ANS-C01 Practice Test 45 — 15 Questions

Question 1

A company is deploying a web application that must be accessible over HTTPS only. They are using an Application Load Balancer (ALB) with an SSL certificate from AWS Certificate Manager (ACM). Which TWO configurations are necessary to ensure that only HTTPS traffic reaches the application?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the security group for the ALB to allow inbound traffic on port 443 from 0.0.0.0/0.. To ensure only HTTPS traffic reaches the application, the security group for the ALB should allow inbound traffic on port 443 from anywhere (option C), and the ALB listener must be configured to accept traffic on port 443 using the SSL certificate from ACM (option E). Option A is incorrect because allowing port 80 would permit HTTP traffic. Option B is incorrect because an HTTP listener would accept unencrypted traffic. Option D is incorrect because redirecting HTTP to HTTPS still allows HTTP traffic to reach the ALB initially; the proper approach is to not accept HTTP at all.

Answer

Configure the security group for the ALB to allow inbound traffic on port 80 from 0.0.0.0/0.

Answer

Configure the ALB listener to accept traffic on port 80.

Answer

Configure the ALB to redirect HTTP traffic to HTTPS.

Question 2

Refer to the exhibit. A company has two VPCs (vpc-aaaaaaaa and vpc-bbbbbbbb) that are peered. The CIDR blocks are both 10.0.0.0/16. The peering connection status is 'active'. Which of the following is true about this configuration?

Accepted Answer

The VPCs cannot communicate because of overlapping CIDR blocks. VPC peering does not support overlapping CIDR blocks. Even though the peering connection status is active, routes cannot be added to the route tables because the CIDR blocks are identical (both 10.0.0.0/16), preventing communication. Option B is incorrect because the peering connection can become active despite overlapping CIDRs; the issue arises at the routing layer. Option C is incorrect because the overlapping CIDRs prevent any communication between the VPCs. Option D is incorrect because DNS resolution is not automatically enabled; it requires additional configuration.

Answer

The VPC peering connection will not become active due to overlapping CIDRs

Answer

The VPCs can communicate using the peering connection without any issues

Answer

DNS resolution between the VPCs will be automatically enabled

Question 3

Which THREE are valid methods to secure data in transit between a VPC and an on-premises network over the internet? (Choose three.)

Accepted Answer

AWS Direct Connect with a VPN. To secure data in transit between a VPC and an on-premises network over the internet, the valid methods are AWS Direct Connect with a VPN (B), AWS Client VPN (C), and AWS Site-to-Site VPN (E). 
- AWS Site‑to‑Site VPN creates an IPsec VPN tunnel over the internet between the VPC and the on‑premises network, encrypting all traffic.
- AWS Client VPN is a managed service that allows individual clients to securely connect to the VPC over the internet using an OpenVPN tunnel.
- AWS Direct Connect with a VPN combines a dedicated physical connection (Direct Connect) with an IPsec VPN to provide both low latency and encryption. While Direct Connect itself is not over the internet, the VPN layer secures the data in transit. 
- Option A (VPC Endpoint) is used to access AWS services privately within the VPC, not for on‑premises connectivity. 
- Option D (VPC Peering) connects VPCs, not on‑premises networks.

Answer

VPC Endpoint (Gateway or Interface)

Answer

VPC Peering

Question 4

A company wants to connect its on-premises data center to a VPC using AWS Site-to-Site VPN. Which of the following is required to establish the VPN connection?

Accepted Answer

Virtual private gateway attached to the VPC and a customer gateway representing the on-premises router. To establish a Site-to-Site VPN, you need a virtual private gateway (VGW) or transit gateway on the AWS side, and a customer gateway (CGW) representing the on-premises router. Option C is correct. Option A is incorrect because a Direct Connect gateway is used for Direct Connect connections, not VPN. Option B is incorrect because an internet gateway is used for public internet traffic, not VPN. Option D is incorrect because a VPC endpoint is for private access to AWS services, not for establishing a VPN connection.

Answer

Direct Connect gateway associated with the VPC

Answer

Internet gateway attached to the VPC

Answer

VPC endpoint for the VPN service

Question 5

A company is designing a highly available architecture for a web application using an Application Load Balancer (ALB) in multiple Availability Zones. Which TWO configurations are required to achieve high availability?

Accepted Answer

The ALB must be configured with subnets in at least two Availability Zones. The ALB must be configured with subnets in at least two Availability Zones to remain available if one AZ fails. Option B is correct because an internet-facing ALB is required to accept traffic from the internet; an internal ALB would not be accessible. Option C is incorrect because high availability does not require three instances; two instances (one per AZ) can provide high availability. Option D is incorrect because NAT gateways are not required for ALB high availability; they are used for outbound internet access from private subnets. Option E is incorrect because cross-zone load balancing is enabled by default, but it is not a requirement for high availability; high availability is achieved by having instances in multiple AZs.

Answer

At least three EC2 instances must be registered with the ALB

Answer

A NAT gateway must be deployed in each Availability Zone

Answer

Cross-zone load balancing must be enabled on the ALB

Question 6

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to an on-premises network with CIDR 172.16.0.0/12. They are using an AWS Transit Gateway with a VPN attachment to the on-premises network. The transit gateway route table has a static route for 172.16.0.0/12 pointing to the VPN attachment. Which THREE of the following are necessary for traffic to flow from the VPC to on-premises?

Accepted Answer

The VPC route tables include a route for 172.16.0.0/12 pointing to the transit gateway. Necessary because the VPC route tables must have a route for 172.16.0.0/12 pointing to the transit gateway to forward traffic to on-premises. Option B is necessary because the VPC must be attached to the transit gateway to allow communication. Option C is necessary because the transit gateway route table must include a static route for 172.16.0.0/12 pointing to the VPN attachment. Option D is not necessary because the on-premises router does not need to advertise the route over BGP; the static route in the transit gateway suffices. Option E is not necessary because the VPN tunnel can use static routing instead of dynamic BGP.

Answer

The on-premises router is advertising the 172.16.0.0/12 route over BGP

Answer

The VPN tunnel is configured with dynamic BGP routing

Question 7

A company wants to centrally manage and enforce VPC security group rules across multiple accounts in AWS Organizations. Which AWS service should be used?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager is the correct service for centrally managing and enforcing VPC security group rules across multiple accounts in AWS Organizations. It provides centralized security policy management, allowing you to define common security group rules and automatically apply them to new and existing accounts. AWS Config (Option A) is primarily for compliance auditing and resource configuration history, not enforcement. AWS CloudFormation StackSets (Option B) can deploy resources across accounts but does not provide ongoing enforcement of security policies. IAM Policies (Option D) control permissions, not security group configurations.

Answer

AWS Config

Answer

AWS CloudFormation StackSets

Answer

IAM Policies

Question 8

Refer to the exhibit. A network engineer has configured VPC Flow Logs for a VPC and is verifying the logs. The flow logs are being delivered to CloudWatch Logs, but the engineer notices that the logs do not contain the 'srcaddr' and 'dstaddr' fields. What is the most likely cause?

Accepted Answer

The flow log is using the default log format, which does not include source and destination addresses. The default log format for VPC Flow Logs does not include source and destination addresses. To include those fields, you must specify a custom format with `${srcaddr}` and `${dstaddr}`. Since the logs are missing these fields, the flow log is likely using the default format rather than a custom one.

Answer

The flow log is configured with TrafficType set to 'REJECT' only

Answer

The IAM role FlowLogRole does not have permission to write to CloudWatch Logs

Answer

The flow log is configured with a MaxAggregationInterval of 60 seconds, which causes fields to be omitted

Question 9

A network engineer is troubleshooting connectivity issues between an Amazon EC2 instance in a public subnet and an on-premises server over AWS Direct Connect. The instance can reach the internet but cannot reach the on-premises server. Which TWO actions should the engineer take to diagnose the issue?

Accepted Answer

Check the VPC route table to ensure a route exists for the on-premises CIDR pointing to the virtual private gateway. The correct answers are A and C. For connectivity between an EC2 instance in a public subnet and an on-premises server over AWS Direct Connect, two key checks are: (1) The VPC route table must have a route for the on-premises CIDR pointing to the virtual private gateway (VGW) to route traffic to the Direct Connect connection. (2) The security group attached to the EC2 instance must allow inbound traffic from the on-premises CIDR, as security groups act as a stateful firewall for the instance. Option B is incorrect because Direct Connect uses a virtual private gateway, not a VPN tunnel. Option D is incorrect because VPC Flow Logs are used for analysis, not real-time diagnosis. Option E is incorrect because network ACLs are stateless; outbound traffic does not automatically allow return traffic, so explicit inbound rules are required for the return traffic.

Answer

Check the VPN connection status to ensure the tunnel is up

Answer

Enable VPC Flow Logs and analyze them for dropped packets

Answer

Check the network ACLs for the subnet to ensure they allow inbound traffic from on-premises

Question 10

A network engineer is troubleshooting an AWS Direct Connect connection that is experiencing high latency. The connection is a 1 Gbps dedicated connection. The engineer notices that the link utilization is at 90%. What is the MOST likely cause of the high latency?

Accepted Answer

High bandwidth utilization causing queuing. High bandwidth utilization (90%) leads to queuing delays as packets wait in buffers, increasing latency. Option A is incorrect: the virtual interface type (private vs public) does not directly cause high latency. Option B is incorrect: BGP keepalive timer misconfiguration affects BGP session stability, not latency. Option D is incorrect: jumbo frames can reduce latency by reducing overhead, not increase it.

Answer

The virtual interface is configured as private instead of public

Answer

BGP keepalive timer misconfiguration

Answer

The use of jumbo frames

Question 11

A company has a VPC with a CIDR block of 10.0.0.0/16. They have two subnets: subnet-A (10.0.1.0/24) and subnet-B (10.0.2.0/24). An EC2 instance in subnet-A needs to communicate with an RDS database in subnet-B. Both subnets are in the same Availability Zone. What is the most efficient way to enable this communication?

Accepted Answer

No additional configuration is required. The instance and database can communicate within the same VPC.. Both the EC2 instance and the RDS database reside within the same VPC (10.0.0.0/16), and subnets within a VPC can communicate with each other by default using the VPC's local route. No additional configuration is needed, as the VPC's main route table or subnet route tables already include a local route for the VPC CIDR, enabling direct communication within the same Availability Zone.

Answer

Create a Transit Gateway and attach both subnets to it.

Answer

Place a NAT Gateway in subnet-A and configure route tables accordingly.

Answer

Create a VPC Peering connection between the two subnets.

Question 12

Order the steps to set up a redundant Direct Connect connection with two virtual interfaces in different AWS regions:

Accepted Answer

Provision Direct Connect connections, then create virtual interfaces (VIFs), then configure BGP, then tune routing, then test failover.. First provision the connections, then create VIFs, configure BGP, tune routing, then test failover.

Answer

Create virtual interfaces (VIFs), then provision Direct Connect connections, then configure BGP, then tune routing, then test failover.

Answer

Provision Direct Connect connections, then configure BGP, then create virtual interfaces (VIFs), then tune routing, then test failover.

Answer

Provision Direct Connect connections, then create virtual interfaces (VIFs), then test failover, then configure BGP, then tune routing.

Question 13

An IAM policy is attached to a user. What is the effect when the user attempts to launch an EC2 instance of type m5.large?

Accepted Answer

The action is denied because the instance type does not equal t2.micro.. The IAM policy attached to the user includes an Allow statement for ec2:RunInstances only when the condition ec2:InstanceType equals t2.micro. Since the user is attempting to launch an m5.large instance, the condition is not satisfied, and the Allow statement does not apply. Consequently, the default implicit deny takes effect, and the action is denied. It is not an explicit denial but rather the absence of an applicable Allow.

Answer

The action is allowed because the policy allows t2.micro instances.

Answer

The action is allowed because there is no explicit allow for RunInstances.

Answer

The action is denied because the condition is not met.

Question 14

A company has a VPC with multiple subnets and uses AWS Transit Gateway to connect to on-premises via AWS Direct Connect. They want to implement network segmentation so that certain VPCs can only communicate with specific on-premises networks. Which THREE components should they use? (Choose THREE.)

Accepted Answer

Direct Connect gateway. Options B, C, and D are correct. The Direct Connect gateway (B) integrates Direct Connect with Transit Gateway. The Transit Gateway association to the Direct Connect gateway (C) enables routing between VPCs and on-premises networks. Transit Gateway route tables (D) allow separate routing domains to segment traffic. Option A (VPC peering) is not needed because Transit Gateway already handles inter-VPC routing. Option E (Site-to-Site VPN) is not required when using Direct Connect for connectivity.

Answer

VPC peering connections

Answer

Site-to-Site VPN connection

Question 15

A company is designing a network security solution for a VPC that hosts a multi-tier web application. The web servers are in a public subnet, and the application servers are in a private subnet. The company wants to ensure that the web servers can only be accessed on port 443 from the internet, and the application servers can only be accessed from the web servers on port 3306. Which THREE components should be configured?

Accepted Answer

Network ACL on the public subnet allowing inbound 443 from 0.0.0.0/0 and outbound ephemeral ports. The correct components are: a security group for web servers allowing inbound 443 from 0.0.0.0/0 (E), a security group for application servers allowing inbound 3306 from the web server security group (D), and a network ACL on the public subnet allowing inbound 443 and outbound ephemeral ports (B) to add a stateless filtering layer. Option A is incorrect because the NACL rule lacks an outbound rule for return traffic, making it incomplete. Option C is unnecessary because the access control for the private subnet is best achieved with security groups, and a NACL is not required for this purpose.

Answer

Network ACL on the public subnet allowing inbound 443 from 0.0.0.0/0

Answer

Network ACL on the private subnet allowing inbound 3306 from the public subnet CIDR