ANS-C01 Practice Test 49 — 15 Questions

Question 1

A network engineer is designing a VPC with public and private subnets. The private subnets must have outbound internet access but not be directly reachable from the internet. Which AWS service should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

NAT Gateway. A NAT Gateway is the correct choice because it enables instances in private subnets to initiate outbound internet traffic (e.g., for software updates) while preventing the internet from initiating inbound connections to those instances. It translates the private IP addresses of the instances to the NAT Gateway's Elastic IP address, providing one-way internet access without direct reachability.

Answer

Elastic IP Address (EIP)

Answer

Internet Gateway (IGW)

Answer

Virtual Private Gateway (VGW)

Question 2

A company is designing a highly available architecture for a web application using an Application Load Balancer (ALB) across multiple Availability Zones. The application requires that user sessions are maintained (sticky sessions) and that the ALB can offload SSL/TLS termination. Which configuration should they use?

Accepted Answer

Create an Application Load Balancer with a target group that has stickiness enabled and an HTTPS listener that terminates SSL.. An Application Load Balancer (ALB) natively supports both sticky sessions (via a generated cookie or application-based cookie) and SSL/TLS termination at the HTTPS listener. This allows the ALB to decrypt traffic before forwarding it to targets over HTTP, reducing backend processing overhead while maintaining session affinity across multiple Availability Zones for high availability.

Answer

Create a Network Load Balancer with a target group that has stickiness enabled and an SSL listener.

Answer

Launch EC2 instances as reverse proxy servers in front of the application servers, configure SSL on the reverse proxy, and use an Application Load Balancer to distribute traffic to the reverse proxies.

Answer

Create a Classic Load Balancer with sticky sessions and SSL termination.

Question 3

A company needs to establish a dedicated, private, high-bandwidth connection between its on-premises data center and AWS. Which AWS service should be used?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct service because it provides a dedicated, private, high-bandwidth network connection from an on-premises data center to AWS, bypassing the public internet. This is achieved through a physical cross-connect at an AWS Direct Connect location, delivering consistent latency and higher throughput compared to internet-based connections.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

VPC peering

Question 4

A company uses AWS Direct Connect to connect their on-premises network to AWS. They want to encrypt all traffic between their on-premises router and the AWS Direct Connect location. Which solution should they implement?

Accepted Answer

Enable MACsec on the Direct Connect connection.. MACsec (IEEE 802.1AE) provides link-layer encryption on the Direct Connect connection between the on-premises router and the AWS Direct Connect location, which is exactly the requirement to encrypt traffic on that segment. AWS supports MACsec on dedicated 10 Gbps and 100 Gbps connections, and it encrypts all frames on the physical link without requiring an overlay tunnel. This is the only option that encrypts the Direct Connect path itself.

Answer

Use an IPsec VPN over the internet for additional encryption.

Answer

Use AWS PrivateLink to create a secure connection.

Answer

Use TLS to encrypt the traffic at the application layer.

Question 5

Refer to the exhibit. A VPN connection has two tunnels. Which statement is correct about this VPN configuration?

Accepted Answer

The VPN provides high availability with two tunnels. The exhibit shows a VPN connection with two tunnels, which is the standard design for AWS Site-to-Site VPN to provide high availability. Each tunnel is on a separate device and path, so if one tunnel fails, traffic automatically fails over to the other tunnel. This ensures that the VPN connection remains operational even during maintenance or failure of a single tunnel.

Answer

The VPN uses BGP dynamic routing

Answer

The tunnel inside CIDRs are /24 networks

Answer

Both tunnels use the same inside CIDR

Question 6

A company has a VPC with both IPv4 and IPv6 CIDRs. They need to allow outbound IPv6 traffic from private subnets to the internet. What should they use?

Accepted Answer

An egress-only internet gateway.. An egress-only internet gateway (EIGW) is a horizontally scaled, redundant VPC component that allows outbound IPv6 traffic from instances in a VPC to the internet, while preventing the internet from initiating an IPv6 connection to those instances. It is specifically designed for IPv6 traffic and must be used with a route table entry that directs all outbound IPv6 traffic (::/0) to the EIGW. Unlike an internet gateway, an EIGW does not support inbound IPv6 connections, making it the correct choice for private subnets that need outbound-only IPv6 internet access.

Answer

An internet gateway attached to the VPC.

Answer

A customer-managed prefix list.

Answer

A NAT gateway in a public subnet.

Question 7

Refer to the exhibit. An IAM role ARN is shown. A security engineer wants to allow an EC2 instance to assume this role. What is required for the EC2 instance to successfully assume the role?

Accepted Answer

The role's trust policy must allow the EC2 service principal to assume the role, and the EC2 instance must be launched with an instance profile that includes this role.. To allow an EC2 instance to assume an IAM role, two conditions must be met: 1) The role's trust policy must allow the EC2 service principal (ec2.amazonaws.com) to assume the role, 2) The EC2 instance must be launched with an instance profile that includes that role. This is correctly described in option B. Option A is incorrect because the trust policy specifies the service principal, not an IP address. Option C is incorrect because the permissions policy defines what the role can do, not who can assume it; the trust policy controls who can assume the role. Option D is incorrect because the EC2 instance can access the IAM endpoint via private IP as long as it has network connectivity (e.g., through a VPC endpoint or NAT), and a public IP is not required.

Answer

The trust policy must specify the EC2 instance's private IP address.

Answer

The role's permissions policy must include an Allow for the EC2 instance's security group.

Answer

The EC2 instance must have a public IP address to access the IAM endpoint.

Question 8

A company is designing a network for a new VPC. They want to ensure that the VPC can connect to an on-premises data center via a site-to-site VPN. The on-premises network uses a CIDR block of 10.0.0.0/8. The VPC will use a CIDR block of 10.0.0.0/16. The network engineer is concerned about overlapping IP addresses. What is the best way to avoid IP address overlap?

Accepted Answer

Use a different RFC 1918 CIDR block for the VPC. Using a different RFC 1918 CIDR block (e.g., 172.16.0.0/12 or 192.168.0.0/16) for the VPC completely avoids IP address overlap with the on-premises 10.0.0.0/8 network. Overlapping CIDR blocks (both using 10.0.0.0/8) would prevent successful route propagation and cause asymmetric routing or connectivity failures in the site-to-site VPN. NAT can mitigate overlap but adds complexity and is not the 'best' design choice when a non-overlapping private range is available.

Answer

Use the same CIDR block and rely on NAT

Answer

Use a smaller subnet within the same 10.0.0.0/8 range

Answer

Use a public IP range for the VPC

Question 9

A network engineer manages a VPC that uses an internet gateway for public subnets and a NAT gateway for private subnets. The engineer needs to verify which elastic network interfaces (ENIs) and IP addresses are associated with the NAT gateway to troubleshoot a connectivity issue. Which AWS service or feature should the engineer use to obtain this information?

Accepted Answer

Amazon EC2 API (DescribeNatGateways). The correct answer is the Amazon EC2 API DescribeNatGateways because it directly provides the NAT gateway's ENI and IP address details needed for troubleshooting. Other services like VPC Flow Logs, Trusted Advisor, and AWS Config offer monitoring or compliance data but do not expose the gateway's own network interface attributes. Using the EC2 API ensures accurate and immediate retrieval of the required information.

Answer

VPC Flow Logs

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 10

A company is designing a VPC with public and private subnets. They want EC2 instances in private subnets to be able to access the internet for software updates. Which AWS service should they use?

Accepted Answer

NAT Gateway. A NAT Gateway enables EC2 instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing the internet from initiating inbound connections to those instances. It translates the private IP addresses of the instances to the NAT Gateway's Elastic IP address using source network address translation (SNAT), allowing them to reach public endpoints.

Answer

AWS Direct Connect

Answer

Internet Gateway (IGW)

Answer

VPC Peering connection

Question 11

A company is deploying a new application in a VPC that uses a single Availability Zone. The application consists of an Application Load Balancer (ALB) in a public subnet and EC2 instances in a private subnet. The EC2 instances need to send logs to an Amazon S3 bucket. The company has created a VPC gateway endpoint for S3 and associated it with the route table for the private subnet. The EC2 instances have an instance profile that grants access to the S3 bucket. However, the log delivery fails. The network team has verified that the route table for the private subnet includes a route to the S3 prefix list via the gateway endpoint. What is the MOST likely cause of the failure?

Accepted Answer

The VPC endpoint policy does not allow the PutObject action on the S3 bucket.. The most likely cause is that the VPC endpoint policy does not allow the PutObject action on the S3 bucket. Even though the route table has a route to the S3 prefix list via the gateway endpoint and the EC2 instance profile grants access, the endpoint policy acts as an additional layer of authorization. If the endpoint policy does not explicitly allow the s3:PutObject action for the target bucket, requests will be denied, causing the log delivery to fail.

Answer

The route table does not have a route to the S3 prefix list.

Answer

The VPC endpoint is not configured with private DNS.

Answer

The security group on the EC2 instances does not allow outbound traffic to the S3 prefix list.

Question 12

A network engineer is analyzing VPC Flow Logs for a VPC with CIDR 10.0.0.0/16. The exhibit shows a sample log entry. The engineer notices that traffic from 10.0.1.10 to 10.0.2.10 on port 443 is being accepted. However, the application team reports that the connection is failing. What is the most likely reason for the disconnect?

Accepted Answer

The application layer is failing to establish a proper connection.. The VPC Flow Logs show that traffic from 10.0.1.10 to 10.0.2.10 on port 443 is being accepted (ACCEPT record), which indicates that the network layer (security groups, network ACLs, and routing) is permitting the traffic. Since the application team reports the connection is failing, the issue must be at a higher layer, specifically the application layer (e.g., TLS handshake failure, certificate mismatch, or the application not listening on port 443). Flow logs capture only network-layer metadata (IP, port, protocol, action) and cannot detect application-layer errors.

Answer

The security groups are blocking the traffic.

Answer

The route tables are incorrectly configured, causing packet loss.

Answer

The flow logs are misconfigured and not capturing all traffic.

Question 13

A company uses AWS Direct Connect with a private virtual interface (VIF) to connect its on-premises network to a VPC. The network engineer notices that traffic from on-premises to AWS is being dropped intermittently. The engineer suspects that the Direct Connect gateway route propagation is not working correctly. Which tool or feature should the engineer use to verify the routes advertised from the on-premises network to AWS?

Accepted Answer

Virtual interface BGP session details. The correct answer is the virtual interface BGP session details because it directly shows the prefixes advertised from the on-premises network to AWS. The Direct Connect gateway route table shows routes in the opposite direction, VPC route tables show VPC routing, and CloudTrail logs API activity but not BGP advertisements. Inspecting the BGP session is essential for diagnosing intermittent route propagation problems.

Answer

VPC route table

Answer

AWS Direct Connect gateway route table

Answer

AWS CloudTrail logs

Question 14

A network engineer is configuring a Site-to-Site VPN connection between an on-premises network and AWS. The engineer wants to ensure that if the primary VPN tunnel goes down, traffic automatically fails over to the secondary tunnel. Which configuration is required?

Accepted Answer

Enable dynamic routing (BGP) on the VPN connection. Dynamic routing with BGP enables automatic failover between VPN tunnels because BGP advertises routes and automatically withdraws them when a tunnel fails, causing the routing table to update and traffic to use the other tunnel. Static routes (A) require manual intervention for failover, as they do not dynamically adapt. VPN CloudHub (B) is designed to interconnect multiple VPN connections, not for failover between tunnels. Configuring a second customer gateway device (D) is necessary for redundancy but does not itself enable automatic failover without BGP.

Answer

Use static routes with equal-cost multipath (ECMP)

Answer

Enable VPN CloudHub

Answer

Configure a second customer gateway device

Question 15

A company is migrating from a legacy MPLS network to AWS using Direct Connect. The network team wants to ensure high availability with a backup connection. They have two Direct Connect connections from different providers, both terminating at the same AWS Direct Connect location. Which configuration provides the most resilient setup?

Accepted Answer

Use both connections with separate virtual interfaces, each terminating on different customer routers.. Using two separate Direct Connect connections with separate virtual interfaces, each terminating on different customer routers, provides high availability by eliminating single points of failure at both the physical and logical levels. Option A is wrong because using the same provider reduces diversity. Option C is wrong because using a single connection with two VIFs still has a single physical link. Option D is wrong because terminating on the same router creates a single point of failure.

Answer

Use both connections but from the same provider to simplify management.

Answer

Use one connection with two virtual interfaces for redundancy.

Answer

Use both connections with a single virtual interface on each, but terminate on the same router.