ANS-C01 Practice Test 5 — 10 Questions

Question 1

A company is designing a network for a three-tier web application. The web tier must be accessible from the internet, while the application and database tiers must be in private subnets. The company wants to minimize the number of load balancers. Which design should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Place an internet-facing Application Load Balancer in a public subnet, web tier instances in public subnets, and app/database instances in private subnets.. An internet-facing Application Load Balancer (ALB) in a public subnet can receive internet traffic and forward it to web tier instances in public subnets, while the application and database tiers remain in private subnets with no direct internet access. This design uses a single load balancer to handle all external traffic, minimizing the number of load balancers while maintaining security boundaries.

Answer

Place an internal Application Load Balancer in a private subnet and use a NAT gateway for internet access.

Answer

Place an internet-facing Network Load Balancer in a public subnet and use it for all tiers.

Answer

Place an internet-facing Application Load Balancer in a private subnet.

Question 2

A solutions architect needs to design a highly available web application that uses an Application Load Balancer (ALB) and spans multiple Availability Zones (AZs) in a single region. The application must be able to handle a sudden increase in traffic without manual intervention. Which feature should the architect enable on the ALB to meet this requirement?

Accepted Answer

Enable cross-zone load balancing. Cross-zone load balancing distributes incoming traffic evenly across all registered targets in all enabled Availability Zones, rather than sending traffic only to targets in the same AZ as the load balancer node. This ensures that if one AZ receives more traffic than another, the ALB can still balance the load across all healthy instances, allowing the application to handle sudden traffic spikes without manual scaling intervention.

Answer

Enable connection draining

Answer

Enable sticky sessions

Answer

Enable deletion protection

Question 3

A company has an S3 bucket with the bucket policy shown. The VPC endpoint ID is correct. However, an EC2 instance in a private subnet in the same VPC cannot download objects from the bucket. What is a possible reason?

Accepted Answer

The EC2 instance is accessing S3 via a NAT Gateway instead of the VPC endpoint. The bucket policy likely includes a condition that restricts access to only requests originating from the VPC endpoint (e.g., `aws:sourceVpce`). If the EC2 instance in the private subnet routes traffic through a NAT Gateway instead of the VPC endpoint, the source IP will be the NAT Gateway's public IP, not the VPC endpoint's private IP, causing the condition to fail and the request to be denied. The instance can still reach S3 via the NAT Gateway, but the policy explicitly blocks non-endpoint traffic.

Answer

The EC2 instance does not have a route to the VPC endpoint

Answer

The bucket policy does not allow s3:ListBucket

Answer

The VPC endpoint security group is blocking traffic

Question 4

A company has created a VPC Interface Endpoint for Amazon ECR (Docker registry API) as shown in the exhibit. However, an EC2 instance in the same VPC is unable to authenticate with the ECR registry using the private DNS name. What is the most likely cause?

Accepted Answer

Private DNS is not enabled for the endpoint. The most likely cause is that Private DNS is not enabled for the VPC Interface Endpoint. When Private DNS is enabled, the endpoint automatically associates a Route 53 private hosted zone with the VPC, allowing the default private DNS name (e.g., *.dkr.ecr.us-east-1.amazonaws.com) to resolve to the endpoint's elastic network interface IP addresses. Without this, the EC2 instance will resolve the private DNS name to the public IP of the ECR service, bypassing the endpoint and failing authentication due to network path issues.

Answer

The endpoint service name is incorrect; it should be com.amazonaws.us-east-1.ecr.api

Answer

The endpoint is not in the 'available' state

Answer

The endpoint type should be Gateway, not Interface

Question 5

A company has a VPC with an Application Load Balancer (ALB) that distributes traffic to EC2 instances in private subnets. The ALB needs to be accessible from the internet. The security team requires that all traffic to the ALB be inspected by AWS WAF. Which configuration meets these requirements?

Accepted Answer

Associate AWS WAF with the ALB and make the ALB internet-facing. AWS WAF can be directly associated with an Application Load Balancer (ALB) to inspect HTTP/HTTPS traffic before it reaches the ALB. Making the ALB internet-facing allows it to receive traffic directly from the internet while WAF provides the required traffic inspection. This combination meets both the accessibility and security requirements without additional components.

Answer

Use a Network Load Balancer with AWS WAF attached

Answer

Place the ALB behind a Security Group that inspects traffic

Answer

Use Amazon CloudFront in front of the ALB with AWS WAF

Question 6

A network engineer deploys this CloudFormation template. After deployment, an EC2 instance launched in PublicSubnet1 cannot reach the internet. What is the most likely cause?

Accepted Answer

The subnet does not have a route to the Internet Gateway because the route table is not associated with the subnet.. The most likely cause is that the route table containing the default route (0.0.0.0/0) pointing to the Internet Gateway is not associated with PublicSubnet1. Without this association, traffic from the subnet has no path to the Internet Gateway, even if the IGW is attached to the VPC. CloudFormation templates often create separate route tables and subnets, and a missing subnet-to-route-table association is a common misconfiguration.

Answer

The Internet Gateway is not attached to the VPC.

Answer

The subnet does not have MapPublicIpOnLaunch set to true.

Answer

The security group is blocking outbound traffic.

Question 7

A network engineer is setting up a cross-account Route 53 Resolver rule association. The engineer creates the above resource-based policy on a resolver rule in account 111111111111. The engineer then tries to associate the rule from account 222222222222 but receives an access denied error. What is the MOST likely reason for the failure?

Accepted Answer

The policy's Principal is set to account 111111111111 instead of account 222222222222.. The resource-based policy on the Route 53 Resolver rule must specify the consuming account (222222222222) as the Principal to authorize cross-account association. Since the policy incorrectly sets the Principal to the owning account (111111111111), the request from account 222222222222 lacks the required permissions, resulting in an access denied error.

Answer

The policy does not allow the 'route53resolver:AssociateResolverRule' action.

Answer

The policy does not include the 'route53resolver:DisassociateResolverRule' action.

Answer

The resolver rule is not shared with account 222222222222.

Question 8

A company is designing a VPC with public and private subnets. The company needs to provide internet access to instances in the private subnets. Which TWO components are required? (Choose TWO.)

Accepted Answer

Internet Gateway attached to the VPC. An Internet Gateway (IGW) is required to provide a target in the VPC route tables for internet-bound traffic. For instances in private subnets, a NAT Gateway placed in a public subnet translates their private IP addresses to the public IP of the NAT Gateway, allowing outbound internet access while preventing unsolicited inbound connections. The private subnet's route table must point 0.0.0.0/0 to the NAT Gateway, and the public subnet's route table must point 0.0.0.0/0 to the IGW.

Answer

Transit Gateway

Answer

VPC Gateway Endpoint for S3

Answer

Virtual Private Gateway

Question 9

A company has a multi-account AWS environment using AWS Organizations. The network team wants to centralize VPC traffic inspection using a Transit Gateway and a firewall appliance in a central account. Which THREE steps are required to implement this design? (Choose THREE.)

Accepted Answer

Create a Transit Gateway in the central account and attach the central VPC.. A Transit Gateway (TGW) in the central account acts as the hub for VPC traffic inspection. Attaching the central VPC (which contains the firewall appliance) to the TGW allows all inter-VPC traffic to be routed through the central inspection VPC, enabling centralized traffic inspection without requiring VPC peering or per-spoke firewalls.

Answer

Create a VPC peering connection between each spoke VPC and the central VPC.

Answer

Deploy a firewall appliance in each spoke VPC.

Question 10

A company is designing a hybrid network using AWS Direct Connect. They want to extend their on-premises network to multiple VPCs in the same AWS Region. Which resource should they use to achieve this?

Accepted Answer

Direct Connect gateway. A Direct Connect gateway is the correct resource because it allows you to associate up to 10 VPCs (or 20 with a quota increase) in the same or different AWS Regions with a single Direct Connect connection. It acts as a central hub, enabling connectivity from your on-premises network to multiple VPCs via a single private virtual interface (VIF) attached to the Direct Connect gateway, without needing separate VIFs per VPC.

Answer

Direct Connect transit virtual interface

Answer

Direct Connect private virtual interface (VIF)

Answer

Link Aggregation Group (LAG)