ANS-C01 Practice Test 46 — 15 Questions

Question 1

A company uses a VPC with multiple subnets in different Availability Zones. The VPC has a NAT Gateway in a public subnet of us-east-1a, and a second NAT Gateway in us-east-1b for high availability. Each private subnet in us-east-1a routes 0.0.0.0/0 to the NAT Gateway in us-east-1a, and private subnets in us-east-1b route to the NAT Gateway in us-east-1b. The company's EC2 instances in private subnets need to access an external service using IPv6. The VPC is not configured for IPv6. The network engineer needs to enable IPv6 connectivity for these instances. Which solution is the most cost-effective and scalable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add an IPv6 CIDR block to the VPC, assign IPv6 addresses to private subnets, and add a route for ::/0 to an egress-only internet gateway.. The most cost-effective and scalable solution is to add an IPv6 CIDR block to the VPC, assign IPv6 addresses to the private subnets, and route ::/0 to an egress-only internet gateway. This allows instances in private subnets to initiate outbound IPv6 traffic to the internet while preventing inbound IPv6 connections, which is ideal for private instances needing to access external services. It is cost-effective because egress-only internet gateways are free (you only pay for data transfer) and scalable as they automatically scale with your traffic.

Answer

Add an IPv6 CIDR block to the VPC and configure a NAT64 gateway to translate IPv6 to IPv4.

Answer

Attach an internet gateway to the VPC and add a route for ::/0 to the internet gateway in the private subnets.

Answer

Add an IPv6 CIDR block to the VPC and use the existing NAT Gateways with IPv6.

Question 2

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access the internet for software updates. The instance has a route to a NAT Gateway in the public subnet. However, the instance cannot reach the internet. Which step should the network engineer take to troubleshoot?

Accepted Answer

Verify that the NAT Gateway has an Elastic IP and the private subnet's route table has a route to the NAT Gateway. For a private subnet's EC2 instance to reach the internet via a NAT Gateway, the NAT Gateway must have an Elastic IP (EIP) attached and the private subnet's route table must contain a route to that NAT Gateway. Without the EIP, the NAT Gateway cannot perform source NAT, and without the route, traffic never reaches the NAT Gateway. Therefore, verifying these two elements is the correct troubleshooting step.

Answer

Move the NAT Gateway to a private subnet

Answer

Verify that the NAT Gateway is in the same subnet as the EC2 instance

Answer

Attach an Internet Gateway to the private subnet

Question 3

A company has a VPC with CIDR 172.16.0.0/16. They have two subnets: 172.16.1.0/24 (public) and 172.16.2.0/24 (private) in us-west-2a. They have an EC2 instance in the private subnet that needs to access an S3 bucket for log uploads. The company wants to avoid using a NAT Gateway to reduce costs. The S3 bucket is in the same region. Which solution should the network engineer implement?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and add a route from the private subnet to the endpoint.. A VPC Gateway Endpoint for S3 allows private subnet resources to access S3 without traversing the internet or requiring a NAT Gateway. The endpoint uses AWS PrivateLink to route traffic directly to S3 over the AWS network, and you must add a route in the private subnet's route table pointing to the endpoint (prefix list ID) to enable connectivity.

Answer

Assign an IAM instance profile to the EC2 instance that allows S3 access.

Answer

Set up a VPN connection from the VPC to the S3 bucket.

Answer

Create an S3 access point and configure the VPC to use it.

Question 4

A security engineer is designing a VPC with public and private subnets. The company requires that all outbound traffic from private subnets to the internet must go through a single IP address for logging and compliance. Which service should be used?

Accepted Answer

NAT Gateway. A NAT Gateway provides outbound internet access for instances in private subnets while using a single Elastic IP address, ensuring all outbound traffic appears to originate from that IP. This satisfies the requirement for a single IP for logging and compliance. NAT Gateway is highly available within an AZ and scales automatically.

Answer

Transit Gateway

Answer

Internet Gateway

Answer

VPC Endpoint

Question 5

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance is behind a NAT Gateway in the public subnet. The download is failing. Which configuration should the network engineer check FIRST?

Accepted Answer

The route table associated with the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway.. For an EC2 instance in a private subnet to reach the internet via a NAT Gateway, the private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway. Without this route, traffic from the instance destined for the internet has no path to the NAT Gateway, causing the download to fail.

Answer

The network ACL for the private subnet allows inbound HTTP/HTTPS traffic.

Answer

The EC2 instance has a public IP address assigned.

Answer

The Internet Gateway is attached to the private subnet.

Question 6

Which TWO AWS services can be used to provide inbound internet connectivity to resources in a VPC? (Select TWO.)

Accepted Answer

Internet Gateway. An Internet Gateway (B) is the horizontally scaled, redundant VPC component that attaches directly to a VPC and enables bidirectional communication between resources in the VPC and the internet, so it is the canonical way to provide inbound internet connectivity to public subnets. An internet-facing Elastic Load Balancer (C) is deployed in public subnets with public IP addresses and accepts inbound traffic from the internet, then distributes it to backend targets in the VPC, thus providing inbound internet connectivity to those resources. VPC Endpoint (A) is used for private connectivity to AWS services or endpoint services without traversing the internet, so it does not provide inbound internet access. Amazon CloudFront (D) is a CDN that caches and serves content from edge locations but does not by itself give VPC resources inbound internet connectivity. NAT Gateway (E) is designed for outbound-only traffic from private subnets to the internet and explicitly does not allow inbound connections.

Answer

VPC Endpoint

Answer

Amazon CloudFront

Answer

NAT Gateway

Question 7

A company is designing a network for a critical application that requires low-latency communication between EC2 instances in the same AWS Region. They want to maximize network throughput and minimize latency. Which TWO design choices should they make? (Choose two.)

Accepted Answer

Enable enhanced networking (ENA) on the EC2 instances.. Option B is correct because enabling enhanced networking with the Elastic Network Adapter (ENA) provides higher bandwidth, higher packet-per-second performance, and lower latency than the default virtual network interface, which directly supports the goal of maximizing throughput and minimizing latency. Option E is correct because a cluster placement group packs instances close together within a single Availability Zone, providing low-latency, high-throughput networking (up to 10 Gbps or more with supported instance types) ideal for tightly coupled, latency-sensitive applications. Option A is incorrect because an internet gateway is only for routing traffic to and from the internet and does not reduce inter-instance latency or increase throughput. Option C is incorrect because a VPN connection adds encryption overhead and traverses the public internet, increasing latency rather than minimizing it. Option D is incorrect because a spread placement group distributes instances across distinct hardware to reduce correlated failures, which increases network distance and latency rather than optimizing throughput.

Answer

Attach an internet gateway to the VPC and route traffic through it.

Answer

Use a VPN connection to route traffic between instances.

Answer

Use a spread placement group for the EC2 instances.

Question 8

Which TWO of the following are valid methods to connect multiple VPCs in the same AWS region? (Select TWO.)

Accepted Answer

VPC peering. VPC peering (A) is a valid method because it creates a direct, one-to-one private network connection between two VPCs in the same region (or across regions), allowing traffic to route between them using private IPv4/IPv6 addresses without traversing the public internet. A transit gateway (E) is also valid because it acts as a regional hub that multiple VPCs can attach to, enabling transitive routing between many VPCs in the same region through a single gateway. AWS Direct Connect (B) is not a VPC-to-VPC connection method; it links an on-premises network to AWS over a dedicated private circuit. VPC endpoints (C) only provide private connectivity from a VPC to supported AWS services or endpoint services, not VPC-to-VPC connectivity. Site-to-Site VPN (D) connects an on-premises network to a VPC over IPsec tunnels, not multiple VPCs to each other within a region.

Answer

AWS Direct Connect

Answer

VPC endpoints

Answer

Site-to-Site VPN

Question 9

A company is setting up a Site-to-Site VPN connection between their on-premises network and AWS. Which THREE components are required for a VPN connection?

Accepted Answer

VPN Tunnel. A Site-to-Site VPN connection in AWS fundamentally requires three components: a Virtual Private Gateway (VGW) attached to the VPC on the AWS side, a Customer Gateway (CGW) representing the on-premises VPN device, and at least one VPN Tunnel that carries the encrypted traffic between them. Option D (Virtual Private Gateway) is correct because it is the AWS-side VPN concentrator that terminates the IPSec tunnels and must be attached to the target VPC. Option E (Customer Gateway) is correct because it is the AWS resource that holds the public IP address and BGP ASN of the on-premises router, which is necessary to establish the tunnels. Option A (VPN Tunnel) is correct because each Site-to-Site VPN connection consists of two IPSec tunnels for redundancy, and the tunnel is the actual encrypted path over which traffic flows. Option B (Transit Gateway) is not required because a VGW can be used directly for a single VPC VPN, and Transit Gateway is only needed when connecting multiple VPCs or using a hub-and-spoke topology. Option C (Internet Gateway) is not required because an Internet Gateway provides internet access for public subnets, not for VPN termination, and the VPN traffic is handled by the Virtual Private Gateway.

Answer

Transit Gateway

Answer

Internet Gateway

Question 10

A company has a VPC with public and private subnets in two Availability Zones. The company hosts a web application on EC2 instances in the private subnets. The application needs to access an S3 bucket. What is the MOST cost-effective and secure way to provide this access?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and attach it to the private subnet route tables.. A VPC Gateway Endpoint for S3 provides private, secure connectivity to S3 without traversing the public internet, and it incurs no hourly or data processing charges, making it the most cost-effective and secure choice. Traffic stays within the AWS network, and the endpoint is attached to the private subnet route tables, allowing EC2 instances in those subnets to access S3 directly without needing a NAT Gateway or public IPs.

Answer

Deploy a NAT Gateway in each public subnet and route traffic from private subnets through it.

Answer

Use AWS Transit Gateway to route traffic to S3 via a centralized VPN.

Answer

Attach an Internet Gateway to the VPC and assign public IPs to the EC2 instances.

Question 11

A company's security team is designing a network architecture for a multi-tier application. The web tier must be accessible from the internet, while the application and database tiers must be isolated. Which TWO actions should be taken to meet these requirements?

Accepted Answer

Place application and database servers in private subnets. Option C is correct because placing the application and database servers in private subnets removes them from direct internet reachability, since private subnets have no route to an Internet Gateway, thereby isolating the back-end tiers as required. Option D is correct because the web tier must be internet-accessible, and placing web servers in a public subnet with a route to an Internet Gateway provides the inbound/outbound internet connectivity needed for public access. Option A is wrong because putting application and database servers in a public subnet exposes them to the internet, directly violating the isolation requirement, and a VPC endpoint does not make a public subnet private. Option B is wrong because web servers in a private subnet behind a NAT Gateway can initiate outbound traffic but cannot receive inbound connections from the internet, so the web tier would not be publicly accessible. Option E is wrong because security group rules alone, while useful for tier-to-tier filtering, do not provide the subnet-level public/private separation and internet routing architecture the scenario requires.

Answer

Place application and database servers in a public subnet with a VPC endpoint

Answer

Place web servers in a private subnet with a NAT Gateway

Answer

Use security group rules to allow traffic only between tiers

Question 12

Which TWO of the following are valid methods to secure data at rest in Amazon S3? (Choose two.)

Accepted Answer

Use SSE-S3 (Server-Side Encryption with S3 managed keys).. Option A is correct because SSE-S3 (Server-Side Encryption with Amazon S3-managed keys) encrypts objects at rest using AES-256, with S3 handling key management, directly protecting stored data. Option C is correct because client-side encryption encrypts the object data before it is uploaded, so the data is already ciphertext while stored in S3, satisfying data-at-rest protection. Option B is incorrect because SSL/TLS protects data in transit, not data at rest. Option D is incorrect because a VPC endpoint controls network access to S3 but does not encrypt stored objects. Option E is incorrect because network ACLs are stateless subnet-level access controls and do not provide encryption for data at rest.

Answer

Use SSL/TLS to encrypt data during transfer.

Answer

Use a VPC endpoint to restrict access to the bucket.

Answer

Configure a network ACL to block unauthorized access.

Question 13

A company has multiple VPCs connected via a Transit Gateway. They want to implement network segmentation so that only specific VPCs can communicate with each other. Which TWO methods can achieve this? (Choose two.)

Accepted Answer

Deploy AWS Network Firewall in a centralized inspection VPC. AWS Network Firewall can be deployed in a centralized inspection VPC to filter traffic between VPCs attached to a Transit Gateway. By routing inter-VPC traffic through the firewall appliance, you can enforce stateful inspection and allow or deny traffic based on source/destination VPCs, achieving network segmentation.

Answer

Assign instances to different security groups

Answer

Configure network ACLs on each subnet

Answer

Create separate VPC peering connections

Question 14

A company is using AWS WAF to protect a web application. They want to block requests that originate from known malicious IP addresses. Which WAF rule type should be used?

Accepted Answer

IP set match condition. IP set match conditions are used to match the source IP address of a request against a list of IP addresses. Regex, string match, and SQL injection are for other attack types.

Answer

String match condition

Answer

Regex match condition

Answer

SQL injection match condition

Question 15

A security engineer needs to audit all API calls that modify security group rules in a VPC. Which AWS service should be used to record these API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity in an AWS account, including calls that modify security group rules (e.g., AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress). It captures the identity of the caller, the time, source IP, and request parameters, providing a full audit trail. This makes it the correct service for auditing API calls that change security group configurations.

Answer

Amazon Inspector

Answer

AWS Config

Answer

VPC Flow Logs