ANS-C01 Practice Test 46 — 15 Questions

Question 1

A company wants to connect its on-premises data center to AWS using AWS Direct Connect. The company requires a dedicated 1 Gbps connection with low latency and high bandwidth for mission-critical workloads. Which type of Direct Connect interface should be used?

Accepted Answer

Dedicated Connection. Option B is correct because a dedicated connection provides a physical Ethernet link dedicated to the customer. A virtual interface is used on top of a dedicated connection. C and D are incorrect as they are not types of Direct Connect interfaces.

Answer

AWS Transit VIF

Answer

VPN Connection

Answer

Hosted Connection

Question 2

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16 and needs to connect to an on-premises network using AWS Site-to-Site VPN. The on-premises network uses 10.0.0.0/8. What should be done to avoid overlapping CIDRs?

Accepted Answer

Create a new VPC with a non-overlapping CIDR and migrate resources. Overlapping CIDRs cause routing issues; the VPC CIDR must be changed to a non-overlapping range.

Answer

Configure a VPN with overlapping CIDRs, it will still work

Answer

Use NAT on the customer gateway to translate addresses

Answer

Use VPC peering to connect to on-premises

Question 3

A company has a VPC peering connection between VPC A (10.0.0.0/16) and VPC B (10.1.0.0/16). Both VPCs have route tables that include routes to each other's CIDR blocks via the peering connection. Instances in VPC A can ping instances in VPC B, but traffic to an Application Load Balancer (ALB) in VPC B fails. The ALB is in public subnets with internet-facing scheme. What is the most likely cause?

Accepted Answer

The ALB security group does not allow inbound traffic from VPC A. Option C is correct because an internet-facing ALB expects traffic to come from the internet via its public IP. Traffic from a peered VPC uses private IPs, which the ALB's security group may not allow unless explicitly permitted. Option A is wrong because route tables are configured correctly. Option B is wrong because the ALB can be reached from the internet. Option D is wrong because VPC peering does not affect the ALB's public accessibility.

Answer

The VPC peering connection does not support transitive routing for ALBs

Answer

The ALB is internet-facing and cannot be accessed from a peered VPC

Answer

The route tables in VPC B do not have a route back to VPC A

Question 4

A company is implementing a network segmentation strategy using AWS Transit Gateway. They have three VPCs: production, development, and shared services. They need to ensure that production and development VPCs can both access shared services, but cannot communicate with each other. Which THREE configurations are required?

Accepted Answer

Create a route table for the shared services VPC that allows routes to both production and development. Option A is correct because each VPC must be attached to the transit gateway. Option B is correct because route tables must be created to control routing. Option C is correct because the shared services VPC needs a route table that allows traffic from both production and development. Option D is wrong because VPC peering is not needed. Option E is wrong because a single route table would allow all-to-all communication.

Answer

Create a VPC peering connection between production and development

Answer

Use a single transit gateway route table for all attachments

Question 5

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network team notices that traffic to a particular EC2 instance is taking a suboptimal path that goes through the internet instead of Direct Connect. The EC2 instance has both a private IP and a public IP. The on-premises router is advertising the VPC's CIDR block over BGP. What is the most likely cause?

Accepted Answer

The on-premises DNS is resolving the EC2 instance's public IP address instead of its private IP address.. If the on-premises router uses the public IP to reach the instance, traffic will go over the internet, not Direct Connect. The issue is that the on-premises DNS or routing is resolving the public IP instead of the private IP for the instance. Option B is correct. Option A is incorrect because the private VIF is designed for private IP traffic. Option C is incorrect because security groups do not affect routing paths. Option D is incorrect because the BGP advertisement of the VPC CIDR is correct.

Answer

The private VIF is not configured to route the VPC CIDR.

Answer

The security group on the EC2 instance is blocking traffic from the on-premises IP range.

Answer

The on-premises router is not advertising the VPC CIDR to the Direct Connect router.

Question 6

A company has a VPC with multiple subnets. They want to use VPC Flow Logs to capture network traffic metadata for troubleshooting. Which TWO of the following are valid destinations for VPC Flow Logs? (Select TWO.)

Accepted Answer

Amazon CloudWatch Logs log group. Option A and Option D are correct. VPC Flow Logs can be published to Amazon S3 or Amazon CloudWatch Logs. Option B is wrong because Kinesis Data Firehose is not a direct destination; you can use CloudWatch Logs subscription filter to send to Firehose. Option C is wrong because SQS is not a supported destination. Option E is wrong because Lambda is not a direct destination; you can use CloudWatch Logs subscription filter to invoke Lambda.

Answer

Amazon Kinesis Data Firehose delivery stream

Answer

AWS Lambda function

Answer

Amazon Simple Queue Service (SQS) queue

Question 7

A company is deploying a VPC with a CIDR block of 10.0.0.0/16. The VPC requires six subnets: three public and three private, each with a /24 CIDR. The company needs to ensure high availability across three Availability Zones. Which TWO of the following are valid subnet CIDR assignments that meet these requirements?

Accepted Answer

Public: 10.0.0.0/24, 10.0.1.0/24, 10.0.2.0/24; Private: 10.0.3.0/24, 10.0.4.0/24, 10.0.5.0/24. Options A and D are correct because they provide three non-overlapping /24 subnets per AZ across three AZs. B overlaps and C and E overlap within the same AZ.

Answer

Public: 10.0.0.0/24, 10.0.1.0/24, 10.0.2.0/24; Private: 10.0.0.0/25, 10.0.1.0/25, 10.0.2.0/25

Answer

Public: 10.0.0.0/24, 10.0.0.0/25, 10.0.0.128/25; Private: 10.0.1.0/24, 10.0.1.0/25, 10.0.1.128/25

Answer

Public: 10.0.0.0/24, 10.0.1.0/24, 10.0.2.0/24; Private: 10.0.0.0/25, 10.0.1.0/25, 10.0.2.0/25

Question 8

A company is building a hybrid network with an AWS Transit Gateway connecting multiple VPCs and an on-premises network via Direct Connect. The on-premises network uses BGP to advertise routes to the Transit Gateway. One of the VPCs has an overlapping CIDR (10.0.0.0/16) with the on-premises network (10.0.0.0/8). The company wants to ensure that traffic from other VPCs to 10.0.0.0/16 goes to the VPC, not on-premises. What configuration is required?

Accepted Answer

No additional configuration is needed; the more specific route will be preferred automatically. Option C is correct because Transit Gateway uses longest prefix match. The VPC's /16 is more specific than the on-premises /8, so traffic to 10.0.0.0/16 will automatically go to the VPC. No additional configuration is needed. Option A is wrong because disabling route propagation would remove the on-premises routes entirely. Option B is wrong because a static route is not needed; longest prefix match already handles it. Option D is wrong because AS_PATH prepending is used to influence BGP path selection, but in this case, longest prefix match is sufficient.

Answer

Use AS_PATH prepending on the on-premises BGP advertisements to make them less preferred

Answer

Add a static route in the Transit Gateway route table for 10.0.0.0/16 pointing to the VPC attachment

Answer

Disable route propagation from the Direct Connect virtual interface to the Transit Gateway

Question 9

A company is using AWS CloudFormation to deploy a VPC with two public subnets and two private subnets across two Availability Zones. The template includes an internet gateway and a NAT gateway in each public subnet. The company needs to ensure that instances in the private subnets can access the internet. Which route table configuration should be used?

Accepted Answer

Add a route 0.0.0.0/0 pointing to the NAT gateway in the same AZ in each private subnet route table.. Option D is correct because private subnets need a default route (0.0.0.0/0) pointing to a NAT gateway in the same AZ for high availability. A and B point to IGW which would not work for private subnets. C only points to one NAT gateway, not AZ-specific.

Answer

Add a route to the internet gateway in the private subnet route tables.

Answer

Add a route to the NAT gateway in the public subnet route tables.

Answer

Add a route 0.0.0.0/0 pointing to a single NAT gateway in both private subnet route tables.

Question 10

A company is deploying a global application with users in North America and Europe. They have set up an Application Load Balancer (ALB) in us-east-1 and another in eu-west-1. They want to route users to the nearest ALB using AWS Global Accelerator. What is the correct configuration to achieve this?

Accepted Answer

Create a Global Accelerator accelerator with endpoint groups in each region, each pointing to the respective ALB. Option A is correct because Global Accelerator uses Anycast IP addresses and health checks to route traffic to the nearest healthy endpoint (ALB). Option B is wrong because Route 53 latency-based routing does not use Anycast; it relies on DNS, which can be cached. Option C is wrong because CloudFront is a CDN, not a load balancer for dynamic content without caching. Option D is wrong because a Network Load Balancer (NLB) is not needed; Global Accelerator can directly target ALBs.

Answer

Use Amazon CloudFront with origins pointing to each ALB

Answer

Place each ALB behind a Network Load Balancer and use Global Accelerator

Answer

Create a Route 53 latency record set with aliases to each ALB

Question 11

A company is deploying a multi-tier web application across multiple Availability Zones in a VPC. The architecture includes public-facing Application Load Balancers, Amazon EC2 instances in private subnets, and an Amazon RDS for MySQL Multi-AZ DB instance. To meet compliance requirements, all traffic between the web tier and database tier must be encrypted and must not traverse the internet. Which TWO actions should the company take to implement this securely? (Choose two.)

Accepted Answer

Enable SSL/TLS encryption on the RDS DB instance and configure the web servers to connect using SSL.. Option A is correct because enabling encryption in transit with SSL/TLS between web tier and RDS MySQL encrypts the traffic. Option C is correct because using an RDS endpoint within the same VPC ensures traffic does not traverse the internet. Option B is incorrect because RDS instances do not have Elastic IPs in private subnets. Option D is incorrect because an RDS endpoint already provides a private IP within the VPC; a VPC endpoint is for services like S3. Option E is incorrect because a VPN connection is not needed for traffic within the same VPC.

Answer

Establish an AWS Site-to-Site VPN between the web tier subnets and the database subnet.

Answer

Create a VPC endpoint for Amazon RDS and route database traffic through it.

Answer

Assign an Elastic IP address to the RDS DB instance to ensure a stable IP for the web tier.

Question 12

A company is deploying an AWS Network Firewall in a centralized inspection VPC to inspect traffic between VPCs connected to an AWS Transit Gateway. The architecture uses Transit Gateway route tables to send inter-VPC traffic through the inspection VPC. The Network Firewall is configured with stateful and stateless rule groups. After deployment, the security team notices that traffic from VPC A to VPC B is being dropped. Other traffic flows correctly. What is the MOST likely cause of this issue?

Accepted Answer

The stateless rule group is set to forward traffic, but the stateful rule group is not configured to allow the traffic.. Option B is correct because the stateful rule group must have a pass rule for the traffic. Option A is incorrect because stateless rules forward traffic but stateful rules can drop. Option C is incorrect because route tables in VPC A do not affect firewall. Option D is incorrect because Transit Gateway does not have security groups.

Answer

The route table for VPC A's subnets does not have a route to the inspection VPC.

Answer

The stateful rule group is configured to drop all traffic that is not explicitly allowed.

Answer

The security group attached to the Transit Gateway is blocking the traffic.

Question 13

A company is deploying a multi-tier web application on AWS. The application uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances in private subnets across multiple Availability Zones. The security team requires that all traffic between the ALB and the EC2 instances be encrypted using TLS. The application must also support HTTP health checks from the ALB. Which TWO actions should the network engineer take to meet these requirements? (Choose TWO.)

Accepted Answer

Install a certificate on each EC2 instance and configure the target group to use HTTPS.. Options B and D are correct. Option B: Installing a certificate on EC2 instances enables TLS termination at the instance, allowing encrypted traffic from the ALB. Option D: Configuring the target group to use HTTPS health checks ensures health checks are sent over TLS. Option A is incorrect because ALB does not support HTTPS health checks to instances without a certificate. Option C is incorrect because the listener should use HTTPS to forward encrypted traffic. Option E is incorrect because the security group should allow HTTPS (port 443) from the ALB, not HTTP.

Answer

Configure the ALB listener to use HTTP and enable stickiness.

Answer

Configure the ALB listener to use HTTPS and set the target group protocol to HTTP.

Answer

Configure the security group for EC2 instances to allow inbound HTTP traffic from the ALB.

Question 14

A network engineer is reviewing VPC Flow Logs for a VPC. The logs show that traffic from 10.0.1.5 to 10.0.2.10 on port 443 is being accepted and rejected intermittently. Both instances are in the same VPC. What is the most likely cause?

Accepted Answer

The security group on the destination instance is configured to allow inbound HTTPS but deny outbound traffic.. Option C is correct because a security group that allows inbound HTTPS but denies outbound can cause intermittent rejects if the return traffic is blocked. NACLs are stateless and would block consistently. B and D are less likely.

Answer

The network ACL is blocking traffic.

Answer

The route table is misconfigured.

Answer

The source instance's security group is denying outbound traffic.

Question 15

A network engineer is troubleshooting connectivity issues. The route table shows a blackhole route for 10.0.0.0/8 pointing to a VPC endpoint (vpce-12345678). What is the most likely cause of the blackhole state?

Accepted Answer

The VPC endpoint (vpce-12345678) has been deleted.. Option B is correct because a blackhole route for a VPC endpoint typically indicates the endpoint has been deleted or is in a failed state. A is incorrect because the VPC CIDR is more specific. C is irrelevant. D is incorrect because blackhole doesn't indicate no route.

Answer

The VPC CIDR 10.0.0.0/16 is overlapping with the endpoint route.

Answer

The route table does not have a route to the internet.

Answer

The internet gateway is not attached to the VPC.