ANS-C01 Practice Questions 2 — 50 Questions

Question 1

A company has a VPC with multiple subnets. They want to capture and analyze network traffic between EC2 instances in the same VPC for troubleshooting. Which AWS service should be used?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet/byte counts) at the VPC, subnet, or network interface level, enabling detailed analysis of traffic between EC2 instances within the same VPC. This is the correct service because it provides the network-level visibility needed for troubleshooting traffic flows without requiring agents or changes to the instances.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon CloudWatch Metrics

Question 2

A company is migrating its on-premises data center to AWS. As part of the migration, they need to establish connectivity between their on-premises network (10.0.0.0/8) and multiple VPCs in a single region. They are using AWS Transit Gateway with a Direct Connect gateway. They have two Direct Connect connections, each with a private virtual interface (VIF) to the Direct Connect gateway. The on-premises routers are configured with BGP and are advertising 10.0.0.0/8. The Transit Gateway has three VPC attachments: VPC1 (10.1.0.0/16), VPC2 (10.2.0.0/16), and VPC3 (10.3.0.0/16). All VPC attachments are in the same Transit Gateway route table, which also includes the Direct Connect gateway attachment. Initially, all VPCs can communicate with on-premises. After a maintenance window, the network team adds a new on-premises subnet (10.4.0.0/16) and updates the BGP advertisement to include 10.4.0.0/16. However, after the change, instances in VPC3 can no longer reach on-premises resources in any subnet, while VPC1 and VPC2 can still communicate with all on-premises subnets including the new one. The network engineer checks the Transit Gateway route table and sees that the route for 10.0.0.0/8 is present, pointing to the Direct Connect gateway attachment. What is the MOST likely cause of the issue?

Accepted Answer

The VPC3 subnet route tables have a static route for 10.0.0.0/8 that points to a non-existent or unavailable target. The issue is specific to VPC3. Since the route table has a route for 10.0.0.0/8, all VPCs should be able to reach on-premises. However, if VPC3 has a more specific route that conflicts, it might cause issues. But the most common cause is that the VPC3 route table (in the VPC itself) might have a local route or a VPN route that is more specific and overriding the Transit Gateway route. Alternatively, the Transit Gateway route table might have a specific route for VPC3 that is misconfigured. However, the description says the Transit Gateway route table has the correct route. The issue could be that VPC3's subnet route tables have a route for the on-premises CIDR pointing to a different target (like a VPN connection) that is now inactive or incorrect. But the question says after adding the new subnet, VPC3 lost connectivity entirely. Perhaps the BGP update caused a route flap or a prefix limit was exceeded on the Direct Connect gateway, but that would affect all VPCs. Since only VPC3 is affected, it's likely a VPC-specific issue. The most plausible is that the VPC3's route tables have a static route for the on-premises CIDR that was manually added and is now incorrect or conflicting. However, the best answer among the options is that the Transit Gateway route table has a blackhole route for 10.4.0.0/16, but that wouldn't affect all on-premises subnets. Let's think: The Direct Connect gateway might have a prefix limit that was exceeded when adding 10.4.0.0/16, causing the BGP session to drop, but that would affect all VPCs. The most likely single-VPC issue is that VPC3's route tables have a route for the on-premises CIDR pointing to an incorrect attachment, like a peering connection or VPN that is not working. But the options given might include such a scenario. I'll go with: The VPC3 route tables have a static route for 10.0.0.0/8 pointing to a network interface that no longer exists.

Answer

The BGP advertisement for 10.4.0.0/16 exceeded the allowed prefix limit on the Direct Connect gateway

Answer

The Direct Connect gateway is not propagating routes to the Transit Gateway for VPC3

Answer

The Transit Gateway route table has a route for 10.4.0.0/16 that is blackholed

Question 3

A company is designing a multi-region active-active application using Amazon Route 53 and Application Load Balancers (ALBs). The application must be highly available and route traffic to the closest healthy endpoint. Which TWO configurations should the company use? (Choose two.)

Accepted Answer

Configure Route 53 with latency-based routing. Latency-based routing (Option B) directs traffic to the AWS region that provides the lowest latency for each user, which aligns with the requirement to route to the closest healthy endpoint. Health checks (Option C) must be associated with each Route 53 record to mark endpoints as healthy or unhealthy, ensuring traffic is only sent to available ALBs. Together, these configurations enable an active-active multi-region design with automatic failover to the next-lowest-latency healthy region.

Answer

Configure Route 53 with failover routing

Answer

Configure Route 53 with weighted routing

Answer

Configure Route 53 with geoproximity routing

Question 4

A network engineer is troubleshooting an issue where an EC2 instance in a VPC cannot reach an S3 bucket via a gateway endpoint. The instance is in a private subnet with a route table that has a route for the S3 prefix list pointing to the gateway endpoint. Which TWO actions should the engineer take to diagnose the problem?

Accepted Answer

Verify that the route table for the subnet includes a route for the S3 prefix list (com.amazonaws.region.s3) with target type gateway endpoint.. The correct diagnostic steps are A (verify the route table has the S3 prefix list route to the gateway endpoint) and E (check the security group allows outbound HTTPS). The route table must include the prefix list route for the gateway endpoint to work, and the security group must permit HTTPS (443) outbound because S3 API calls use HTTPS. Option B is incorrect because gateway endpoints are used for S3, not interface endpoints (which are for other services). Option C is incorrect; although VPC Flow Logs can help analyze traffic after initial checks, they are not the first diagnostic step. Option D is incorrect because the instance does not need a public IP; gateway endpoints route traffic within the AWS network without leaving the VPC directly.

Answer

Ensure the VPC has an interface endpoint for S3.

Answer

Review VPC Flow Logs for the subnet to see if traffic is being dropped.

Answer

Confirm that the EC2 instance has a public IP address.

Question 5

A company has a Direct Connect connection with a private VIF and a public VIF. The private VIF is used to access VPC resources, and the public VIF is used to access AWS public services. Recently, the company enabled AWS Global Accelerator for its application. The network team notices that traffic to the application via Global Accelerator is not using the Direct Connect connection but is going over the internet. What should the team do to ensure traffic uses the Direct Connect public VIF?

Accepted Answer

Configure a VPN connection over the Direct Connect public VIF to route Global Accelerator traffic. Global Accelerator uses static anycast IP addresses that are not directly reachable over a Direct Connect public VIF. The public VIF provides access to AWS public services via the Direct Connect connection, but Global Accelerator IPs are not advertised over the BGP session. To route on-premises traffic to Global Accelerator through Direct Connect, you must establish a VPN connection over the public VIF. This VPN tunnel encapsulates the traffic and sends it over the Direct Connect link, ensuring it does not traverse the public internet. Option B is incorrect because you cannot advertise Global Accelerator IPs from your on-premises router; they are owned and advertised by AWS. Option C is incorrect because a Direct Connect gateway is used for private VIFs and does not integrate with Global Accelerator. Option D is incorrect because a private VIF is for accessing VPC resources, not public services like Global Accelerator.

Answer

Advertise the Global Accelerator IP addresses on the on-premises router to route traffic via the public VIF

Answer

Attach a Direct Connect gateway to the Global Accelerator

Answer

Create a private VIF for Global Accelerator traffic

Question 6

A company has multiple AWS accounts under AWS Organizations. The security team wants to centrally log all network traffic that is denied by security group rules across all accounts. Which approach meets this requirement with the least operational overhead?

Accepted Answer

Enable VPC Flow Logs with organization-level aggregation and publish to a central S3 bucket. VPC Flow Logs can capture rejected traffic, and publishing to a central S3 bucket using Organization-level aggregation simplifies management. Option D is correct because it uses VPC Flow Logs with organization-level aggregation. Option A is wrong because AWS Config does not log network traffic. Option B is wrong because it requires per-account setup. Option C is wrong because CloudTrail does not capture network flows.

Answer

Enable AWS Config rules for security group changes and send logs to a central account

Answer

Create VPC Flow Logs in each account and publish to a central S3 bucket

Answer

Use AWS CloudTrail to log all API calls and filter for security group events

Question 7

A company has a VPC with multiple subnets. They want to capture and analyze network traffic between EC2 instances in the same VPC for troubleshooting. Which AWS service should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Transit Gateway with VPC attached and route traffic through a shared services VPC containing the inspection appliance. A Transit Gateway with a shared services VPC architecture allows centralized inspection of all outbound internet traffic. By attaching the VPCs to a Transit Gateway and routing traffic through a shared services VPC that hosts the inspection appliance (e.g., a firewall or proxy), you can enforce security policies. The Transit Gateway acts as a hub, enabling transitive routing between VPCs while directing internet-bound traffic to the inspection appliance before it reaches an internet gateway or NAT gateway.

Answer

Use VPC Peering between all VPCs

Answer

Configure a NAT Gateway in each Availability Zone

Answer

Use AWS Direct Connect to route traffic on-premises

Question 8

A company is designing a network architecture for a multi-tier web application. The application includes a public-facing Application Load Balancer (ALB) in a public subnet, web servers in private subnets, and an Amazon RDS database in a private subnet. The company requires that the database is not directly accessible from the application servers except through specific ports, and that traffic between the web servers and the database is encrypted. Which TWO actions should the company take to meet these requirements? (Choose two.)

Accepted Answer

Enable SSL/TLS encryption for connections between the web servers and the RDS database. Enabling SSL/TLS encryption for connections between the web servers and the RDS database ensures that data in transit is encrypted, meeting the requirement for encrypted traffic. Option D is correct because configuring a security group on the RDS instance that allows inbound traffic from the web servers' security group on the database port provides a stateful, instance-level firewall rule that restricts direct access to only the web servers, without exposing the database to the public subnet or relying on IP-based rules.

Answer

Place the RDS database in a public subnet with a security group that allows only the web servers' IP addresses

Answer

Establish a VPC peering connection between the web servers' VPC and the RDS VPC

Answer

Use a network ACL to restrict inbound traffic to the RDS subnet to only the web server's IP range

Question 9

A company wants to block inbound SSH traffic to all EC2 instances in a VPC while allowing all other traffic. Which security group rule should be configured?

Accepted Answer

Remove any inbound rule that allows TCP port 22. Security groups are stateful and act as a virtual firewall. By default, all inbound traffic is denied unless explicitly allowed. Therefore, to block SSH traffic, you simply remove any inbound rule that permits TCP port 22. This is option B. Option A is incorrect because security groups do not support 'deny' rules; they only support allow rules. Option C is incorrect because the question specifically asks about security group configuration, not network ACLs. Option D is incorrect because outbound rules do not affect inbound traffic, and security groups are stateful, so blocking outbound SSH would not block incoming SSH connections.

Answer

Add an inbound rule to deny TCP port 22

Answer

Add an inbound deny rule for TCP port 22 to the network ACL

Answer

Add an outbound rule to deny TCP port 22

Question 10

A company wants to restrict outbound traffic from a VPC to only allow HTTPS traffic to a specific list of domains. Which AWS service can be used to achieve this?

Accepted Answer

AWS Network Firewall. AWS Network Firewall is the correct choice because it provides stateful, managed firewall rules that can inspect and filter outbound traffic based on domain names (FQDN) for HTTPS (port 443) using TLS inspection or domain list rules. This allows you to create a rule group that permits outbound HTTPS traffic only to a specified list of domains, while blocking all other outbound traffic.

Answer

Security groups

Answer

Amazon Route 53

Answer

Application Load Balancer

Question 11

A company is designing a hybrid network with AWS Direct Connect. They have multiple VPCs in the same Region and want to use a single Direct Connect connection to access all VPCs. Which AWS resource should be used?

Accepted Answer

Direct Connect Gateway. A Direct Connect Gateway allows you to associate up to 10 Virtual Private Gateways (VGWs) or Transit Gateways in the same or different AWS accounts, enabling a single Direct Connect connection to reach multiple VPCs in the same Region. This is the correct resource because it acts as a hub that terminates the Direct Connect virtual interfaces (VIFs) and propagates routes to the associated VPCs via their VGWs or Transit Gateways.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

Virtual Private Gateway

Question 12

A company has a VPC with a public subnet and a private subnet. They launch an EC2 instance in the private subnet with a private IP only. The instance needs to download patches from the internet. Which configuration is required?

Accepted Answer

Create a NAT gateway in the public subnet and add a default route to the NAT gateway in the private subnet's route table.. A NAT gateway in the public subnet provides outbound internet access for instances in the private subnet while preventing inbound connections from the internet. By adding a default route (0.0.0.0/0) in the private subnet's route table pointing to the NAT gateway, traffic from the EC2 instance destined for the internet is forwarded to the NAT gateway, which then uses its Elastic IP to communicate with the internet. This allows the instance to download patches without requiring a public IP or direct internet gateway access.

Answer

Launch a NAT instance in the private subnet and configure source/destination check.

Answer

Create a VPC endpoint for the patch service.

Answer

Attach an internet gateway to the VPC and add a default route to it in the private subnet's route table.

Question 13

A company is using AWS Organizations to manage multiple accounts. The security team wants to enforce that all S3 buckets have server-side encryption enabled. Which SCP should be applied to the root OU?

Accepted Answer

Deny s3:PutBucketEncryption unless encryption settings include AES256 or aws:kms. A Service Control Policy (SCP) applied to the root OU can deny the s3:PutBucketEncryption action unless specific encryption settings (AES256 or aws:kms) are used. This prevents any account in the organization from creating or modifying S3 buckets without encryption. Option A is wrong because IAM policies are attached to principals (users/roles), not to OUs, and cannot enforce encryption across all accounts. Option B is wrong because SCPs are applied to OUs or accounts, not to individual resources like S3 buckets. Option D is wrong because AWS Config rules can detect non-compliance but do not enforce via SCPs; they would require an automated remediation action.

Answer

Create an IAM policy that allows s3:PutBucketEncryption only with specific conditions

Answer

Attach an IAM policy to each S3 bucket requiring encryption

Answer

Use AWS Config rules to auto-enable encryption on existing buckets

Question 14

A company wants to audit all changes to security groups in their AWS account. They need to be notified whenever a security group rule is added, modified, or removed. They also want to see who made the change. Which solution should they implement?

Accepted Answer

Enable AWS CloudTrail and create a CloudWatch Events rule that triggers on EC2 SecurityGroup events, sending notifications via SNS.. AWS CloudTrail captures all API calls, including EC2 SecurityGroup-related actions (AuthorizeSecurityGroupIngress, RevokeSecurityGroupIngress, etc.), recording the identity of the caller. A CloudWatch Events rule can filter for these specific events and trigger an SNS notification, providing both the change details and the IAM user or role that made the change. This meets the audit and notification requirements precisely.

Answer

Use AWS Trusted Advisor to check for security group changes and send email alerts.

Answer

Use AWS Config to monitor security group changes and trigger a Lambda function to send notifications.

Answer

Enable VPC Flow Logs and analyze logs for changes to security group rules.

Question 15

A company needs to log all network traffic to and from EC2 instances for security analysis. Which TWO services can capture this data? (Choose 2)

Accepted Answer

VPC Flow Logs. Options B and D are correct. VPC Flow Logs capture metadata (IP addresses, ports, protocols) about network traffic. Traffic Mirroring captures actual packet content for deep packet inspection. Option A (AWS Config) is incorrect because it records configuration changes, not network traffic. Option C (AWS CloudTrail) is incorrect because it logs API calls, not network traffic. Option E (Amazon CloudWatch Logs) is incorrect because it is for log storage and monitoring, not for capturing network traffic.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Question 16

A company is setting up AWS Direct Connect with a 1 Gbps dedicated connection. They want redundant connectivity with automatic failover. What is the most cost-effective way to achieve this?

Accepted Answer

Provision a second Direct Connect connection at a different location and configure BGP.. Achieving true redundancy with automatic failover for AWS Direct Connect requires physically diverse connections. A second Direct Connect connection at a different location, combined with BGP routing (e.g., using AS_PATH prepending or MED for traffic engineering), ensures that traffic automatically fails over if one connection goes down. While a VPN over the internet (option D) might seem cost-effective, it introduces variable latency, potential bandwidth constraints, and additional data transfer costs, making it less suitable for consistent performance and automatic failover in a dedicated connectivity context. Therefore, provisioning a second Direct Connect connection is the most cost-effective approach that meets the requirements.

Answer

Use a single connection with multiple VLANs.

Answer

Use a single connection with a VPN over the same connection for redundancy.

Answer

Provision a single Direct Connect connection and use a VPN over the internet as backup.

Question 17

A company has a VPC with a CIDR of 10.0.0.0/16. They have created a VPC peering connection with another VPC (CIDR 10.1.0.0/16). They want to enable DNS resolution between the VPCs. Which TWO actions must be taken?

Accepted Answer

Both VPCs must have the 'Enable DNS Resolution' attribute set to true in their VPC settings.. To enable DNS resolution across a VPC peering connection, two conditions must be met. First, both VPCs must have the 'Enable DNS Resolution' attribute set to true in their VPC settings, which requires both EnableDnsHostnames and EnableDnsSupport to be enabled (Option B). Second, the VPC peering connection itself must have DNS resolution enabled. This can be done by the accepter when accepting the peering connection or later by modifying the peering connection (Option D). Option A is incorrect because the requester does not accept the peering connection; the accepter does. Option C is not required for DNS resolution. Option E (route table entries) is necessary for connectivity but not specifically for DNS resolution.

Answer

The requester must accept the peering connection with the 'Enable DNS Resolution' option checked.

Answer

Ensure both VPCs are in the same AWS region.

Answer

The route tables must include a route for the peered VPC's CIDR.

Question 18

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to add additional IP address space for new subnets. The existing subnets use 10.0.0.0/17 and 10.0.128.0/17. Which CIDR block should be added as a secondary CIDR to the VPC to provide the most additional contiguous address space?

Accepted Answer

10.1.0.0/16. (10.1.0.0/16) is correct because the VPC already uses the entire 10.0.0.0/16 range (split into 10.0.0.0/17 and 10.0.128.0/17). To add contiguous address space, you must use a different /16 block that is adjacent in the private IPv4 address space, such as 10.1.0.0/16. AWS VPCs support secondary CIDRs that must not overlap with existing CIDRs, and 10.1.0.0/16 provides a non-overlapping, contiguous block.

Answer

10.0.0.0/0

Answer

10.0.0.0/8

Answer

10.0.0.0/16

Question 19

A company is using AWS CloudTrail to log API calls. They want to ensure that log files are encrypted at rest and that only authorized users can access them. Which combination of actions should they take?

Accepted Answer

Enable default encryption (SSE-S3) on the S3 bucket and attach a bucket policy that restricts access to authorized IAM principals.. Enabling default encryption (SSE-S3) on the S3 bucket ensures logs are encrypted at rest. Attaching a bucket policy that restricts access to authorized IAM principals ensures only authorized users can access them. This combination fully satisfies both requirements. Option A (SSE-KMS with a customer managed key) encrypts the logs at rest, but it does not include the access controls needed to ensure only authorized users can access the logs—additional measures would be required. Option B (disable public access and enable versioning) does not encrypt the logs. Option D (SSE-C) is impractical for CloudTrail logs because it requires you to supply encryption keys with every API call and does not inherently restrict access. Therefore, option C is the correct combination.

Answer

Use SSE-KMS with a customer managed key and allow CloudTrail to use the key.

Answer

Disable public access to the S3 bucket and enable versioning.

Answer

Enable SSE-C on the S3 bucket and provide the encryption key in each API call.

Question 20

A company is experiencing intermittent connectivity issues between a VPC and an on-premises data center over an AWS Direct Connect connection. The network engineer checks the Direct Connect virtual interface status and sees it is 'up'. However, BGP sessions are flapping. Which action should the engineer take to diagnose the issue?

Accepted Answer

Check the BGP keepalive and hold timers on both sides.. BGP session flapping is often caused by mismatched keepalive or hold timers between the customer router and AWS. Checking and aligning these timers helps diagnose and resolve the flapping. Option A is incorrect because the virtual interface is already up, indicating VLAN configuration is likely correct. Option B is incorrect; BFD is used for faster failure detection, not for diagnosing timer mismatches that cause flapping. Option C is excessive; recreating the virtual interface with a new VLAN ID is unnecessary when the issue is BGP-related.

Answer

Verify the VLAN configuration on the customer router.

Answer

Enable BFD on the Direct Connect virtual interface.

Answer

Recreate the virtual interface with a new VLAN ID.