ANS-C01 Practice Exam 53 — 20 Questions

Question 1

A company is designing a network security architecture for a VPC that hosts a multi-tier application. The security team requires that the web tier can only be accessed from the internet, the application tier can only be accessed from the web tier, and the database tier can only be accessed from the application tier. Additionally, the team needs to ensure that no traffic can bypass these controls. Which THREE actions should the team take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use security group rules that reference other security groups as sources.. Security group rules can reference other security groups as sources, which allows the web tier security group to permit traffic only from the application tier security group, and the application tier security group to permit traffic only from the database tier security group. This creates a logical, stateful firewall that enforces the required traffic flow between tiers without relying on IP addresses, ensuring that no traffic can bypass the controls even if subnet configurations change.

Answer

Enable VPC Flow Logs on all subnets and send logs to Amazon S3.

Answer

Attach an internet gateway to the VPC and add a default route to the internet gateway in the web tier subnet's route table.

Question 2

A company is deploying a critical application that requires low latency between EC2 instances in the same AWS region but across multiple Availability Zones. The instances are part of an Auto Scaling group behind a Network Load Balancer. Which network design provides the lowest latency while maintaining high availability?

Accepted Answer

Do not use a placement group; enable Enhanced Networking (ENA) on all instances.. Enhanced Networking (ENA) provides the highest possible packet-per-second performance and lowest latency by offloading network processing to dedicated hardware on the instance. Since the application requires low latency across multiple Availability Zones, a placement group is not suitable because cluster placement groups cannot span multiple AZs, and spread/partition placement groups do not improve latency — they only control instance placement for fault isolation. ENA alone, combined with a Network Load Balancer, delivers the lowest latency while maintaining high availability across AZs.

Answer

Use a cluster placement group across two Availability Zones.

Answer

Use a spread placement group across two Availability Zones.

Answer

Use a partition placement group across two Availability Zones.

Question 3

A network engineer is diagnosing a connectivity issue between an on-premises network and an Amazon VPC connected via a site-to-site VPN. The VPN tunnel is up, but traffic is not reaching the VPC. Which TWO actions should the engineer take to troubleshoot the issue? (Choose two.)

Accepted Answer

Review the security group rules associated with the VPC resources to ensure they allow traffic from the on-premises network. Security groups act as a virtual firewall for VPC resources. If traffic from the on-premises network is not reaching the VPC, the security group rules must allow inbound traffic from the on-premises IP range. Option C is correct because the VPC route tables need a route for the on-premises network pointing to the virtual private gateway (VGW) to direct traffic correctly. Option B is incorrect because the customer gateway is the on-premises VPN endpoint, and its association with the VPC is already established since the VPN tunnel is up. Option D is incorrect because NAT is not a requirement for site-to-site VPN; the issue is about routing, not address translation. Option E is incorrect because the tunnel is already up, so checking its status again does not help diagnose why traffic is not flowing.

Answer

Confirm the customer gateway is associated with the correct VPC

Answer

Verify that the on-premises network has a NAT device configured

Answer

Check that the VPN tunnel's status is 'UP'

Question 4

A company has a VPC with a public subnet containing a NAT gateway and a private subnet containing Amazon EC2 instances. The instances in the private subnet need to download patches from the internet. The NAT gateway is in the public subnet and has an Elastic IP address. The private subnet's route table has a default route pointing to the NAT gateway. However, the instances cannot reach the internet. What is the MOST likely cause?

Accepted Answer

The public subnet's route table does not have a route to an internet gateway.. The NAT gateway resides in the public subnet, but for it to route traffic to the internet, the public subnet's route table must have a default route (0.0.0.0/0) pointing to an internet gateway (IGW). Without this route, the NAT gateway cannot forward traffic from the private subnet to the internet, even though the private subnet's route table correctly points to the NAT gateway. The missing IGW route in the public subnet breaks the outbound path.

Answer

The NAT gateway does not have a route back to the private subnet.

Answer

The NAT gateway is not associated with a security group that allows inbound internet traffic.

Answer

The security group attached to the EC2 instances does not allow outbound traffic to the internet.

Question 5

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16 and an IPv6 CIDR of 2001:db8:1234::/56. The company hosts a web application on IPv4-only EC2 instances in a private subnet. The application must be accessible from the internet via IPv6. The company has an internet-facing Application Load Balancer (ALB) with dual-stack IP address type. The ALB is in a public subnet. The target group is configured with IP address type IPv4. Users report that they can access the application via IPv4 but not via IPv6. The ALB security group allows inbound HTTP/HTTPS from ::/0. What is the MOST likely cause?

Accepted Answer

The public subnet does not have an associated IPv6 CIDR.. The most likely cause is that the public subnet does not have an associated IPv6 CIDR. For an ALB to accept IPv6 traffic, it must have an IPv6 address assigned to its network interface. This requires the public subnet to have an IPv6 CIDR block attached. Even though the ALB is configured as dual-stack, without an IPv6 CIDR on the subnet, the ALB cannot obtain an IPv6 address and therefore cannot receive IPv6 traffic. Option B is incorrect because an ALB can forward IPv6 client traffic to IPv4 targets using IPv4 communication; the target group IP address type does not need to be IPv6. Option C is false as the ALB is dual-stack. Option D is irrelevant because the private subnet's route table does not affect ALB-to-target communication.

Answer

The target group is configured with IP address type IPv4, but the ALB must use IPv6 to communicate with the targets.

Answer

The ALB is configured as IPv4-only instead of dual-stack.

Answer

The private subnet's route table does not have an IPv6 route to the NAT gateway or egress-only internet gateway.

Question 6

A company is designing a multi-VPC architecture in a single AWS Region. The company has three VPCs: Production, Development, and Shared Services. They want to enable transitive routing between all VPCs while minimizing operational overhead. Which TWO solutions meet these requirements?

Accepted Answer

Use AWS Transit Gateway to connect all VPCs.. AWS Transit Gateway (Option C) serves as a central hub for transitive routing between all connected VPCs, eliminating the need for full-mesh peering. It automatically handles route propagation and attachment management, significantly reducing operational overhead. Option E also uses AWS Transit Gateway as the core, but connects VPCs via VPN attachments to an on-premises router that performs the inter-VPC routing. While this adds some overhead due to the on-premises component, it still provides transitive routing without requiring a full mesh of VPC-to-VPC connections, thus meeting the requirements. Options A and B require full meshes or many point-to-point connections, increasing overhead. Option D introduces an on-premises router but lacks a central hub for VPC-to-VPC routing without additional configuration.

Answer

Establish VPC peering connections between each pair of VPCs.

Answer

Configure a VPN connection between each VPC.

Answer

Configure AWS Direct Connect connections from each VPC to the same on-premises router.

Question 7

A network engineer is troubleshooting high latency on a Direct Connect connection. The engineer wants to use monitoring tools to identify the source of the latency. Which two AWS services can provide metrics and logs to help diagnose the issue? (Choose TWO.)

Accepted Answer

Amazon CloudWatch. The correct answers are C (Amazon CloudWatch) and E (VPC Flow Logs). CloudWatch provides metrics for Direct Connect, including connection state, BGP status, packet loss, and latency. VPC Flow Logs capture IP traffic information that can be analyzed to identify latency patterns. Option A (AWS CloudTrail) is incorrect because it logs API calls, not network metrics. Option B (AWS Config) is incorrect because it tracks configuration changes. Option D (AWS Trusted Advisor) is incorrect because it provides recommendations, not real-time metrics or logs.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 8

A company is deploying a new application in a VPC. The application consists of EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The ALB must only receive traffic from the company's on-premises network via an AWS Site-to-Site VPN. Which THREE steps should the network engineer take to meet this requirement?

Accepted Answer

Place the ALB in a private subnet and use a Transit Gateway.. To restrict ALB traffic exclusively to the on-premises network via Site-to-Site VPN, three steps are needed. First, place the ALB in a private subnet to keep it internal and use a Transit Gateway to route VPN traffic to private subnets. Second, configure the network ACL on the ALB's subnet to allow inbound traffic only from the on-premises CIDR. Third, configure the ALB's security group to allow inbound traffic from the same CIDR. Option B (public subnet) is incorrect because it would make the ALB internet-facing, which is unnecessary and less secure. Option E (NAT gateway) is irrelevant for inbound traffic restriction.

Answer

Place the ALB in a public subnet.

Answer

Create a NAT gateway in the public subnet for outbound traffic.

Question 9

A company has a VPC with public and private subnets in two Availability Zones. The private subnets need to access the internet for software updates. Which configuration meets this requirement securely?

Accepted Answer

Deploy a NAT Gateway in a public subnet and update the private subnet route tables to point 0.0.0.0/0 to the NAT Gateway.. A NAT Gateway placed in a public subnet with an Elastic IP allows instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections. The private subnet route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway's elastic network interface, which translates source private IPs to the NAT Gateway's Elastic IP using SNAT (Source Network Address Translation). This meets the requirement securely by maintaining the private subnets' isolation from direct internet exposure.

Answer

Attach an Internet Gateway to the VPC and add a route to 0.0.0.0/0 in the private subnet route tables pointing to the Internet Gateway.

Answer

Create a VPC Peering connection to a second VPC that has an Internet Gateway and route all traffic through it.

Answer

Configure a Virtual Private Gateway and use an AWS Direct Connect connection to the internet.

Question 10

A company is connecting their on-premises data center to AWS using a site-to-site VPN. The customer gateway device has a dynamic routing configuration with BGP. The VPN connection is established, but the VPC route table does not contain the on-premises network routes. What is the most likely cause?

Accepted Answer

Route propagation is not enabled on the VPC route table.. When using a site-to-site VPN with dynamic routing (BGP), the VPC route table must have route propagation enabled to automatically import the BGP-advertised routes from the virtual private gateway (VGW). Without route propagation, the VPC route table will not contain the on-premises network routes, even though the VPN tunnel and BGP session are established.

Answer

The customer gateway device is not configured with the correct BGP ASN.

Answer

The VPC route table has static routes pointing to the virtual private gateway.

Answer

The VPN connection is using static routing instead of dynamic routing.

Question 11

A company is deploying a multi-region application with an Application Load Balancer (ALB) in us-east-1 and a second ALB in eu-west-1. They want to route traffic to the nearest region using Amazon Route 53. They have set up a latency-based routing policy. Users in North America are being routed to eu-west-1 instead of us-east-1. What is the most likely cause?

Accepted Answer

Latency measurements between the user and us-east-1 are higher than expected due to transient network conditions. Latency-based routing in Route 53 selects the region with the lowest measured latency for the user. If transient network conditions cause higher-than-normal latency between the user and us-east-1, Route 53 may route traffic to eu-west-1 despite the geographic proximity. This is the most likely cause because the question states the routing policy is already set to latency, and transient conditions can skew measurements.

Answer

The routing policy is incorrectly configured as geolocation instead of latency

Answer

The us-east-1 ALB is not associated with a Route 53 record set

Answer

The health checks for the us-east-1 ALB are failing

Question 12

A company has set up a Site-to-Site VPN connection between its on-premises network and AWS. The VPN tunnel shows as 'UP' but traffic is not flowing. What should the engineer check?

Accepted Answer

Verify that route propagation is enabled on the VPC route table. Route propagation from the virtual private gateway to the VPC route table must be enabled. Option A is wrong because the tunnel state is up, so security group is not likely the issue (security group affects instances, not VPN endpoint). Option B is wrong because the internet gateway is for public internet access, not VPN. Option C is wrong because the customer gateway is the on-premises endpoint; it is configured but if routes are not propagated, traffic won't flow.

Answer

Ensure the customer gateway is configured correctly

Answer

Verify the security group rules for the VPN connection

Answer

Check the internet gateway route table

Question 13

A network engineer is troubleshooting high latency on an AWS Transit Gateway attachment to a VPN. The VPN tunnel is established, and traffic flows, but latency spikes are observed during peak hours. The engineer suspects packet loss. Which diagnostic step should be taken first?

Accepted Answer

Use Amazon CloudWatch metrics for the Transit Gateway attachment to check for dropped packets.. The first step in diagnosing packet loss on a Transit Gateway VPN attachment is to check the attachment's CloudWatch metrics, such as DroppedPacketCount or PacketDropRate, which directly indicate packet loss. Option A (traceroute) can show path latency but does not confirm packet loss at the Transit Gateway level. Option C (verify VPN tunnel status) only confirms the tunnel is up, not packet loss. Option D (VPN CloudWatch metrics) provides tunnel-level metrics but is less specific to the Transit Gateway attachment itself. The attachment metrics are more direct for this issue.

Answer

Run a traceroute from an on-premises host to an EC2 instance.

Answer

Verify the VPN tunnel status in the AWS Management Console.

Answer

Review the VPN CloudWatch metrics for tunnel data.

Question 14

Which TWO of the following are valid methods to connect an on-premises network to an Amazon VPC? (Select TWO.)

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet for consistent latency and higher bandwidth. This is a valid method for connecting an on-premises network to a VPC, as it establishes a direct physical link that can be associated with a virtual interface to a VPC.

Answer

VPC peering connection

Answer

VPC endpoint

Answer

Internet Gateway

Question 15

A company has a hybrid network with multiple VPCs connected via a Transit Gateway. They need to centralize outbound internet traffic through a single VPC. Which architecture should be used?

Accepted Answer

Designate one VPC as an egress VPC with a NAT Gateway and Internet Gateway, and use Transit Gateway route tables to route 0.0.0.0/0 from other VPCs to the egress VPC.. It uses a dedicated egress VPC with a NAT Gateway and Internet Gateway, and leverages Transit Gateway route tables to direct 0.0.0.0/0 traffic from all other VPCs to this central point. This architecture centralizes outbound internet traffic, avoids overlapping NAT responsibilities, and maintains a clean hub-and-spoke design where only the egress VPC has direct internet access.

Answer

Attach a NAT Gateway to each VPC's private subnets.

Answer

Attach an Internet Gateway to each VPC and route 0.0.0.0/0 to the IGW.

Answer

Use a VPN connection to an on-premises data center for internet access.

Question 16

A network engineer is troubleshooting an issue where an AWS Lambda function cannot create an Elastic Network Interface (ENI) in a VPC. The function has the IAM policy shown in the exhibit. Which statement explains why the function is failing?

Accepted Answer

The policy is missing the ec2:CreateNetworkInterfacePermission action. AWS Lambda requires the `ec2:CreateNetworkInterfacePermission` action to allow the Lambda service to create and manage ENIs on your behalf. While the policy may not explicitly deny `ec2:CreateNetworkInterface`, it is missing this required permission action. Without `ec2:CreateNetworkInterfacePermission`, Lambda cannot delegate ENI creation, causing the failure.

Answer

The policy denies the ec2:CreateVpc action which is required to create an ENI

Answer

The policy allows ec2:DescribeInstances which conflicts with ENI creation

Answer

The policy denies the ec2:CreateNetworkInterface action

Question 17

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to initiate outbound connections to the internet for software updates. The company wants to ensure that all outbound traffic goes through a single, highly available IP address for whitelisting purposes. Which solution should be used?

Accepted Answer

Launch a NAT instance in a public subnet and assign an Elastic IP. Configure the private subnet route table to point to the NAT instance.. A NAT instance in a public subnet with an Elastic IP provides a single, stable IP address for outbound traffic from the private subnet. By configuring the private subnet route table to point to the NAT instance, all outbound internet traffic goes through that instance. While not inherently highly available across Availability Zones, the solution meets the core requirement of a single IP for whitelisting and can be made more resilient using Auto Scaling and instance recovery.

Answer

Create an internet gateway and attach it to the private subnet, then configure the route table.

Answer

Create a VPC endpoint for Amazon S3 and route software update traffic through that endpoint.

Answer

Create a NAT gateway in each Availability Zone and assign the same Elastic IP to both.

Question 18

A company has a VPC with a public subnet and a private subnet. The public subnet contains a NAT gateway and a bastion host. The private subnet contains several EC2 instances that need to download software updates from the internet. The security team has configured the following: - A security group on the EC2 instances allows outbound traffic to 0.0.0.0/0 on ports 443 and 80. - The private subnet's route table has a default route (0.0.0.0/0) pointing to the NAT gateway. - The NAT gateway is in the public subnet with an Elastic IP and its security group allows inbound traffic from the private subnet CIDR on ports 443 and 80, and outbound to 0.0.0.0/0 on all ports. Despite this, the EC2 instances cannot reach the internet. What is the most likely cause?

Accepted Answer

The NAT gateway's security group inbound rule is too restrictive. The most likely cause is that the NAT gateway's security group inbound rule is too restrictive. NAT gateways are managed services and do not have security groups; if one were hypothetically attached, its inbound rule allowing only ports 443 and 80 would block return traffic on ephemeral ports. More critically, security groups are stateful—if outbound traffic is allowed, return traffic is automatically permitted regardless of inbound rules. Therefore, option D is incorrect. Option B is incorrect because the NAT gateway has an Elastic IP, and option C is incorrect because the private subnet route table has a default route to the NAT gateway.

Answer

The NAT gateway does not have an Elastic IP associated

Answer

The route table of the private subnet does not have a route to the NAT gateway

Answer

The EC2 instances' security group does not allow inbound traffic from the NAT gateway

Question 19

A company is deploying a multi-tier application in a VPC. The web servers must be accessible from the internet, but the database servers must not be. Which architecture meets these requirements?

Accepted Answer

Place web servers in public subnets with an internet gateway, and databases in private subnets with no direct internet access.. Placing web servers in public subnets with an internet gateway and database servers in private subnets with no direct internet access ensures only the web tier is accessible from the internet. Option A is incorrect because a NAT gateway is used for outbound internet access from private subnets, not for allowing inbound traffic to the database servers. Option C is incorrect because an AWS Site-to-Site VPN is used to connect on-premises networks to a VPC, not to provide internet access to private subnets. Option D is incorrect because placing database servers in public subnets directly exposes them to the internet; security groups alone do not prevent internet routability, and best practice is to place databases in private subnets.

Answer

Use a NAT gateway for the database servers to allow inbound traffic.

Answer

Place all servers in private subnets and use an AWS Site-to-Site VPN for internet access.

Answer

Place both web and database servers in public subnets and use security groups to restrict database access.

Question 20

A company is experiencing high latency for traffic between EC2 instances in the same VPC but in different Availability Zones. The network team suspects the issue is related to the placement group used. The instances are in a spread placement group. What should the network engineer do to reduce latency?

Accepted Answer

Change the placement group to a cluster placement group and ensure instances are in the same Availability Zone.. A cluster placement group is designed for low-latency, high-throughput traffic by ensuring instances are in close proximity. Option B is incorrect because enabling enhanced networking and increasing instance size can improve throughput but does not directly reduce latency caused by inter-AZ distance. Option C is incorrect because moving instances to the same AZ helps, but a spread placement group still places instances on different racks, which introduces additional latency compared to a cluster placement group. Option D is incorrect because VPC peering is used for connectivity between different VPCs; for intra-VPC traffic, adding a VPC peering connection does not reduce latency and may even add complexity.

Answer

Enable enhanced networking on the instances and increase the instance size.

Answer

Move the instances to the same subnet within the same Availability Zone but keep the spread placement group.

Answer

Create a VPC peering connection between the two AZs and route traffic through it.