ANS-C01 Practice Questions 2 — 50 Questions

Question 1

A company is using AWS Direct Connect to connect its on-premises network to a VPC via a private virtual interface (VIF) attached to a virtual private gateway (VGW). The company wants to add redundant connectivity using a second Direct Connect connection from a different provider. The network team proposes using a Direct Connect gateway (DXGW) with two private VIFs from different connections, each attached to the DXGW. The DXGW will be associated with the VGW. Which THREE steps are required to complete this configuration? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Associate both private virtual interfaces with the same Direct Connect gateway.. Option B is correct because a Direct Connect gateway can aggregate multiple private VIFs from different Direct Connect connections, so both private VIFs must be associated with the same DXGW to provide redundant paths into the same VPC. Option C is correct because the DXGW must be associated with the virtual private gateway (VGW) attached to the VPC, which allows the DXGW to advertise and route traffic to that VPC over the private VIFs. Option D is correct because the on-premises network must advertise its prefixes over both BGP sessions (one per private VIF) so that AWS can learn the routes and use both connections for active-active load sharing or failover. Option A is not required because, with a DXGW associated to a VGW, the VPC route tables point to the virtual private gateway, not directly to the Direct Connect gateway. Option E is incorrect because a single VGW can be associated with the DXGW; separate VGWs per connection are not needed and would not provide the intended redundant attachment to the same VPC.

Answer

Add routes to the VPC subnets' route tables pointing to the Direct Connect gateway.

Answer

Create a separate virtual private gateway for each Direct Connect connection.

Question 2

A company wants to allow its employees to securely access internal web applications hosted in a VPC without using a VPN. The solution must authenticate users against the company's Active Directory and apply fine-grained access controls. Which AWS service should be used?

Accepted Answer

AWS Verified Access. AWS Verified Access is the correct service because it provides secure access to corporate applications hosted in a VPC without requiring a VPN, and it integrates with identity providers such as Active Directory for authentication and fine-grained access control. Option A (AWS SSO) is designed for federating access to AWS accounts and applications, not for securing access to internal VPC-based applications without a VPN. Option C (AWS Client VPN) requires VPN client software and a VPN connection, which does not meet the requirement of not using a VPN. Option D (Application Load Balancer with OIDC authentication) can authenticate users but typically requires the ALB to be publicly accessible or connected via VPN, and it does not provide the same purpose-built zero-trust access capabilities as Verified Access.

Answer

AWS Single Sign-On (SSO)

Answer

AWS Client VPN

Answer

Application Load Balancer with OIDC authentication

Question 3

Which THREE of the following are considerations when designing a VPC with multiple Availability Zones for high availability? (Choose THREE.)

Accepted Answer

Use an Application Load Balancer to distribute traffic across instances in different Availability Zones.. An Application Load Balancer (ALB) distributes incoming traffic across multiple targets, such as EC2 instances, in different Availability Zones (AZs). By registering instances from multiple AZs with the ALB, you ensure that if one AZ becomes unavailable, the ALB can route traffic to healthy instances in another AZ, thereby maintaining high availability. This aligns with the AWS Well-Architected Framework's recommendation to deploy workloads across multiple AZs and use a load balancer to handle failover.

Answer

Create a single public subnet that spans all Availability Zones.

Answer

Use a single NAT gateway in one Availability Zone to reduce cost.

Question 4

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team notices that traffic between two VPCs is taking a suboptimal path through the on-premises network instead of staying within AWS. What is the MOST likely cause?

Accepted Answer

The Transit Gateway route tables do not have a route for the destination VPC CIDR, so traffic is sent to the on-premises network via a default route.. When a Transit Gateway route table lacks a specific route for the destination VPC CIDR, traffic destined for that VPC is evaluated against the remaining routes. If a default route (0.0.0.0/0) exists pointing to an on-premises network attachment (e.g., a VPN or Direct Connect), the traffic will be forwarded over that path, resulting in a suboptimal route that leaves AWS and re-enters through the on-premises network. This is the most likely cause because the Transit Gateway performs destination-based routing, and missing a specific VPC route forces fallback to the default route.

Answer

The subnet route tables in each VPC have a route pointing to the other VPC's CIDR via the Internet Gateway.

Answer

The VPCs are peered directly, bypassing the Transit Gateway.

Answer

Security groups are blocking traffic between the VPCs.

Question 5

A company is designing a network for a three-tier web application in a single VPC. The web tier must be accessible from the internet, but the application and database tiers must not have direct internet access. The application servers need to make outbound calls to a third-party API. Which architecture meets these requirements?

Accepted Answer

Web servers in public subnets with an Application Load Balancer, application servers in private subnets with a NAT gateway, and database servers in private subnets.. It places web servers in public subnets with an Application Load Balancer for inbound internet traffic, while application and database servers reside in private subnets without direct internet access. A NAT gateway in a public subnet enables the application servers to initiate outbound connections to a third-party API, with return traffic automatically routed back, meeting the requirement for outbound-only internet access.

Answer

Web servers in public subnets, application and database servers in private subnets with an internet gateway for outbound traffic.

Answer

All servers in public subnets with security groups restricting access.

Answer

All servers in private subnets and a VPN connection to the internet.

Question 6

A company has a VPC with a CIDR of 10.0.0.0/16. It creates a subnet 10.0.1.0/24 in us-east-1a and launches an EC2 instance with a private IP 10.0.1.10. The instance needs to send traffic to an on-premises server at 192.168.1.50 over a Direct Connect private VIF. The VPC has a virtual private gateway attached and a route table associated with the subnet. Which TWO entries must exist in the route table for the traffic to succeed?

Accepted Answer

Destination: 10.0.0.0/16, Target: local. For traffic from an EC2 instance in a VPC to an on-premises server over a Direct Connect private VIF, the route table must include two entries: a local route for the VPC CIDR (10.0.0.0/16) which is automatically added and enables communication within the VPC (Option C), and a specific route to the on-premises network (192.168.1.0/24) pointing to the virtual private gateway (vgw-xxxxxxxx) so that traffic destined for 192.168.1.50 is directed over the Direct Connect (Option D). No other entries are required; the local route already covers all subnets, and there is no need for a default route to the internet.

Answer

Destination: 0.0.0.0/0, Target: igw-xxxxxxxx

Answer

Destination: 0.0.0.0/0, Target: nat-xxxxxxxx

Answer

Destination: 10.0.1.0/29, Target: local

Question 7

A company runs a latency-sensitive trading application on EC2 instances spread across three Availability Zones in a VPC. The application uses a Network Load Balancer (NLB) with a TCP listener on port 443. The company wants the NLB to route each client connection to the same backend instance for the life of the connection, and they want to minimize failover disruption if a target becomes unhealthy. Which NLB configuration should a network engineer implement?

Accepted Answer

Rely on the NLB's default flow hash behavior, which pins each TCP connection to a single healthy target for the connection's lifetime.. Network Load Balancers operate at Layer 4 and by default use a flow hash to select a target for each TCP connection; the connection stays with that target until it closes or the target becomes unhealthy. There is no cookie-based sticky session option on a TCP listener, and no separate source IP affinity attribute. Client IP preservation and cross-zone load balancing change addressing and distribution, not per-connection pinning, so the default flow hash behavior is the correct mechanism.

Answer

Enable sticky sessions using an application-controlled cookie on the TCP listener.

Answer

Configure the target group with client IP preservation and enable cross-zone load balancing.

Answer

Enable source IP affinity on the target group so that each client IP is consistently mapped to the same target.

Question 8

A financial services company is required to encrypt all data at rest and in transit. They have an Amazon S3 bucket with server-side encryption enabled (SSE-S3) and are using HTTPS for all API calls. During an audit, the auditor points out that the bucket policy does not explicitly deny requests that do not use HTTPS. Which of the following should the company add to the bucket policy to enforce HTTPS?

Accepted Answer

{"Effect":"Deny","Principal":"*","Action":"s3:*","Resource":"arn:aws:s3:::bucketname/*","Condition":{"Bool":{"aws:SecureTransport":"false"}}}. To enforce HTTPS, the bucket policy must deny requests where aws:SecureTransport is false, which is exactly what option D specifies. This condition evaluates to true for HTTP requests, causing the Deny to apply and blocking unencrypted access. The other options either allow rather than deny or use the wrong boolean value.

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:*","Resource":"arn:aws:s3:::bucketname/*","Condition":{"Bool":{"aws:SecureTransport":"true"}}}

Answer

{"Effect":"Allow","Principal":"*","Action":"s3:*","Resource":"arn:aws:s3:::bucketname/*","Condition":{"Bool":{"aws:SecureTransport":"true"}}}

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:*","Resource":"arn:aws:s3:::bucketname/*","Condition":{"Bool":{"aws:SecureTransport":"true"}}}

Question 9

A network engineer needs to analyze network traffic between EC2 instances in the same VPC to troubleshoot a performance issue. Which AWS feature should they use?

Accepted Answer

VPC Flow Logs.. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet/byte counts) for network interfaces in a VPC, making them the correct tool for analyzing network traffic between EC2 instances to troubleshoot performance issues. Unlike other options, Flow Logs operate at the network layer (Layer 3/4) and can be published to CloudWatch Logs or S3 for detailed traffic analysis.

Answer

AWS Config.

Answer

AWS CloudTrail.

Answer

AWS X-Ray.

Question 10

A company wants to monitor network traffic to and from an EC2 instance to detect anomalous outbound traffic. Which AWS service should they use to capture and analyze the traffic?

Accepted Answer

VPC Traffic Mirroring. VPC Traffic Mirroring copies network traffic from an EC2 instance's ENI to a target (another ENI or Network Load Balancer) for deep packet inspection and analysis. It is the AWS-native service designed to capture and analyze traffic for anomaly detection, intrusion detection, and forensic use cases, making it the correct choice for monitoring outbound traffic.

Answer

Amazon GuardDuty

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 11

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to an on-premises network with CIDR 172.16.0.0/12. They are using an AWS Transit Gateway with a VPN attachment to the on-premises network. The transit gateway route table has a static route for 172.16.0.0/12 pointing to the VPN attachment. Which THREE of the following are necessary for traffic to flow from the VPC to on-premises?

Accepted Answer

The VPC route tables include a route for 172.16.0.0/12 pointing to the transit gateway. Option B is correct because the VPC must have a Transit Gateway attachment (a VPC attachment) before any traffic can be sent to or received from the transit gateway; without this attachment, the TGW cannot route packets into the VPC. Option A is correct because the VPC's route tables must contain a route for 172.16.0.0/12 targeting the transit gateway; otherwise instances in the VPC have no path toward the on-premises CIDR. Option C is correct because the transit gateway route table must have a route for 172.16.0.0/12 pointing to the VPN attachment, which is exactly the static route described in the scenario and is required for the TGW to forward traffic to the VPN. Option D is not required because the scenario already states a static route exists on the TGW, so BGP advertisement from the on-premises router is unnecessary for the TGW to know the route. Option E is not required because the VPN can use static routing; dynamic BGP is optional and not mandated by the scenario.

Answer

The on-premises router is advertising the 172.16.0.0/12 route over BGP

Answer

The VPN tunnel is configured with dynamic BGP routing

Question 12

A company has a VPC with an IPv6 CIDR block and wants to provide internet access to instances in a private subnet using an egress-only internet gateway. Which of the following must be configured correctly?

Accepted Answer

Add a default route (::/0) in the private subnet's route table pointing to the egress-only internet gateway.. An egress-only internet gateway (EIG) is a horizontally scaled, redundant VPC component that allows outbound-only IPv6 traffic from instances in a private subnet to the internet, while preventing unsolicited inbound connections. To use it, you must add a default route (::/0) in the private subnet's route table pointing to the EIG, which directs all outbound IPv6 traffic through the gateway. This configuration ensures that instances can initiate outbound IPv6 connections (e.g., to download updates) but cannot be reached from the internet.

Answer

Configure NAT64 on the VPC to translate IPv6 to IPv4.

Answer

Enable route propagation for the egress-only internet gateway in the route table.

Answer

Assign an IPv6 address to the egress-only internet gateway.

Question 13

A company wants to provide internet access to instances in a private subnet without using a NAT Gateway, due to cost constraints. They have a public subnet with a bastion host that has a public IP. They also have a VPC with an Internet Gateway. What is the most cost-effective way to allow outbound internet access for instances in the private subnet?

Accepted Answer

Launch a NAT instance in the public subnet and configure the private subnet route table to point 0.0.0.0/0 to the NAT instance.. Launch a NAT instance in the public subnet and configure the private subnet route table to point 0.0.0.0/0 to the NAT instance. A NAT instance is a cost-effective alternative to NAT Gateway, as it uses an EC2 instance with IP forwarding enabled and can be run on a low-cost instance type. It requires management but avoids NAT Gateway hourly charges. Option B is incorrect because a VPN connection to a third-party proxy introduces unnecessary complexity and cost. Option C is incorrect because VPC endpoints only provide access to specific AWS services (e.g., S3), not general internet access. Option D is incorrect because the bastion host is typically used for SSH access, and while it could be configured for NAT, it is not recommended for security reasons; a dedicated NAT instance in a public subnet is the proper approach.

Answer

Use a VPN connection to a third-party internet proxy.

Answer

Create a VPC endpoint for Amazon S3 and configure the private subnet to use it.

Answer

Configure the bastion host as a NAT instance by enabling IP forwarding.

Question 14

A company runs a multi-tier web application on AWS. The web servers in public subnets need to send traffic to the application servers in private subnets. The application servers must only accept traffic from the web servers. Both tiers are in the same VPC. Which design meets these requirements without introducing a single point of failure or unnecessary complexity?

Accepted Answer

Place the web servers in a public subnet with a security group that allows inbound from 0.0.0.0/0 on port 443. Place the app servers in a private subnet with a security group that allows inbound from the web server security group on the application port.. It uses security group referencing, which allows the app servers' security group to dynamically allow traffic from any instance associated with the web servers' security group, regardless of IP address changes. This design avoids a single point of failure by not introducing any load balancer or gateway, and it minimizes complexity by leveraging native VPC security group behavior within the same VPC.

Answer

Place the web servers and app servers in the same private subnet behind an internal Network Load Balancer. Route web traffic through the NLB.

Answer

Place the web servers in a public subnet with an Internet Gateway. Place the app servers in a private subnet with a NAT Gateway for outbound traffic. Use NACLs to allow inbound from the web subnet CIDR.

Answer

Place the web servers in a public subnet with a NACL allowing inbound on port 443. Place the app servers in a private subnet with a NACL allowing inbound from the web subnet CIDR on the application port.

Question 15

A company has an Amazon RDS for MySQL database in a private subnet. The database should only be accessible from a specific fleet of EC2 instances in the same VPC. Which combination of security controls should be used to meet this requirement?

Accepted Answer

Use a security group for the RDS instance that allows inbound MySQL traffic from the security group of the EC2 instances.. A security group on the RDS instance that allows inbound MySQL traffic from the security group of the EC2 instances restricts access to only those instances that are members of that security group. Option A is incorrect because network ACLs are stateless and operate at the subnet level, requiring explicit inbound and outbound rules; they cannot reference security groups. Option B is incorrect because a VPN connection is used for connectivity to external networks, not for communication within the same VPC. Option D is incorrect because IAM database authentication controls user authentication to the database, not network-level access from EC2 instances.

Answer

Use a network ACL on the private subnet that allows MySQL traffic from the EC2 instances' IP addresses.

Answer

Set up a VPN connection between the EC2 instances and the RDS instance.

Answer

Enable IAM database authentication for the RDS instance and require EC2 instances to use IAM credentials.

Question 16

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to add a new CIDR block 10.1.0.0/16 to accommodate more subnets. The VPC already has multiple subnets and route tables. What is the impact of adding this secondary CIDR?

Accepted Answer

Existing subnets and route tables remain unchanged; new subnets can be created in the new CIDR.. Adding a secondary CIDR block to an existing VPC is a non-disruptive operation. The existing subnets and route tables remain completely unchanged because the secondary CIDR is an additional IP address space, not a modification of the existing one. New subnets can be created within the new CIDR block, and you must explicitly associate them with route tables as needed.

Answer

The secondary CIDR will be automatically advertised to all route tables.

Answer

The VPC will experience a brief outage while the new CIDR is being associated.

Answer

Existing subnets will automatically be extended to include IPs from the new CIDR.

Question 17

A company is designing a multi-region architecture using AWS Transit Gateway inter-region peering. They need to ensure that traffic between VPCs in different regions can traverse the TGW peering attachment without being inspected by a central security appliance. Which configuration should be used?

Accepted Answer

Create TGW peering attachments and configure the route tables to point to each other's TGW attachment.. Transit Gateway inter-region peering attachments connect two TGWs across regions, and each TGW's route table must have a route pointing to the peering attachment to forward traffic. This creates a direct path between the TGWs without forcing traffic through a centralized inspection VPC, satisfying the requirement that traffic not be inspected.

Answer

Route all inter-region traffic through a centralized inspection VPC in one region.

Answer

Set up a VPN connection between the two TGWs for encrypted traffic.

Answer

Use VPC peering between the VPCs instead of TGW peering.

Question 18

An organization has a multi-account setup using AWS Organizations. The security team wants to centrally manage and enforce security group rules across all VPCs in all accounts. Which solution should they implement?

Accepted Answer

Use AWS Firewall Manager to create common security group policies.. AWS Firewall Manager allows centralized management of security group policies across all accounts in an AWS Organization. It can enforce common security group rules, automatically remediate non-compliant resources, and apply policies to existing and new VPCs. This meets the requirement for central enforcement across all VPCs in all accounts.

Answer

Deploy a centralized network ACL in each VPC.

Answer

Enable VPC Flow Logs and analyze using Amazon Detective.

Answer

Use AWS Config rules to remediate non-compliant security groups.

Question 19

A company wants to connect multiple VPCs across different AWS Regions using AWS Transit Gateway. Which feature allows the VPCs to communicate with each other using private IP addresses without creating peering connections?

Accepted Answer

Transit Gateway inter-Region peering. Transit Gateway inter-Region peering allows VPCs in different AWS Regions to communicate using private IP addresses through a central Transit Gateway, without requiring individual VPC peering connections. This feature uses the AWS global network to route traffic between peered Transit Gateways, enabling cross-region connectivity with a hub-and-spoke architecture.

Answer

AWS Direct Connect gateway

Answer

AWS PrivateLink

Answer

VPC Peering

Question 20

A company has a VPC with CIDR 10.0.0.0/16 and needs to connect to an on-premises network with CIDR 10.0.0.0/8. They plan to use AWS Direct Connect with a private virtual interface. What should they do to resolve the overlapping CIDR conflict?

Accepted Answer

Change the VPC CIDR to a non-overlapping range, such as 172.16.0.0/16, and re-create the VPC with the new CIDR.. AWS does not support network address translation (NAT) for overlapping CIDRs on a Direct Connect private virtual interface. The only way to resolve the conflict is to change the VPC CIDR to a non-overlapping range (e.g., 172.16.0.0/16) and recreate the VPC, as the VPC CIDR cannot be modified after creation. This ensures that routes between the VPC and on-premises network do not conflict.

Answer

Create a VPN connection with dynamic routing and use BGP to advertise the VPC CIDR.

Answer

Create a VPC peering connection between the VPC and the on-premises network.

Answer

Use a NAT Gateway in the VPC to translate the on-premises IP addresses.