ANS-C01 Practice Test 46 — 15 Questions

Question 1

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access an S3 bucket for backups. The company wants to minimize data transfer costs and avoid traversing the internet. Which solution should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a VPC Gateway Endpoint for S3 and attach a bucket policy allowing access from the VPC. A VPC Gateway Endpoint for S3 provides private connectivity to S3 from within the VPC without needing an internet gateway, NAT gateway, or VPN. This minimizes data transfer costs and avoids internet traversal. Option A (Gateway Endpoint) is the correct solution. Option B (proxy server) introduces additional complexity and cost, and does not avoid internet traversal. Option C (Interface Endpoint) is more expensive and is not necessary because S3 supports Gateway Endpoints. Option D (public subnet with NAT) requires the instance to have a public IP and uses a NAT gateway, which incurs costs and uses the internet.

Answer

Set up a proxy server in the public subnet and configure the EC2 instance to use it

Answer

Create a VPC Interface Endpoint for S3 and associate it with the private subnet

Answer

Place the EC2 instance in a public subnet with a public IP and use a NAT gateway

Question 2

A company wants to audit all network traffic to and from EC2 instances for security analysis. Which AWS service should they enable?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture information about IP traffic going to and from network interfaces in a VPC, making them the correct choice for auditing network traffic. Option A is correct. AWS CloudTrail records API calls, not network traffic. AWS Config records resource configuration changes. Amazon GuardDuty analyzes logs and flows for threats, but it does not capture the raw traffic itself.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Config

Question 3

A company wants to ensure that all IAM users have multi-factor authentication (MFA) enabled. Which AWS service can be used to enforce this policy?

Accepted Answer

IAM policy with a condition for aws:MultiFactorAuthPresent. An IAM policy with a condition that checks aws:MultiFactorAuthPresent can require MFA for API calls, enforcing MFA usage. Option A is wrong because AWS Organizations SCPs can enforce policies at the account level but cannot require MFA for individual IAM users without an accompanying IAM policy. Option B is wrong because AWS Config can detect non-compliance with MFA rules but cannot enforce the policy itself. Option D is wrong because AWS CloudTrail is used for logging API activity, not for enforcement.

Answer

AWS Organizations SCP

Answer

AWS Config

Answer

AWS CloudTrail

Question 4

A company needs to provide temporary, limited-privilege credentials to users so they can access AWS resources from mobile apps. Which AWS service should they use?

Accepted Answer

AWS Security Token Service (STS). AWS Security Token Service (STS) enables you to request temporary, limited-privilege credentials for users, which is ideal for mobile apps. Option A (KMS) is used for encryption key management, not credential generation. Option B (Cognito user pools) provides user identity management but does not directly issue temporary AWS credentials. Option D (IAM user with access keys) provides long-term credentials, not temporary.

Answer

AWS Key Management Service (KMS)

Answer

Amazon Cognito user pools

Answer

IAM user with access keys

Question 5

A company is designing a network security architecture for a multi-tier application. They want to ensure that the web tier can communicate with the application tier only on specific ports, and the application tier can communicate with the database tier only on specific ports. Which TWO configurations should be implemented?

Accepted Answer

Use network ACLs to provide a secondary layer of stateless filtering at the subnet level.. The correct answers are C and E. Security groups (E) are stateful and can reference other security groups as a source, allowing traffic between tiers only on required ports. Network ACLs (C) are stateless and provide a secondary layer of filtering at the subnet level. Option A is wrong because a transit gateway is used to connect multiple VPCs, not for filtering within a VPC. Option B is wrong because VPC peering connects VPCs, and security groups cannot be applied to a peering connection. Option D is wrong because a single security group cannot differentiate traffic between tiers; each tier needs its own security group.

Answer

Use a transit gateway with network ACLs to filter traffic between tiers.

Answer

Use VPC peering to connect the tiers and apply security groups on the peering connection.

Answer

Use a single security group for all tiers and define rules based on CIDR blocks.

Question 6

A company is designing a multi-account AWS environment using AWS Organizations. They need to enforce that all new S3 buckets created across accounts have encryption enabled and block public access. Which TWO approaches meet these requirements? (Choose two.)

Accepted Answer

Apply a service control policy (SCP) to the root organizational unit that denies s3:PutBucketPublicAccessBlock and s3:PutBucketEncryption if the configuration does not meet requirements.. SCPs can be applied to the root OU to deny s3:PutBucketPublicAccessBlock and s3:PutBucketEncryption unless the bucket meets encryption and public access requirements, thus enforcing the policy organization-wide. Option C is correct because AWS Config conformance packs can include managed rules to detect buckets without encryption or with public access, and automatic remediation actions can be configured to fix non-compliant buckets. Option B is incorrect because an S3 bucket policy only applies to a single bucket and cannot enforce requirements across all buckets in all accounts; it also cannot prevent creation of buckets that don't meet the policy. Option D is incorrect because CloudTrail only provides logging and alerting; it does not enforce or remediate. Option E is incorrect because an IAM role with MFA requirement does not enforce encryption or public access settings on buckets; it only controls who can create buckets.

Answer

Use an S3 bucket policy that denies all principals unless encryption is enabled.

Answer

Enable AWS CloudTrail to monitor bucket creation and send alerts to the security team.

Answer

Create an IAM role in each account that requires MFA for creating S3 buckets.

Question 7

A company uses a VPC with multiple subnets in different Availability Zones. The VPC has a NAT Gateway in a public subnet of us-east-1a, and a second NAT Gateway in us-east-1b for high availability. Each private subnet in us-east-1a routes 0.0.0.0/0 to the NAT Gateway in us-east-1a, and private subnets in us-east-1b route to the NAT Gateway in us-east-1b. The company's EC2 instances in private subnets need to access an external service using IPv6. The VPC is not configured for IPv6. The network engineer needs to enable IPv6 connectivity for these instances. Which solution is the most cost-effective and scalable?

Accepted Answer

Add an IPv6 CIDR block to the VPC, assign IPv6 addresses to private subnets, and add a route for ::/0 to an egress-only internet gateway.. Since the VPC is not IPv6-enabled, adding an IPv6 CIDR block assigns IPv6 addresses to subnets. For outbound-only IPv6 access from private subnets, an egress-only internet gateway (EIGW) is the appropriate and most cost-effective solution because it allows outbound traffic to the internet while preventing inbound connections, similar to a NAT gateway for IPv4. A route for ::/0 to the EIGW from the private subnets achieves the goal. Option A is incorrect because NAT64 translates IPv6 to IPv4, but the target service uses IPv6, so no translation is needed. Option C is incorrect because an internet gateway would permit inbound traffic and instances would need public IPv6 addresses, which is not stated and is less secure. Option D is incorrect because NAT Gateways do not support IPv6.

Answer

Add an IPv6 CIDR block to the VPC and configure a NAT64 gateway to translate IPv6 to IPv4.

Answer

Attach an internet gateway to the VPC and add a route for ::/0 to the internet gateway in the private subnets.

Answer

Add an IPv6 CIDR block to the VPC and use the existing NAT Gateways with IPv6.

Question 8

A company has a VPC with a CIDR of 172.16.0.0/16. The VPC has two subnets: subnet A (172.16.1.0/24) and subnet B (172.16.2.0/24). The company launches an EC2 instance in subnet A with a private IP of 172.16.1.10 and a public IP. The instance's security group allows inbound SSH from 0.0.0.0/0. The subnet A's route table has a route to an internet gateway (IGW) for 0.0.0.0/0. The network engineer can SSH into the instance from the internet. The company then attaches a second network interface (eth1) to the instance with an IP from subnet B (172.16.2.20). The engineer wants to use this interface for additional management traffic. After attaching, the engineer can no longer SSH into the instance via the original public IP. What is the MOST likely cause?

Accepted Answer

The operating system's routing table now uses eth1 as the default gateway, causing asymmetric routing.. When a second ENI (eth1) is attached to an EC2 instance, the operating system may reassign the default gateway route to the new interface, especially if the new interface receives a default route via DHCP. This causes traffic from the instance to egress via eth1 instead of eth0, while inbound traffic still arrives via the original public IP on eth0. This asymmetric routing breaks the SSH session because the response packets are sent out through eth1, which is in a different subnet and does not have the same public IP, so they are dropped. Option A correctly identifies this issue. Option D is incorrect because the IGW is attached to the VPC, not to individual subnets. Options B and C are not the most likely cause given the scenario.

Answer

The route table for subnet B does not have a route to the IGW.

Answer

The security group for eth1 blocks inbound SSH.

Answer

The internet gateway is not attached to subnet B.

Question 9

A company has a production VPC with CIDR 10.0.0.0/16. They have an internet-facing Application Load Balancer (ALB) in public subnets across two Availability Zones. The ALB distributes traffic to a fleet of EC2 instances in private subnets. The EC2 instances need to access an Amazon S3 bucket to retrieve configuration files. The company wants to minimize data transfer costs and ensure that traffic to S3 does not traverse the internet. A network engineer created a Gateway VPC Endpoint for S3 in the VPC and added a route in the public subnet route tables pointing to the endpoint. However, the EC2 instances still cannot access the S3 bucket. The security groups for the EC2 instances allow outbound HTTPS to 0.0.0.0/0. The NACLs are default (allow all). The S3 bucket policy allows access from the VPC endpoint. What is the MOST likely reason the EC2 instances cannot access S3?

Accepted Answer

The route to the Gateway VPC Endpoint was added only to public subnets, not to private subnets. The Gateway VPC Endpoint for S3 must have a route in the route tables of the subnets where the EC2 instances reside. The engineer added the route only to public subnet route tables, not the private subnets. Therefore, traffic from the EC2 instances to S3 still uses the default route (0.0.0.0/0) via NAT Gateway or Internet Gateway, not the VPC endpoint. Option A is incorrect because the endpoint is in the same region. Option B is incorrect because the security group allows outbound HTTPS to all destinations. Option C is incorrect because the S3 bucket policy includes the necessary condition.

Answer

The Gateway VPC Endpoint is in a different region than the S3 bucket

Answer

The security group for the EC2 instances does not allow outbound traffic to the S3 prefix list

Answer

The S3 bucket policy does not include a condition for the VPC endpoint

Question 10

A company is using AWS Transit Gateway to connect multiple VPCs and an on-premises network via Direct Connect. The network team wants to isolate traffic between VPCs while allowing all VPCs to reach the on-premises network. Which TWO configurations should be implemented?

Accepted Answer

Use a Direct Connect gateway to propagate routes to all VPCs. Creating separate Transit Gateway route tables for each VPC and associating them with the respective VPC attachments enforces traffic isolation between VPCs: each VPC route table only contains routes to the on-premises network, not to other VPCs, thus achieving the isolation requirement. Additionally, using a Direct Connect gateway to propagate routes to all VPCs ensures that the on-premises network routes are available in these isolated route tables. Option A is incorrect because a Direct Connect virtual interface must be attached to a Direct Connect Gateway, which then associates with the Transit Gateway via a transit gateway attachment. A VPN attachment is for VPN connections, not Direct Connect. Option D is incorrect because a single Transit Gateway route table for all attachments would allow VPC-to-VPC communication via automatically propagated routes. Option E is incorrect because VPC peering connections would create direct connectivity between VPCs, violating the isolation requirement.

Answer

Attach the Direct Connect virtual interface to a VPN attachment on the Transit Gateway

Answer

Use a single Transit Gateway route table for all attachments

Answer

Create VPC peering connections between each VPC

Question 11

A company uses a centralized inspection VPC for traffic inspection. All VPCs route traffic to the inspection VPC via Transit Gateway. The security team wants to ensure that all traffic between VPCs is inspected by a network virtual appliance in the inspection VPC. Which Transit Gateway feature should be configured?

Accepted Answer

Transit Gateway route tables. To ensure that all traffic between VPCs is inspected by the network virtual appliance in the inspection VPC, you must control the routing. Transit Gateway route tables (Option C) allow you to define which traffic is sent to the inspection VPC by associating attachments with specific route tables and adding static routes or propagating routes. This ensures that inter-VPC traffic is forced through the inspection appliance before reaching its destination. Transit Gateway flow logs (Option A) only provide visibility into traffic but do not enforce inspection; they are a monitoring tool, not a routing mechanism. Therefore, Option C is correct, while Options A, B, and D are incorrect.

Answer

Transit Gateway flow logs

Answer

Transit Gateway multicast

Answer

Transit Gateway peering

Question 12

A company has a VPC with public and private subnets. The private subnets have a route to a NAT gateway for outbound internet access. The security team wants to audit all traffic from the private subnets to the internet. Which TWO steps should be taken to capture this traffic?

Accepted Answer

Create a VPC Flow Log for the VPC and filter by the NAT gateway's network interface.. To capture traffic from private subnets to the internet through a NAT gateway, you need to enable VPC Flow Logs on the NAT gateway's elastic network interface (option C). Additionally, you can create a VPC Flow Log for the VPC and filter by the NAT gateway's network interface (option B) to capture the same traffic. Option A is incorrect because VPC Flow Logs on the internet gateway capture traffic that reaches the internet gateway, but traffic from private subnets goes through the NAT gateway, not directly through the internet gateway. Option D is incorrect because a Site-to-Site VPN is not used for outbound internet traffic from private subnets; it is for connecting to on-premises networks. Option E is incorrect because AWS CloudTrail logs API calls, not network traffic.

Answer

Enable VPC Flow Logs on the internet gateway.

Answer

Set up an AWS Site-to-Site VPN to route traffic through a third-party logging appliance.

Answer

Enable AWS CloudTrail for the NAT gateway.

Question 13

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access an S3 bucket for backups. The company wants to minimize data transfer costs and avoid traversing the internet. Which solution should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify that the NAT Gateway has an Elastic IP and the private subnet's route table has a route to the NAT Gateway. For a NAT Gateway to provide internet access to instances in a private subnet, it must have an Elastic IP (EIP) attached, and the private subnet's route table must include a route pointing to the NAT Gateway as the target for 0.0.0.0/0. Option A is wrong because NAT Gateways must reside in a public subnet (with a route to an Internet Gateway) to work. Option B is wrong because the NAT Gateway must be in the same VPC but not necessarily the same subnet as the EC2 instance; it should be in a public subnet. Option D is wrong because an Internet Gateway is attached to the VPC, not to individual subnets; attaching an Internet Gateway directly to a private subnet is not a valid configuration.

Answer

Move the NAT Gateway to a private subnet

Answer

Verify that the NAT Gateway is in the same subnet as the EC2 instance

Answer

Attach an Internet Gateway to the private subnet

Question 14

A company is deploying a new application that requires low latency between EC2 instances. Which THREE placement group strategies should the network engineer consider?

Accepted Answer

Spread placement group. The correct placement group strategies are Cluster placement group (lowest latency, highest throughput), Spread placement group (protects against hardware failures by placing instances on distinct racks), and Partition placement group (reduces likelihood of correlated failures for large distributed and replicated workloads). Option A (Cross-zone load balancing) is a feature of Elastic Load Balancing, not a placement group. Option C (Availability Zone placement group) is not a valid placement group type.

Answer

Cross-zone load balancing

Answer

Availability Zone placement group

Question 15

A company wants to monitor network traffic between two VPCs connected via a Transit Gateway. Which THREE AWS services can be used to capture and analyze this traffic?

Accepted Answer

VPC Flow Logs. Options A, C, and D are correct. VPC Flow Logs capture IP traffic for network interfaces, Transit Gateway Flow Logs capture traffic through the transit gateway, and third-party network monitoring appliances deployed in a VPC can capture and analyze traffic. Option B is incorrect because AWS Config records configuration changes, not traffic. Option E is incorrect because AWS CloudTrail logs API calls, not network traffic.

Answer

AWS Config

Answer

AWS CloudTrail