ANS-C01 Practice Questions 1 — 50 Questions

Question 1

A company is designing a network security architecture for a multi-account environment using AWS Transit Gateway. The security team needs to centralize inspection of all traffic between VPCs using a third-party firewall appliance in a shared services VPC. What is the most scalable and highly available design?

Accepted Answer

Create a Transit Gateway with separate route tables for each VPC and a shared route table for the inspection VPC. Use Gateway Load Balancer to distribute traffic to a fleet of firewall instances.. Option B is correct because it combines AWS Transit Gateway with separate route tables per VPC and a shared inspection route table, enabling centralized traffic steering to a fleet of firewall instances behind a Gateway Load Balancer (GWLB). GWLB transparently distributes traffic across multiple firewall instances at the network layer (GENEVE protocol), providing both horizontal scalability and high availability without introducing a single point of failure or requiring complex VPC peering meshes.

Answer

Use VPC peering to connect all VPCs to the shared services VPC and route traffic through the firewall.

Answer

Attach all VPCs to a Transit Gateway and configure a Network Load Balancer in the shared services VPC to distribute traffic to firewall instances.

Answer

Attach all VPCs to a Transit Gateway and use a single firewall instance with elastic network interfaces in each VPC.

Question 2

A company is using AWS Direct Connect to connect its on-premises network to AWS. The company wants to encrypt all traffic between its on-premises network and AWS. Which solution meets this requirement?

Accepted Answer

Use a private VIF and establish an IPsec VPN tunnel over the Direct Connect connection.. Option B is correct because AWS Direct Connect does not natively encrypt traffic; it provides a private, dedicated network connection. To meet the encryption requirement, you can establish an IPsec VPN tunnel over the private VIF, which encrypts all traffic between the on-premises network and the VPC. This approach combines the low latency and reliability of Direct Connect with the security of IPsec encryption.

Answer

Use a public virtual interface (VIF) and route traffic through a NAT gateway.

Answer

Use a private virtual interface (VIF) and enable encryption on the Direct Connect connection.

Answer

Use a private VIF and enable TLS on all applications.

Question 3

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Site-to-Site VPN. The security team wants to inspect all traffic between VPCs using a centralized inspection VPC with third-party firewall appliances. Which architecture ensures that traffic from VPC A to VPC B is routed through the inspection VPC?

Accepted Answer

Attach all VPCs to a Transit Gateway. Create separate route tables: one for inspection VPC attachments and one for others. In VPC A's route table, route to VPC B via the inspection VPC attachment.. Option A is correct because it uses separate Transit Gateway route tables to isolate the inspection VPC and other VPCs. By configuring the route table for VPC A to point to VPC B's CIDR via the inspection VPC attachment, all inter-VPC traffic is forced through the centralized firewall appliances. This leverages Transit Gateway's ability to route traffic between attachments based on route table associations and propagations, ensuring traffic flows through the inspection VPC without requiring VPC peering or additional per-VPC firewalls.

Answer

Create a VPC peering connection between VPC A and VPC B, and attach firewall appliances in both VPCs.

Answer

Use AWS PrivateLink to create VPC endpoints in VPC A and VPC B, and route traffic through the firewall VPC.

Answer

Deploy AWS Network Firewall in each VPC and configure VPC route tables to send traffic to the firewall endpoint.

Question 4

A global e-commerce company uses a hub-and-spoke network topology with a transit VPC in us-east-1. Each spoke VPC has an AWS Site-to-Site VPN connection to its respective on-premises office. Users report intermittent connectivity issues when accessing a web application hosted in a spoke VPC in eu-west-1 from an on-premises office in ap-southeast-1. The network engineer checks the VPN connection and finds it is up. Which design change would MOST likely resolve the issue?

Accepted Answer

Enable jumbo frames on the transit VPC's EC2-based virtual appliances.. The issue is intermittent connectivity between an on-premises office in ap-southeast-1 and a spoke VPC in eu-west-1, traversing a transit VPC in us-east-1. The VPN is up, so the problem is likely packet fragmentation or MTU mismatch across the long-haul path. Enabling jumbo frames on the transit VPC's EC2-based virtual appliances (e.g., firewall or router instances) increases the maximum transmission unit, reducing fragmentation and improving performance for large packets, which is a common cause of intermittent issues in hub-and-spoke topologies.

Answer

Change the VPN connection from static to dynamic routing.

Answer

Enable BGP route propagation on the transit VPC's route tables.

Answer

Deploy a new transit VPC in eu-west-1.

Question 5

A company is designing a multi-VPC architecture in the same region. The VPCs need to communicate with each other using private IP addresses. The company must minimize cost and operational overhead. Which solution should the company use?

Accepted Answer

Create VPC peering connections between each pair of VPCs.. Option C is correct because VPC peering connections provide direct, private IP connectivity between VPCs using the AWS global network, with no bandwidth bottlenecks or single points of failure. It is the most cost-effective solution for a small number of VPCs (e.g., fewer than 10) as there are no hourly charges for the peering connection itself—only data transfer costs. This minimizes operational overhead compared to managing VPN tunnels or a Transit Gateway, as peering is a simple, one-to-one relationship that does not require additional appliances or complex routing policies.

Answer

Set up AWS Site-to-Site VPN connections between each VPC.

Answer

Use ClassicLink to connect the VPCs.

Answer

Create a Transit Gateway and attach all VPCs.

Question 6

A company is deploying an application that requires low-latency communication between EC2 instances in two different AWS Regions. The application traffic is latency-sensitive and the company wants to minimize jitter. Which network design provides the lowest and most consistent latency?

Accepted Answer

Deploy an AWS Global Accelerator with endpoints in both Regions and use the accelerator's static IP addresses for communication.. AWS Global Accelerator uses the AWS global network and Anycast static IP addresses to route traffic over optimized paths, providing lower and more consistent latency than VPC peering, internet transit, or VPNs. It minimizes jitter by avoiding the public internet and leveraging AWS's internal backbone, which is ideal for latency-sensitive inter-Region communication.

Answer

Create a VPC peering connection between the two VPCs and route traffic through the peering connection.

Answer

Use internet gateways and route traffic over the public internet between the instances.

Answer

Use a Site-to-Site VPN connection between the two VPCs over the internet.

Question 7

Which TWO of the following are valid components of an AWS Transit Gateway design for connecting multiple VPCs and on-premises networks?

Accepted Answer

Transit Gateway route table. Option D is correct because a Transit Gateway route table is a fundamental component that controls how traffic is routed between attachments (VPCs, VPNs, Direct Connect) within the Transit Gateway. Each attachment is associated with exactly one route table, and route propagation enables dynamic learning of routes across the network.

Answer

VPC Endpoint Gateway

Answer

Transit Gateway endpoint attached to a subnet in a VPC

Answer

Direct Connect Gateway associated with a Transit Gateway

Question 8

A solutions architect is designing a VPC with public and private subnets in two Availability Zones. The private subnets require outbound internet access for software updates, but inbound internet access must be blocked. Which solution meets these requirements?

Accepted Answer

Deploy a NAT Gateway in a public subnet and add a default route to the NAT Gateway in the private subnet route tables.. Option B is correct because a NAT Gateway, deployed in a public subnet with an Elastic IP and a route to an Internet Gateway, enables outbound traffic from private subnets to the internet while blocking unsolicited inbound connections. The private subnet route table directs default traffic (0.0.0.0/0) to the NAT Gateway, which performs source network address translation (SNAT) on outbound packets, ensuring responses return to the NAT Gateway without exposing private instances directly.

Answer

Attach an internet gateway to the VPC and add a default route to the internet gateway in the private subnet route tables.

Answer

Launch an EC2 instance in a public subnet with a proxy software and route private subnet traffic through it.

Answer

Create a VPC endpoint for Amazon S3 and add a route to the endpoint in the private subnet route tables.

Question 9

A company has a Direct Connect connection with a private VIF attached to a virtual private gateway. The VPC has multiple subnets in two Availability Zones. The on-premises network advertises a default route (0.0.0.0/0) via BGP. The company wants all internet-bound traffic from the VPC to go through the on-premises network. Which THREE actions are required to achieve this?

Accepted Answer

Add a default route pointing to the virtual private gateway in the private subnet route tables.. Option B is correct because adding a default route (0.0.0.0/0) pointing to the virtual private gateway in the private subnet route tables ensures that all internet-bound traffic from those subnets is forwarded over the Direct Connect private VIF to the on-premises network. This leverages the BGP-advertised default route from the on-premises network, allowing the company to enforce its security and routing policies for internet access.

Answer

Deploy a NAT Gateway in a public subnet.

Answer

Attach an internet gateway to the VPC.

Question 10

A company is designing a network for a three-tier web application on AWS. The web tier must be accessible from the internet, and the application and database tiers must be in private subnets. The company wants to use a single AWS Region and ensure high availability. Which TWO configurations should be implemented? (Choose two.)

Accepted Answer

Place an internet-facing Application Load Balancer (ALB) in public subnets across two Availability Zones.. Option A is correct because an internet-facing Application Load Balancer (ALB) in public subnets across two Availability Zones (AZs) provides both internet access to the web tier and high availability. The ALB distributes incoming HTTP/HTTPS traffic to web instances in private subnets, and deploying across two AZs ensures fault tolerance if one AZ fails.

Answer

Use a stateful network ACL for the web tier subnets to simplify security rules.

Answer

Deploy a NAT Gateway in a single Availability Zone for outbound traffic from private subnets.

Answer

Create the VPC with a single Availability Zone to simplify management.

Question 11

A network engineer is troubleshooting connectivity between two VPCs (VPC-A and VPC-B) connected via a VPC peering connection. Both VPCs have CIDR blocks: VPC-A = 10.0.0.0/16, VPC-B = 10.1.0.0/16. An EC2 instance in VPC-A (10.0.1.10) cannot ping an EC2 instance in VPC-B (10.1.1.10). Security groups and NACLs allow all traffic. The route tables are configured as follows: In VPC-A, a route to 10.1.0.0/16 via the peering connection. In VPC-B, a route to 10.0.0.0/16 via the peering connection. What is the most likely cause?

Accepted Answer

There is an intermediate VPC or on-premises network that routes traffic incorrectly due to the lack of transitive routing.. VPC peering connections do not support transitive routing. Even though the route tables in VPC-A and VPC-B correctly point to each other via the peering connection, if there is an intermediate VPC or on-premises network involved in the path, traffic cannot be forwarded through that intermediate point. The ping fails because the peering connection is a direct, one-to-one link and does not allow routing through a third network.

Answer

The VPCs have overlapping CIDR blocks.

Answer

Security groups are blocking ICMP traffic.

Answer

The route tables are missing routes to the peering connection.

Question 12

A company is migrating a legacy application to AWS. The application requires multicast communication between EC2 instances in the same VPC. Which THREE options can support this requirement? (Choose three.)

Accepted Answer

Use AWS Transit Gateway with a multicast domain.. AWS Transit Gateway supports multicast through the creation of a multicast domain, which allows EC2 instances in different subnets and VPCs attached to the transit gateway to send and receive multicast traffic. This is a native AWS capability that does not require third-party appliances or workarounds, making it a valid option for the requirement.

Answer

Use AWS Direct Connect to extend the on-premises multicast domain to the VPC.

Answer

Create a VPC peering connection and enable multicast across the peered VPCs.

Question 13

A company wants to ensure that traffic between two VPCs in the same region is encrypted in transit. The VPCs are connected via a VPC peering connection. What should the network engineer do to meet this requirement?

Accepted Answer

Use TLS or IPsec at the application layer between instances.. Option B is correct because VPC peering connections do not support native encryption of traffic. To meet the requirement for encryption in transit between two VPCs connected via a VPC peering connection, you must implement encryption at the application layer using TLS or IPsec between the instances. This ensures that traffic is encrypted end-to-end, independent of the underlying network path.

Answer

Create an AWS Site-to-Site VPN between the VPCs and disable the VPC peering connection.

Answer

Replace the VPC peering connection with a Transit Gateway and enable VPN encryption.

Answer

Enable encryption on the VPC peering connection.

Question 14

A network engineer is troubleshooting connectivity issues from an on-premises network to an AWS VPC over a Direct Connect private VIF. The VPC has a virtual private gateway attached. The on-premises router can ping the private IP of an EC2 instance in the VPC, but application traffic (TCP port 443) fails. What is the most likely cause?

Accepted Answer

The security group for the EC2 instance does not allow inbound HTTPS traffic.. Since the on-premises router can ping the EC2 instance's private IP, Layer 3 connectivity is working, which rules out routing and BGP issues. The failure of TCP port 443 specifically points to a firewall or access control blocking the application traffic. A security group acts as a virtual firewall at the instance level, and by default it denies all inbound traffic unless explicitly allowed. Therefore, the most likely cause is that the security group for the EC2 instance does not have an inbound rule permitting HTTPS (TCP 443) traffic.

Answer

The network ACL in the VPC is blocking outbound traffic.

Answer

The BGP session is in the 'Idle' state.

Answer

The route table associated with the virtual private gateway does not have a route to the on-premises network.

Question 15

A company is using AWS Transit Gateway to interconnect multiple VPCs and on-premises networks. The network engineer needs to ensure that traffic between VPC A and VPC B follows a specific path through a Network Virtual Appliance (NVA) in VPC C. Which TWO actions should the engineer take?

Accepted Answer

Add a static route in the Transit Gateway route table for VPC A's CIDR pointing to the VPC B attachment with a blackhole.. Option B is correct because adding a static route in the Transit Gateway route table for VPC A's CIDR pointing to the VPC B attachment with a blackhole forces traffic destined to VPC B to be dropped at the Transit Gateway, preventing direct routing. Option D is correct because adding a specific route for VPC B's CIDR in the Transit Gateway route table used by VPC A, pointing to the VPC C attachment, ensures traffic from VPC A to VPC B is forwarded through the NVA in VPC C, enforcing the desired inspection path.

Answer

Associate VPC A's and VPC B's route tables with a different Transit Gateway route table that has a default route pointing to the VPC C attachment.

Answer

Enable route propagation for VPC A and VPC B attachments in the same Transit Gateway route table.

Answer

Create a VPC peering connection between VPC A and VPC B.

Question 16

A multinational corporation is using AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Direct Connect and VPN. The network team is experiencing asymmetric routing for traffic between two VPCs that both have routes to the same on-premises network. Which feature should the team implement to resolve this issue?

Accepted Answer

Use AS_PATH prepending on the BGP advertisements from the on-premises router to influence route preference.. AS_PATH prepending allows the on-premises router to artificially lengthen the AS_PATH for specific BGP routes, making those routes less preferred. This influences route selection in the Transit Gateway and VPC route tables, ensuring that traffic from each VPC takes a consistent path and eliminating asymmetric routing.

Answer

Deploy a NAT Gateway in each VPC to force symmetric traffic.

Answer

Create a Transit Gateway peering attachment between the two VPCs.

Answer

Enable VPC Flow Logs to detect and alert on asymmetric flows.

Question 17

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team observes that traffic between two VPCs (VPC A and VPC B) is not being forwarded correctly. The transit gateway route table is configured with static routes for the VPC CIDRs. Which THREE steps should the engineer take to troubleshoot this issue? (Choose THREE.)

Accepted Answer

Verify that the transit gateway route table contains the CIDR blocks of both VPCs.. Option A is correct because the transit gateway route table must contain the CIDR blocks of both VPCs for traffic to be forwarded between them. Without these static routes, the transit gateway has no destination to route the traffic, causing it to be dropped. Verifying the route table entries ensures the necessary paths exist.

Answer

Check the Direct Connect virtual interface status.

Answer

Verify that the NAT Gateway in each VPC is properly configured.

Question 18

A company uses AWS Site-to-Site VPN to connect its on-premises network to AWS. The VPN connection is established, but traffic from on-premises to AWS is not working. The on-premises network team confirms that the on-premises firewall is allowing traffic to the VPC CIDR. What should the network engineer check in AWS to resolve the issue?

Accepted Answer

Check the VPC route tables to ensure routes to the on-premises network point to the virtual private gateway.. Option D is correct because even if the VPN tunnel is up and BGP is peering, traffic will not flow unless the VPC route tables have a route pointing to the virtual private gateway (VGW) for the on-premises CIDR. Without this route, the VPC has no path to forward return traffic back to the on-premises network, causing asymmetric routing or blackholing.

Answer

Verify that the VPN tunnel status is UP.

Answer

Review the customer gateway configuration for incorrect BGP settings.

Answer

Ensure the virtual private gateway is attached to the correct VPC.

Question 19

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. Network engineers report intermittent connectivity issues between VPC A and the on-premises network. The transit gateway route table shows the on-premises CIDR (10.0.0.0/8) propagated from the VPN attachment. VPC A has a subnet route pointing to the transit gateway for 10.0.0.0/8. Which step should the engineer take FIRST to diagnose the issue?

Accepted Answer

In the transit gateway route table, verify that the VPN attachment is correctly associated and that the 10.0.0.0/8 route is propagated and has the correct attachment.. Option C is correct because the first diagnostic step for intermittent connectivity through a transit gateway is to verify the route table configuration. The engineer must confirm that the VPN attachment is correctly associated with the transit gateway route table and that the 10.0.0.0/8 route is propagated from the VPN attachment, as a missing or misassociated route would cause traffic to be dropped even if the VPN tunnel is up.

Answer

Verify that the VPN tunnel status shows as UP on both sides.

Answer

Enable VPC Flow Logs on VPC A to verify traffic reaching the transit gateway.

Answer

Check the security group rules on the EC2 instances in VPC A for outbound traffic.

Question 20

A global e-commerce company is migrating to AWS and plans to use a hub-and-spoke topology with AWS Transit Gateway. The network team wants to ensure high availability for the connection between the hub VPC and the on-premises data center using AWS Direct Connect with multiple virtual interfaces (VIFs). They need to be able to fail over quickly with minimal packet loss. Which design should meet these requirements?

Accepted Answer

Provision two Direct Connect connections, each with multiple private VIFs, and attach them to the same transit gateway. Use BFD to detect failures and rely on ECMP routing across the VIFs.. Option C is correct because it provides true high availability and fast failover by using two separate Direct Connect connections, each with multiple private VIFs, attached to the same transit gateway. BFD (Bidirectional Forwarding Detection) enables sub-second failure detection, and ECMP (Equal-Cost Multi-Path) routing across the VIFs allows active-active load balancing, minimizing packet loss during failover. This design eliminates single points of failure and meets the requirement for rapid convergence with minimal disruption.

Answer

Provision one Direct Connect connection with a single private VIF, and enable BFD on the VIF to detect failures quickly.

Answer

Provision one Direct Connect connection with two private VIFs, and use a second Direct Connect connection as backup with a single VIF. Configure route tables to prefer the primary.

Answer

Provision two Direct Connect connections, each with a single private VIF, and use AWS Site-to-Site VPN as a backup for each.