ANS-C01 Practice Test 42 — 15 Questions

Question 1

A company uses AWS Direct Connect to connect its on-premises network to AWS. The security team wants to encrypt all traffic traversing the Direct Connect link. Which solution should be used?

Accepted Answer

Establish an IPsec VPN tunnel over the Direct Connect link. AWS Direct Connect does not natively encrypt traffic; to encrypt data in transit over a Direct Connect link, you must establish an IPsec VPN tunnel over the Direct Connect connection. This combines the dedicated bandwidth and consistency of Direct Connect with the encryption of a VPN, satisfying the security team's requirement.

Answer

Enable encryption on the Direct Connect virtual interface

Answer

Use TLS on all applications that communicate across the link

Answer

Use VPC endpoints for all AWS services accessed

Question 2

A company is designing a VPC with IPv6. Which components are required to enable IPv6 communication between instances in the VPC and the internet? (Select TWO.)

Accepted Answer

A route in the subnet route table to ::/0 to the internet gateway. To enable IPv6 communication between instances in a VPC and the internet, you need an internet gateway (IGW) attached to the VPC, and a route in the subnet's route table that directs IPv6 traffic (destination ::/0) to that internet gateway. The IGW performs NAT for IPv6 (using eUI-64 addresses) and allows bidirectional traffic, so both components are required.

Answer

An egress-only internet gateway

Answer

A VPC peering connection to a VPC with internet access

Answer

A NAT Gateway

Question 3

A company has a Direct Connect connection with a single private virtual interface (VIF) to a virtual private gateway (VGW) attached to a VPC. The VPC CIDR is 10.0.0.0/16. The on-premises CIDR is 172.16.0.0/12. The BGP session is established, and the on-premises router is advertising the 172.16.0.0/12 route to the VGW. The VGW is configured to propagate routes to the VPC route tables. However, instances in the VPC cannot reach on-premises resources. The VPC route table shows a propagated route for 172.16.0.0/12 with a target of the VGW. What is the most likely issue?

Accepted Answer

The on-premises router does not have a route to the VPC CIDR via the Direct Connect interface. The most likely issue is that the on-premises router does not have a route to the VPC CIDR via the Direct Connect interface. Even though the BGP session is established and the VPC route table has a propagated route to on-premises, return traffic from on-premises to the VPC will fail if the on-premises router lacks a route pointing back through the Direct Connect connection. This is a common asymmetric routing problem.

Answer

The security groups for the VPC instances do not allow outbound traffic to the on-premises network

Answer

The VPC route table does not have a route for the on-premises CIDR

Answer

The BGP session is not advertising the VPC CIDR to the on-premises router

Question 4

A company has an AWS Direct Connect connection and wants to use it to access Amazon S3 buckets without traversing the public internet. Which virtual interface type should be used?

Accepted Answer

Public virtual interface. A public virtual interface is the correct choice because it allows access to AWS public services, such as Amazon S3, over a Direct Connect connection without traversing the public internet. It uses the same BGP peering and routing policies as private virtual interfaces but directs traffic to the public IP address space of AWS services, ensuring traffic stays within the AWS global network.

Answer

Transit virtual interface

Answer

Hosted virtual interface

Answer

Private virtual interface

Question 5

A company is using AWS Direct Connect to connect its on-premises data center to AWS. The network team notices increased latency and packet loss during peak hours. The Direct Connect virtual interface (VIF) is configured as a private VIF to a VPC. What is the MOST likely cause of the issue?

Accepted Answer

The VIF bandwidth is insufficient for the traffic volume.. Increased latency and packet loss during peak hours on a private VIF most likely indicate that the VIF's bandwidth capacity is insufficient for the traffic volume. Direct Connect offers dedicated bandwidth (e.g., 1 Gbps, 10 Gbps), and when utilization approaches the limit, packets are dropped and latency spikes due to queuing.

Answer

Jumbo frames are not enabled on the VIF.

Answer

The BGP keepalive timer is set too low.

Answer

The MTU size of the VIF is set to 1500 bytes.

Question 6

A company uses AWS Organizations with SCPs to enforce security controls. The security team wants to prevent users from disabling Amazon GuardDuty or modifying its configuration in any member account. Which SCP effect should be used?

Accepted Answer

Deny. 'Deny' because SCPs use Deny to explicitly block actions. Allow is used to whitelist, but SCPs default to Allow, so Deny is needed to override. 'Block' and 'Prevent' are not valid SCP effects.

Answer

Prevent

Answer

Allow

Answer

Block

Question 7

Arrange the steps to configure BGP on a Cisco router for a Direct Connect private virtual interface:

Accepted Answer

Enter configuration mode, then enable BGP, then define the neighbor, then advertise prefixes, then verify.. First enter config mode, enable BGP, define the neighbor, advertise prefixes, then verify.

Answer

Enable BGP, then enter configuration mode, then define the neighbor, then advertise prefixes, then verify.

Answer

Enter configuration mode, then enable BGP, then advertise prefixes, then define the neighbor, then verify.

Answer

Enter configuration mode, then enable BGP, then define the neighbor, then verify, then advertise prefixes.

Question 8

Order the steps to troubleshoot an inter-Region VPC peering connection that is not working:

Accepted Answer

Verify peering status, then check route tables, then check security groups and NACLs, then test connectivity, then use VPC Flow Logs. First verify peering status, then check routes, then security groups/ACLs, then test, then use flow logs.

Answer

Test connectivity, then check security groups and NACLs, then check route tables, then use VPC Flow Logs, then verify peering status

Answer

Check security groups and NACLs, then check route tables, then verify peering status, then test connectivity, then use VPC Flow Logs

Answer

Use VPC Flow Logs, then verify peering status, then check route tables, then check security groups and NACLs, then test connectivity

Question 9

Arrange the steps to configure a site-to-site VPN connection between an AWS Virtual Private Gateway and an on-premises Cisco ASA in the correct order.

Accepted Answer

Define customer gateway, then create VPN connection, then apply VPN configuration to Cisco ASA, then verify tunnel status, then configure routing.. First, define the customer gateway, then create the VPN connection, apply the configuration, verify the tunnel, and finally configure routing.

Answer

Create VPN connection, then define customer gateway, then apply configuration, then verify tunnel, then configure routing.

Answer

Define customer gateway, then create VPN connection, then verify tunnel, then apply configuration, then configure routing.

Answer

Define customer gateway, then apply configuration, then create VPN connection, then verify tunnel, then configure routing.

Question 10

A network engineer is setting up a VPC peering connection between two VPCs (VPC-A and VPC-B) in different AWS accounts. The VPCs are in the same region. After accepting the peering request, instances in VPC-A cannot communicate with instances in VPC-B. What should the engineer check first?

Accepted Answer

The route tables in both VPCs have routes to the peer VPC CIDR.. VPC peering requires explicit route table entries in both VPCs pointing the peer CIDR to the peering connection (pcx-xxxx). Even after the peering connection is accepted and shows 'active', no traffic flows until each VPC's route table has a route for the other VPC's CIDR targeting the peering connection. This is the most common first misconfiguration and should be checked before deeper troubleshooting.

Answer

The security groups in both VPCs allow traffic from the peer VPC CIDR.

Answer

The network ACLs in both VPCs allow traffic from the peer VPC CIDR.

Answer

The VPC peering connection status is 'active'.

Question 11

A company has a VPC with multiple subnets. An EC2 instance in a private subnet needs to access an S3 bucket. Which AWS service should be used to allow this access without traversing the internet?

Accepted Answer

VPC Gateway Endpoint for S3. A VPC Gateway Endpoint for S3 allows EC2 instances in a private subnet to access S3 buckets without traversing the internet by using AWS's internal network. It uses prefix lists and route table entries to direct S3 traffic through the endpoint, which is horizontally scaled and highly available. This avoids the need for a NAT gateway or internet gateway, keeping traffic within the AWS backbone.

Answer

Transit Gateway

Answer

NAT gateway

Answer

Internet gateway

Question 12

A company wants to audit all Network Load Balancer (NLB) operations performed in their AWS account. Which AWS service should they use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls for all AWS services, including Network Load Balancer (NLB) operations. Therefore, to audit NLB operations, CloudTrail should be used. Option B (Amazon CloudWatch Logs) stores logs but does not natively capture API calls. Option C (AWS Config) tracks resource configurations and changes, not API operations. Option D (VPC Flow Logs) captures network traffic information, not API calls. Hence, Option A is correct.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

VPC Flow Logs

Question 13

A company is using AWS WAF to protect a web application behind an Application Load Balancer. They want to block requests that contain SQL injection attacks. Which WAF rule type should they use?

Accepted Answer

Managed rule group for SQL injection. AWS WAF provides managed rule groups specifically designed to detect common web threats, including SQL injection attacks. The 'Managed rule group for SQL injection' contains pre-configured rules that inspect request components (such as query strings, URI, and body) for SQL injection patterns, making it the correct choice for blocking such attacks without requiring custom rule authoring.

Answer

IP set rule

Answer

Rate-based rule

Answer

Geographic match rule

Question 14

A company is designing a multi-account AWS environment using AWS Organizations. The company wants to centralize outbound internet traffic from all VPCs in all accounts through a single VPC in a shared services account. The shared services account has a VPC with a NAT gateway and an internet gateway. Which architecture meets this requirement?

Accepted Answer

Attach all VPCs to a transit gateway and route traffic through a shared services VPC that has NAT gateway and internet gateway.. A transit gateway allows you to centrally route traffic from multiple VPCs across different AWS accounts to a shared services VPC. By attaching all VPCs to a transit gateway and configuring route tables appropriately, you can force all outbound internet traffic from the spoke VPCs to go through the shared services VPC's NAT gateway and internet gateway, centralizing egress traffic.

Answer

Create VPC gateway endpoints for all AWS services in each VPC.

Answer

Set up a VPN connection from each VPC to the shared services VPC and use the latter's internet gateway.

Answer

Peer each VPC to the shared services VPC and configure a default route pointing to the shared services VPC's NAT gateway.

Question 15

A company wants to connect its on-premises data center to AWS using AWS Direct Connect and wants to use the same connection to access multiple VPCs in the same AWS region. The company also needs to maintain private IP connectivity between the VPCs. Which THREE components should the company use to meet these requirements? (Choose three.)

Accepted Answer

Transit Gateway VPC attachments. The company needs to reach multiple VPCs in the same region over a single Direct Connect connection, which is exactly what an AWS Direct Connect gateway (D) provides: it is a globally available resource that aggregates virtual interfaces and allows one private VIF to reach many VPCs across regions via virtual private gateways or transit gateways. To attach those VPCs to the Direct Connect gateway in a scalable hub-and-spoke design, an AWS Transit Gateway (E) is required, since it acts as a regional hub that the Direct Connect gateway associates with. Each VPC must then be connected to that Transit Gateway using Transit Gateway VPC attachments (A), which bind the VPC to the TGW and enable the private IP routing between VPCs and toward on-premises. VPC peering (B) is not appropriate because it is a one-to-one, non-transitive connection that does not integrate with a Direct Connect gateway for multi-VPC on-premises access. A Site-to-Site VPN (C) is unnecessary and would be a separate IPsec overlay rather than the requested Direct Connect private connectivity.

Answer

VPC peering connections between each VPC

Answer

AWS Site-to-Site VPN connection