ANS-C01 Practice Test 50 — 15 Questions

Question 1

A company has a Direct Connect connection with a private VIF to a VPC. The network team notices intermittent packet loss on the link. CloudWatch metrics show no errors on the connection. What should the team do next to isolate the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run a traceroute from an on-premises device to an EC2 instance in the VPC.. Running a traceroute from an on-premises device to an EC2 instance in the VPC helps identify where packets are being dropped along the path. Option B is incorrect because checking BGP session status only verifies routing adjacency, not packet loss. Option C is incorrect because VPC Flow Logs capture metadata but do not indicate packet loss on the Direct Connect link. Option D is incorrect because increasing bandwidth does not resolve packet loss; it only adds capacity.

Answer

Check the BGP session status on the customer router.

Answer

Enable VPC Flow Logs on the VPC.

Answer

Increase the bandwidth of the Direct Connect connection.

Question 2

A company uses AWS Client VPN to provide remote access to its VPC. Users report slow connection speeds. The CloudWatch metrics show high packet loss on the VPN connections. What is the most likely cause?

Accepted Answer

MTU mismatch between the client and the VPN endpoint.. An MTU mismatch between the client and VPN endpoint can cause fragmentation and packet loss, leading to slow speeds. Option A is incorrect because an expired certificate would cause authentication failure, not packet loss. Option B is incorrect because subnet size affects IP address availability, not packet loss. Option D is incorrect because route propagation affects reachability, not packet loss.

Answer

The client certificate has expired.

Answer

The Client VPN subnet is too small.

Answer

Route propagation is not enabled in the VPC route table.

Question 3

A company uses AWS Direct Connect with a private VIF to connect to their VPC. They want to monitor the network latency between their on-premises router and the AWS Direct Connect location. Which AWS service should they use?

Accepted Answer

AWS Direct Connect metrics in CloudWatch. AWS Direct Connect publishes metrics such as latency (round-trip time) and BGP session state to CloudWatch. These metrics can be used to monitor network latency between on-premises and the Direct Connect location. Option B is incorrect because AWS X-Ray is for tracing application requests, not network infrastructure latency. Option C is incorrect because VPC Flow Logs capture IP traffic metadata (e.g., sources, destinations, ports), not latency. Option D is incorrect because CloudWatch Synthetics monitors endpoint availability and response times via canaries, not Direct Connect link latency.

Answer

AWS X-Ray

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Synthetics

Question 4

A company is designing a network security architecture for a multi-tier application. They need to ensure that the web tier can only communicate with the app tier on port 443, and the app tier can only communicate with the database tier on port 3306. Which TWO actions should they take? (Choose TWO.)

Accepted Answer

Create a security group for the web tier that allows outbound traffic to the app tier security group on port 443.. Options A and B are correct because security groups are stateful and allow you to reference other security groups as sources or destinations, enabling granular control of traffic between tiers. Option A allows the web tier to send outbound traffic to the app tier on port 443, and Option B allows the app tier to receive that traffic from the web tier. Options C, D, and E are incorrect: AWS Network Firewall is unnecessary for this simple requirement; network ACLs are stateless and would require complex rules; a VPC endpoint policy only applies to VPC endpoints, not inter-tier traffic.

Answer

Deploy an AWS Network Firewall to inspect inter-tier traffic.

Answer

Use network ACLs to statelessly filter traffic on the subnets.

Answer

Configure a VPC endpoint policy to deny all traffic between tiers.

Question 5

A company is designing a multi-region architecture using AWS Global Accelerator and Application Load Balancers (ALBs) in two AWS Regions. They want to route traffic to the closest healthy endpoint and minimize latency. Which configuration best meets these requirements?

Accepted Answer

Create a Global Accelerator with endpoint groups in each region, each pointing to the regional ALB.. AWS Global Accelerator uses the Anycast IP address to route traffic to the nearest edge location, then forwards it over the AWS global network to the closest healthy endpoint group. By configuring endpoint groups in each region, each pointing to the regional ALB, Global Accelerator provides both low-latency routing and automatic failover, meeting the requirement for multi-region traffic distribution to the closest healthy endpoint.

Answer

Deploy a single ALB in one region and use Route 53 geolocation routing to direct traffic.

Answer

Use Amazon Route 53 latency-based routing with ALBs in each region.

Answer

Use an Application Load Balancer in one region and a Network Load Balancer in another with cross-zone load balancing.

Question 6

Which TWO of the following are valid components of an AWS Transit Gateway design for connecting multiple VPCs and on-premises networks?

Accepted Answer

Transit Gateway route table. A Transit Gateway route table is a fundamental component that controls how traffic is routed between attachments (VPCs, VPNs, Direct Connect) within the Transit Gateway. Each attachment is associated with exactly one route table, and route propagation enables dynamic learning of routes across the network.

Answer

VPC Endpoint Gateway

Answer

Transit Gateway endpoint attached to a subnet in a VPC

Answer

Direct Connect Gateway associated with a Transit Gateway

Question 7

A company has a VPC with CIDR 10.0.0.0/16 and needs to connect to another VPC (192.168.0.0/16) using VPC peering. Both VPCs have overlapping CIDRs with some on-premises networks. What must be done to ensure proper routing?

Accepted Answer

Verify that the CIDR blocks do not overlap. If they do, you must re-IP one VPC or use other solutions like Transit Gateway with network address translation.. VPC peering requires non-overlapping CIDR blocks because AWS uses the destination CIDR to route traffic; if the CIDRs overlap, the route tables cannot distinguish between the two VPCs, causing asymmetric routing or dropped traffic. Option B correctly identifies that overlapping CIDRs must be resolved, either by re-IPing one VPC or using Transit Gateway with NAT capabilities to translate addresses and avoid conflicts.

Answer

Use AWS Transit Gateway instead and attach both VPCs.

Answer

Use a NAT gateway in one VPC to translate addresses.

Answer

Create the peering connection and add routes for the full CIDR ranges in both route tables.

Question 8

A company is using AWS Transit Gateway with multiple VPCs and Direct Connect Gateway. They want to ensure that traffic between VPCs and on-premises is encrypted. Which TWO solutions can achieve this?

Accepted Answer

Enable MACsec on the Direct Connect connection. The correct answers are A and B. MACsec (802.1ae) encrypts traffic at Layer 2 on the Direct Connect connection, providing encryption between the on-premises device and AWS. A VPN attachment on the Transit Gateway establishes an IPsec VPN between the Transit Gateway and an on-premises VPN device, encrypting traffic at Layer 3. Option C is incorrect because Transit Gateway does not have native IPsec capabilities; it relies on VPN attachments for IPsec. Option D is incorrect because IPsec is not supported over a private virtual interface; IPsec is typically used over a public virtual interface or a VPN connection. Option E is incorrect because VPC peering does not extend to on-premises traffic; it is only between VPCs.

Answer

Use Transit Gateway IPsec VPN to encrypt traffic between VPCs

Answer

Enable IPsec on the private virtual interface

Answer

Use VPC peering with encryption

Question 9

A company has a Direct Connect connection with a private VIF to a VPC. The network team notices intermittent packet loss on the link. CloudWatch metrics show no errors on the connection. What should the team do next to isolate the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set up an IPsec VPN tunnel over the Direct Connect private VIF. An IPsec VPN tunnel over a Direct Connect private VIF adds an extra layer of encryption to traffic between on-premises and the EC2 instance. Direct Connect private VIFs provide a private, isolated connection but do not encrypt data by default; IPsec encrypts the IP payload at Layer 3, ensuring confidentiality over the physical link. This meets the requirement for an additional encryption layer without altering the application or network stack on the EC2 instance.

Answer

Enable TLS on the EC2 instance

Answer

Use an SSL certificate on the on-premises router

Answer

Use AWS Key Management Service (KMS) to encrypt the traffic

Question 10

A financial services company is designing a multi-region architecture for disaster recovery. They have a primary VPC in us-east-1 and a standby VPC in us-west-2. Each VPC has its own CIDR block (10.0.0.0/16 and 10.1.0.0/16). They want to use an inter-region VPC peering connection for replication traffic. Which of the following is a required step to establish this peering connection?

Accepted Answer

The owner of each VPC must accept the peering connection request.. Inter-region VPC peering connections require both VPC owners to accept the peering request. In AWS, a VPC peering connection is a one-to-one relationship between two VPCs, and the request must be accepted by the owner of the accepter VPC (in this case, the standby VPC in us-west-2) after the requester VPC (us-east-1) initiates it. This acceptance is a mandatory step for the peering connection to become active, regardless of whether the VPCs are in the same or different regions.

Answer

Ensure the VPC CIDR blocks do not overlap.

Answer

Create a VPN attachment between the two VPCs using AWS Site-to-Site VPN.

Answer

Create two separate peering connections, one for each direction of traffic.

Question 11

Match each AWS networking service to the OSI layer it primarily operates at.

Accepted Answer

AWS Direct Connect: Layer 2 (Data Link). AWS Direct Connect provides physical or virtual connections at Layer 2, AWS Site-to-Site VPN encrypts and routes IP packets at Layer 3, CloudFront and ALB handle HTTP/HTTPS at Layer 7. Common confusions include misattributing Direct Connect to Layer 3 or CloudFront to lower layers.

Answer

AWS Direct Connect: Layer 3 (Network)

Answer

Amazon CloudFront: Layer 4 (Transport)

Question 12

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to add an IPv6 CIDR block to the VPC. Which action should they take?

Accepted Answer

Associate an Amazon-provided IPv6 CIDR block with the VPC.. Amazon VPC supports IPv6 through an Amazon-provided IPv6 CIDR block that is automatically allocated from Amazon's pool of global unicast addresses. You cannot bring your own IPv6 CIDR or manually assign one; the only supported method is to associate an Amazon-provided /56 IPv6 CIDR block with the VPC. This enables dual-stack networking, allowing resources to communicate over both IPv4 and IPv6.

Answer

Request an IPv6 CIDR block from your regional internet registry and associate it with the VPC.

Answer

Enable IPv6 on the subnets directly without associating a VPC CIDR.

Answer

Manually assign a /56 IPv6 CIDR block to the VPC.

Question 13

A network engineer is diagnosing a connectivity issue between two VPCs connected via VPC peering. The engineer has confirmed that the route tables in both VPCs have appropriate routes and the security groups allow traffic. However, traffic from VPC A to VPC B fails. Which TWO steps should the engineer take to troubleshoot? (Select TWO.)

Accepted Answer

Check the network ACL of the subnet in VPC B where the target instance resides.. Checking the network ACL (NACL) of the subnet in VPC B where the target instance resides can reveal if inbound traffic is blocked by the stateless NACL. Option D is correct because verifying the operating system firewall on the target instance in VPC B can block traffic even if AWS network rules are open. Option B is wrong because VPC peering can work across different AWS accounts, so being in the same account is not necessary. Option C is wrong because the engineer should already have verified the peering connection status as part of initial checks; if it were inactive, the problem would be obvious, so it is not a likely next step. Option E is wrong because while VPC Flow Logs are useful for deep analysis, they are not the first step for a basic connectivity check; direct checks like NACLs and OS firewalls are more immediate.

Answer

Confirm that both VPCs are in the same AWS account.

Answer

Verify the VPC peering connection status is active.

Answer

Enable VPC Flow Logs on both VPCs to analyze traffic.

Question 14

A company has several VPCs in the same AWS account and region. They want to centrally manage and monitor network traffic between these VPCs and also to on-premises networks. Which AWS service should they use?

Accepted Answer

Transit Gateway. AWS Transit Gateway (C) is the correct choice because it acts as a central hub to interconnect multiple VPCs and on-premises networks using a single gateway, simplifying network management and enabling centralized monitoring. It supports transitive routing between all attached networks, which is essential for the company's requirement to manage and monitor traffic across many VPCs and their on-premises environment.

Answer

AWS Direct Connect

Answer

VPC Peering

Answer

AWS VPN CloudHub

Question 15

Which THREE are best practices for managing network security in a multi-VPC AWS environment using AWS Transit Gateway?

Accepted Answer

Use separate Transit Gateway route tables for different environments (e.g., production, development).. Options A, B, and D are correct. Using separate Transit Gateway route tables for different environments (A) enforces isolation and least privilege. Centralizing egress through a shared VPC with a NAT gateway or proxy (B) provides a controlled exit point for internet-bound traffic. Enabling VPC Flow Logs on all VPCs and centralizing logs in a security account (D) enables monitoring and auditing of traffic patterns. Option C is incorrect because a single route table would allow all VPCs to communicate, violating environment isolation. Option E is incorrect because network ACLs are stateless and not designed for inter-VPC traffic filtering in a Transit Gateway architecture; security groups and route tables are more appropriate.

Answer

Attach all VPCs to a single Transit Gateway route table for simplicity.

Answer

Use network ACLs on every subnet to filter traffic between VPCs.