ANS-C01 Practice Exam 51 — 20 Questions

Question 1

A company is designing a network for a critical application that requires low latency and high throughput between EC2 instances in the same AWS Region. Which network design should the company use?

Accepted Answer

Launch the instances in a Cluster Placement Group.. A Cluster Placement Group is the correct choice because it provides the lowest possible latency and highest throughput between EC2 instances by placing them in a single Availability Zone with non-blocking, high-bandwidth networking. This design is ideal for tightly coupled, high-performance computing (HPC) or latency-sensitive applications that require consistent, low-latency communication within the same AWS Region.

Answer

Launch the instances in a Spread Placement Group.

Answer

Launch the instances as larger instance types with enhanced networking.

Answer

Launch the instances in different Availability Zones.

Question 2

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team notices that some VPCs cannot communicate with each other even though they are attached to the same transit gateway. What is the most likely cause?

Accepted Answer

The transit gateway route tables are missing routes to the other VPCs.. Transit Gateway uses its own route tables to control which attachments can reach which destinations. If VPCs are attached but their routes are not propagated or associated with the correct TGW route table, traffic between them is dropped. The most likely cause of selective VPC-to-VPC failure is missing routes in the TGW route table.

Answer

The security groups on the instances are not allowing inbound traffic from the other VPCs.

Answer

The VPC attachments are not in the 'available' state.

Answer

The VPCs' network ACLs are blocking traffic.

Question 3

A network engineer is troubleshooting connectivity issues between two VPCs connected via a VPC peering connection. The VPCs are in different AWS accounts and regions. The engineer can ping the private IP of an instance in the peered VPC from one side, but not from the other. What is the most likely cause?

Accepted Answer

Route tables in one VPC do not have a route to the peered VPC CIDR. The most likely cause is that the route tables in one VPC lack a route pointing to the peered VPC's CIDR block. For a VPC peering connection to function bidirectionally, each VPC must have a route in its route table that directs traffic destined for the other VPC's CIDR to the peering connection (pcx-*). Without this route, packets from the source VPC to the peered VPC will be dropped, even if the peering connection itself is active and the security groups allow traffic.

Answer

The security group in the peered VPC is blocking ICMP traffic

Answer

The VPC CIDR blocks overlap

Answer

The VPC peering connection is in a 'pending-acceptance' state

Question 4

A company's VPC has an internet gateway and a NAT Gateway in a public subnet. The private subnet route table has a default route pointing to the NAT Gateway. EC2 instances in the private subnet can access the internet, but cannot access an on-premises network connected via AWS Site-to-Site VPN. What is the most likely cause?

Accepted Answer

The private subnet route table does not have a route to the on-premises network via the virtual private gateway.. The private subnet route table has a default route (0.0.0.0/0) pointing to the NAT Gateway, which allows outbound internet traffic. However, traffic destined for the on-premises network must be routed via the Virtual Private Gateway (VGW) attached to the VPC. Since the route table lacks a specific route (e.g., 10.0.0.0/8) pointing to the VGW, packets to the on-premises CIDR are instead sent to the NAT Gateway, which drops them because it has no route or interface for the on-premises network.

Answer

The NAT Gateway is not configured to route traffic to the VPN.

Answer

The internet gateway is not attached to the VPC.

Answer

The VPN connection is not advertising the on-premises CIDR via BGP.

Question 5

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access an S3 bucket. The company wants to avoid using a NAT gateway and ensure that traffic does not traverse the internet. Which solution should be used?

Accepted Answer

Create a VPC endpoint for S3 (Gateway type) and update the route table. A VPC endpoint for S3 (Gateway type) allows instances in a private subnet to access S3 without traversing the internet or using a NAT gateway. The endpoint is attached to the VPC, and the route table for the private subnet is updated to route S3 traffic through the endpoint. This keeps traffic within the AWS network.

Answer

Attach an internet gateway to the VPC and assign a public IP to the instance

Answer

Set up a VPN connection to the S3 bucket

Answer

Deploy a NAT gateway in the public subnet and route traffic through it

Question 6

A company is deploying a VPC with public and private subnets across two Availability Zones. They need to ensure that instances in the private subnets can access the internet for software updates without being directly reachable from the internet. Which AWS service should they use?

Accepted Answer

NAT Gateway. A NAT Gateway enables instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet. It translates the private IP addresses of the instances to the NAT Gateway's Elastic IP address using source network address translation (SNAT). This satisfies the requirement of internet access without direct reachability.

Answer

Virtual Private Gateway

Answer

VPC Peering Connection

Answer

Internet Gateway

Question 7

A company has a VPC with multiple subnets. They want to monitor all network traffic to and from an EC2 instance for troubleshooting. Which AWS service should they use?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including metadata such as source/destination IPs, ports, protocols, and packet accept/reject decisions. This makes it the correct service for monitoring all network traffic to and from an EC2 instance for troubleshooting purposes.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS CloudTrail

Question 8

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The network team wants to ensure that traffic between the on-premises network and AWS is encrypted. Which solution meets this requirement?

Accepted Answer

Establish an IPSec VPN tunnel over the Direct Connect connection using a public VIF or transit VIF.. Direct Connect by itself does not encrypt traffic — it is a private dedicated network connection, but data traverses it in plaintext. To encrypt traffic over Direct Connect, you run an IPSec VPN tunnel over the Direct Connect connection using a public VIF (for VPN termination on the AWS side) or a transit VIF (when using AWS Transit Gateway). This combines the private, consistent path of Direct Connect with the confidentiality of IPSec.

Answer

Establish a VPC peering connection between the on-premises network and the VPC.

Answer

Use a private virtual interface (VIF) over Direct Connect.

Answer

Use an IPSec VPN connection over the internet.

Question 9

A company has a VPC with public and private subnets. The security team wants to analyze all traffic to and from the internet for security incidents. Which AWS service should be used to capture and analyze this traffic?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic metadata (source/destination IP, port, protocol, bytes, action) for ENIs, subnets, or VPCs, and can be published to CloudWatch Logs, S3, or Kinesis Data Firehose for analysis. This is the native AWS mechanism for capturing and analyzing traffic to and from the internet at the VPC level. It is the correct answer because the question asks for traffic capture and analysis, not inline filtering or threat detection.

Answer

AWS Shield Advanced

Answer

AWS Network Firewall

Answer

AWS WAF

Question 10

A company has a VPC with a public subnet and a private subnet. They have a NAT Gateway in the public subnet. They also have an EC2 instance in the private subnet that needs to access the internet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway. The security group for the EC2 instance allows outbound HTTPS traffic. The network ACL for the private subnet allows inbound and outbound ephemeral ports. However, the EC2 instance cannot reach the internet. The network engineer checks the NAT Gateway and sees that it has an Elastic IP attached. The engineer also checks the route table for the public subnet and finds no route to the internet. What should the engineer do to fix the issue?

Accepted Answer

Add a route in the public subnet route table to 0.0.0.0/0 via the internet gateway.. The NAT Gateway resides in the public subnet, and for the NAT Gateway to forward traffic to the internet, the public subnet's route table must have a default route (0.0.0.0/0) pointing to an internet gateway. Without that route, the NAT Gateway cannot send traffic to the internet, even though the private subnet's route points to the NAT Gateway. Options A, C, and D are incorrect: A is unnecessary because a NAT Gateway in the private subnet would not have direct internet access; C would bypass the NAT Gateway and require a route to the internet gateway directly from the private subnet, which is not the standard design; D is wrong because adding another Elastic IP does not solve the missing route issue.

Answer

Deploy a second NAT Gateway in the private subnet.

Answer

Add a route in the private subnet route table to 0.0.0.0/0 via the internet gateway.

Answer

Attach a second Elastic IP to the NAT Gateway.

Question 11

A company has set up a site-to-site VPN connection between its on-premises network and AWS. The tunnel status shows 'UP' on both sides, but traffic from on-premises cannot reach EC2 instances in the VPC. What is the most likely cause?

Accepted Answer

The VPC route tables do not have a route pointing to the virtual private gateway for the on-premises CIDR.. The most likely cause is that the VPC route tables lack a route pointing to the virtual private gateway (VGW) for the on-premises CIDR. Even though the VPN tunnel is UP (indicating Phase 1 and Phase 2 IPsec SAs are established), traffic from on-premises cannot reach EC2 instances if the VPC does not know how to forward return traffic back through the VGW. Without this route, the VPC drops inbound packets or sends them to the internet gateway instead of the VPN tunnel.

Answer

The pre-shared keys are mismatched.

Answer

The VPN tunnel has been idle for too long and needs to be re-initiated.

Answer

The security group associated with the EC2 instances does not allow inbound traffic from the VPN gateway.

Question 12

A security engineer reviews VPC Flow Logs and sees the entries shown. The last entry shows a REJECT for traffic from 203.0.113.5 to 10.0.1.5 on port 443. However, the third entry shows ACCEPT for traffic from 10.0.1.5 to 203.0.113.5 on port 443. What is the most likely reason for the REJECT?

Accepted Answer

The network ACL associated with the subnet of 10.0.1.5 does not allow inbound traffic from 203.0.113.5.. The VPC Flow Logs show outbound traffic from 10.0.1.5 to 203.0.113.5 on port 443 was allowed (ACCEPT), but the inbound response was rejected. Security groups are stateful, so they automatically allow return traffic for established connections. Therefore, a security group (Option C) would not cause this REJECT. Network ACLs are stateless and require explicit inbound rules; if the inbound rule for traffic from 203.0.113.5 is missing, the response is dropped, resulting in a REJECT. Option A correctly identifies this. Option B (AWS WAF) operates at the application layer (Layer 7) and is not reflected in VPC Flow Logs, which capture Layer 3/4 traffic. Option D (route table) would cause a lack of connectivity, not a REJECT entry in flow logs.

Answer

AWS WAF is blocking the inbound traffic.

Answer

The security group attached to the instance 10.0.1.5 does not allow inbound traffic from 203.0.113.5.

Answer

The route table for the subnet of 10.0.1.5 does not have a route to the internet.

Question 13

A network engineer is diagnosing a connectivity issue between an on-premises network and an Amazon VPC connected via a site-to-site VPN. The VPN tunnel is up, but traffic is not reaching the VPC. Which TWO actions should the engineer take to troubleshoot the issue? (Choose two.)

Accepted Answer

Review the security group rules associated with the VPC resources to ensure they allow traffic from the on-premises network. Option A is correct because security group rules on the VPC resources must explicitly allow inbound traffic from the on-premises CIDR range; even with a healthy VPN tunnel, restrictive or missing security group rules will silently drop packets. Option C is correct because the VPC route tables must contain routes for the on-premises network with the virtual private gateway (VGW) as the target; without these routes, return traffic cannot be directed back through the VPN. Option B is incorrect because a customer gateway is an on-premises device object in AWS and is not associated with a VPC—it is attached to the VPN connection, not the VPC. Option D is incorrect because a NAT device on-premises is irrelevant to site-to-site VPN connectivity and is not required for this traffic flow. Option E is incorrect because the scenario already states the VPN tunnel is up, so rechecking the tunnel status adds no diagnostic value.

Answer

Confirm the customer gateway is associated with the correct VPC

Answer

Verify that the on-premises network has a NAT device configured

Answer

Check that the VPN tunnel's status is 'UP'

Question 14

A company is migrating its on-premises data center to AWS. The network team needs to establish a site-to-site VPN connection with dynamic routing using BGP. The on-premises router supports BGP but does not support BGP communities. The VPN connection is established, but the VPC does not learn the on-premises routes. What is the most likely cause?

Accepted Answer

The on-premises router is not advertising any prefixes over BGP. For a site-to-site VPN with dynamic routing, the VPC learns on-premises routes only via BGP advertisements from the customer gateway. If the on-premises router is not advertising any prefixes over BGP (for example, because the network statements or route redistribution are missing), the VPC route tables will never receive those routes even though the tunnel is UP and BGP peering may be established. The lack of BGP communities support is irrelevant because communities are optional attributes, not required for basic prefix advertisement.

Answer

The VPN tunnel uses pre-shared keys instead of certificates

Answer

The VPC route table needs a static route to the on-premises CIDR

Answer

The VPN tunnel is not in a UP state

Question 15

A company has a VPC with a CIDR block of 10.0.0.0/16. They have three subnets: Subnet A (10.0.1.0/24) in us-east-1a, Subnet B (10.0.2.0/24) in us-east-1b, and Subnet C (10.0.3.0/24) in us-east-1c. The company has deployed a set of EC2 instances in Subnet A that need to access an Amazon S3 bucket. The company wants to ensure that traffic to S3 does not traverse the internet and remains within the AWS network. The VPC has a VPC endpoint for S3 (gateway type) created and associated with the route table for Subnet A. However, the instances are unable to access the S3 bucket. What is the MOST likely cause?

Accepted Answer

The route table for Subnet A does not have a route for the S3 prefix list pointing to the VPC endpoint.. A gateway VPC endpoint for S3 works by injecting a route into the subnet's route table that points the S3 prefix list (pl-xxxxxxxx) to the endpoint (vpce-xxxxxxxx). Even though the endpoint was created and associated with the route table, the actual route entry must exist for traffic to be redirected. Without that route, instances fall back to the default route (typically a NAT gateway or IGW), which either fails or sends traffic over the internet — violating the requirement.

Answer

The VPC does not have an internet gateway attached.

Answer

The S3 bucket policy does not allow access from the VPC endpoint.

Answer

The VPC endpoint is not associated with a security group that allows outbound traffic to S3.

Question 16

A company has a hybrid network with multiple VPCs connected via AWS Transit Gateway and an on-premises network via Direct Connect. The network team is planning to migrate a legacy application from on-premises to a new VPC. The application requires low-latency access to an RDS database running in an existing VPC. The team wants to minimize changes to the existing routing. What should the team do to meet these requirements?

Accepted Answer

Attach the new VPC to the existing transit gateway and ensure the transit gateway route tables permit traffic between the new VPC and the RDS VPC.. Attaching the new VPC to the existing transit gateway allows immediate connectivity to the RDS VPC without changing existing routes, provided the transit gateway route tables are configured correctly. Option B is wrong because routing traffic through on-premises adds unnecessary latency and complexity. Option C is wrong because VPC peering requires route table updates in both VPCs, which contradicts the requirement to minimize routing changes. Option D is wrong because migrating the RDS database would change the database endpoint and potentially cause downtime, and does not leverage the existing transit gateway.

Answer

Set up a VPN connection from the new VPC to the on-premises network, and route traffic through on-premises to the RDS VPC.

Answer

Create a VPC peering connection between the new VPC and the RDS VPC.

Answer

Migrate the RDS database to the new VPC to keep the application and database in the same VPC.

Question 17

A network engineer is troubleshooting network connectivity issues in a VPC. The engineer suspects that the network ACL is blocking traffic. Which TWO actions should the engineer take to verify this?

Accepted Answer

Review the inbound and outbound rules of the network ACL.. Option A is correct because a network ACL is stateless and applies separate inbound and outbound rule sets at the subnet level, so the engineer must review both the inbound and outbound rules to confirm whether the ACL is denying the traffic in either direction. Option D is correct because VPC Flow Logs capture IP traffic metadata for network interfaces and can be filtered on the 'ACCEPT' or 'REJECT' status, which directly shows whether traffic is being rejected by a network ACL or security group. Option B is not the right verification action here because security group rules are stateful and evaluated at the instance level, not the subnet-level ACL the engineer suspects. Option C is incorrect because AWS CloudTrail records API activity and management events, not network packet traffic. Option E is incorrect because AWS Direct Connect is a dedicated network connection service and is not a troubleshooting tool for VPC ACL traffic.

Answer

Check the security group rules for the affected instances.

Answer

Use AWS CloudTrail to view network traffic logs.

Answer

Test connectivity using AWS Direct Connect.

Question 18

A company is deploying a global application with users in North America and Europe. The application runs on EC2 instances in us-east-1 and eu-west-1. To reduce latency, the company wants to route users to the nearest region and provide automatic failover. Which combination of AWS services should be used?

Accepted Answer

Amazon Route 53 with latency-based routing and health checks.. Amazon Route 53 latency-based routing directs users to the region with the lowest latency, automatically routing traffic to the nearest region. Combined with health checks, if an endpoint fails, Route 53 automatically fails over to the next lowest-latency healthy endpoint, meeting both the latency reduction and automatic failover requirements.

Answer

Amazon CloudFront with origins in each region.

Answer

AWS Global Accelerator with endpoint groups in each region.

Answer

Amazon Route 53 with geolocation routing and health checks.

Question 19

Which TWO of the following are valid ways to encrypt data in transit between an on-premises data center and an Amazon VPC? (Choose two.)

Accepted Answer

Use AWS Site-to-Site VPN.. Option A is correct because AWS Site-to-Site VPN creates IPsec tunnels over the public internet between the on-premises customer gateway and the AWS virtual private gateway or transit gateway, encrypting all traffic in transit. Option C is correct because running a VPN (IPsec) tunnel over an AWS Direct Connect connection provides encryption for data in transit while still using the dedicated private connectivity of Direct Connect. Option B is incorrect because a standard AWS Direct Connect connection is a private, dedicated network link but does not encrypt traffic by itself. Option D is incorrect because VPC peering connects VPCs to each other and does not provide encryption between an on-premises data center and a VPC. Option E is incorrect because an internet gateway only enables internet connectivity, and security groups are stateful firewalls that filter traffic but do not encrypt it.

Answer

Use AWS Direct Connect without any additional encryption.

Answer

Use VPC peering.

Answer

Use an internet gateway with a security group.

Question 20

A company has a VPC with public and private subnets. They use a NAT Gateway in the public subnet to allow instances in the private subnet to access the internet. The security team wants to ensure that all outbound traffic from the private subnet is logged and inspected. Which THREE services should they use together to achieve this? (Choose THREE.)

Accepted Answer

VPC Flow Logs. VPC Flow Logs (A) is correct because it captures IP traffic metadata (source/destination IP, ports, protocol, ACCEPT/REJECT) for the private subnet's ENIs, providing the logging and visibility the security team requires. AWS Network Firewall (C) is correct because it is a managed, stateful firewall deployed in the VPC that can inspect and filter outbound traffic from the private subnet before it reaches the NAT Gateway, satisfying the inspection requirement. Amazon Route 53 Resolver DNS Firewall (D) is correct because it inspects and filters DNS queries from the private subnet, blocking resolution of malicious domains and adding a DNS-layer control to the outbound traffic path. AWS Direct Connect (B) is not correct because it is a dedicated private network connection to AWS, not a logging or inspection service for outbound internet traffic. AWS Transit Gateway (E) is not correct because it is a hub for connecting VPCs and on-premises networks, not a traffic logging or inspection mechanism.

Answer

AWS Direct Connect

Answer

AWS Transit Gateway