is wrong because CloudTrail logs API calls, not network traffic.

Answer

AWS Config

Answer

AWS CloudTrail

Question 8

A company has a hybrid network with multiple VPCs connected via AWS Transit Gateway and an on-premises network via Direct Connect. The network team is planning to migrate a legacy application from on-premises to a new VPC. The application requires low-latency access to an RDS database running in an existing VPC. The team wants to minimize changes to the existing routing. What should the team do to meet these requirements?

Accepted Answer

Attach the new VPC to the existing transit gateway and ensure the transit gateway route tables permit traffic between the new VPC and the RDS VPC.. Attaching the new VPC to the existing transit gateway allows immediate connectivity to the RDS VPC without changing existing routes, provided the transit gateway route tables are configured correctly. Option B is wrong because routing traffic through on-premises adds unnecessary latency and complexity. Option C is wrong because VPC peering requires route table updates in both VPCs, which contradicts the requirement to minimize routing changes. Option D is wrong because migrating the RDS database would change the database endpoint and potentially cause downtime, and does not leverage the existing transit gateway.

Answer

Set up a VPN connection from the new VPC to the on-premises network, and route traffic through on-premises to the RDS VPC.

Answer

Create a VPC peering connection between the new VPC and the RDS VPC.

Answer

Migrate the RDS database to the new VPC to keep the application and database in the same VPC.

Question 9

A company has a VPC with public and private subnets. The private subnets need to access the internet through a NAT Gateway. The security team wants to ensure that traffic from the private subnets to the internet is logged and inspected for malicious activity. Which solution meets these requirements?

Accepted Answer

Configure VPC Traffic Mirroring from the private subnet instances to a network security appliance (e.g., partner firewall) for deep packet inspection.. VPC Traffic Mirroring allows you to capture and mirror all traffic from the elastic network interfaces (ENIs) of instances in private subnets to a network security appliance (e.g., partner firewall) for deep packet inspection and logging. This meets the requirement for inspecting traffic for malicious activity. Option A is incorrect because AWS Shield Advanced provides DDoS protection but does not provide deep packet inspection or logging of all traffic. Option B is incorrect because AWS WAF is a web application firewall that inspects HTTP/HTTPS traffic at the application layer, not network-level traffic from private subnets. Option C is incorrect because VPC Flow Logs only capture metadata (IP addresses, ports, protocols) and do not inspect packet payloads for malicious activity.

Answer

Use AWS Shield Advanced to inspect traffic and detect malicious activity.

Answer

Deploy AWS WAF on the NAT Gateway to inspect and filter outgoing traffic.

Answer

Enable VPC Flow Logs on the NAT Gateway and analyze the logs with Amazon Detective.

Question 10

A company has a VPC with an AWS Direct Connect private VIF connected to a virtual private gateway. The on-premises network uses BGP to advertise routes to AWS. The network team wants to ensure that only specific prefixes from on-premises are accepted. They configure the virtual private gateway with a BGP community. However, after configuration, they notice that all prefixes are still being accepted. What is the MOST likely reason?

Accepted Answer

The virtual private gateway does not filter routes based on BGP communities; you need to use a prefix list.. BGP communities are tags that can be applied to routes, but the virtual private gateway (VPG) does not filter routes based on BGP communities. To filter which prefixes are accepted, you must use a prefix list or route table filtering. Therefore, simply configuring a BGP community on the VPG will not prevent all prefixes from being accepted; you need to explicitly filter using a prefix list. Option B is correct. Option A is not needed because BGP communities are already supported. Option C is not the most likely reason because even if the community is advertised, the VPG won't filter based on it. Option D is false because the community can be configured on either side, but filtering still requires a prefix list.

Answer

The virtual private gateway needs to have the BGP community enabled.

Answer

The BGP community is not being advertised by the on-premises router.

Answer

The BGP community must be configured on the customer gateway device.

Question 11

A company has a hybrid network with an AWS Direct Connect connection and an AWS Site-to-Site VPN as a backup. The network team notices that traffic is asymmetrically routing through both connections, causing performance issues. Which TWO steps should the team take to ensure traffic uses the primary Direct Connect and only fails over to the VPN? (Choose two.)

Accepted Answer

Configure BGP communities on the Direct Connect to influence route preference.. BGP communities can be used on the Direct Connect connection to set a higher local preference, making the routes learned via Direct Connect preferred over those from the VPN. Option E is correct: Advertising a more specific prefix over Direct Connect ensures that traffic selects the more specific route, preferring Direct Connect. Option A is incorrect because increasing BGP MED on the VPN would make VPN less preferred, but this is not as effective or reliable as using BGP communities or more specific prefixes for ensuring primary use. Option B is incorrect because AWS VPN CloudHub is designed for interconnecting multiple VPN sites, not for failover from Direct Connect to VPN. Option D is incorrect because disabling AS path prepend on Direct Connect would actually make Direct Connect more preferred (shorter AS path), but this is not a recommended step to ensure primary use; it may also disrupt existing routing policies. The best practice is to use BGP communities and specific prefix advertisements to achieve the desired traffic flow.

Answer

Increase the BGP MED value on the VPN connection to make it less preferred.

Answer

Enable VPN automatic failover using AWS VPN CloudHub.

Answer

Disable AS path prepend on the Direct Connect BGP session.

Question 12

A financial services company is deploying a multi-account environment using AWS Organizations. The security team requires that all network traffic to and from the internet must flow through a centralized inspection VPC that hosts third-party firewall appliances. The architecture uses a single AWS Transit Gateway with a centralized inspection VPC attached. Which THREE steps are necessary to enforce this architecture? (Choose THREE.)

Accepted Answer

Configure each VPC's route table with a default route (0.0.0.0/0) pointing to the transit gateway attachment.. Spoke VPCs need a default route (0.0.0.0/0) pointing to the transit gateway attachment to send internet-bound traffic to the inspection VPC. Option D is correct: in the inspection VPC, traffic from the transit gateway must be routed to the firewall appliances, inspected, and then sent back to the transit gateway for egress to the internet. Option E is correct: separate transit gateway route tables for the inspection VPC and spoke VPCs are required, with appropriate propagation and static routes to enforce traffic flow through the inspection VPC. Option B is incorrect because service control policies (SCPs) can be used to restrict actions in AWS Organizations but do not directly enforce routing; routing is handled via route tables. Option C is incorrect because VPC Gateway Endpoints for S3 and DynamoDB do not affect internet traffic routing; they provide private access to those services.

Answer

Use AWS Organizations service control policies to prevent direct internet access from spoke VPCs.

Answer

Deploy VPC Gateway Endpoints for S3 and DynamoDB in each spoke VPC.

Question 13

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. The network team needs to monitor the BGP session status for each VPN attachment. Which TWO services can be used to monitor BGP status and receive alerts if a session goes down?

Accepted Answer

Amazon CloudWatch Alarms on the BGP status metric.. Amazon CloudWatch provides metrics for VPN tunnels, including the BGP status metric (e.g., TunnelState, BGPStatus). CloudWatch Alarms can be set on this metric to trigger notifications if the BGP session goes down. Option A is correct because CloudWatch Alarms on the BGP status metric directly monitor and alert on BGP session state. Option E is correct because CloudWatch metrics for VPN tunnels include BGP status data. Option B (AWS Config) is incorrect because AWS Config is used for resource compliance and configuration changes, not real-time monitoring of BGP sessions. Option C (VPC Flow Logs) is incorrect because VPC Flow Logs capture IP traffic information, not BGP routing protocol status. Option D (AWS CloudTrail) is incorrect because CloudTrail logs API calls, not BGP session state.

Answer

AWS Config rules.

Answer

VPC Flow Logs.

Answer

AWS CloudTrail logs.

Question 14

A company has a hybrid network architecture with an AWS Direct Connect connection between its on-premises data center and an Amazon VPC. The VPC has a single private subnet with Amazon EC2 instances running a critical application. The on-premises network uses BGP to advertise a route for the VPC's CIDR (10.0.0.0/16) to the on-premises routers. Recently, the company added a new application in a second VPC (VPC-B) with CIDR 10.1.0.0/16 and peered it with the original VPC (VPC-A). After the peering, users on-premises can still reach resources in VPC-A, but cannot reach resources in VPC-B. The VPC-A route table has a route for VPC-B's CIDR pointing to the peering connection. The VPC-B route table has a route for VPC-A's CIDR pointing to the peering connection. The on-premises routers have a static route for VPC-B's CIDR pointing to the Direct Connect virtual interface. What is the most likely cause of the issue?

Accepted Answer

The on-premises network is not advertising VPC-B's CIDR to the VPC via BGP, so VPC-B does not have a route back to on-premises.. The on-premises network is not advertising VPC-B's CIDR via BGP over Direct Connect. While the on-premises routers have a static route for VPC-B's CIDR pointing to the Direct Connect virtual interface, this only directs traffic from on-premises to VPC-B. For return traffic from VPC-B to on-premises, VPC-B needs a route to the on-premises network. Normally, this route would be learned via BGP over Direct Connect if the on-premises network advertised the VPC-B CIDR to the VPC. Without that advertisement, VPC-B does not have a route back to on-premises, causing the connectivity failure. Option A is incorrect because the VPC peering connection is working: VPC-A and VPC-B can communicate, as the issue is only with on-premises reachability. Option C is incorrect because security groups are stateful; if traffic from on-premises reached VPC-B, the return traffic would be automatically allowed. The issue is routing, not security. Option D is incorrect because route propagation for the virtual private gateway only affects VPC-A (if it is attached to the VGW), not VPC-B, which is connected via peering.

Answer

The VPC peering connection is not properly configured.

Answer

The security group on VPC-B instances is blocking inbound traffic from on-premises IP ranges.

Answer

The virtual private gateway does not have route propagation enabled for VPC-B.

Question 15

A company runs a multi-tier application on AWS. The web tier consists of EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application tier runs on EC2 instances in a separate Auto Scaling group, and the database tier uses an Amazon RDS MySQL instance. All resources are in the same VPC. The security team has identified that the application tier instances are receiving traffic from unknown IP addresses on port 22 (SSH). The team wants to ensure that only the web tier instances can communicate with the application tier on the application port (8080), and only from a specific security group. Additionally, the database tier should only accept traffic from the application tier on port 3306. Currently, the security groups are configured as follows: Web-SG allows inbound from 0.0.0.0/0 on ports 80 and 443; App-SG allows inbound from 0.0.0.0/0 on port 8080 and from 0.0.0.0/0 on port 22; DB-SG allows inbound from 0.0.0.0/0 on port 3306. The team has also noticed that the web tier instances can be accessed via SSH from the internet. Which course of action should the team take to remediate the security issues?

Accepted Answer

Update Web-SG to allow SSH from a specific management CIDR. Update App-SG to allow inbound on port 8080 from Web-SG only, and remove inbound SSH from App-SG (or restrict to management CIDR). Update DB-SG to allow inbound on port 3306 from App-SG only.. This option comprehensively addresses the security issues: restrict SSH access to the web tier from a trusted management CIDR, limit application tier access (port 8080) to only the web tier security group, and restrict database access (port 3306) to only the application tier security group. Additionally, it removes the overly permissive SSH rule on the application tier or restricts it to a management CIDR. Option A is insufficient because it leaves App-SG and DB-SG open to the internet on their respective ports. Option B removes SSH entirely, which may be needed for management, and does not address application traffic restrictions between tiers. Option D suggests using network ACLs, which are stateless and more complex; security groups are stateful and more appropriate for this use case.

Answer

Update Web-SG to allow SSH from a specific management CIDR. Leave App-SG and DB-SG as is because they are not directly accessible from the internet.

Answer

Remove inbound SSH rules from all security groups and rely on AWS Systems Manager Session Manager for administrative access.

Answer

Use network ACLs on the subnets to restrict traffic between tiers instead of security groups.