ANS-C01 Practice Test 43 — 15 Questions

Question 1

A company is designing a network for a critical application that requires maximum availability. The application will be deployed across multiple Availability Zones in a single region. Which THREE design choices improve network availability?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an Application Load Balancer with targets in multiple Availability Zones. Option A is correct because an Application Load Balancer is a regional, highly available service that distributes traffic across healthy targets in multiple Availability Zones, automatically routing around a failed AZ. Option B is correct because deploying EC2 instances in at least two Availability Zones removes a single point of failure, so the application keeps serving traffic if one AZ becomes unavailable. Option E is correct because creating a NAT gateway in each Availability Zone gives each AZ an independent egress path; if one AZ's NAT gateway fails, instances in other AZs still have outbound connectivity. Option C is incorrect because a single NAT gateway in one AZ is a single point of failure for outbound traffic and creates cross-AZ dependency. Option D is incorrect because using a single subnet per Availability Zone is normal and does not by itself improve availability; subnets are AZ-scoped, and redundancy comes from spanning multiple AZs, not from limiting subnets.

Answer

Use a single NAT gateway in one Availability Zone

Answer

Use a single subnet per Availability Zone

Question 2

A company is deploying a multi-tier web application across multiple AWS accounts. They want to centralize network security by using a shared services VPC with a Transit Gateway. All application VPCs will be attached to the Transit Gateway. The security team needs to inspect and filter traffic between application VPCs. Which solution should be used to meet this requirement?

Accepted Answer

Deploy a Transit Gateway and attach a central inspection VPC with a firewall appliance. Configure route tables to send inter-VPC traffic through the inspection VPC.. A Transit Gateway with a central inspection VPC allows you to route all inter-VPC traffic through a firewall appliance for inspection. By configuring route tables on the Transit Gateway, you can force traffic between application VPCs to traverse the inspection VPC, enabling centralized security filtering without requiring point-to-point peering or per-VPC rules.

Answer

Create VPC Peering connections between each pair of application VPCs and apply security groups to the peer connections.

Answer

Use security groups in each application VPC to control traffic between VPCs.

Answer

Use network ACLs in each application VPC to filter traffic between VPCs.

Question 3

A company is using AWS Direct Connect with a private VIF to connect its on-premises data center to a VPC. The network team wants to monitor the link health and receive alarms if the connection goes down. Which AWS service should they use?

Accepted Answer

Amazon CloudWatch with Direct Connect metrics.. Amazon CloudWatch provides metrics for Direct Connect connections, such as connection state and BGP status, and can trigger alarms. Option B is wrong because Amazon Inspector is for security assessments, not link health monitoring. Option C is wrong because AWS Config tracks configuration changes, not operational status. Option D is wrong because VPC Flow Logs capture IP traffic logs, not link health.

Answer

Amazon Inspector.

Answer

AWS Config.

Answer

VPC Flow Logs.

Question 4

Refer to the exhibit. A Direct Connect private virtual interface is in the 'available' state, and the BGP session is up. However, the on-premises network cannot reach any resources in the VPC attached to the Direct Connect gateway. What is the MOST likely cause?

Accepted Answer

The Direct Connect gateway is not associated with the virtual private gateway or route propagation is not enabled. For a Direct Connect private VIF to provide access to a VPC, the Direct Connect gateway must be associated with the virtual private gateway (VGW) of that VPC, and route propagation must be enabled so that on-premises routes are advertised into the VPC and VPC routes are advertised to on-premises. If the association or route propagation is missing, BGP may be up but no routes are exchanged, resulting in no connectivity.

Answer

The BGP ASN is private and not allowed

Answer

The VLAN ID is incorrect

Answer

The BGP session is not established

Question 5

A company is migrating its on-premises data center to AWS and wants to use AWS Direct Connect for private connectivity. The network team plans to advertise the company's public IP prefixes to AWS via BGP. Which AWS resource must be configured to allow advertisement of these prefixes?

Accepted Answer

A public virtual interface on the Direct Connect connection. A public virtual interface (VIF) on AWS Direct Connect allows BGP peering where you can advertise your public IP prefixes to AWS, enabling private connectivity to public AWS services. Private and transit VIFs do not support customer-originated public prefix advertisements.

Answer

A VPN CloudHub topology

Answer

A private virtual interface on the Direct Connect connection

Answer

A transit virtual interface on the Direct Connect connection

Question 6

A company wants to centrally manage and enforce security rules for all VPCs in a multi-account environment. Which AWS service should be used?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager is the correct choice because it provides centralized management of firewall rules across multiple accounts and VPCs in an AWS Organization. It allows you to enforce a common set of security policies, such as AWS WAF rules, AWS Shield Advanced protections, and VPC security group rules, ensuring consistent governance across all VPCs in the multi-account environment.

Answer

Amazon GuardDuty

Answer

AWS Shield

Answer

AWS WAF

Question 7

A company has a VPC with CIDR 10.0.0.0/16. They have an on-premises network with CIDR 172.16.0.0/12 connected via AWS Site-to-Site VPN. The company also has a second VPC (VPC B) with CIDR 10.1.0.0/16 peered with the first VPC. They notice that instances in VPC B cannot reach the on-premises network. What is the most likely cause?

Accepted Answer

VPC peering does not support transitive routing.. VPC peering does not support transitive routing. This means that if VPC A is peered with VPC B and also connected to an on-premises network via VPN, traffic from VPC B cannot use VPC A as a transit point to reach the on-premises network. Each VPC must have its own direct connection to the on-premises network, or a transit gateway must be used to enable transitive routing.

Answer

Route propagation is disabled in VPC B.

Answer

The VPN connection is not compatible with VPC peering.

Answer

The VPN tunnel is down.

Question 8

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. The company wants to use the same Direct Connect connection to access multiple VPCs in the same AWS Region. Which solution should the company implement?

Accepted Answer

Create a transit virtual interface on the Direct Connect connection and associate it with a Direct Connect gateway.. A transit virtual interface (VIF) on a Direct Connect connection can be associated with a Direct Connect gateway, which enables connectivity to multiple VPCs in the same AWS Region. The Direct Connect gateway acts as a hub, allowing the single physical connection to route traffic to multiple VPCs via the transit VIF, without needing separate private VIFs for each VPC.

Answer

Use a public virtual interface and route traffic through the internet.

Answer

Request a hosted virtual interface from an AWS Direct Connect partner.

Answer

Create additional private virtual interfaces for each VPC.

Question 9

A company has a VPC with a public subnet and a private subnet. The private subnet instances need to make outbound internet requests. A NAT Gateway is deployed in the public subnet. The network engineer notices that instances in the private subnet cannot reach the internet, but the NAT Gateway's Elastic IP is reachable from the internet. Which of the following is the most likely cause?

Accepted Answer

The route table for the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT Gateway.. The most likely cause is that the private subnet's route table lacks a default route (0.0.0.0/0) pointing to the NAT Gateway. Without this route, instances in the private subnet have no path to the internet, even though the NAT Gateway itself is reachable from the internet via its Elastic IP. This is a common misconfiguration.

Answer

The network ACL on the private subnet blocks outbound traffic.

Answer

The NAT Gateway is not associated with an Elastic IP.

Answer

The security group attached to the NAT Gateway blocks outbound traffic.

Question 10

Which TWO of the following are true about AWS VPC endpoints? (Choose two.)

Accepted Answer

Gateway Endpoints can be used to access Amazon S3 and DynamoDB.. Gateway VPC endpoints allow private connectivity to Amazon S3 and DynamoDB without traversing the internet, using route table entries rather than private IP addresses. This is the only AWS service pair supported by Gateway Endpoints, making them a cost-effective and simple solution for these two services.

Answer

Interface Endpoints are free of charge.

Answer

Gateway Endpoints use AWS PrivateLink.

Answer

Both Gateway and Interface Endpoints require a NAT gateway.

Question 11

A company has a VPC with a public subnet hosting a web server. The security group for the web server allows inbound HTTP (port 80) from 0.0.0.0/0. The network ACL for the public subnet allows inbound HTTP from 0.0.0.0/0. Users report that they cannot access the website. The engineer verifies that the web server is running and has a public IP. What is the most likely issue?

Accepted Answer

The network ACL outbound rule is blocking return traffic.. Network ACLs are stateless, meaning that return traffic must be explicitly allowed by outbound rules. If the NACL's outbound rules do not allow the return traffic from the web server to the client (e.g., ephemeral ports), the response packets will be blocked, and users cannot access the website. The security group, being stateful, automatically allows return traffic, so the NACL is the most likely culprit.

Answer

The web server is listening on a different port.

Answer

The internet gateway is not attached to the VPC.

Answer

The security group outbound rule is blocking return traffic.

Question 12

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to peer with another VPC with CIDR 10.0.0.0/16. They plan to use a transit gateway to connect the VPCs. What is the correct approach to handle the overlapping CIDR ranges?

Accepted Answer

Create a new VPC with a non-overlapping CIDR and migrate resources from one of the existing VPCs.. Transit gateways do not perform NAT or resolve overlapping CIDR conflicts between attached VPCs. When two VPCs have identical CIDR blocks (10.0.0.0/16), the transit gateway cannot route traffic correctly because it cannot distinguish between the two networks. The only viable solution is to create a new VPC with a non-overlapping CIDR and migrate resources from one of the existing VPCs, eliminating the conflict at the network layer.

Answer

Create a VPC peering connection and use a smaller subnet CIDR for traffic filtering.

Answer

Use a transit gateway with network address translation (NAT) to translate one VPC CIDR to a non-overlapping range.

Answer

Configure the transit gateway with equal-cost multipath (ECMP) to load balance traffic between the overlapping CIDRs.

Question 13

A company needs to establish a dedicated, low-latency, and consistent network connection from their on-premises data center to AWS. Which AWS service should they use?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated, low-latency, and consistent private network connection from on-premises to AWS, bypassing the internet. Option A (Site-to-Site VPN) uses the public internet and is less consistent. Option B (VPN CloudHub) connects multiple on-premises sites to AWS but still relies on the internet. Option C (VPC peering) connects VPCs within AWS, not on-premises. Therefore, D is correct.

Answer

AWS Site-to-Site VPN

Answer

AWS VPN CloudHub

Answer

VPC peering

Question 14

A company has a VPC with public and private subnets. They launch an EC2 instance in a private subnet and need it to access the internet. Which combination of components is required?

Accepted Answer

A NAT Gateway in a public subnet and a default route (0.0.0.0/0) in the private subnet's route table pointing to the NAT Gateway. A NAT Gateway in a public subnet provides outbound-only internet access for instances in private subnets. A default route (0.0.0.0/0) in the private subnet's route table pointing to the NAT Gateway ensures traffic destined for the internet is forwarded to the NAT Gateway, which then translates the source IP to its own Elastic IP and sends the traffic through the Internet Gateway (IGW) attached to the public subnet. This combination allows the EC2 instance to initiate outbound connections (e.g., for software updates) while remaining unreachable from the internet.

Answer

A NAT instance in the private subnet with a route to an Internet Gateway

Answer

A VPC Gateway Endpoint for S3 in the private subnet

Answer

An Internet Gateway (IGW) attached to the VPC and a default route (0.0.0.0/0) in the private subnet's route table pointing to the IGW

Question 15

A company has a multi-account AWS environment with hundreds of VPCs interconnected via a transit gateway. The network team needs to centrally monitor VPC reachability and identify asymmetric routing paths. Which THREE services or features should be used together to achieve this? (Choose three.)

Accepted Answer

Amazon CloudWatch Contributor Insights. VPC Reachability Analyzer (B) is correct because it performs static, hop-by-hop path analysis between a source and destination (ENI, IP, or resource) and explicitly reports whether the path is reachable and where it breaks, which is exactly what is needed to validate VPC reachability across the transit gateway. AWS Network Manager (C) is correct because its Route Analyzer and topology views model the transit gateway route tables and attachments, letting the team centrally visualize routing and detect asymmetric or suboptimal paths across hundreds of VPCs. Amazon CloudWatch Contributor Insights (A) is correct because it analyzes VPC Flow Logs to surface the top contributors and traffic patterns, helping identify asymmetric routing behavior in live traffic that static analysis alone may miss. AWS Config (D) is not correct here because it records resource configuration changes and evaluates compliance rules, not end-to-end path reachability or routing asymmetry. AWS CloudHSM (E) is not correct because it is a dedicated hardware security module service for cryptographic key operations and has no role in network path analysis.

Answer

AWS Config

Answer

AWS CloudHSM