ANS-C01 Practice Exam 52 — 20 Questions

Question 1

A company has a VPC with public and private subnets in two Availability Zones. An Application Load Balancer in the public subnets distributes traffic to EC2 instances in the private subnets. The security group for the EC2 instances allows inbound traffic from the ALB security group. Users report intermittent timeouts. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The network ACL for the private subnets is blocking inbound traffic from the ALB subnets.. Intermittent timeouts are often caused by network ACL rules that block ephemeral ports used for return traffic. The ALB initiates connections to EC2 instances on random ephemeral ports (1024-65535). If the private subnet's network ACL denies inbound traffic on these ports from the ALB subnets, connections will fail intermittently. In contrast, a missing inbound rule on the ALB security group would result in consistent failures, not intermittent ones.

Answer

The security group for the ALB does not allow inbound traffic from the internet.

Answer

The ALB is not associated with an internet gateway.

Answer

Cross-zone load balancing is disabled on the ALB.

Question 2

A company is setting up a new VPC with a CIDR block of 10.0.0.0/16. They need to create subnets for different tiers: public (web servers), private (application servers), and database (RDS). They want to maximize the number of available IP addresses while ensuring each subnet has at least 256 IP addresses. Which subnet design meets these requirements?

Accepted Answer

Create six /24 subnets (256 IPs each) across two Availability Zones (three per AZ).. It creates six /24 subnets (each with 256 IP addresses) across two Availability Zones, meeting the requirement of at least 256 IPs per subnet while maximizing total available IPs (1,536 IPs) and providing high availability by distributing subnets across multiple AZs. The /24 subnet mask provides exactly 256 IPs (254 usable) per subnet, which satisfies the minimum requirement without wasting address space.

Answer

Create three /25 subnets (128 IPs each) in one Availability Zone.

Answer

Create six /26 subnets (64 IPs each) across two Availability Zones.

Answer

Create three /24 subnets (256 IPs each) in one Availability Zone.

Question 3

Which TWO features are provided by AWS Shield Advanced that are not available in AWS Shield Standard? (Choose 2)

Accepted Answer

DDoS cost protection. Shield Advanced provides DDoS cost protection (option B) and 24/7 access to the AWS DDoS Response Team (option D). Option A is incorrect because automatic web application firewall rule updates are not a feature of Shield Advanced; AWS WAF can be integrated but rules are not automatically updated. Option C is incorrect because detailed DDoS logs are not a distinct feature of Shield Advanced; both Standard and Advanced provide access to AWS Shield logs. Option E is incorrect because network-layer DDoS protection (e.g., SYN flood, UDP flood) is provided by both Shield Standard and Shield Advanced; Advanced adds application-layer protection and other benefits.

Answer

Automatic web application firewall rule updates

Answer

Access to detailed DDoS logs

Answer

Network-layer DDoS protection

Question 4

Refer to the exhibit. A VPC endpoint for S3 is created as a Gateway endpoint. The route tables rtb-11111111 and rtb-22222222 are associated with the endpoint. An EC2 instance in a subnet associated with rtb-11111111 cannot access S3 via the endpoint. What is the most likely cause?

Accepted Answer

The route table rtb-11111111 does not have a route to the S3 prefix list with the target as the VPC endpoint.. A Gateway VPC Endpoint for S3 works by adding a route in the subnet's route table that points the S3 prefix list (com.amazonaws.region.s3) to the endpoint ID (vpce-xxx). Without this specific route, traffic destined for S3 from the subnet associated with rtb-11111111 will follow the default route (e.g., an Internet Gateway or NAT Gateway) instead of being routed through the endpoint. Since the endpoint is only associated with rtb-11111111 and rtb-22222222, but rtb-11111111 lacks the required prefix list route, traffic from that subnet cannot reach S3 via the endpoint.

Answer

The endpoint policy denies access to S3 from the instance's IAM role.

Answer

The security group on the EC2 instance does not allow outbound traffic to the S3 prefix list.

Answer

The VPC does not have DNS resolution enabled for the endpoint.

Question 5

A financial services company has a multi-account AWS environment using AWS Organizations. They have a central security account with AWS Network Firewall and a central inspection VPC. All other VPCs are connected to the inspection VPC via AWS Transit Gateway. The company wants to enforce that all traffic between VPCs (east-west) and traffic to the internet (north-south) passes through the Network Firewall. They have configured the Transit Gateway route tables appropriately. However, they notice that traffic from an application VPC to another application VPC is not being inspected. The network engineer has verified that the application VPCs have a default route to the Transit Gateway, and the Transit Gateway route table has a route for the inspection VPC. What is the most likely reason that east-west traffic is bypassing the Network Firewall?

Accepted Answer

The Transit Gateway route tables allow direct communication between application VPCs. The most likely reason east-west traffic is bypassing the Network Firewall is that the Transit Gateway route tables allow direct communication between application VPCs. For traffic to be inspected, it must be routed through the inspection VPC. If the application VPCs have routes in the same Transit Gateway route table that point directly to each other (e.g., a static route or a propagated route from the same VPC attachment), traffic will take that direct path and bypass the Network Firewall. Option B is incorrect because the inspection VPC can have subnets for east-west traffic; the issue is routing, not subnet design. Option C is incorrect because Network Firewall can inspect traffic between VPCs at high throughput. Option D is incorrect because Network Firewall is stateful and handles return traffic correctly.

Answer

The inspection VPC does not have a subnet for east-west traffic

Answer

Network Firewall cannot inspect traffic between VPCs at high throughput

Answer

Network Firewall is not stateful and cannot handle return traffic

Question 6

An organization is designing a hybrid network using AWS Direct Connect with a private VIF. They want to ensure high availability and failover. Which THREE components should be part of the design?

Accepted Answer

Two separate Direct Connect connections from different providers or locations.. Using two separate Direct Connect connections from different providers or locations ensures physical diversity, eliminating single points of failure. This design meets the high availability requirement by providing redundant paths for traffic, even if one connection or provider experiences an outage.

Answer

A NAT gateway in each Availability Zone.

Answer

A single Direct Connect connection with multiple VLANs.

Question 7

A company wants to allow its VPC to access an S3 bucket securely without traversing the internet. Which AWS resource enables private connectivity between a VPC and S3?

Accepted Answer

VPC Gateway Endpoint. A VPC Gateway Endpoint (C) is the correct choice because it provides private, direct connectivity between a VPC and S3 without traversing the internet. It uses AWS PrivateLink to route traffic through the AWS network, using prefix lists in the VPC route table to direct S3 traffic to the endpoint, ensuring data never leaves the AWS backbone.

Answer

Internet Gateway

Answer

AWS Site-to-Site VPN

Answer

NAT Gateway

Question 8

A company has a web application running on EC2 instances behind an Application Load Balancer (ALB). The application stores files in an S3 bucket. The security team wants to ensure that the EC2 instances can only access the specific S3 bucket and no other AWS services. They have created an IAM role for the EC2 instances with a policy that grants s3:PutObject and s3:GetObject on the specific bucket. They have also attached a VPC endpoint for S3 to the VPC and added a bucket policy that allows access only from the VPC endpoint. Despite this, the EC2 instances can still access other S3 buckets. What is the most likely reason?

Accepted Answer

The VPC endpoint policy does not restrict access to the specific S3 bucket.. The most likely reason is that the VPC endpoint policy is not restricting access to the specific S3 bucket (Option C). Even though the IAM role only grants permissions on the specific bucket, the VPC endpoint policy defaults to allowing access to all S3 resources. Without a restrictive endpoint policy, the EC2 instances can access other S3 buckets if they have any IAM permissions that allow it (e.g., from another attached policy). Option A is incorrect because the VPC endpoint does not require a route table association to function; rather, the route table must have a route pointing to the endpoint for traffic to use it. Option B is incorrect because the security group on the endpoint controls network traffic, not access to S3 buckets. Option D is incorrect because the IAM role must have a trust policy allowing EC2 to assume it, but that is a prerequisite and would not cause the described issue by itself.

Answer

The VPC endpoint does not have a route table associated with the private subnets.

Answer

The security group on the VPC endpoint is allowing all traffic.

Answer

The IAM role does not have a trust policy that allows EC2 to assume it.

Question 9

A company uses AWS Shield Advanced to protect their web application against DDoS attacks. They have a CloudFront distribution and an Application Load Balancer (ALB) as origins. They want to receive notifications when a DDoS attack is detected. What is the MOST comprehensive way to set up notifications?

Accepted Answer

Create a CloudWatch alarm on the AWS Shield Advanced metric DDoSDetected and configure an SNS notification.. AWS Shield Advanced provides DDoSDetected metrics in CloudWatch. You can create a CloudWatch alarm on this metric and configure an SNS notification to alert when a DDoS attack is detected. Option A is incorrect because Shield Advanced does not have automatic notification settings; it relies on CloudWatch alarms. Option B is incorrect because AWS Config monitors configuration changes, not DDoS events. Option D is incorrect because Route 53 health checks monitor endpoint health, not DDoS attacks.

Answer

Enable Shield Advanced automatic notifications in the AWS Shield console.

Answer

Set up AWS Config rules to detect changes in the Shield Advanced configuration and send alerts.

Answer

Use Amazon Route 53 health checks to monitor the application and send notifications on failure.

Question 10

A company has deployed a multi-tier web application in a single AWS region. The architecture includes a VPC with public and private subnets across two Availability Zones. The web tier uses an Application Load Balancer (ALB) in the public subnets, and the application tier runs on EC2 instances in the private subnets. The database tier uses an Amazon RDS Multi-AZ deployment in the database subnets. The company is experiencing intermittent connectivity issues between the application tier and the database tier. The application logs show connection timeouts. The network engineer has verified that the security groups and network ACLs are correctly configured. The RDS instance is reachable from the application tier via a telnet test from one specific instance, but not consistently from all instances. What is the most likely cause of the intermittent connectivity?

Accepted Answer

The RDS Multi-AZ failover is causing the primary instance to change, and the application is not reconnecting to the new endpoint.. The most likely cause is that the RDS Multi-AZ failover is causing the primary instance to change, and the application is not reconnecting to the new endpoint. In a Multi-AZ deployment, if a failover occurs, the DNS endpoint updates to point to the new primary, but if the application caches the resolved IP address or uses stale connections, it may experience intermittent timeouts. This explains why connectivity works from some instances (those with fresh DNS entries) but not others. Option C is incorrect because within a single VPC, the local route automatically enables routing between all subnets; missing routes would cause consistent failure, not intermittent. Option B is incorrect because network ACLs, if correctly configured, would not cause intermittent issues. Option D is incorrect because a security group misconfiguration would likely cause consistent failure from all instances, not intermittent connectivity.

Answer

The network ACLs on the database subnets are blocking ephemeral ports used by the application.

Answer

The database subnets are in different Availability Zones than the application subnets, and the route tables in the application subnets do not have routes to the database subnet CIDRs.

Answer

The security group for the database is allowing traffic only from the application tier's security group, but the application tier instances are using a different security group.

Question 11

A company has a VPC with a CIDR block of 10.0.0.0/16. They have an AWS Site-to-Site VPN connection to an on-premises network with a CIDR of 192.168.0.0/16. The VPN is configured with dynamic routing (BGP). The on-premises network advertises a route to 192.168.0.0/16 via BGP. The VPC route table has a static route to 192.168.0.0/16 pointing to a virtual private gateway. The company also has a Direct Connect connection to the same on-premises network advertising the same CIDR. The VPC route table has a propagated route to 192.168.0.0/16 pointing to a Direct Connect virtual interface, learned via BGP. Which route will be used for traffic destined to 192.168.0.0/16?

Accepted Answer

Traffic will use the VPN connection because the static route to the virtual private gateway takes precedence over the propagated route from Direct Connect.. In AWS, when a VPC route table has both a static route and a propagated route (learned via BGP) for the same destination, the static route takes precedence regardless of the gateway type. In this scenario, the VPN route is a static route pointing to the virtual private gateway, while the Direct Connect route is a propagated route automatically added via BGP from the Direct Connect virtual interface. Therefore, the static route to the VPN gateway is used. Note that AWS does not allow two static routes with the same destination in the same route table; thus the Direct Connect route must be propagated.

Answer

Traffic will use the VPN connection because the static route to the virtual private gateway has a lower prefix.

Answer

Traffic will use the Direct Connect connection because it is a more reliable connection.

Answer

Traffic will be load-balanced between VPN and Direct Connect.

Question 12

A company has a Direct Connect connection with a private VIF to a VPC. The VPC has a virtual private gateway (VGW) attached. The on-premises network advertises a prefix 10.0.0.0/8 over BGP. The VPC has subnets with CIDR 10.0.1.0/24 and 10.0.2.0/24. The company wants to ensure that traffic to on-premises uses Direct Connect. However, traffic to an S3 bucket uses the internet. What route configuration is required?

Accepted Answer

Add specific routes for S3 public IP prefixes pointing to the internet gateway.. S3 public IP prefixes are not within the on-premises advertised prefix 10.0.0.0/8. Without explicit routes for S3, traffic to S3 would use the default route (if any) or be dropped. By adding specific routes for S3 public IP prefixes pointing to the internet gateway, S3 traffic is forced over the internet while all other traffic (including to on-premises) uses the Direct Connect private VIF via the propagated 10.0.0.0/8 route.

Answer

Change the VPC CIDR to avoid overlap with on-premises.

Answer

Add a static route for 0.0.0.0/0 pointing to the internet gateway.

Answer

Add a static route in the VPC route table for 0.0.0.0/0 pointing to the VGW.

Question 13

A company is designing a multi-region application with Amazon RDS for MySQL as the primary database. The application requires read-after-write consistency across regions. Which design should the company choose to meet this requirement?

Accepted Answer

Use Amazon Aurora Global Database with cluster endpoints in each region. Amazon Aurora Global Database is the correct choice because it provides dedicated cluster endpoints in each region that automatically route write traffic to the primary region and read traffic to local replicas, ensuring read-after-write consistency through its storage-layer replication with typical latency under 1 second. Unlike standard RDS cross-Region replication, Aurora Global Database uses a physical storage-based replication mechanism that guarantees global consistency without relying on MySQL binary logs, which can introduce replication lag and potential inconsistency.

Answer

Use Amazon RDS with cross-Region replication enabled using MySQL binary log

Answer

Use Amazon RDS Multi-AZ deployments in each region with read replicas

Answer

Use Amazon RDS with synchronous replication across regions

Question 14

A company wants to allow their employees to securely access resources in a VPC from their home offices. Which AWS service should they use?

Accepted Answer

AWS Client VPN. AWS Client VPN is a managed, cloud-based VPN service that allows individual users to securely access AWS resources from remote locations, such as home offices, using a VPN client installed on their device. It supports OpenVPN-based connections and integrates with Active Directory for user authentication, making it ideal for remote employee access to a VPC without requiring dedicated hardware or complex site-to-site configurations.

Answer

AWS Direct Connect

Answer

AWS Site-to-Site VPN

Answer

Amazon CloudFront

Question 15

A company is using AWS WAF to protect a web application behind an Application Load Balancer. They want to block requests that contain SQL injection attacks. Which WAF rule type should they use?

Accepted Answer

Managed rule group for SQL injection. AWS WAF provides managed rule groups specifically designed to detect common web threats, including SQL injection attacks. The 'Managed rule group for SQL injection' contains pre-configured rules that inspect request components (such as query strings, URI, and body) for SQL injection patterns, making it the correct choice for blocking such attacks without requiring custom rule authoring.

Answer

IP set rule

Answer

Rate-based rule

Answer

Geographic match rule

Question 16

A company has a Direct Connect connection with a private VIF attached to a Direct Connect Gateway. The company wants to connect to multiple VPCs in the same AWS Region. What is the MOST cost-effective and scalable design?

Accepted Answer

Create a Transit Gateway, attach it to the Direct Connect Gateway using a Transit VIF, and attach each VPC to the Transit Gateway.. It uses a Transit Gateway (TGW) to interconnect multiple VPCs and a Direct Connect Gateway (DXGW) via a Transit VIF, which is the most cost-effective and scalable design. The Transit VIF allows a single Direct Connect connection to be shared across many VPCs through the TGW, avoiding the need for multiple private VIFs or complex peering arrangements. This design scales to hundreds of VPCs and reduces operational overhead by centralizing routing.

Answer

Provision multiple private VIFs, each connected to a different VPC.

Answer

Create a Direct Connect Gateway and associate each VPC's Virtual Private Gateway to it using a private VIF.

Answer

Use a private VIF to connect to a Virtual Private Gateway in one VPC and use VPC Peering to reach other VPCs.

Question 17

A company wants to allow its employees to securely access internal applications hosted in a VPC without traversing the internet. The company also wants to be able to enforce security policies at the user level. Which AWS service should the company use?

Accepted Answer

AWS Client VPN. AWS Client VPN is a managed, cloud-based VPN service that allows employees to securely access internal applications hosted in a VPC from any location without traversing the internet. It uses OpenVPN-based client software and integrates with AWS Identity and Access Management (IAM) and Active Directory to enforce security policies at the user level, such as group-based access controls and multi-factor authentication.

Answer

Bastion host in a public subnet

Answer

AWS Direct Connect

Answer

AWS Site-to-Site VPN

Question 18

A company is designing a network for a critical application that requires an SLA of 99.99% availability. The application runs on EC2 instances in an Auto Scaling group across three Availability Zones. The company needs to ensure that the network design meets the SLA. Which THREE components should the company include? (Choose THREE.)

Accepted Answer

A NAT gateway in each Availability Zone for outbound internet access.. A NAT gateway in each Availability Zone ensures that outbound internet traffic remains within the same AZ, preventing cross-AZ data transfer costs and avoiding a single point of failure. This design supports the 99.99% SLA by maintaining high availability for outbound connectivity, as each AZ can independently handle its own traffic without relying on a shared resource.

Answer

A single AWS Direct Connect connection for all inbound traffic.

Answer

A single AWS Site-to-Site VPN connection for administrative access.

Question 19

A financial services company has a VPC with a public subnet and a private subnet. EC2 instances in the private subnet need to download patches from the internet. The company has a NAT gateway in the public subnet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT gateway. However, instances cannot reach the internet. The NAT gateway is in an 'available' state and has an Elastic IP attached. The security group for the NAT gateway allows all outbound traffic. What is the most likely cause of the issue?

Accepted Answer

The route table for the public subnet does not have a default route (0.0.0.0/0) pointing to an internet gateway. The most likely cause is that the route table for the public subnet (where the NAT gateway resides) does not have a default route (0.0.0.0/0) pointing to an internet gateway. The NAT gateway needs this route to forward traffic from private instances to the internet. Option A is incorrect because security groups for NAT gateways do not block inbound traffic from private instances; they only control traffic to the NAT gateway itself. Option B is incorrect because bandwidth provisioning is not related to connectivity; the NAT gateway can handle traffic up to its bandwidth limit. Option C is incorrect because NAT gateways do not require IAM roles to access the internet; they use Elastic IPs.

Answer

The security group for the NAT gateway is blocking inbound traffic from private instances

Answer

The NAT gateway is not provisioned with sufficient bandwidth

Answer

The NAT gateway does not have an IAM role to access the internet

Question 20

An EC2 instance with the attached network interface shown above is unable to reach the internet. The instance is in a public subnet with a route to an internet gateway. The security group allows outbound traffic. What is the most likely cause?

Accepted Answer

The network interface's attachment status is 'attached', but the instance may not have a public IP address.. The instance is in a public subnet with a route to an internet gateway, and the security group allows outbound traffic. However, for an instance in a public subnet to reach the internet directly, it must have a public IP address (either assigned automatically or as an Elastic IP). Without a public IP, the internet gateway cannot translate the instance's private IP to a public one, so outbound traffic fails. The route table is correct (contains 0.0.0.0/0 pointing to the internet gateway), source/destination check enabled is normal and does not block internet access, and the security group is associated and allows outbound traffic. Therefore, the most likely cause is the lack of a public IP address.

Answer

The source/destination check is enabled, which prevents the instance from sending traffic to the internet if it is not the source of the traffic.

Answer

The route table for the subnet does not have a 0.0.0.0/0 route pointing to the internet gateway.

Answer

The security group is not associated with the network interface.