ANS-C01 Practice Exam 51 — 20 Questions

Question 1

A company is experiencing intermittent connectivity issues between two VPCs connected via a VPC peering connection. The VPCs are in different AWS regions. VPC A has CIDR 10.0.0.0/16 and VPC B has CIDR 10.1.0.0/16. The route tables in both VPCs have been updated to include routes pointing to the peering connection. Security groups and network ACLs are configured to allow all traffic for testing. However, traffic from VPC A to VPC B fails intermittently. Which of the following is the most likely cause of this intermittent failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The VPC peering connection does not support transitive routing. If any traffic is being routed through an intermediate device (e.g., a NAT instance or a VPN connection), the peering connection will not forward that traffic.. The intermittent failure is most likely due to VPC peering's lack of transitive routing. If traffic from VPC A to VPC B is routed through an intermediate device (e.g., a NAT instance, VPN connection, or another VPC), the VPC peering connection will not forward that traffic because it does not support transitive routing. This can cause intermittent failures when the intermediate device's route or state changes, even though direct routes and security groups are correctly configured.

Answer

The security group rules in VPC A are not allowing inbound traffic from VPC B's CIDR. The security group must reference the VPC B CIDR explicitly.

Answer

The route tables in both VPCs must include explicit routes for each other's CIDR blocks, but they should also include routes to the internet gateway for proper routing.

Answer

The VPCs are in different regions, and cross-region VPC peering is not supported. A transit gateway must be used instead.

Question 2

A company has a VPC with public and private subnets in two Availability Zones. The private subnets host EC2 instances that need to access the internet for software updates. The company must ensure that traffic from the private instances uses a single, predictable public IP address. What is the MOST cost-effective solution?

Accepted Answer

Deploy a NAT Gateway in a public subnet in one Availability Zone, and route private subnet traffic to it.. A NAT Gateway in a public subnet provides outbound-only internet access for private instances, and it uses a single Elastic IP address, ensuring a predictable public IP. This is the most cost-effective managed solution, as NAT Gateways are highly available within an Availability Zone and require no manual instance management.

Answer

Attach an Internet Gateway to the VPC and update the private subnet route table with a default route to the Internet Gateway.

Answer

Create a Transit Gateway with a VPC attachment and route traffic through a central egress VPC.

Answer

Launch a NAT instance in a public subnet and configure source/destination check.

Question 3

A security engineer is designing a network architecture for a multi-account AWS environment using AWS Organizations. The company requires that all inter-VPC traffic be inspected by a centralized firewall appliance. Which solution provides the most scalable and maintainable inspection architecture?

Accepted Answer

Use a Transit Gateway with a centralized inspection VPC that uses AWS Network Firewall. Using a Transit Gateway with a centralized inspection VPC that uses AWS Network Firewall provides a scalable and maintainable architecture. Transit Gateway allows all VPCs to connect through a central hub, and AWS Network Firewall provides managed, scalable deep packet inspection. Option B is incorrect because VPC peering does not scale well and requires complex routing. Option C is incorrect because Network ACLs are stateless and cannot perform deep packet inspection. Option D is incorrect because third-party firewall appliances in a single VPC can become a bottleneck and are less scalable than the managed AWS Network Firewall solution.

Answer

Create VPC peering connections between all VPCs and route traffic through a security VPC with a firewall

Answer

Use Network ACLs in each VPC to filter traffic between subnets

Answer

Use a Transit Gateway and attach all VPCs to a centralized inspection VPC that hosts a third-party firewall

Question 4

A company has a VPC with public and private subnets. They want to allow instances in the private subnet to download software updates from the internet while preventing inbound traffic from the internet. Which AWS service should they use?

Accepted Answer

NAT Gateway. A NAT Gateway allows outbound internet traffic from private subnets while blocking inbound traffic, making it the correct choice. Option A (VPC Peering) is incorrect because it does not provide internet access. Option C (Internet Gateway) is incorrect because it allows inbound traffic from the internet. Option D (VPN Connection) is incorrect because it typically provides private connectivity to an on-premises network, not direct internet access.

Answer

VPC Peering

Answer

Internet Gateway

Answer

VPN Connection

Question 5

A company uses AWS Network Firewall to inspect traffic. They notice that some traffic is bypassing the firewall. The VPC has a route table with a default route (0.0.0.0/0) pointing to the firewall endpoint. Which configuration could cause traffic to bypass the firewall?

Accepted Answer

The route table has a more specific route for the destination traffic. A more specific route (e.g., a /32 or /24 for the destination network) in the VPC route table will take precedence over the default route (0.0.0.0/0) that points to the firewall endpoint. This causes traffic destined for that specific network to bypass the firewall. Option A is incorrect because route propagation adds routes from VPN or Direct Connect but does not inherently cause bypass. Option B is incorrect because if the subnet is not associated with the firewall's route table, it uses the main route table, which could bypass the firewall, but the key issue here is the existence of a more specific route. Option C is incorrect because the firewall endpoint being in a different Availability Zone does not cause traffic to bypass; it can cause increased latency or other issues but not bypass.

Answer

The route table has route propagation enabled

Answer

The subnet is not associated with the route table

Answer

The firewall endpoint is in a different Availability Zone

Question 6

A company has multiple VPCs that need to communicate with each other and with an on-premises network via AWS Transit Gateway. Which THREE of the following are valid attachment types for a transit gateway?

Accepted Answer

Direct Connect Gateway. AWS Transit Gateway supports attachments to Direct Connect Gateways, enabling integration of Direct Connect virtual interfaces with the transit gateway for hybrid connectivity. This allows traffic from on-premises networks connected via Direct Connect to be routed through the transit gateway to multiple VPCs and other attachments.

Answer

Internet Gateway

Answer

Network Load Balancer

Question 7

A company uses AWS Direct Connect with a private VIF to connect its on-premises network to a VPC. The on-premises router advertises a specific route for a subnet (192.168.1.0/24) to the VPC via BGP. However, instances in the VPC cannot reach the 192.168.1.0/24 subnet. The VPC route table shows the route as 'active' and 'propagated' from the Direct Connect virtual interface. What is the most likely cause?

Accepted Answer

The VPC route table does not have a route to the 192.168.1.0/24 subnet pointing to the virtual private gateway.. Even though the VPC route table shows the route as 'active' and 'propagated', this might be the main route table. If the instance's subnet is associated with a different route table that does not have a route to 192.168.1.0/24 pointing to the virtual private gateway, traffic will not be directed properly. The most likely cause is that the subnet's route table lacks this specific route. Option A is incorrect because security groups do not affect outbound traffic initiated by instances, and the issue is routing, not security. Option B is incorrect because overlapping CIDR would cause the route to not appear as active or propagated, contradicting the scenario. Option C is incorrect because BGP communities are not used for route propagation in Direct Connect private VIFs.

Answer

The security group for the VPC instances is blocking inbound traffic from the on-premises network.

Answer

The VPC has overlapping CIDR with the on-premises network.

Answer

The on-premises router is not advertising the correct BGP community.

Question 8

Refer to the exhibit. A network engineer examines the network ACL for a subnet. Which statement best describes the effect of this network ACL?

Accepted Answer

Inbound TCP traffic is allowed, but all outbound traffic is denied. The inbound rule explicitly allows TCP traffic (protocol 6) from any source (0.0.0.0/0). However, the outbound rules consist only of a default deny rule, which blocks all outbound traffic. Therefore, inbound TCP traffic is allowed, but all outbound traffic is denied. Option A is incorrect because outbound traffic is denied, not allowed. Option C is incorrect because only inbound TCP is allowed, not all inbound traffic. Option D is incorrect because outbound traffic is denied.

Answer

Both inbound and outbound TCP traffic are allowed

Answer

All inbound traffic is allowed

Answer

All outbound traffic is allowed

Question 9

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company has set up a NAT gateway in the public subnet. However, instances in the private subnet cannot reach the internet. What is the most likely cause?

Accepted Answer

The private subnet route table does not have a route to the NAT gateway. Instances in a private subnet require a route to the NAT gateway to reach the internet. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT gateway as its target. Without this route, traffic from private instances sent to the internet will not be directed to the NAT gateway, and will instead remain in the VPC or be dropped. Option A is incorrect because the NAT gateway itself resides in a public subnet and uses the internet gateway via that subnet's route table; it does not require its own route to the IGW. Option B is incorrect because security groups by default allow all outbound traffic, so this is unlikely to be the issue. Option C is incorrect because not having an Elastic IP would prevent the NAT gateway from having a public IP, but the question states a NAT gateway is set up, implying it has an Elastic IP; the more fundamental issue is the missing route.

Answer

The NAT gateway does not have a route to the internet gateway

Answer

The security group for the instances blocks outbound traffic

Answer

The NAT gateway is not associated with an Elastic IP

Question 10

A company has a VPC with both IPv4 and IPv6 CIDR blocks. The network engineer needs to capture all traffic between the VPC and the internet. Which THREE resources must have VPC Flow Logs enabled?

Accepted Answer

Internet gateway. Options A (Internet gateway), B (NAT gateway), and E (Egress-only internet gateway) are correct because each of these resources has an attached network interface that can have VPC Flow Logs enabled to capture all traffic to and from the internet. Specifically, the internet gateway handles IPv4 and IPv6 traffic, the NAT gateway handles IPv4 traffic from private subnets, and the egress-only internet gateway handles IPv6 traffic from private subnets. Option C (Subnet) is incorrect because flow logs are configured on network interfaces, not on subnets directly. Option D (VPC) is incorrect because flow logs are not attached to the VPC itself; they are attached to individual network interfaces.

Answer

Subnet

Answer

VPC

Question 11

A company wants to protect its web application running on Amazon EC2 behind an Application Load Balancer (ALB) from common web exploits like SQL injection and cross-site scripting (XSS). Which THREE AWS services should be used together to provide comprehensive protection?

Accepted Answer

AWS WAF. AWS WAF (Option A) protects against web exploits like SQL injection and XSS. AWS Shield (Option C) provides DDoS protection. The Application Load Balancer (Option E) is the target for the web application and can be integrated with WAF and Shield for comprehensive protection. Amazon Route 53 (Option B) is a DNS service and does not directly provide security against web exploits. Amazon CloudFront (Option D) is a CDN that can be used with WAF, but it is not required since the ALB is already in place; the question asks for three services that together provide comprehensive protection, and the combination of WAF, Shield, and ALB covers web application firewall, DDoS protection, and traffic distribution.

Answer

Amazon Route 53

Answer

Amazon CloudFront

Question 12

A security engineer is designing a network security solution for a multi-tier application. The web tier must be accessible from the internet on ports 80 and 443. The application tier must only accept traffic from the web tier. The database tier must only accept traffic from the application tier on port 3306. Which THREE network access control mechanisms should be used?

Accepted Answer

Security groups that allow traffic from specific security groups for the database tier.. Options A, D, and E are correct network access control mechanisms. Option A is correct because security groups can allow traffic based on source security group IDs, enabling tier-specific access. Option D is correct because network ACLs provide stateless filtering at the subnet level, adding a layer of defense. Option E is correct because security groups can reference other security groups as sources, allowing the database tier to accept traffic only from the application tier security group. Option B is incorrect because AWS WAF is a web application firewall that filters HTTP/HTTPS traffic at the application layer, not suitable for database tier access control. Option C is incorrect because IAM policies manage user and resource permissions, not network-level traffic filtering.

Answer

AWS WAF to filter traffic to the database tier.

Answer

IAM policies to restrict access to the database.

Question 13

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks via Direct Connect and Site-to-Site VPN. The network team wants to ensure that traffic between VPCs does not traverse the on-premises network. Which Transit Gateway feature should be used?

Accepted Answer

Transit Gateway route tables with separate associations and propagations. Transit Gateway route tables with separate associations and propagations allow you to isolate traffic between VPCs and on-premises networks. By associating VPC attachments to one route table and on-premises attachments (Direct Connect, VPN) to another, you can prevent VPC-to-VPC traffic from being routed through the on-premises network. This ensures that inter-VPC traffic stays within AWS, meeting the requirement.

Answer

Transit Gateway Multicast

Answer

Transit Gateway Network Manager

Answer

Transit Gateway BGP over AWS Direct Connect

Question 14

A company needs to enforce that all IAM users use multi-factor authentication (MFA) to access the AWS Management Console. Which policy element should be used in an IAM policy to deny access if MFA is not present?

Accepted Answer

Condition. The Condition element in an IAM policy allows you to specify conditions for when a policy is in effect. To deny access if MFA is not present, you use the `aws:MultiFactorAuthPresent` condition key with a Boolean value of `false`. This ensures that only requests authenticated with MFA are allowed, enforcing the security requirement.

Answer

Resource

Answer

Action

Answer

Effect

Question 15

A company is deploying a VPC with public and private subnets across two Availability Zones. They need to ensure that instances in the private subnets can access the internet for software updates without being directly reachable from the internet. Which AWS service should they use?

Accepted Answer

NAT Gateway. A NAT Gateway enables instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet. It translates the private IP addresses of the instances to the NAT Gateway's Elastic IP address using source network address translation (SNAT). This satisfies the requirement of internet access without direct reachability.

Answer

Virtual Private Gateway

Answer

VPC Peering Connection

Answer

Internet Gateway

Question 16

A company is designing a multi-region active-active architecture using Application Load Balancers (ALBs) and AWS Global Accelerator. The application must have the lowest possible latency for global users. Which design meets these requirements?

Accepted Answer

Use AWS Global Accelerator with endpoints in both regions and configure traffic dials to distribute traffic.. AWS Global Accelerator uses the Anycast static IP addresses to route traffic over the AWS global network to the optimal endpoint based on health, latency, and traffic dials. By configuring endpoints in both regions with traffic dials, you can distribute traffic actively across both regions, ensuring the lowest possible latency for global users by directing them to the nearest healthy endpoint.

Answer

Use Amazon CloudFront with multiple origins pointing to each ALB.

Answer

Use Amazon Route 53 with latency routing policy to route users to the closest ALB.

Answer

Use AWS Global Accelerator with a single endpoint in one region and failover to the other region.

Question 17

A company attaches the above bucket policy to an S3 bucket. A user from the IP range 203.0.113.0/24 makes a request over HTTPS (TLS) to download an object from the bucket. Will the request succeed?

Accepted Answer

Yes, because the request uses HTTPS and comes from the allowed IP range.. The bucket policy includes an Allow statement that grants s3:GetObject access to requests coming from the IP range 203.0.113.0/24 over HTTPS (using the aws:SecureTransport condition). The Deny statement only denies requests that do not use HTTPS (i.e., aws:SecureTransport equals false), so a request from the allowed IP range using TLS is not affected by the Deny and is permitted by the Allow statement.

Answer

Yes, but only if the request also includes a valid AWS signature.

Answer

No, because the Allow statement is overridden by the Deny statement.

Answer

No, because the Deny statement denies all requests regardless of the condition.

Question 18

A company is designing a network security architecture for a multi-account AWS environment using AWS Organizations. They need to centrally manage and enforce VPC security group rules across all accounts. Which service should they use?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager allows centralized management of security groups and AWS WAF rules across accounts in AWS Organizations. Option A is wrong because AWS CloudFormation StackSets deploy resources but do not centrally enforce security group rules. Option B is wrong because AWS Config is for compliance and configuration tracking, not enforcement. Option D is wrong because AWS Service Catalog is for provisioning approved resources, not managing security groups.

Answer

AWS CloudFormation StackSets

Answer

AWS Config

Answer

AWS Service Catalog

Question 19

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. They have a VPC with a CIDR of 10.0.0.0/16 attached to the transit gateway. They also have a Direct Connect virtual interface attached to the transit gateway. The on-premises network can reach some VPCs but not the VPC with CIDR 10.0.0.0/16. The transit gateway route table has a static route for the on-premises CIDR and a route propagation from the VPC attachment. What is the most likely issue?

Accepted Answer

The VPC CIDR overlaps with the on-premises CIDR. The most likely issue is that the VPC CIDR (10.0.0.0/16) overlaps with the on-premises CIDR. When CIDR blocks overlap, the transit gateway cannot distinguish between destinations in the VPC and on-premises, leading to routing conflicts. This explains why the on-premises network can reach other VPCs with non-overlapping CIDRs but not this VPC. The static route for the on-premises CIDR and the propagated route from the VPC attachment both exist in the transit gateway route table, but the overlap causes the transit gateway to forward traffic inconsistently or drop it. Options A, C, and D are incorrect: A) The transit gateway has no such attachment limit; C) The route table does have a route to the on-premises network via the static route; D) The VPC attachment is associated and propagating routes.

Answer

The transit gateway has reached the maximum number of attachments

Answer

The transit gateway route table does not have a route to the on-premises network

Answer

The VPC attachment is not associated with the transit gateway route table

Question 20

Which TWO options are valid methods to connect a VPC to an on-premises network? (Choose 2)

Accepted Answer

AWS Direct Connect. AWS Site-to-Site VPN and AWS Direct Connect are the two primary services for hybrid connectivity. VPC peering is for VPC-to-VPC, not on-premises. VPC endpoints are for accessing AWS services privately. Internet gateway is for public internet access.

Answer

Internet gateway

Answer

VPC endpoint

Answer

VPC peering connection