ANS-C01 Practice Test 44 — 15 Questions

Question 1

A company wants to audit all changes to security group rules in their AWS account. Which AWS service should be used to record these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls made in the AWS account, including calls to authorize security group rule changes (e.g., AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress). This makes it the appropriate service for auditing changes to security group rules. AWS Config (Option B) records resource configurations and can track changes, but it is not the primary service for API-level auditing. VPC Flow Logs (Option C) capture network traffic metadata, not configuration changes. Amazon Inspector (Option D) is a vulnerability assessment service, not an audit service for changes.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon Inspector

Question 2

A company is using AWS Transit Gateway with multiple VPC attachments. They need to ensure that traffic between two specific VPCs is encrypted in transit. The VPCs are in the same AWS region. What is the SIMPLEST solution?

Accepted Answer

Create a VPN attachment on the Transit Gateway and route traffic through it. AWS Transit Gateway does not natively encrypt traffic between VPC attachments; the simplest way to encrypt inter-VPC traffic over a TGW is to create a VPN attachment (site-to-site VPN) on the transit gateway and route the traffic through it, which applies IPsec encryption. This uses the existing TGW routing model and requires no changes to VPC peering or PrivateLink.

Answer

Enable encryption on the Transit Gateway route tables

Answer

Use AWS PrivateLink to connect the VPCs

Answer

Use VPC peering instead of Transit Gateway and enable encryption

Question 3

A company has a VPC with public and private subnets. The private subnets need internet access for software updates. The company wants to minimize costs and management overhead. Which solution should they use?

Accepted Answer

Create a NAT gateway in a public subnet and add a route to the private subnet route table pointing to the NAT gateway. A NAT gateway deployed in a public subnet allows instances in private subnets to initiate outbound traffic to the internet for software updates while preventing inbound internet traffic, and it is a fully managed service requiring minimal overhead. Option A (VPC endpoints) only provides access to specific AWS services like S3 and CloudFront, not general internet. Option B (attaching an IGW and adding a default route to private subnets) would make the private subnets effectively public, allowing unsolicited inbound connections and violating security best practices. Option D (NAT instance) requires manual configuration, patching, and scaling, increasing management overhead compared to a NAT gateway.

Answer

Use a VPC endpoint for S3 and CloudFront

Answer

Attach an internet gateway to the VPC and add a default route to the private subnet route table pointing to the internet gateway

Answer

Launch a NAT instance on an EC2 instance in a public subnet

Question 4

A company is deploying a critical application on AWS and needs to ensure that traffic between two VPCs in the same region is encrypted in transit. The VPCs are connected via a VPC peering connection. What should the network engineer do to meet the encryption requirement?

Accepted Answer

Configure IPsec on the EC2 instances to encrypt traffic over the VPC peering connection.. For same-region VPC peering, AWS does not automatically encrypt traffic in transit. Traffic between VPCs in the same region over a peering connection is not encrypted by default. To meet the encryption requirement, you must configure IPsec on the EC2 instances to encrypt the traffic. Inter-region VPC peering automatically encrypts traffic, but that does not apply here.

Answer

No additional configuration is needed; VPC peering traffic is automatically encrypted.

Answer

Create a VPN connection between the two VPCs using the VPC peering connection.

Answer

Use AWS Transit Gateway with VPN attachments between the VPCs.

Question 5

A company is deploying a multi-tier web application across multiple Availability Zones in a single Region. The web tier must be fault-tolerant and distribute traffic across EC2 instances. The application tier uses an Auto Scaling group of EC2 instances that need to be accessed by the web tier using a static IP address. Which combination of AWS services meets these requirements?

Accepted Answer

Application Load Balancer for the web tier and Network Load Balancer for the application tier. The web tier requires fault tolerance and traffic distribution across EC2 instances, which is best handled by an Application Load Balancer (ALB) operating at Layer 7 with path-based routing and health checks. The application tier needs a static IP address for the web tier to access it, which is a key feature of a Network Load Balancer (NLB) — it preserves the client IP and provides static IP addresses per Availability Zone, unlike ALBs which use dynamic IPs. This combination meets both requirements: ALB for web traffic distribution and NLB for static IP access to the application tier.

Answer

Classic Load Balancer for the web tier and Application Load Balancer for the application tier

Answer

AWS Global Accelerator for the web tier and Classic Load Balancer for the application tier

Answer

Network Load Balancer for the web tier and Application Load Balancer for the application tier

Question 6

A network engineer is troubleshooting connectivity between two EC2 instances in the same VPC but different subnets. The instances can ping each other's private IP addresses, but traffic on TCP port 443 fails. What is the most likely cause?

Accepted Answer

Security group or network ACL rules blocking port 443.. Since the instances can ping each other, ICMP traffic is working, which rules out routing issues and confirms that the instances are reachable at Layer 3. TCP port 443 failing specifically indicates that a firewall rule is blocking the HTTPS traffic. Security groups are stateful and operate at the instance level, while network ACLs are stateless and operate at the subnet level; either can block port 443 while allowing ICMP, making this the most likely cause.

Answer

VPC Flow Logs misconfiguration.

Answer

Internet gateway not attached to the VPC.

Answer

Missing route in the route table.

Question 7

Which TWO options are valid methods to connect a VPC to an on-premises network? (Choose two.)

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN (A) is correct because it creates an IPsec VPN tunnel over the public internet between an on-premises customer gateway and an AWS virtual private gateway or transit gateway, securely connecting the VPC to the on-premises network. AWS Direct Connect (C) is correct because it provides a dedicated private physical network connection from an on-premises location to AWS, which can be attached to a virtual private gateway or Direct Connect gateway to reach the VPC. An Internet Gateway (B) only enables internet connectivity for resources in a VPC and does not link to an on-premises network. A VPC endpoint (D) privately connects a VPC to supported AWS services (or to endpoint services via PrivateLink), not to an on-premises network. VPC peering (E) connects two VPCs to each other and does not provide on-premises connectivity.

Answer

Internet Gateway

Answer

VPC endpoint

Answer

VPC peering

Question 8

A network engineer needs to create a set of IAM permissions for a DevOps team to monitor network resources. The policy above is proposed. What critical missing permission is required to allow the team to list and describe VPCs?

Accepted Answer

ec2:DescribeVpcs. The correct permission to list and describe VPCs is `ec2:DescribeVpcs`. This API call returns information about one or more VPCs, including their CIDR blocks, state, and tags. Without this specific permission, the DevOps team cannot retrieve VPC details, even if they have other EC2 describe permissions.

Answer

ec2:DescribeVpcPeeringConnections

Answer

ec2:DescribeSubnets

Answer

ec2:CreateVpc

Question 9

A company uses AWS Certificate Manager (ACM) to provision SSL/TLS certificates for their Application Load Balancer (ALB). They want to ensure that the ALB only accepts connections using TLS 1.2 or higher. How should they configure this?

Accepted Answer

Configure the ALB with an appropriate security policy that enforces TLS 1.2.. The Application Load Balancer supports security policies that allow you to enforce TLS 1.2 or higher. Option A is incorrect because ACM provides certificates but does not dictate the TLS version; that is determined by the load balancer's security policy. Option C is incorrect because while CloudFront can enforce TLS policies, it is an additional service and not required; the ALB itself can enforce TLS 1.2. Option D is incorrect because Route 53 is a DNS service and does not handle TLS version enforcement.

Answer

Use ACM to generate a certificate that only supports TLS 1.2.

Answer

Configure the ALB to use a CloudFront distribution with a TLS policy.

Answer

Use AWS Route 53 to enforce TLS version at the DNS level.

Question 10

A company is configuring a site-to-site VPN connection between its on-premises network and AWS. The VPN tunnel is up, but traffic is not passing. The company has verified that routes are correct on both sides. Which TWO actions should the company take to troubleshoot the issue?

Accepted Answer

Check the security group rules for the EC2 instances in the VPC.. Option C is correct because security groups in AWS act as stateful instance-level firewalls, and if they do not permit the relevant traffic (e.g., ICMP for testing or the application ports) from the on-premises CIDR, packets will be silently dropped even though the VPN tunnel and routes are fine. Option E is correct because network ACLs are stateless subnet-level filters; their inbound and outbound rules must explicitly allow the on-premises CIDR on both directions (including ephemeral ports for return traffic), otherwise traffic will be blocked despite correct routing. Option A is not the issue here because a virtual private gateway must already be attached to the VPC for the site-to-site VPN tunnel to come up at all, and the scenario states the tunnel is up. Option B is not the issue because if the on-premises firewall were blocking IPSec (UDP 500/4500, ESP), the tunnel would not have established. Option D is not the issue because a mismatched encryption algorithm would prevent Phase 2/IPSec SA negotiation, so the tunnel would not be up.

Answer

Verify that the virtual private gateway is attached to the VPC.

Answer

Ensure that the on-premises firewall is configured to allow IPSec traffic.

Answer

Verify that the VPN tunnel is using the correct encryption algorithm.

Question 11

A company is using AWS Direct Connect to connect its on-premises data center to AWS. The company wants to ensure that traffic to the VPC uses the Direct Connect connection instead of the internet. Which configuration is required?

Accepted Answer

Add a route in the VPC route table pointing to the on-premises CIDR via the virtual private gateway.. To ensure traffic to the on-premises network uses Direct Connect instead of the internet, you must add a route in the VPC route table that points to the on-premises CIDR via the virtual private gateway (VGW). The VGW is the AWS side of the Direct Connect connection, and this route directs traffic through the private virtual interface. Without this route, traffic would follow the default route to the internet gateway.

Answer

Create a VPC peering connection to the on-premises network.

Answer

Use a NAT gateway in the VPC.

Answer

Add a route in the VPC route table pointing to the on-premises CIDR via the internet gateway.

Question 12

Order the steps to troubleshoot an AWS Direct Connect virtual interface that is in the 'down' state:

Accepted Answer

Check connection status, then verify virtual interface configuration, then check on-premises BGP, then test connectivity, then escalate if unresolved.. Start with the connection status, then verify virtual interface configuration, check on-premises BGP, test connectivity, and escalate if unresolved.

Answer

Check connection status, then check on-premises BGP, then verify virtual interface configuration, then test connectivity, then escalate if unresolved.

Answer

Check connection status, then test connectivity, then verify virtual interface configuration, then check on-premises BGP, then escalate if unresolved.

Answer

Verify virtual interface configuration, then check connection status, then check on-premises BGP, then test connectivity, then escalate if unresolved.

Question 13

A company is setting up a Site-to-Site VPN connection to AWS. The customer gateway device is behind a NAT device that performs address translation. Which tunnel option must be enabled to ensure the VPN tunnel establishes correctly?

Accepted Answer

NAT Traversal (NAT-T). When a customer gateway device is behind a NAT device, the NAT device modifies the IP addresses and potentially the UDP ports in the IPsec packet headers. Standard IPsec (ESP) does not work through NAT because ESP is a Layer 4 protocol with no port numbers. NAT Traversal (NAT-T) solves this by encapsulating IPsec packets inside UDP (typically port 4500), allowing the NAT device to perform address translation without breaking the VPN tunnel.

Answer

Perfect Forward Secrecy (PFS)

Answer

Dead Peer Detection (DPD)

Answer

IKEv2

Question 14

A company needs to provide internet access to a VPC that has both public and private subnets. They have already created an Internet Gateway and attached it to the VPC. What else must be configured for instances in the public subnet to be reachable from the internet?

Accepted Answer

Add a route to the public subnet's route table pointing 0.0.0.0/0 to the Internet Gateway.. For instances in a public subnet to be reachable from the internet, the subnet's route table must include a default route (0.0.0.0/0) pointing to the Internet Gateway (IGW). The IGW itself is a horizontally scaled, redundant component that provides a target for internet-bound traffic, but without the route, traffic from the internet cannot reach the instances. This route enables bidirectional communication: the IGW performs NAT for instances with public IPs, translating their private IPs to the associated Elastic IP or public IP.

Answer

Launch a NAT Gateway in the public subnet.

Answer

Attach the VPC to an AWS Transit Gateway.

Answer

Establish a VPN connection to the Internet Gateway.

Question 15

A company has multiple AWS accounts and wants to centrally manage network resources using AWS Transit Gateway. Which feature allows sharing the Transit Gateway across accounts?

Accepted Answer

AWS Resource Access Manager (RAM). AWS Resource Access Manager (RAM) is the service that lets you share AWS resources, including Transit Gateway, with other accounts or within an AWS Organization. Once shared via RAM, the recipient accounts can attach their VPCs to the Transit Gateway without needing to own it. This is the standard mechanism for cross-account TGW sharing.

Answer

VPC peering

Answer

AWS Organizations

Answer

AWS Service Catalog