ANS-C01 Practice Test 48 — 15 Questions

Question 1

A company has a Direct Connect connection with a private VIF to a VPC. They have set up a Transit Gateway and attached the VPC and the Direct Connect gateway. The on-premises network can reach some VPC resources but not others. The VPC has multiple subnets with different CIDR blocks. The on-premises router is advertising the same prefixes over BGP. What is the most likely cause of the partial connectivity?

Accepted Answer

The VPC route tables for the subnets that cannot be reached do not have a route to the Transit Gateway for the on-premises prefixes.. The most common cause of partial connectivity in this scenario is that the VPC route tables do not have routes pointing to the Transit Gateway for the on-premises prefixes. Even if the Transit Gateway has routes, the VPC subnets must send traffic to the Transit Gateway. Option A is correct. Option B is incorrect because if the Transit Gateway route table had incorrect propagation, it would affect all prefixes equally. Option C is incorrect because the on-premises router advertising the same prefixes would not cause partial connectivity. Option D is incorrect because the Direct Connect gateway association is fine if some traffic works.

Answer

The Direct Connect gateway association with the Transit Gateway is misconfigured.

Answer

The Transit Gateway route table does not have a static route or propagation for the on-premises prefixes.

Answer

The on-premises router is advertising different prefixes over BGP than expected.

Question 2

A company has a VPC with public and private subnets across two Availability Zones. The private subnets require outbound internet access for updates, but must not be directly reachable from the internet. The company has a NAT gateway in each public subnet. Security team reports that instances in private subnets cannot reach the internet. Which configuration should be verified first?

Accepted Answer

Verify that the route table for the public subnets has a default route pointing to an internet gateway, and the private subnets' route table has a default route pointing to the NAT gateway. Option C is correct because NAT gateway requires a route to an internet gateway in the route table of the public subnet where it resides, and the private subnet route table must have a default route pointing to the NAT gateway. Option A is wrong because NACLs are stateless and default NACLs allow all traffic; they are not the most likely cause. Option B is wrong because security groups are stateful and outbound traffic is allowed by default. Option D is wrong because VPC endpoints are for specific AWS services, not general internet access.

Answer

Verify that the VPC has a VPC endpoint for S3 configured

Answer

Verify that the network ACLs for the private subnets allow outbound traffic to 0.0.0.0/0

Answer

Verify that the security groups attached to the instances allow outbound HTTPS traffic

Question 3

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to an on-premises network with CIDR 172.16.0.0/12. They are using an AWS Transit Gateway with a VPN attachment to the on-premises network. The transit gateway route table has a static route for 172.16.0.0/12 pointing to the VPN attachment. Which THREE of the following are necessary for traffic to flow from the VPC to on-premises?

Accepted Answer

The VPC route tables include a route for 172.16.0.0/12 pointing to the transit gateway. Option A is necessary because the VPC route table must have a route to on-premises via the transit gateway. Option B is necessary because the transit gateway route table must have the route. Option C is necessary because the VPC must be attached to the transit gateway. Option D is not necessary because the VPN tunnel may be inside the transit gateway attachment. Option E is not necessary because BGP may not be required if static routes are used.

Answer

The on-premises router is advertising the 172.16.0.0/12 route over BGP

Answer

The VPN tunnel is configured with dynamic BGP routing

Question 4

A company is implementing a network for a three-tier application in a VPC. They need to ensure that the web tier can communicate with the application tier, but the application tier cannot initiate connections to the web tier. Which configuration should be used?

Accepted Answer

Use security groups on the application tier instances to allow inbound from the web tier security group, and do not allow inbound from application tier in the web tier security group. Option B is correct because a stateful firewall like security groups can allow inbound from web to app while blocking inbound from app to web. Option A is wrong because network ACLs are stateless and require separate rules for inbound and outbound, making it more complex. Option C is wrong because a reverse proxy is unnecessary. Option D is wrong because a transit gateway is for inter-VPC routing, not for this requirement.

Answer

Use network ACLs on the application tier subnets to allow inbound from web tier and block outbound to web tier

Answer

Use a transit gateway with route tables to control traffic flow

Answer

Place a reverse proxy between the tiers

Question 5

A company has a Direct Connect connection with a private VIF to a VPC. They also have a Site-to-Site VPN connection to the same VPC as a backup. The on-premises router is advertising the same prefixes over both connections. The company wants to ensure that traffic uses Direct Connect when available and fails over to VPN if Direct Connect goes down. Which configuration should be applied?

Accepted Answer

Prepend AS path on the BGP advertisements over the VPN connection to make the path less preferred.. To prefer Direct Connect over VPN, you should adjust the BGP attributes on the on-premises router. One common method is to prepend AS path on the VPN BGP advertisements to make the path longer, so the Direct Connect path is preferred. Option A is correct. Option B is incorrect because decreasing the MED on Direct Connect would make it more preferred, but the question asks for a method that can be applied on-premises. Option C is incorrect because local preference is usually set on the AWS side. Option D is incorrect because disabling BGP on the VPN would remove the backup.

Answer

Set a higher MED value on the Direct Connect BGP advertisements.

Answer

Disable BGP on the VPN connection to force traffic to Direct Connect.

Answer

Set a higher local preference on the VPN BGP advertisements.

Question 6

A company has a VPC with public and private subnets. They have a NAT gateway in a public subnet for outbound internet access from private instances. Which TWO of the following are required for the NAT gateway to function correctly?

Accepted Answer

A route in the public subnet's route table to an internet gateway. Option A is required because the NAT gateway needs an Elastic IP for outbound traffic. Option B is required because the public subnet must have a route to an internet gateway. Option C is not required because security groups are not attached to NAT gateways. Option D is not required because NAT gateways are not assigned to private subnets. Option E is not required because NAT gateways do not use NACLs.

Answer

The NAT gateway is deployed in a private subnet

Answer

A security group attached to the NAT gateway

Answer

A network ACL attached to the NAT gateway's subnet that allows inbound traffic from the internet

Question 7

A company is designing a highly available architecture for a web application using an Application Load Balancer (ALB) in multiple Availability Zones. Which TWO configurations are required to achieve high availability?

Accepted Answer

The ALB must be configured with subnets in at least two Availability Zones. Option A is correct because ALB must have subnets in at least two Availability Zones. Option B is correct because the ALB must be internet-facing to be accessible from the internet. Option C is wrong because cross-zone load balancing is enabled by default and not required for high availability. Option D is wrong because a single NAT gateway is a single point of failure. Option E is wrong because a single instance per AZ is sufficient.

Answer

At least three EC2 instances must be registered with the ALB

Answer

A NAT gateway must be deployed in each Availability Zone

Answer

Cross-zone load balancing must be enabled on the ALB

Question 8

A company has a VPC with public and private subnets in multiple Availability Zones. They want to deploy a NAT gateway for outbound internet access for instances in private subnets. Which of the following is the most highly available architecture?

Accepted Answer

Deploy one NAT gateway in each Availability Zone with a route table per AZ that points to the NAT gateway in the same AZ.. For high availability, you should deploy a NAT gateway in each Availability Zone and route traffic from private subnets in each AZ to the NAT gateway in the same AZ. This avoids cross-AZ data transfer costs and ensures that an AZ failure does not affect other AZs. Option A is correct. Options B and C do not provide equal HA. Option D is incorrect because a NAT instance is less reliable than a managed NAT gateway.

Answer

Deploy one NAT gateway in the first Availability Zone and route all private subnet traffic to that NAT gateway.

Answer

Use a single NAT instance in a public subnet with an auto scaling group and health checks.

Answer

Deploy two NAT gateways in the first Availability Zone and use a single route table pointing to one of them.

Question 9

A company is designing a multi-tier application with web servers in public subnets and database servers in private subnets. The database servers should only be accessible from the web servers. Which AWS feature should be used to enforce this?

Accepted Answer

Security groups that reference the web server security group as a source. Option C is correct because security groups act as a virtual firewall for instances, and you can allow inbound traffic from a specific security group (the web servers' security group). Option A is wrong because NACLs are stateless and applied at subnet level, not instance-level. Option B is wrong because network ACLs are not as granular as security groups for this use case. Option D is wrong because VPC endpoints are for accessing AWS services privately.

Answer

VPC endpoints to restrict access to the database servers

Answer

Network ACLs with allow rules for the web server subnet CIDR

Answer

Network ACLs with deny rules for all traffic except from the web server subnet

Question 10

Refer to the exhibit. A company has two VPCs (vpc-aaaaaaaa and vpc-bbbbbbbb) that are peered. The CIDR blocks are both 10.0.0.0/16. The peering connection status is 'active'. Which of the following is true about this configuration?

Accepted Answer

The VPCs cannot communicate because of overlapping CIDR blocks. Option C is correct because overlapping CIDR blocks are not supported for VPC peering; even though the status is active, the overlapping CIDRs will cause routing issues. Option A is wrong because the peering connection can be active but routing may fail. Option B is wrong because overlapping CIDRs are not supported. Option D is wrong because DNS resolution is a separate setting.

Answer

The VPC peering connection will not become active due to overlapping CIDRs

Answer

The VPCs can communicate using the peering connection without any issues

Answer

DNS resolution between the VPCs will be automatically enabled

Question 11

A company wants to connect its on-premises data center to a VPC using AWS Site-to-Site VPN. Which of the following is required to establish the VPN connection?

Accepted Answer

Virtual private gateway attached to the VPC and a customer gateway representing the on-premises router. To establish a Site-to-Site VPN, you need a virtual private gateway (VGW) or transit gateway on the AWS side, and a customer gateway (CGW) representing the on-premises router. Option B is correct. Option A is incorrect because an internet gateway is used for public internet traffic, not VPN. Option C is incorrect because a Direct Connect gateway is for Direct Connect connections. Option D is incorrect because a VPC endpoint is for private access to AWS services.

Answer

Direct Connect gateway associated with the VPC

Answer

Internet gateway attached to the VPC

Answer

VPC endpoint for the VPN service

Question 12

A company is implementing a hybrid network using AWS Direct Connect. They have a virtual private gateway (VGW) attached to their VPC and a Direct Connect gateway (DXGW) with a private virtual interface (VIF) to their on-premises router. They have established a BGP session between the on-premises router and the VGW. The on-premises network can reach EC2 instances in the VPC, but the VPC instances cannot reach on-premises resources. What is the most likely cause?

Accepted Answer

The VPC route tables lack a route for the on-premises CIDR pointing to the virtual private gateway. Option B is correct because the VPC route table must have a route for the on-premises CIDR pointing to the virtual private gateway. Option A is wrong because the VGW is already attached. Option C is wrong because BGP is established. Option D is wrong because VPC endpoints are not relevant.

Answer

The virtual private gateway is not attached to the VPC

Answer

The VPC has a VPC endpoint for S3 that is causing a routing conflict

Answer

The BGP session is not advertising the on-premises CIDR to the VGW

Question 13

Which TWO of the following are valid methods to provide outbound internet access to instances in a private subnet?

Accepted Answer

Deploy a NAT instance in a public subnet and configure routing. Option A is correct because NAT gateway provides outbound internet access. Option B is correct because NAT instance can also provide this functionality. Option C is wrong because internet gateway is attached to the VPC but requires instances to have public IPs, which is not suitable for private subnets. Option D is wrong because VPC endpoints are for accessing AWS services only. Option E is wrong because VPN does not provide direct internet access.

Answer

Use a VPC endpoint for internet access

Answer

Attach an internet gateway directly to the private subnet

Answer

Use a VPN connection to the internet

Question 14

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. They want to add a second Direct Connect connection for redundancy. What is the MINIMUM number of virtual interfaces required to achieve active-active failover for the VPC?

Accepted Answer

Two private virtual interfaces (one on each connection). Option B is correct because with two Direct Connect connections, you can create a private VIF on each, and using BGP and AS_PATH prepending, you can achieve active-active load balancing and failover. Option A is wrong because a single VIF cannot provide redundancy. Option C is wrong because you need two VIFs for active-active. Option D is wrong because transit VIFs are for connecting to Direct Connect Gateway, not directly to a VPC.

Answer

Two transit virtual interfaces (one on each connection)

Answer

One private virtual interface and one transit virtual interface

Answer

One private virtual interface

Question 15

A company is implementing a multicast application in AWS. The application requires that multicast traffic be forwarded between Amazon EC2 instances in different VPCs. The company has set up a multicast domain using AWS Transit Gateway Connect with multicast support. The multicast group is using the IP address 239.0.1.10. The network engineer has confirmed that the EC2 instances are registered as multicast members and that the Transit Gateway multicast domain is configured correctly. However, receivers in VPC B are not receiving multicast traffic from senders in VPC A. What is the MOST likely cause of this issue?

Accepted Answer

The security group for the sender EC2 instances does not allow outbound UDP traffic to the multicast group address.. Option A is correct because multicast traffic must be allowed by the source's security group outbound rules. Option B is incorrect because IGMP is not used; multicast group members are statically registered. Option C is incorrect because multicast groups are not tied to subnets. Option D is incorrect because TTL is not the issue as hosts are in same region.

Answer

The multicast group is not associated with the correct subnet in VPC A.

Answer

The multicast traffic has a TTL value of 1, which prevents it from leaving the source subnet.

Answer

The receiver instances are not sending IGMP join messages to the multicast group.