ANS-C01 Practice Test 43 — 15 Questions

Question 1

A company is deploying a VPC with public and private subnets. They want to allow instances in a private subnet to access the internet for software updates while preventing inbound internet traffic. Which configuration should be used?

Accepted Answer

Attach an internet gateway to the VPC, and create a NAT gateway in a public subnet. Add a route in the private subnet route table to the NAT gateway for 0.0.0.0/0. Option A is correct because a NAT gateway in a public subnet allows outbound internet access from private subnets while blocking inbound traffic. Option B is wrong because an internet gateway allows inbound traffic. Option C is wrong because a VPC endpoint is for specific AWS services, not general internet. Option D is wrong because a transit gateway is for inter-VPC routing.

Answer

Create a VPC endpoint for internet access

Answer

Use a transit gateway with a NAT instance

Answer

Attach an internet gateway to the VPC and add a route in the private subnet to the internet gateway for 0.0.0.0/0

Question 2

A company wants to establish a dedicated, private connection between their on-premises data center and AWS. They require consistent, low-latency performance and support for multiple VLANs. Which AWS service should they use?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated private connection with consistent performance and support for multiple VLANs via Virtual LANs (VLANs). Option A is wrong because a VPN connection uses the public internet. Option C is wrong because VPC peering is for connecting VPCs. Option D is wrong because Transit Gateway is a hub for multiple VPCs and on-premises, but the private connection itself is Direct Connect.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

VPC Peering

Question 3

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network uses BGP to advertise a specific prefix (10.0.0.0/16) to AWS. The VPC CIDR is 10.0.0.0/16. The company wants to ensure that traffic from the VPC to on-premises uses the Direct Connect connection. However, traffic is going over the internet instead. What is the most likely cause?

Accepted Answer

The VPC CIDR overlaps with the on-premises prefix, and the local route in the VPC route table takes precedence.. Option D is correct because when the VPC CIDR and the on-premises prefix overlap, the VPC's local route takes precedence over any other route, including Direct Connect. Traffic destined for the on-premises network would be considered local to the VPC. Option A is wrong because longer prefix match does not apply to overlapping local routes. Option B is wrong because AWS always prefers more specific routes; the issue is the local route. Option C is wrong because BGP ASN prepending does not affect route preference over the local route.

Answer

The on-premises BGP ASN is prepended, causing the route to be less preferred.

Answer

The on-premises prefix is less specific than the VPC CIDR, so the VPC route takes precedence.

Answer

The BGP route is not being propagated into the VPC route table.

Question 4

Which TWO of the following are valid methods to connect multiple VPCs in the same AWS Region? (Choose TWO.)

Accepted Answer

VPC peering. Option A (VPC Peering) and Option C (Transit Gateway) are correct. VPC Peering allows direct connectivity, and Transit Gateway supports transitive routing. Option B (VPN) is for on-premises. Option D (Direct Connect) is for on-premises. Option E (Internet Gateway) is for internet access, not VPC to VPC.

Answer

Internet gateway

Answer

AWS Site-to-Site VPN

Answer

AWS Direct Connect

Question 5

A company has an AWS Transit Gateway with multiple VPC attachments. They want to centralize outbound internet traffic through a single VPC that has a NAT gateway and an internet gateway. All other VPCs should route internet-bound traffic through this central VPC. What configuration is required?

Accepted Answer

Attach a virtual private gateway to the central VPC and add a static route in the transit gateway route table pointing 0.0.0.0/0 to the virtual private gateway. Option D is correct because you need to attach a virtual private gateway to the central VPC and add a static route in the transit gateway route table pointing 0.0.0.0/0 to that VGW, then the other VPCs need a default route in their route tables pointing to the transit gateway attachment. Option A is wrong because TGW attachments do not have route tables; route tables are associated with TGW. Option B is wrong because that would send traffic directly to the internet gateway, not through the central VPC. Option C is wrong because that would route traffic to the NAT gateway directly in the central VPC, but the transit gateway cannot route to a NAT gateway directly; it needs a VGW or a prefix list.

Answer

Add a default route in the central VPC's subnet route tables pointing to the internet gateway

Answer

Create a route table in the central VPC and associate it with the transit gateway attachment

Answer

Add a route in the transit gateway route table pointing 0.0.0.0/0 to the NAT gateway in the central VPC

Question 6

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network team reports intermittent connectivity loss to resources in the VPC, but the Direct Connect tunnel status shows as UP. Which configuration is MOST likely causing the issue?

Accepted Answer

Traffic is being routed asymmetrically through the Direct Connect and a VPN backup. Option B is correct because asymmetric routing can cause connectivity drops if traffic returns via a different path and is dropped by security groups or ACLs. Option A is incorrect because BGP keepalives would not affect specific traffic. Option C is incorrect because jumbo frames may cause fragmentation but not intermittent loss. Option D is incorrect because a separate VIF is not required for each VPC.

Answer

The BGP keepalive interval is set to 60 seconds

Answer

Jumbo frames are enabled on the Direct Connect interface but not on on-premises routers

Answer

A separate private VIF is required for each VPC in the account

Question 7

Which THREE actions are required to enable an EC2 instance in a private subnet to download software updates from the internet? (Select THREE.)

Accepted Answer

Allocate an Elastic IP and associate it with the NAT Gateway. Options B, C, and D are correct. A NAT Gateway in a public subnet, a route to it, and an EIP for the NAT Gateway. Option A is wrong because an Internet Gateway alone does not provide outbound access for private subnets. Option E is wrong because security groups allow outbound by default.

Answer

Configure the security group to allow outbound traffic to 0.0.0.0/0

Answer

Attach an Internet Gateway to the VPC

Question 8

A network engineer created the CloudFormation stack shown. After creation, an EC2 instance launched in PublicSubnet does not have a public IP address. What is the most likely reason?

Accepted Answer

The VPC does not have an Internet Gateway attached. The subnet property 'MapPublicIpOnLaunch' is set to true, but the VPC does not have an Internet Gateway attached, and the subnet's route table does not have a route to an Internet Gateway. Without an Internet Gateway, public IP assignment might not work as expected, or the instance cannot reach the internet.

Answer

The subnet does not have an Internet Gateway attached

Answer

The subnet's route table does not have a route to a NAT Gateway

Answer

The instance type does not support public IP addresses

Question 9

Refer to the exhibit. A Lambda function is attached to a VPC using the network interface eni-1234567890abcdef0. The Lambda function needs to send traffic to an on-premises server via a Direct Connect connection. The traffic is failing. Which setting on the network interface is most likely causing the issue?

Accepted Answer

The SourceDestCheck flag is enabled, which prevents the Lambda function from sending traffic that it is not the source or destination of.. The SourceDestCheck flag is set to true (default). For Lambda functions that are not the source or destination of traffic (e.g., when acting as a NAT or forwarding traffic), this check must be disabled. In this scenario, if the Lambda function is forwarding traffic, the source/destination check would drop packets. Option A (multiple IPs) is not an issue; Option B (security group) could be but the exhibit doesn't show rules; Option C (subnet) is not the direct cause.

Answer

The network interface is in a subnet that does not have a route to the Direct Connect.

Answer

The network interface has two private IP addresses.

Answer

The security group attached to the network interface may be blocking outbound traffic.

Question 10

A company has a VPC with a CIDR of 10.0.0.0/16. They have two Availability Zones, each with a public and a private subnet. They want to connect their on-premises network (192.168.0.0/16) to the VPC using a site-to-site VPN. Which THREE resources are needed to establish the VPN connection? (Choose THREE.)

Accepted Answer

Customer Gateway. A site-to-site VPN requires a Virtual Private Gateway (VPG) on the VPC side, a Customer Gateway (CGW) representing the on-premises router, and a VPN Connection between them. Option A is wrong because a Transit Gateway is not required for a simple VPN. Option D is wrong because a Direct Connect connection is separate. Option E is wrong because a VPC endpoint is for private access to AWS services.

Answer

AWS Direct Connect

Answer

AWS Transit Gateway

Question 11

A network engineer is designing a highly available VPN connectivity between an on-premises data center and AWS. The company has two AWS Direct Connect connections terminated on two different AWS Direct Connect locations for redundancy. The company wants to use AWS Site-to-Site VPN as a backup for Direct Connect. The VPN connections will terminate on a single Virtual Private Gateway (VGW) attached to a VPC. The on-premises network has two customer gateways (CGWs) each with a unique BGP ASN. Which TWO actions should the engineer take to ensure automatic failover and load balancing? (Choose two.)

Accepted Answer

Configure the VPN connections to use BGP dynamic routing.. Option A is correct because using BGP dynamic routing on both VPN tunnels allows automatic failover and load balancing. Option C is correct because creating a VPN connection from each CGW to the same VGW provides two separate tunnels. Option B is incorrect because static routes do not provide automatic failover. Option D is incorrect because a single CGW creates a single point of failure. Option E is incorrect because the VPN is backup; using BGP on both tunnels handles failover without cloudwatch alarms.

Answer

Set up a CloudWatch alarm to trigger an AWS Lambda function that changes route table entries upon VPN failure.

Answer

Configure the VPN connections to use static routes with equal cost multipath (ECMP).

Answer

Use a single customer gateway with two separate tunnels to the virtual private gateway.

Question 12

Which TWO statements about AWS Direct Connect are correct? (Select TWO.)

Accepted Answer

Direct Connect supports multiple virtual interfaces (VIFs) over a single connection. Options A and C are correct. Direct Connect provides consistent network performance and supports multiple virtual interfaces. Option B is wrong because it is not encrypted by default. Option D is wrong because it is not a VPN. Option E is wrong because it requires a dedicated connection.

Answer

Direct Connect traffic is encrypted by default

Answer

Direct Connect is a managed VPN service

Answer

Direct Connect can be provisioned in minutes without any physical infrastructure

Question 13

A company is designing a network for a highly available application across multiple AWS regions. The application requires low-latency communication between regions and uses IP addresses that cannot change. Which AWS service should be used to connect the VPCs in different regions?

Accepted Answer

VPC Peering. Option A is correct because VPC peering provides low-latency, private connectivity between VPCs in different regions. B is intra-region only. C is for on-premises. D is for internet-facing.

Answer

AWS Direct Connect

Answer

VPC Endpoints

Answer

Internet Gateway

Question 14

A company has a VPC with a CIDR of 10.0.0.0/16. They have two subnets: 10.0.1.0/24 (public) and 10.0.2.0/24 (private). They launch a NAT Gateway in the public subnet and add a route in the private subnet route table: destination 0.0.0.0/0, target nat-gateway-id. An EC2 instance in the private subnet can ping an external server, but cannot connect to it via SSH. The security group allows outbound SSH (port 22), and the NACL allows outbound ephemeral ports. What is the likely cause?

Accepted Answer

The external server's firewall is blocking traffic from the NAT Gateway's Elastic IP address.. The issue is likely that the external server's security group or firewall is blocking inbound SSH from the NAT Gateway's public IP. The NAT Gateway uses its Elastic IP for outbound traffic, and the external server must allow that IP. Option B is wrong because the NAT Gateway does not block SSH. Option C is wrong because the NACL is permissive. Option D is wrong because the route is correct.

Answer

The NACL on the private subnet is blocking outbound ephemeral ports.

Answer

The route table in the private subnet does not have a route to the NAT Gateway.

Answer

The NAT Gateway is not configured to allow SSH traffic.

Question 15

A company has multiple VPCs that need to communicate with each other using private IP addresses. The VPCs are in the same AWS account and Region. Which AWS service provides the simplest and most scalable solution?

Accepted Answer

VPC peering connections. Option A is correct because VPC peering is simple, scalable, and allows direct connections between VPCs. Option B is wrong because VPN connections are complex and costly. Option C is wrong because Transit Gateway is more complex than needed for a few VPCs. Option D is wrong because ClassicLink is legacy and limited.

Answer

AWS Site-to-Site VPN

Answer

ClassicLink

Answer

AWS Transit Gateway