ANS-C01 Practice Questions 1 — 50 Questions

Question 1

A company has an application that requires fixed IP addresses for whitelisting by third-party partners. The application is hosted on an Application Load Balancer (ALB) in a VPC. Which solution provides static IP addresses for the ALB?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Place an AWS Global Accelerator in front of the ALB.. AWS Global Accelerator provides two static IP addresses that act as fixed entry points for traffic. By placing it in front of an Application Load Balancer (ALB), you can whitelist these static IPs with third-party partners while the ALB itself remains dynamic. Global Accelerator uses the AWS global network to route traffic to the ALB, preserving the ALB's native HTTP/HTTPS features.

Answer

Use Amazon CloudFront with the ALB as origin.

Answer

Assign an Elastic IP to the ALB.

Answer

Replace the ALB with a Network Load Balancer (NLB).

Question 2

A company has a VPC with a CIDR of 10.0.0.0/16. It has six subnets: three public (10.0.1.0/24, 10.0.2.0/24, 10.0.3.0/24) and three private (10.0.4.0/24, 10.0.5.0/24, 10.0.6.0/24). The company wants to launch an RDS instance in a private subnet. Which subnet should the RDS instance be placed in to maximize high availability and follow best practices?

Accepted Answer

Place the RDS instance in two private subnets that are in different Availability Zones.. Amazon RDS Multi-AZ deployments require the RDS instance to be placed in at least two subnets that reside in different Availability Zones (AZs) within the same VPC. This configuration enables synchronous standby replication across AZs, providing automatic failover and high availability. The subnets must be private to ensure the database is not directly exposed to the internet, aligning with security best practices.

Answer

Place the RDS instance in a public subnet and use security groups to restrict access.

Answer

Place the RDS instance in all three private subnets to maximize availability.

Answer

Place the RDS instance in a single private subnet with a large CIDR for future scaling.

Question 3

Which THREE of the following are valid considerations when designing a multi-Region active-active application using AWS Global Accelerator?

Accepted Answer

You can assign different weights to endpoints in different Regions to control traffic distribution.. AWS Global Accelerator allows you to assign different weights to endpoints in different Regions, enabling granular control over traffic distribution for active-active architectures. This is achieved through endpoint group weights, where you can adjust the proportion of traffic sent to each Regional endpoint group, supporting scenarios like gradual rollouts or load balancing across Regions.

Answer

Global Accelerator supports sticky sessions (session affinity) based on client IP.

Answer

Global Accelerator provides a set of static IP addresses that are unique to each Region.

Question 4

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They have two subnets: a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). They launch an EC2 instance in the private subnet that needs to download software updates from the internet. The company configures a NAT gateway in the public subnet and adds a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway. The NAT gateway is assigned an Elastic IP address. However, the EC2 instance cannot reach the internet. The security group for the EC2 instance allows all outbound traffic. What is the MOST likely cause?

Accepted Answer

The public subnet's route table does not have a route to an internet gateway.. The NAT gateway is in the public subnet, but the public subnet's route table must have a route to an internet gateway (0.0.0.0/0 -> IGW) for the NAT gateway to forward traffic to the internet. Without that route, the NAT gateway cannot communicate with the internet. Option A is incorrect because NAT gateways do not use security groups. Option B is incorrect because the NAT gateway has an Elastic IP and is properly allocated; the issue is not with the Elastic IP. Option D is incorrect because the private subnet's route table already has a route to the NAT gateway (0.0.0.0/0 -> NAT), which is correctly configured.

Answer

The NAT gateway is not associated with a security group that allows outbound traffic.

Answer

The NAT gateway's Elastic IP address is not properly allocated.

Answer

The private subnet's route table does not have a route to the NAT gateway.

Question 5

Which THREE factors should be considered when designing a VPC for a multi-tier application that requires high availability and security? (Choose three.)

Accepted Answer

Provision subnets in at least two Availability Zones. Deploying subnets across at least two Availability Zones (AZs) ensures high availability by eliminating a single point of failure. If one AZ experiences an outage, the application can continue serving traffic from the other AZ. This is a foundational principle for building fault-tolerant architectures in AWS.

Answer

Assign public IP addresses to all instances for direct access

Answer

Use a single Availability Zone to reduce latency

Question 6

A company wants to securely connect two VPCs in different AWS regions using AWS infrastructure. Which service should be used?

Accepted Answer

VPC peering. VPC peering is the correct service because it allows direct, private connectivity between two VPCs in different AWS regions using AWS's internal network, without traversing the public internet. It uses the existing AWS infrastructure to route traffic between the VPCs via private IP addresses, and it supports inter-region peering as of 2017, making it the simplest and most cost-effective solution for this specific requirement.

Answer

AWS Direct Connect

Answer

Internet Gateway

Answer

AWS Transit Gateway

Question 7

Which THREE AWS services can be used to improve the availability of a web application across multiple AWS Regions? (Choose 3.)

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator improves availability across multiple AWS Regions by using the AWS global network to route user traffic to the optimal regional endpoint based on health, latency, and geography. It provides static anycast IP addresses and automatically reroutes traffic to healthy endpoints during a regional failure, thereby enhancing fault tolerance and performance for global web applications.

Answer

VPC peering

Answer

AWS Direct Connect

Question 8

A network engineer is monitoring a Direct Connect connection. The exhibit shows CloudWatch metric data for the ConnectionState metric. The engineer sees that the average value is 0.0 for most of the day. What does this indicate?

Accepted Answer

The connection was down for most of the day.. The ConnectionState metric indicates the state of the Direct Connect connection, where 0 means down and 1 means up. An average value of 0.0 for most of the day indicates the connection was down. Therefore, option B is correct. Option A is incorrect because the metric shows a consistent value of 0, not fluctuating. Option C is incorrect because the data is complete and clearly shows the connection was down. Option D is incorrect because a value of 0 means the connection was not up and stable.

Answer

The connection was fluctuating between up and down.

Answer

The metric data is incomplete.

Answer

The connection was up and stable.

Question 9

A company is designing a multi-VPC architecture in the same region. The VPCs need to communicate with each other using private IP addresses. The company must minimize cost and operational overhead. Which solution should the company use?

Accepted Answer

Create VPC peering connections between each pair of VPCs.. VPC peering connections provide direct, private IP connectivity between VPCs using the AWS global network, with no bandwidth bottlenecks or single points of failure. It is the most cost-effective solution for a small number of VPCs (e.g., fewer than 10) as there are no hourly charges for the peering connection itself—only data transfer costs. This minimizes operational overhead compared to managing VPN tunnels or a Transit Gateway, as peering is a simple, one-to-one relationship that does not require additional appliances or complex routing policies.

Answer

Set up AWS Site-to-Site VPN connections between each VPC.

Answer

Use ClassicLink to connect the VPCs.

Answer

Create a Transit Gateway and attach all VPCs.

Question 10

A company has a VPC with an Application Load Balancer (ALB) in front of a fleet of EC2 instances. The security group for the EC2 instances must allow traffic only from the ALB. Which source should be specified in the security group inbound rule?

Accepted Answer

The ID of the ALB's security group. You can reference the ALB's security group ID as the source in the EC2 instances' security group inbound rule. This allows traffic from any network interface that is associated with the ALB's security group, regardless of the ALB's IP addresses or subnets. This is the recommended AWS best practice for controlling traffic between an ALB and its target instances, as it automatically adapts to changes in the ALB's underlying infrastructure.

Answer

The ALB's public IP address

Answer

The subnet CIDR block of the ALB's subnets

Answer

The VPC CIDR block

Question 11

A company has deployed an application in a VPC with public and private subnets. The application uses an Amazon RDS for MySQL database in a private subnet. To meet security requirements, the database must not be accessible from the internet. The application team needs to connect to the database for maintenance using SSH over a bastion host. Which architecture is the most secure?

Accepted Answer

Bastion host in a public subnet with a security group allowing SSH from the corporate IP range, and database security group allowing MySQL from the bastion host's security group. The most secure architecture because it restricts SSH access to the bastion host from only the corporate IP range, and the database security group allows MySQL (port 3306) traffic solely from the bastion host's security group. This ensures the database is never directly exposed to the internet and only accepts connections from the bastion, which itself is locked down to authorized corporate IPs. The use of security group referencing (instead of IP-based rules) provides dynamic, scalable access control that automatically applies to any instances with the bastion's security group.

Answer

Bastion host in a public subnet with the same security group as the database, allowing SSH from the corporate IP range and MySQL from the bastion

Answer

Bastion host in a public subnet with a security group allowing SSH from 0.0.0.0/0, and database security group allowing MySQL from the bastion host's security group

Answer

Connect to the database directly using a Site-to-Site VPN without a bastion host

Question 12

A network engineer is configuring a new AWS Direct Connect connection and needs to establish BGP peering with the AWS side. The engineer has received the BGP configuration from the AWS Direct Connect endpoint. Which information is required to complete the BGP configuration on the on-premises router?

Accepted Answer

The AWS BGP peer IP address and the BGP ASN. B is correct because BGP peering requires the remote peer's IP address and Autonomous System Number (ASN) to establish a TCP connection and exchange routing information. AWS provides these two values in the Direct Connect endpoint configuration, and the on-premises router must use them to configure the BGP neighbor statement. Without both, the BGP session cannot be established.

Answer

The AWS Side BGP password and MD5 hash

Answer

The Amazon side routing table and prefix list

Answer

The Direct Connect virtual interface ID and VLAN ID

Question 13

A company has a VPC with public and private subnets in multiple Availability Zones. They want to deploy a NAT gateway for outbound internet access for instances in private subnets. Which of the following is the most highly available architecture?

Accepted Answer

Deploy one NAT gateway in each Availability Zone with a route table per AZ that points to the NAT gateway in the same AZ.. For high availability, you should deploy a NAT gateway in each Availability Zone and route traffic from private subnets in each AZ to the NAT gateway in the same AZ. This avoids cross-AZ data transfer costs and ensures that an AZ failure does not affect other AZs. Option A is correct. Options B and C do not provide equal HA. Option D is incorrect because deploying both NAT gateways in the same Availability Zone creates a single point of failure—if that AZ goes down, both gateways fail, so it is not highly available.

Answer

Deploy one NAT gateway in the first Availability Zone and route all private subnet traffic to that NAT gateway.

Answer

Use a single NAT instance in a public subnet with an auto scaling group and health checks.

Answer

Deploy two NAT gateways in the first Availability Zone and use a single route table pointing to one of them.

Question 14

A company is designing a network architecture for a critical application that requires high availability and low latency. The application will be deployed on EC2 instances in an Auto Scaling group across three Availability Zones in a single region. The instances will communicate with an Amazon RDS database. Which configuration will provide the MOST resilient and performant network connectivity?

Accepted Answer

Create an RDS Multi-AZ cluster with one writer and two reader instances in different AZs, and use the cluster endpoint for writes and reader endpoint for reads.. A Multi-AZ cluster with one writer and two reader instances provides both high availability and low latency. The cluster endpoint automatically routes write traffic to the primary instance, while the reader endpoint distributes read traffic across the reader instances in different Availability Zones, reducing latency and improving resilience. This architecture ensures that if one Availability Zone fails, the database remains available without manual intervention, meeting the critical application's requirements.

Answer

Launch a single RDS instance in a public subnet and use Route 53 latency-based routing to direct traffic.

Answer

Use a Network Load Balancer in front of the RDS instance to distribute connections across Availability Zones.

Answer

Place the RDS instance in a single Availability Zone and use a read replica in another AZ for failover.

Question 15

A company is deploying a hybrid network architecture with an AWS Direct Connect connection. They require high availability with redundant connections to two different AWS Direct Connect locations. Which configuration meets the high availability requirement?

Accepted Answer

Two Direct Connect connections at two different AWS Direct Connect locations. Deploying two Direct Connect connections at two different AWS Direct Connect locations provides physical and logical redundancy. This ensures that if one location experiences an outage, the other location can continue to handle traffic, meeting the high availability requirement. AWS recommends this architecture for production workloads requiring resilient hybrid connectivity.

Answer

One Direct Connect connection and one AWS Site-to-Site VPN as backup

Answer

Two virtual interfaces (VIFs) on the same Direct Connect connection

Answer

Two Direct Connect connections at the same AWS Direct Connect location

Question 16

A security engineer created the above S3 bucket policy to grant public read access to objects in the 'confidential/' prefix. However, users report that they receive 'Access Denied' errors when trying to access objects that have the tag 'classification: public'. What is the most likely cause?

Accepted Answer

The objects in the 'confidential/' prefix do not have the required tag 'classification: public'.. The bucket policy includes a condition that requires the object to have the tag 'classification: public' (using s3:ExistingObjectTag). If the objects in the 'confidential/' prefix do not have this tag, the condition fails and access is denied, even though the prefix matches. The policy explicitly grants public read access only to objects that satisfy both the prefix and the tag condition.

Answer

The bucket policy does not grant access to objects owned by other AWS accounts.

Answer

The 's3:GetObjectVersion' action is not allowed because the bucket is not versioned.

Answer

The condition should use 'StringLike' instead of 'StringEquals' for tag matching.

Question 17

Refer to the exhibit. A flow log record shows ACCEPT for traffic from 10.0.1.5 to 10.0.2.10 on port 443. Which AWS service is most likely the destination?

Accepted Answer

Application Load Balancer. An Application Load Balancer (ALB) terminates HTTPS (port 443) connections and forwards traffic to targets. Flow logs showing ACCEPT for traffic to port 443 on an ALB's internal IP (10.0.2.10) are expected because the ALB listens on that port for incoming client connections. The ALB operates at Layer 7 and is the only listed service that natively accepts HTTPS traffic on port 443 within a VPC.

Answer

Amazon RDS instance

Answer

NAT Gateway

Answer

Amazon S3

Question 18

A company is designing a network architecture for a multi-account AWS environment using AWS Transit Gateway. They need to meet the following requirements: (1) Centralized inspection of traffic between VPCs using a firewall appliance. (2) Isolated development environments that cannot communicate with each other but can access the internet via a centralized NAT gateway. (3) Compliance with PCI DSS for production workloads, requiring encryption in transit between VPCs. Which TWO actions should they take?

Accepted Answer

Create a dedicated inspection VPC with a firewall appliance and attach it to the Transit Gateway. Use Transit Gateway route tables to route traffic from all VPCs through the inspection VPC.. It enables centralized traffic inspection by attaching a dedicated inspection VPC with a firewall appliance to the Transit Gateway and using separate route tables to force all inter-VPC traffic through that inspection VPC. This design meets the requirement for centralized inspection without requiring complex peering or VPN configurations.

Answer

Use VPC Peering for all inter-VPC communication

Answer

Use AWS Site-to-Site VPN between each VPC and a central VPN hub

Answer

Use AWS Client VPN to connect development VPCs to the production VPC

Question 19

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team observes that traffic between two VPCs (VPC A and VPC B) is not being forwarded correctly. The transit gateway route table is configured with static routes for the VPC CIDRs. Which THREE steps should the engineer take to troubleshoot this issue? (Choose THREE.)

Accepted Answer

Verify that the transit gateway route table contains the CIDR blocks of both VPCs.. The transit gateway route table must contain the CIDR blocks of both VPCs for traffic to be forwarded between them. Without these static routes, the transit gateway has no destination to route the traffic, causing it to be dropped. Verifying the route table entries ensures the necessary paths exist.

Answer

Check the Direct Connect virtual interface status.

Answer

Verify that the NAT Gateway in each VPC is properly configured.

Question 20

Which TWO statements about AWS Direct Connect are correct? (Select TWO.)

Accepted Answer

Direct Connect supports multiple virtual interfaces (VIFs) over a single connection. AWS Direct Connect allows you to create multiple virtual interfaces (VIFs) — including private VIFs, public VIFs, and transit VIFs — over a single physical Direct Connect connection. This enables you to segment traffic to different AWS services (e.g., VPCs via private VIF, public AWS endpoints via public VIF) without needing separate physical cables, leveraging 802.1Q VLAN tagging to isolate each VIF.

Answer

Direct Connect traffic is encrypted by default

Answer

Direct Connect is a managed VPN service

Answer

Direct Connect can be provisioned in minutes without any physical infrastructure