ANS-C01 Practice Test 48 — 15 Questions

Question 1

A company uses AWS Certificate Manager (ACM) to issue certificates for a fleet of Application Load Balancers. The security team requires that only specific IAM roles can request, renew, or delete ACM certificates. Which policy type should be used to enforce this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

IAM identity-based policies attached to the IAM roles. ACM access is controlled via IAM identity-based policies attached to IAM roles, which allow specifying which roles can request, renew, or delete certificates. Option A is incorrect because AWS managed policies are a type of IAM policy, but the question asks for the policy type used to enforce access for specific IAM roles, and AWS managed policies can be used but are not the only type; however, the key point is that identity-based policies are the mechanism. Option B is incorrect because service control policies (SCPs) apply to all accounts in an AWS Organization and cannot target specific IAM roles within an account. Option D is incorrect because ACM does not support resource-based policies; only IAM policies can be used to control access to certificates.

Answer

AWS managed policies such as AWSCertificateManagerFullAccess

Answer

Service control policies (SCPs) in AWS Organizations

Answer

Resource-based policies attached to the ACM certificates

Question 2

A company is using a transit gateway to connect multiple VPCs and on-premises networks via VPN. The network team notices that some VPCs can communicate with each other but not with the on-premises network. The transit gateway route tables are configured correctly. Which TWO configurations should the team check?

Accepted Answer

Verify that the on-premises router is advertising the on-premises CIDR over BGP to the VPN. Option C is correct because for a transit gateway VPN attachment to route traffic to on-premises networks, the customer gateway router must advertise the on-premises CIDR blocks to AWS over BGP; if those routes are not propagated, the transit gateway has no path to the on-premises network even though VPC-to-VPC routing works. Option E is correct because a VPN attachment must be associated with the transit gateway route table that the VPC attachments use (and/or its routes must be propagated into that table); if the VPN attachment is associated with a different route table, VPCs will not learn the VPN routes and cannot reach on-premises. Option A is not the right check because a transit gateway in 'available' state is the normal operating state and would affect all attachments, not selectively block on-premises traffic while VPC-to-VPC works. Option B is not the right check because security groups apply to EC2 instance traffic and would not explain a routing gap specific to the on-premises path. Option D is not the right check because VPC Flow Logs can show dropped packets but do not directly validate the transit gateway VPN route propagation or BGP advertisements needed for on-premises connectivity.

Answer

Verify that the transit gateway is in a 'available' state

Answer

Check the security group rules of the EC2 instances in the VPCs

Answer

Check the VPC Flow Logs for dropped packets

Question 3

A developer wants to allow an EC2 instance in a VPC to access an Amazon S3 bucket without traversing the public internet. Which AWS service should be used?

Accepted Answer

VPC Gateway Endpoint for S3.. A VPC Gateway Endpoint for S3 allows EC2 instances to access S3 buckets privately using AWS’s internal network, without traversing the public internet. Gateway endpoints are specifically designed for services like S3 and DynamoDB, using route table entries to direct traffic to the service via the AWS backbone, with no data transfer costs for traffic within the same region.

Answer

AWS PrivateLink with an interface VPC endpoint.

Answer

NAT gateway in the public subnet.

Answer

AWS Direct Connect with a public VIF.

Question 4

A company has a VPC with a public subnet and a private subnet. They launch an EC2 instance in the private subnet with a private IP only. The instance needs to download patches from the internet. Which configuration is required?

Accepted Answer

Create a NAT gateway in the public subnet and add a default route to the NAT gateway in the private subnet's route table.. A NAT gateway in the public subnet provides outbound internet access for instances in the private subnet while preventing inbound connections from the internet. By adding a default route (0.0.0.0/0) in the private subnet's route table pointing to the NAT gateway, traffic from the EC2 instance destined for the internet is forwarded to the NAT gateway, which then uses its Elastic IP to communicate with the internet. This allows the instance to download patches without requiring a public IP or direct internet gateway access.

Answer

Launch a NAT instance in the private subnet and configure source/destination check.

Answer

Create a VPC endpoint for the patch service.

Answer

Attach an internet gateway to the VPC and add a default route to it in the private subnet's route table.

Question 5

A company has a VPC with multiple subnets. The security team requires that all outbound traffic from the VPC to the internet must traverse a centralized inspection appliance for traffic inspection. Which architecture should be used?

Accepted Answer

Use Transit Gateway with VPC attached and route traffic through a shared services VPC containing the inspection appliance. A Transit Gateway with a shared services VPC architecture allows centralized inspection of all outbound internet traffic. By attaching the VPCs to a Transit Gateway and routing traffic through a shared services VPC that hosts the inspection appliance (e.g., a firewall or proxy), you can enforce security policies. The Transit Gateway acts as a hub, enabling transitive routing between VPCs while directing internet-bound traffic to the inspection appliance before it reaches an internet gateway or NAT gateway.

Answer

Use VPC Peering between all VPCs

Answer

Configure a NAT Gateway in each Availability Zone

Answer

Use AWS Direct Connect to route traffic on-premises

Question 6

A company is using AWS Direct Connect to connect its on-premises data center to a VPC. The company wants to use a single Direct Connect connection to connect to multiple VPCs in different AWS accounts. Which AWS service should be used to achieve this?

Accepted Answer

Direct Connect Gateway. A Direct Connect Gateway (DX Gateway) is the correct service because it allows a single Direct Connect connection to be associated with multiple VPCs across different AWS accounts and regions. The DX Gateway acts as a regional or global transit hub, enabling private connectivity from on-premises to multiple VPCs without needing separate Direct Connect connections for each VPC. This is achieved by associating the DX Gateway with virtual private gateways (VGWs) in each target VPC, and then using AWS Resource Access Manager (RAM) to share the DX Gateway with other accounts.

Answer

Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

VPC Peering

Question 7

Which AWS service can be used to centrally manage and enforce security group rules across multiple accounts in AWS Organizations?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager (Option B) is the correct answer because it provides centralized management of security group rules across accounts in AWS Organizations, allowing you to enforce a common set of security rules. Option A (IAM) manages user permissions, not security groups. Option C (AWS Config) evaluates resource compliance but does not enforce rules. Option D (AWS Shield Advanced) is a DDoS protection service.

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Config

Answer

AWS Shield Advanced

Question 8

A company uses AWS Transit Gateway to connect multiple VPCs. The network team notices that traffic between two VPCs is taking a suboptimal path through a third VPC. What is the most likely cause?

Accepted Answer

Incorrect route table associations and propagations in the Transit Gateway.. Incorrect route table associations and propagations in the Transit Gateway cause traffic between two VPCs to take a suboptimal path through a third VPC. The Transit Gateway uses route tables to determine the next hop for traffic; if the route table for the source VPC does not have a direct route to the destination VPC but instead has a route pointing to the third VPC (e.g., via a VPN attachment or a transit VPC attachment), traffic will be forwarded through that third VPC. This is a common misconfiguration when route propagation is not properly set up or when static routes are incorrectly prioritized.

Answer

Security groups are blocking the direct path, forcing traffic through a third VPC.

Answer

BGP is not configured between the VPCs, so traffic defaults through a transit VPC.

Answer

ECMP routing is enabled, causing traffic to be load-balanced across multiple paths.

Question 9

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from an S3 bucket in the same region. The company wants to minimize data transfer costs and avoid traversing the internet. Which solution should the company implement?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and attach it to the private subnet's route table.. A VPC Gateway Endpoint for S3 provides private, cost-free connectivity to S3 from within a VPC without traversing the internet. It uses prefix-based routing via the route table, ensuring traffic to S3 stays within the AWS network, minimizing data transfer costs and avoiding internet egress charges.

Answer

Create a VPC Interface Endpoint for S3 and attach it to the private subnet.

Answer

Configure an S3 bucket policy to allow access from the VPC and use an Internet Gateway.

Answer

Create a NAT Gateway in the public subnet and route traffic to the S3 bucket through it.

Question 10

A company has a hybrid network with an AWS Site-to-Site VPN connection to an on-premises data center. The network team wants to ensure that only encrypted traffic is sent over the internet between the two sites. The VPC has a virtual private gateway attached. When testing, they discover that some traffic is going over the internet without encryption. Which configuration change should be made to enforce encryption?

Accepted Answer

Add a static route in the VPC route table for the on-premises CIDR block pointing to the virtual private gateway.. Adding a static route in the VPC route table for the on-premises CIDR block pointing to the virtual private gateway ensures that all traffic destined for the on-premises network is routed through the VPN tunnel, enforcing encryption. Without this static route, traffic might be sent via an internet gateway if a more specific route exists or if route propagation is not properly configured. Option B is incorrect because disabling route propagation would remove dynamic routes from the VPN, but traffic could still go over the internet if there is a route to an internet gateway. Option C is incorrect because IPsec acceleration is about improving performance, not ensuring all traffic uses encryption; the tunnel already uses IPsec. Option D is incorrect because replacing the virtual private gateway with a transit gateway is not necessary; the issue is routing, not the gateway type.

Answer

Disable route propagation on the VPC route table to remove any dynamic routes from the VPN.

Answer

Enable IPsec acceleration on the VPN tunnel to ensure all traffic is encrypted.

Answer

Replace the virtual private gateway with a transit gateway and attach the VPN connection.

Question 11

A company has a VPC with public and private subnets in two Availability Zones. An Application Load Balancer in the public subnets distributes traffic to EC2 instances in the private subnets. The security group for the EC2 instances allows inbound traffic from the ALB security group. Users report intermittent timeouts. What is the most likely cause?

Accepted Answer

The network ACL for the private subnets is blocking inbound traffic from the ALB subnets.. Intermittent timeouts are often caused by network ACL rules that block ephemeral ports used for return traffic. The ALB initiates connections to EC2 instances on random ephemeral ports (1024-65535). If the private subnet's network ACL denies inbound traffic on these ports from the ALB subnets, connections will fail intermittently. In contrast, a missing inbound rule on the ALB security group would result in consistent failures, not intermittent ones.

Answer

The security group for the ALB does not allow inbound traffic from the internet.

Answer

The ALB is not associated with an internet gateway.

Answer

Cross-zone load balancing is disabled on the ALB.

Question 12

A company has multiple VPCs connected via AWS Transit Gateway. Each VPC has its own route table in the transit gateway. The company wants to restrict traffic between certain VPCs. For example, VPC A should be able to send traffic to VPC B but not to VPC C. VPC B should be able to send traffic to VPC C. Which configuration should the company use?

Accepted Answer

Create separate transit gateway route tables for each VPC and add only the desired routes for other VPCs.. AWS Transit Gateway supports multiple route tables, and by creating a separate route table for each VPC attachment, you can control which VPCs can communicate by selectively adding routes to the desired destination VPC CIDRs. This allows VPC A to have a route only to VPC B, while VPC B's route table includes routes to both VPC A and VPC C, achieving the required traffic isolation without relying on stateful or stateless filtering at the attachment level.

Answer

Use network ACLs on the transit gateway attachments to filter traffic.

Answer

Use security groups on the VPC attachments to allow or deny traffic.

Answer

Create a single transit gateway route table and associate all VPC attachments with it.

Question 13

A company is migrating a legacy application to AWS. The application requires multicast communication between instances. The company needs to implement a multicast solution within a VPC. Which AWS service or feature should be used to support multicast?

Accepted Answer

Create a Transit Gateway multicast domain. AWS Transit Gateway supports multicast through the creation of a Transit Gateway multicast domain. This feature allows you to send multicast traffic from a source to multiple receivers within a VPC, which is required for legacy applications that rely on multicast communication. Transit Gateway multicast domains work with IGMP (Internet Group Management Protocol) to manage group memberships and route multicast traffic efficiently.

Answer

Configure multicast in the VPC's route tables

Answer

Use AWS Global Accelerator for multicast distribution

Answer

Set up VPC peering to enable multicast between subnets

Question 14

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company has an internet gateway attached to the VPC and a NAT gateway in a public subnet. Which route table configuration is required for the private subnets to access the internet?

Accepted Answer

Add a route in the private subnet route table with destination 0.0.0.0/0 and target the NAT gateway.. Private subnets require a default route (0.0.0.0/0) pointing to the NAT gateway to enable outbound internet access while preventing inbound traffic from the internet. The NAT gateway, residing in a public subnet with an associated Elastic IP, translates private IP addresses to the Elastic IP for internet-bound traffic. The internet gateway is used by public subnets, not private subnets, for direct internet access.

Answer

Add a route in the private subnet route table with destination 0.0.0.0/0 and target the internet gateway.

Answer

Add a route in the public subnet route table with destination 0.0.0.0/0 and target the NAT gateway.

Answer

Add a route in the private subnet route table with destination 0.0.0.0/0 and target the internet gateway, and associate an Elastic IP with the NAT gateway.

Question 15

A company has a VPC with a public subnet and a private subnet. They have a NAT Gateway in the public subnet. Instances in the private subnet need to download patches from the internet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway. However, instances cannot reach the internet. What is a possible cause?

Accepted Answer

The route table for the NAT Gateway's subnet does not have a route to an Internet Gateway.. For a NAT Gateway to route traffic to the internet, its subnet must have a route to an Internet Gateway (IGW). The NAT Gateway resides in the public subnet, and the public subnet's route table must include a default route (0.0.0.0/0) pointing to the IGW. Without this route, the NAT Gateway cannot forward traffic from the private subnet to the internet, even though the private subnet's route table correctly points to the NAT Gateway.

Answer

The NAT Gateway is in a private subnet.

Answer

The network ACL on the private subnet is blocking outbound traffic.

Answer

The NAT Gateway does not have a security group allowing outbound traffic.