ANS-C01 Practice Test 47 — 15 Questions

Question 1

A company is running a stateful firewall appliance in an EC2 instance in a VPC. The appliance inspects traffic between subnets. The company needs to ensure that traffic from the web tier subnet to the application tier subnet passes through the firewall, but the firewall itself must not affect other traffic. Which configuration should the company implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a Gateway Load Balancer to deploy the firewall appliance in a separate subnet, and configure route tables to send inter-subnet traffic to the Gateway Load Balancer endpoint.. A Gateway Load Balancer (GWLB) allows you to deploy a fleet of third-party firewall appliances in a separate subnet and use a Gateway Load Balancer endpoint (GWLBe) to transparently intercept and steer inter-subnet traffic through the firewall. By configuring the route tables of the web and application subnets to send traffic to the GWLBe, the firewall inspects only the desired traffic without affecting other VPC traffic, as the GWLB operates at Layer 3 (Geneve encapsulation) and does not alter the source/destination IP addresses.

Answer

Place the firewall in the same subnet as the web tier and use security groups to redirect traffic.

Answer

Place the firewall in a separate subnet and use network ACLs to force traffic through it.

Answer

Use a transit gateway with appliance mode and attach all subnets to it, then configure routing to send traffic through the firewall.

Question 2

A company wants to connect multiple VPCs across different AWS accounts to a common on-premises network using AWS Transit Gateway. Which resource should be used to allow cross-account VPC attachments?

Accepted Answer

AWS Resource Access Manager (RAM). AWS Resource Access Manager (RAM) enables you to share a Transit Gateway with other AWS accounts within your organization or externally. Once shared, the recipient account can attach its VPCs to the shared Transit Gateway, allowing cross-account VPC attachments to a common on-premises network.

Answer

AWS PrivateLink

Answer

VPC peering connection

Answer

AWS Organizations

Question 3

A global company wants to connect multiple VPCs across different AWS Regions using a hub-and-spoke model. The hub VPC contains shared services such as Active Directory and DNS. Which AWS service provides the most scalable and maintainable solution for this architecture?

Accepted Answer

AWS Transit Gateway with inter-Region peering attachments.. AWS Transit Gateway with inter-Region peering attachments is the most scalable and maintainable solution because it provides a central hub to connect multiple VPCs across different AWS Regions using a fully managed service. Inter-Region peering attachments allow transitive routing between all attached VPCs without requiring full mesh peering, and they support route propagation and centralized management of shared services like Active Directory and DNS. This architecture scales linearly as new VPCs or Regions are added, unlike VPC peering which requires individual non-transitive connections.

Answer

AWS VPN CloudHub to interconnect all VPCs.

Answer

AWS Direct Connect gateway with virtual interfaces to each VPC.

Answer

VPC peering between each spoke VPC and the hub VPC.

Question 4

A company is deploying a VPC with public and private subnets in two Availability Zones. The public subnets contain NAT gateways for outbound internet access from the private subnets. The private subnets host web servers that need to make API calls to an external service over the internet. After implementation, the web servers cannot reach the internet. Which configuration is the most likely cause?

Accepted Answer

The NAT gateway is placed in a private subnet and does not have a route to the internet gateway.. A NAT gateway must be placed in a public subnet with a route to an internet gateway (IGW) to translate private IP addresses for outbound traffic. If the NAT gateway is in a private subnet, it cannot reach the IGW, so the private web servers' traffic destined for the internet (via the 0.0.0.0/0 route pointing to the NAT gateway) will fail, as the NAT gateway itself has no path to the internet.

Answer

The route table for the private subnets is not associated with the VPC's main route table.

Answer

The private subnets have a default route (0.0.0.0/0) pointing to an internet gateway instead of the NAT gateway.

Answer

The public subnets have a default route pointing to the NAT gateway instead of the internet gateway.

Question 5

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team wants to ensure that traffic between VPCs is inspected by a centralized firewall appliance in a inspection VPC. Which architecture meets this requirement?

Accepted Answer

Attach all VPCs to a Transit Gateway and create separate route tables for inspection.. To ensure traffic between VPCs is inspected by a centralized firewall in an inspection VPC, you attach all VPCs to a Transit Gateway and create separate route tables for inspection. This allows you to route traffic from spoke VPCs to the inspection VPC, where the firewall inspects it, and then route to the destination. This is the standard AWS centralized inspection architecture.

Answer

Create VPC peering connections between all VPCs and route traffic through the inspection VPC.

Answer

Deploy AWS Network Firewall in each VPC and allow traffic to flow directly between VPCs.

Answer

Use AWS Direct Connect Gateway to route traffic between VPCs through the inspection VPC.

Question 6

A company is designing a VPC with a public subnet and a private subnet. The private subnet hosts an RDS database, and the public subnet hosts a web server. The web server needs to access the database. Which TWO of the following are required to allow the web server to connect to the database?

Accepted Answer

An inbound rule in the database's security group that references the web server's security group.. Security group rules can reference other security groups as a source, allowing traffic from any instance associated with the referenced security group (the web server's security group) without needing to specify individual IP addresses. This is the recommended AWS best practice for inter-instance communication within a VPC, as it dynamically adapts to changes in the web server's IP or scaling events.

Answer

An inbound rule in the database's security group that allows traffic from the web server's private IP address.

Answer

An internet gateway attached to the VPC.

Answer

A NAT gateway in the public subnet.

Question 7

A company wants to securely connect two VPCs in the same region. The VPCs must be able to communicate using private IP addresses, and connectivity should be highly available. Which solution meets these requirements?

Accepted Answer

Create a VPC peering connection between the two VPCs.. A VPC peering connection allows two VPCs in the same region to communicate using private IPv4 or IPv6 addresses as if they were on the same network, with no single point of failure. It is highly available by design since traffic flows directly between the VPCs using the AWS global network infrastructure, without any intermediate devices or bandwidth limits.

Answer

Set up a VPN connection between the two VPCs using virtual private gateways.

Answer

Create an inter-region VPC peering connection.

Answer

Use an AWS Transit Gateway to connect the two VPCs.

Question 8

A company is designing a network for a real-time gaming application that requires extremely low latency between players. The application will be deployed on EC2 instances in multiple AWS regions. Which AWS service provides the best latency performance by using the AWS global network and anycast IPs?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator uses the AWS global network and anycast IPs to route traffic to the optimal edge location, then over the AWS backbone to the nearest healthy endpoint. This minimizes internet hops and latency, making it ideal for real-time gaming applications that require consistent low latency across multiple regions.

Answer

AWS Direct Connect

Answer

Amazon CloudFront

Answer

Amazon Route 53 Latency Routing

Question 9

A company wants to use AWS Certificate Manager (ACM) to provide a TLS certificate for a website hosted on an ALB. The domain is example.com, and the certificate must be renewed automatically. Which type of certificate should be requested?

Accepted Answer

A public certificate issued by ACM with DNS validation. ACM automatically renews public certificates if DNS validation is used. Option A is incorrect because private certificates issued by ACM Private CA are not trusted by public browsers. Option B is incorrect because self-signed certificates are not trusted by browsers and must be manually renewed. Option C is incorrect because imported certificates from third-party CAs must be manually renewed.

Answer

A private certificate issued by ACM Private CA

Answer

A self-signed certificate generated with OpenSSL

Answer

A certificate imported into ACM from a third-party CA

Question 10

A company is designing a VPC for a web application that requires high availability. The application will be deployed across multiple Availability Zones. Which THREE components are essential for a highly available network design? (Choose THREE.)

Accepted Answer

Subnets in at least two Availability Zones. Option A is correct because high availability requires the application to be spread across multiple Availability Zones, and each subnet in a VPC is tied to exactly one AZ, so you need subnets in at least two AZs to place resources redundantly. Option C is correct because a NAT gateway is AZ-scoped; to keep private-subnet instances able to reach the internet for updates without a single point of failure, you must deploy a NAT gateway in each AZ where private subnets exist. Option E is correct because an internet gateway is the horizontally scaled, redundant VPC component that enables communication between the VPC and the internet, and it must be attached to the VPC for public-facing web traffic to flow. Option B is not essential because a single VPN connection is itself a single point of failure and is not required for a highly available VPC design. Option D is not essential because VPC peering with a backup VPC is a connectivity choice, not a requirement for multi-AZ high availability within the VPC.

Answer

A single VPN connection to on-premises

Answer

VPC peering with a backup VPC

Question 11

A company is deploying a VPC with public and private subnets. They need to provide internet access to instances in the private subnets for software updates. Which THREE components are required to achieve this?

Accepted Answer

Route table in the private subnet with a default route pointing to the NAT Gateway. Option C is correct because the NAT Gateway must reside in a public subnet so it can have a route to the Internet Gateway and perform source NAT for private instances' outbound traffic. Option D is correct because an Internet Gateway attached to the VPC is required to give the public subnet (and thus the NAT Gateway) connectivity to the internet. Option A is correct because the private subnet's route table needs a default route (0.0.0.0/0) pointing to the NAT Gateway so instances in that subnet can send internet-bound traffic through it. Option B is not needed because a Site-to-Site VPN connects on-premises networks to AWS, not private subnets to the public internet. Option E is not needed because Direct Connect is a dedicated private link to AWS, not an internet-access mechanism for private subnet instances.

Answer

AWS Site-to-Site VPN connection

Answer

AWS Direct Connect connection

Question 12

A company is using AWS Direct Connect to connect its on-premises data center to a VPC. They want to ensure high availability and failover. Which TWO configurations should they implement? (Select TWO.)

Accepted Answer

Configure a Site-to-Site VPN connection as a backup.. Option A is correct because a Site-to-Site VPN over the internet provides a redundant, encrypted IPSec backup path that automatically takes over if the Direct Connect connection fails, ensuring high availability and failover for the VPC. Option D is correct because provisioning a second Direct Connect connection at a different Direct Connect location provides physical path diversity and redundancy, so a failure at one location or device does not take down connectivity. Option B is incorrect because a Direct Connect Gateway only enables connectivity from one Direct Connect connection to multiple VPCs across regions; it does not by itself provide redundancy or failover. Option C is incorrect because two virtual interfaces on a single Direct Connect connection still share the same physical link and device, so they do not protect against a connection or location failure. Option E is incorrect because multiple VLANs on the same connection are logical separations, not redundant paths, and cannot provide failover if the underlying connection fails.

Answer

Create a Direct Connect Gateway and attach multiple VPCs.

Answer

Use a single Direct Connect connection with two virtual interfaces.

Answer

Use the same Direct Connect connection with multiple VLANs.

Question 13

A company is designing a network for a critical application that requires an SLA of 99.99% availability. The application runs on EC2 instances in an Auto Scaling group across three Availability Zones. The company needs to ensure that the network design meets the SLA. Which THREE components should the company include? (Choose THREE.)

Accepted Answer

A NAT gateway in each Availability Zone for outbound internet access.. Option B is correct because deploying a NAT gateway in each Availability Zone provides highly available outbound internet access; if one AZ fails, the NAT gateways in the remaining AZs continue to serve their subnets, avoiding the single point of failure a single NAT gateway would create. Option D is correct because VPC endpoints (interface endpoints powered by AWS PrivateLink or gateway endpoints for S3/DynamoDB) let the instances reach AWS services privately without traversing the internet or a NAT device, removing dependency on internet connectivity and reducing failure domains for a 99.99% SLA. Option E is correct because an Application Load Balancer spans multiple Availability Zones and performs health checks, routing traffic only to healthy instances in all three AZs, which is essential for surviving an AZ outage and meeting the availability target. Option A is not appropriate because a single Direct Connect connection is a single point of failure (and Direct Connect alone does not provide the required redundancy without a second connection or VPN backup). Option C is not appropriate because a single Site-to-Site VPN connection is likewise a single point of failure and offers no HA guarantee for the stated SLA.

Answer

A single AWS Direct Connect connection for all inbound traffic.

Answer

A single AWS Site-to-Site VPN connection for administrative access.

Question 14

A company is migrating its on-premises data center to AWS. The migration requires connectivity between the on-premises network and a VPC. The company needs a connection that supports multiple VLANs for separate environments (development, test, production) and provides consistent performance. The company also wants to avoid using the public internet. Which AWS service should be used?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct choice because it provides a dedicated, private network connection from on-premises to AWS, bypassing the public internet for consistent performance. It supports multiple VLANs (802.1Q) via Virtual LANs (VLANs) on a single Direct Connect circuit, allowing separate logical networks for development, test, and production environments. This meets the requirements for private connectivity, multi-VLAN support, and predictable performance.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

AWS Client VPN

Question 15

A company wants to restrict outbound traffic from a VPC to only allow HTTPS traffic to a specific list of domains. Which AWS service can be used to achieve this?

Accepted Answer

AWS Network Firewall. AWS Network Firewall is the correct choice because it provides stateful, managed firewall rules that can inspect and filter outbound traffic based on domain names (FQDN) for HTTPS (port 443) using TLS inspection or domain list rules. This allows you to create a rule group that permits outbound HTTPS traffic only to a specified list of domains, while blocking all other outbound traffic.

Answer

Security groups

Answer

Amazon Route 53

Answer

Application Load Balancer