ANS-C01 Practice Test 42 — 15 Questions

Question 1

A company has a VPC with public and private subnets. They have a web server in the public subnet that needs to make API calls to Amazon S3. The web server has a public IP. What is the MOST secure way to allow the web server to access S3 without traversing the internet?

Accepted Answer

Create a Gateway VPC Endpoint for S3 and add a route in the public subnet's route table to S3 via the endpoint. Option C is correct because a Gateway VPC Endpoint for S3 allows private access to S3 without internet traffic, and it is free and highly available. Option A is wrong because a NAT Gateway is used for outbound internet access, but it still uses the internet. Option B is wrong because an Interface VPC Endpoint for S3 is also private but more expensive than Gateway Endpoint. Option D is wrong because a proxy server adds complexity and is not the most secure or simple solution.

Answer

Place a forward proxy server in the public subnet and configure the web server to use it for S3

Answer

Create an Interface VPC Endpoint for S3 in the public subnet

Answer

Set up a NAT Gateway in the same subnet and route S3 traffic through it

Question 2

A company is designing a multi-region architecture with an Application Load Balancer (ALB) in each region. They need to route traffic to the closest healthy endpoint. Which AWS service should be used for global load balancing?

Accepted Answer

Use AWS Global Accelerator with an endpoint group in each region.. AWS Global Accelerator provides static IP addresses and routes traffic to the closest healthy endpoint, improving performance and availability. Option A is wrong because an ALB is regional. Option B is wrong because a Network Load Balancer is also regional. Option C is wrong because Route 53 with latency routing is a DNS-based approach, not as efficient as Global Accelerator for traffic optimization.

Answer

Use a single Application Load Balancer in one region with cross-region VPC peering.

Answer

Use Route 53 latency-based routing with health checks.

Answer

Use a Network Load Balancer in each region and Route 53 weighted routing.

Question 3

A company is running a web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application needs to store session state in an ElastiCache Redis cluster. The Redis cluster should not be accessible from the internet. Which network design should be used?

Accepted Answer

Place both the EC2 instances and the Redis cluster in private subnets with appropriate security groups.. The Redis cluster should be in a private subnet to prevent internet access. The ALB is typically in a public subnet or a private subnet with an internet-facing ALB. The EC2 instances should be in a private subnet and access Redis via the private subnet. Option A is wrong because a public subnet would expose Redis. Option B is wrong because placing Redis in a public subnet exposes it. Option C is wrong because a NAT Gateway is not needed for private subnet communication within the VPC.

Answer

Place the Redis cluster in a public subnet and restrict access via security group.

Answer

Place the Redis cluster in a private subnet and the EC2 instances in a private subnet, with a NAT Gateway for outbound traffic.

Answer

Place the Redis cluster in a private subnet and the EC2 instances in a public subnet.

Question 4

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. They need to add an additional non-overlapping CIDR to the VPC. What is a valid CIDR block they can add?

Accepted Answer

10.1.0.0/16. Option C is correct because 10.1.0.0/16 does not overlap with 10.0.0.0/16. Option A is wrong because 10.0.0.0/8 is a superset and overlaps. Option B is wrong because 10.0.0.0/16 is the same CIDR. Option D is wrong because 10.0.1.0/24 is within 10.0.0.0/16 and overlaps.

Answer

10.0.1.0/24

Answer

10.0.0.0/8

Answer

10.0.0.0/16

Question 5

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download software patches from the internet. Which AWS service should be used to provide outbound internet access without allowing inbound traffic?

Accepted Answer

NAT gateway. Option A is correct because a NAT gateway allows outbound internet traffic from private subnets and blocks unsolicited inbound traffic. Option B is wrong because an internet gateway is for public subnets and allows inbound traffic. Option C is wrong because a VPC endpoint is for accessing AWS services privately, not the internet. Option D is wrong because a VPN connection is for hybrid connectivity, not internet access.

Answer

Site-to-Site VPN connection

Answer

VPC endpoint

Answer

Internet gateway

Question 6

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks via Direct Connect and Site-to-Site VPN. The network team wants to ensure that traffic between VPCs does not traverse the on-premises network. Which Transit Gateway feature should be used?

Accepted Answer

Transit Gateway route tables with separate associations and propagations. Option B is correct because Transit Gateway route tables allow isolation of traffic between different attachments (e.g., VPCs vs. VPN). Option A is wrong because multicast is not relevant. Option C is wrong because flow logs monitor traffic, not control routing. Option D is wrong because BGP is used for dynamic routing, not for isolation.

Answer

Transit Gateway Multicast

Answer

Transit Gateway Network Manager

Answer

Transit Gateway BGP over AWS Direct Connect

Question 7

Refer to the exhibit. A CloudFormation template creates a VPC with public and private subnets. The template includes an Internet Gateway and a route table with a default route to the IGW, associated with the public subnet. An EC2 instance launched in the public subnet cannot be reached from the internet. The security group allows inbound HTTP from 0.0.0.0/0. What is the MOST likely missing resource?

Accepted Answer

An Elastic IP address assigned to the instance or auto-assign public IP enabled on the subnet. Option C is correct because the template does not define a route table or route for the private subnet. However, the instance is in the public subnet, so the issue is that the public subnet might not have the route table associated. But looking at the template, it has PublicSubnetRouteTableAssociation. The missing piece is that the instance likely needs an Elastic IP or auto-assign public IP. Option A is not needed for public subnets with IGW. Option B is not needed for public subnets. Option D is not needed because the instance is in a public subnet.

Answer

A VPN connection to the VPC

Answer

A NAT Gateway in the public subnet

Answer

A route table for the private subnet

Question 8

A network engineer needs to allow an EC2 instance in a private subnet to access an S3 bucket without traversing the internet. Which AWS service should be used?

Accepted Answer

VPC Gateway Endpoint. A VPC Gateway Endpoint provides private connectivity to S3 and DynamoDB without requiring a NAT or IGW.

Answer

VPC Peering

Answer

Internet Gateway

Answer

NAT Gateway

Question 9

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. They have a VPC with a subnet that hosts a web application. They need to ensure that traffic from the on-premises network to the web application does not traverse the internet. Which TWO components are required? (Select TWO.)

Accepted Answer

Direct Connect Gateway associated with the Transit Gateway. To connect on-premises to a VPC via Transit Gateway without internet, you need a Direct Connect private VIF attached to a Direct Connect Gateway, and the Direct Connect Gateway must be associated with the Transit Gateway. Option A (VPN) would go over the internet; Option C (Internet Gateway) is internet; Option D (VPC Peering) is not for on-premises; Option E (CloudFront) is a CDN.

Answer

Internet Gateway attached to the VPC

Answer

Site-to-Site VPN connection to the Transit Gateway

Answer

CloudFront distribution in front of the web application

Question 10

A company has deployed a VPC with a public subnet and a private subnet in each of two Availability Zones. They have an Application Load Balancer (ALB) in the public subnets and EC2 instances in the private subnets. The EC2 instances need to access an external API over HTTPS. What is the MOST secure way to provide this access?

Accepted Answer

Deploy a NAT Gateway in each public subnet and add a default route in the private subnet route tables pointing to the NAT Gateway.. A NAT Gateway in a public subnet allows outbound HTTPS traffic from private instances while preventing inbound traffic. Option A is wrong because a public IP on the instances exposes them. Option C is wrong because a VPN is for private connectivity, not internet. Option D is wrong because VPC endpoint is for specific AWS services, not external APIs.

Answer

Create a VPC endpoint for the external API service.

Answer

Assign public IP addresses to the EC2 instances and allow outbound traffic in the security group.

Answer

Set up a VPN connection to an on-premises network that has internet access.

Question 11

A company has a Direct Connect connection with a private VIF to a VPC. The VPC has a virtual private gateway (VGW) attached. The on-premises network advertises a prefix 10.0.0.0/8 over BGP. The VPC has subnets with CIDR 10.0.1.0/24 and 10.0.2.0/24. The company wants to ensure that traffic to on-premises uses Direct Connect. However, traffic to an S3 bucket uses the internet. What route configuration is required?

Accepted Answer

Add specific routes for S3 public IP prefixes pointing to the internet gateway.. Option D is correct because adding a specific route for S3 prefixes to the internet gateway will override the more general route through the VGW for those destinations. Option A is wrong because S3 traffic would go through Direct Connect. Option B is wrong because VPC CIDR cannot be changed. Option C is wrong because more specific routes to IGW are needed.

Answer

Change the VPC CIDR to avoid overlap with on-premises.

Answer

Add a static route for 0.0.0.0/0 pointing to the internet gateway.

Answer

Add a static route in the VPC route table for 0.0.0.0/0 pointing to the VGW.

Question 12

A company has a Direct Connect connection with a private VIF to a Direct Connect gateway. The VIF is associated with a Direct Connect gateway that has a virtual private gateway (VGW) attachment to a VPC. The on-premises network is advertising a route to 10.0.0.0/16. However, the VPC cannot reach on-premises resources. The VPC has a route table with a route to 10.0.0.0/16 pointing to the VGW. What is the MOST likely cause?

Accepted Answer

The VPC route table does not have route propagation enabled for the virtual private gateway. Option D is correct because the VGW needs to propagate routes from the Direct Connect gateway to the VPC route table. Without propagation, the VPC does not know the on-premises routes. Option A is incorrect because BGP is typically used with Direct Connect. Option B is incorrect because the Direct Connect gateway can handle multiple prefixes. Option C is incorrect because security groups do not affect inbound routing decisions.

Answer

The on-premises router is not using BGP to advertise routes

Answer

The security group on the VPC instances is blocking inbound traffic

Answer

The Direct Connect gateway does not support the prefix 10.0.0.0/16

Question 13

Refer to the exhibit. A VPN connection is established between an on-premises network (10.0.0.0/16) and an AWS VPC (172.16.0.0/16). The on-premises network can ping the VPC's private IP addresses, but the VPC cannot ping the on-premises network's IP addresses. The VPC route table has a route to 10.0.0.0/16 pointing to the VGW. What is the MOST likely cause?

Accepted Answer

The on-premises network does not have a route to the VPC CIDR (172.16.0.0/16) pointing to the customer gateway. Option B is correct because the VPN connection has a static route for 10.0.0.0/16, but the remote network CIDR is 0.0.0.0/0, which may cause routing issues. However, the main issue is that the VPC has a route to 10.0.0.0/16, but the on-premises network may not have a route back to the VPC's CIDR (172.16.0.0/16). Option A is incorrect because the tunnels are up. Option C is incorrect because static routes are configured. Option D is incorrect because acceleration is optional.

Answer

The VPN tunnels are not both in UP state

Answer

The VPN acceleration is disabled, causing high latency

Answer

The VPN connection is configured with static routes only and BGP is not used

Question 14

A company has an AWS Transit Gateway with multiple VPC attachments. They need to inspect traffic between VPCs using a third-party firewall appliance. What is the best approach?

Accepted Answer

Create a firewall VPC with the appliance and use Transit Gateway route tables to direct traffic through it. Placing a firewall appliance in a dedicated VPC and routing traffic through it via Transit Gateway route tables allows inspection.

Answer

Use VPC security groups across VPCs

Answer

Use AWS Network Firewall directly in each VPC

Answer

Use network ACLs on each VPC subnet

Question 15

A company has an S3 bucket with the bucket policy shown. The VPC endpoint ID is correct. However, an EC2 instance in a private subnet in the same VPC cannot download objects from the bucket. What is a possible reason?

Accepted Answer

The EC2 instance is accessing S3 via a NAT Gateway instead of the VPC endpoint. The bucket policy allows access only via the specified VPC endpoint. If the EC2 instance is accessing S3 through a NAT Gateway or internet gateway, the source VPC endpoint will not be present, and access will be denied. The instance should use the VPC endpoint.

Answer

The EC2 instance does not have a route to the VPC endpoint

Answer

The bucket policy does not allow s3:ListBucket

Answer

The VPC endpoint security group is blocking traffic