ANS-C01 Practice Exam 53 — 20 Questions

Question 1

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to access an S3 bucket. The VPC has a NAT Gateway in the public subnet. The security group for the EC2 instance allows outbound HTTPS to 0.0.0.0/0. The NACL for the private subnet allows outbound HTTPS to 0.0.0.0/0 and inbound ephemeral ports from 0.0.0.0/0. The instance still cannot reach S3. What is the most likely cause?

Accepted Answer

The NAT Gateway's security group does not allow outbound HTTPS traffic.. Option B is correct because S3 requires HTTPS (443) for API calls, but the NAT Gateway's security group must allow inbound HTTPS from the private subnet and outbound to S3. If the NAT Gateway's security group does not allow outbound HTTPS to S3, traffic is dropped. Option A is wrong because the private subnet has a route to the NAT Gateway. Option C is wrong because S3 does not have a security group in the VPC. Option D is wrong because the NACL allows inbound ephemeral ports.

Answer

The NACL for the private subnet blocks inbound traffic from S3.

Answer

The private subnet's route table does not have a route to the NAT Gateway.

Answer

The S3 bucket policy denies access from the VPC.

Question 2

A company has a VPC with a NAT gateway in a public subnet. The security team wants to log all outbound traffic from private subnets to the internet. Which AWS service should be used to capture this traffic?

Accepted Answer

VPC Flow Logs. The correct answer is B because VPC Flow Logs can be enabled on the NAT gateway's elastic network interface to capture all outbound traffic. Option A is wrong because CloudTrail does not capture network traffic. Option C is wrong because AWS Config does not log traffic. Option D is wrong because S3 Access Logs are for S3 bucket access, not NAT gateway traffic.

Answer

AWS CloudTrail

Answer

Amazon S3 Access Logs

Answer

AWS Config

Question 3

A company is deploying a hybrid network using AWS Direct Connect and a VPN backup. The Direct Connect connection is established, and BGP is running over the private VIF. The company wants to use the VPN as a backup only when Direct Connect fails. The network engineer configures BGP communities on the Direct Connect VIF to influence route preference. However, during a Direct Connect failure, failover to VPN takes several minutes. What can the engineer do to reduce failover time?

Accepted Answer

Enable Bidirectional Forwarding Detection (BFD) on the Direct Connect VIF. Option D is correct because BFD can detect failures in sub-second time, reducing failover time. Option A is wrong because BGP timers can be adjusted but are typically already low; BFD is faster. Option B is wrong because static routes are less flexible and increase administrative overhead. Option C is wrong because AS prepending is for route preference, not failover speed.

Answer

Configure AS path prepending on the VPN BGP session to deprioritize it

Answer

Use static routes instead of BGP for the Direct Connect VIF

Answer

Decrease the BGP keepalive and hold timers on both the Direct Connect and VPN BGP sessions

Question 4

A network engineer is designing a hybrid network with AWS Direct Connect and a VPN backup. The company has multiple VPCs connected to an AWS Transit Gateway. The on-premises network advertises the same prefixes over both Direct Connect (via private VIF) and VPN (via BGP). The engineer wants to ensure that traffic from the VPCs to on-premises prefers the Direct Connect path. What should the engineer do?

Accepted Answer

Configure AS path prepending on the VPN BGP advertisements from on-premises. Option A is correct because adjusting the AS path prepending length makes the VPN path appear longer (less preferred) in BGP route selection. Option B is incorrect because MED is only compared between routes from the same AS. Option C is incorrect because local preference is used within a single AS, not across ASes. Option D is incorrect because decreasing the AS path length would make the path more preferred.

Answer

Set a higher local preference on the Transit Gateway for Direct Connect routes

Answer

Decrease the AS path length on the Direct Connect BGP advertisements

Answer

Set a higher MED on the Direct Connect BGP advertisements

Question 5

A company has a VPC with multiple subnets. They want to centrally manage and inspect all traffic between subnets using a security appliance. Which AWS service should be used to achieve this?

Accepted Answer

Transit Gateway with a security appliance in a central VPC. Option B is correct because Transit Gateway with a middlebox appliance (e.g., firewall) in a shared services VPC allows traffic inspection. Option A is wrong because VPC peering is point-to-point and not centralized. Option C is wrong because AWS Network Firewall can be used but Transit Gateway provides the architecture for central inspection. Option D is wrong because Route 53 is DNS.

Answer

VPC peering

Answer

AWS Route 53 Resolver

Answer

AWS Network Firewall

Question 6

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Direct Connect. The network team wants to monitor BGP session status for all Transit Gateway attachments. Which AWS service should be used?

Accepted Answer

AWS Transit Gateway Network Manager. Option A is correct because Transit Gateway Network Manager provides monitoring of BGP sessions and network topology. Option B is incorrect because CloudWatch can monitor metrics but not BGP session status directly. Option C is incorrect because VPC Flow Logs capture traffic, not routing protocol status. Option D is incorrect because AWS Config can track configuration changes but not real-time BGP status.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon CloudWatch with Transit Gateway metrics

Question 7

A network engineer needs to verify the routing path between two EC2 instances in different subnets within the same VPC. Which AWS tool can provide this information?

Accepted Answer

VPC Reachability Analyzer. Option B is correct because VPC Reachability Analyzer can test connectivity and provide routing path information. Option A is incorrect because traceroute from an instance requires SSH access. Option C is incorrect because AWS Config provides configuration history, not real-time path analysis. Option D is incorrect because CloudWatch does not provide path analysis.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Run traceroute from one instance to the other

Question 8

Refer to the exhibit. A network engineer has established a VPC peering connection between VPC A (10.0.0.0/16) in account 111111111111 and VPC B (192.168.0.0/16) in account 222222222222. The peering connection status is 'active'. However, instances in VPC A cannot reach instances in VPC B. What is the MOST likely cause?

Accepted Answer

Route tables in one or both VPCs do not have routes to the peer CIDR. Option D is correct because the route tables in both VPCs need routes to the peer CIDR via the peering connection. Option A is incorrect because the status is active. Option B is incorrect because the CIDRs are non-overlapping. Option C is incorrect because there is no indication of security groups blocking, though they could; but the most common cause is missing routes.

Answer

The peering connection is not in the 'active' state

Answer

Security groups in VPC B are blocking traffic

Answer

The CIDR blocks overlap

Question 9

A network engineer is setting up a VPC peering connection between two VPCs in the same AWS account and Region. Which TWO steps are required to enable communication between instances in the peered VPCs? (Choose two.)

Accepted Answer

Add routes in each VPC's route table pointing to the CIDR of the other VPC. Option A is correct because VPC peering requires adding routes in both VPC route tables. Option D is correct because security group rules must allow traffic from the peered VPC CIDR. Option B is wrong because VPC peering does not require an internet gateway. Option C is wrong because VPC peering does not use a VPN connection. Option E is wrong because a NAT gateway is not required for VPC peering.

Answer

Attach an internet gateway to each VPC

Answer

Establish a VPN connection between the VPCs

Answer

Configure a NAT gateway in each VPC

Question 10

A network engineer is troubleshooting high latency on an AWS Transit Gateway attachment to a VPN. The VPN tunnel is established, and traffic flows, but latency spikes are observed during peak hours. The engineer suspects packet loss. Which diagnostic step should be taken first?

Accepted Answer

Use Amazon CloudWatch metrics for the Transit Gateway attachment to check for dropped packets.. Option A is correct because monitoring the Transit Gateway attachment metrics can show packet loss or errors. Option B is wrong because it only checks if the tunnel is up. Option C is wrong because CloudWatch metrics for the VPN are more granular. Option D is wrong because it does not provide real-time diagnostics.

Answer

Run a traceroute from an on-premises host to an EC2 instance.

Answer

Verify the VPN tunnel status in the AWS Management Console.

Answer

Review the VPN CloudWatch metrics for tunnel data.

Question 11

A company uses VPC Flow Logs to monitor network traffic. The flow logs are published to Amazon S3. The security team wants to analyze the logs for suspicious traffic patterns using Amazon Athena. After creating the Athena table, queries return zero results. The logs are in the correct S3 bucket. What is the most likely cause?

Accepted Answer

The Athena table is not configured to read from the correct S3 partition structure. Option A is correct because VPC Flow Logs are stored in a partitioned folder structure (e.g., AWSLogs/account-id/vpcflowlogs/region/year/month/day/). If the Athena table does not use partition projection or the partition location is incorrect, queries return no data. Option B is wrong because encryption does not prevent Athena from reading. Option C is wrong because the table can be in any database. Option D is wrong because file format (gzip) is supported by Athena.

Answer

The flow logs are encrypted with SSE-KMS and Athena does not have permission to decrypt

Answer

The Athena table is in a different AWS Glue database

Answer

The flow logs are in gzip format, which Athena does not support

Question 12

A company is migrating its on-premises data center to AWS. The network team needs to establish a site-to-site VPN connection with dynamic routing using BGP. The on-premises router supports BGP but does not support BGP communities. The VPN connection is established, but the VPC does not learn the on-premises routes. What is the most likely cause?

Accepted Answer

The on-premises router is not advertising any prefixes over BGP. Option B is correct because the on-premises router must advertise its routes over the BGP session. Option A is incorrect because BGP communities are not required. Option C is incorrect because the VPN connection is established. Option D is incorrect because BGP does not require static routes.

Answer

The VPN tunnel uses pre-shared keys instead of certificates

Answer

The VPC route table needs a static route to the on-premises CIDR

Answer

The VPN tunnel is not in a UP state

Question 13

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The network team notices that traffic is intermittently dropping and the BGP session between the on-premises router and the AWS Direct Connect virtual interface goes down. Which configuration should be checked first to resolve this issue?

Accepted Answer

Ensure the BGP hold timer values are consistent on both ends. The BGP hold timer mismatch can cause session flapping. Option B is correct because setting the hold timer to a consistent value (e.g., 30 seconds) on both sides stabilizes the session. Option A is wrong because increasing the BGP timers may mask the issue but doesn't address the root cause. Option C is wrong because AWS allows BGP authentication. Option D is wrong because MD5 authentication is supported.

Answer

Increase the BGP keepalive timer on the on-premises router to 90 seconds

Answer

Disable BGP authentication on the virtual interface

Answer

Enable BGP MD5 authentication on the on-premises router

Question 14

A company wants to monitor network traffic in its VPC for security analysis and troubleshooting. Which TWO AWS services can be used to capture and analyze IP traffic information? (Choose TWO.)

Accepted Answer

AWS Network Firewall. Options A and C are correct. VPC Flow Logs capture IP traffic metadata, and AWS Network Firewall can capture and inspect traffic. B is wrong because CloudTrail records API calls, not network traffic. D is wrong because GuardDuty is a threat detection service that uses flow logs but does not capture them directly. E is wrong because AWS Trusted Advisor provides best practice checks.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Question 15

A company is using a transit gateway to connect multiple VPCs and on-premises networks via VPN. The network team notices that some VPCs can communicate with each other but not with the on-premises network. The transit gateway route tables are configured correctly. Which TWO configurations should the team check?

Accepted Answer

Verify that the on-premises router is advertising the on-premises CIDR over BGP to the VPN. Options B and D are correct. The VPN attachment must be associated with the correct transit gateway route table (B), and the on-premises router must advertise the correct routes via BGP (D). Option A is incorrect because if some VPCs can communicate with each other, the transit gateway is not in a failed state. Option C is incorrect because VPC Flow Logs do not affect routing. Option E is incorrect because security groups and NACLs are VPC-level and would affect inter-VPC traffic as well.

Answer

Verify that the transit gateway is in a 'available' state

Answer

Check the security group rules of the EC2 instances in the VPCs

Answer

Check the VPC Flow Logs for dropped packets

Question 16

A company uses AWS Direct Connect with a public VIF to access Amazon S3. The on-premises network team reports that the BGP session for the public VIF is flapping intermittently. Which configuration change on the customer router would most likely stabilize the BGP session?

Accepted Answer

Configure BGP route filtering to limit the number of routes advertised to AWS to no more than 100.. BGP flapping due to route advertisements exceeding the maximum allowed is a known issue. The maximum number of routes allowed on a public VIF is 100. Advertising more than this will cause the session to flap. Limiting routes to 100 will stabilize.

Answer

Set the BGP multi-hop TTL to 255.

Answer

Increase the BGP hold timer to 180 seconds.

Answer

Disable BGP fast-external-fallover on the customer router.

Question 17

A company has a hybrid network with multiple AWS Direct Connect connections to different VPCs. The on-premises network uses BGP to advertise prefixes to AWS. The network team notices that some on-premises prefixes are not being received by the VPCs. What is the MOST likely cause?

Accepted Answer

The on-premises router is advertising more than 100 prefixes over the BGP session. Option A is correct because the maximum number of routes advertised over a Direct Connect virtual interface is 100 by default, and exceeding this limit causes BGP to reject additional routes. Option B is wrong because AS_PATH prepending would affect route preference, not advertisement. Option C is wrong because the MED attribute affects path selection, not advertisement. Option D is wrong because BGP communities are optional and not required for prefix advertisement.

Answer

The on-premises router is not using BGP communities

Answer

The on-premises router is using AS_PATH prepending

Answer

The on-premises router is not setting the MED attribute

Question 18

An organization has a multi-account setup using AWS Organizations. The security team wants to centrally manage and enforce security group rules across all VPCs in all accounts. Which solution should they implement?

Accepted Answer

Use AWS Firewall Manager to create common security group policies.. Option A is correct because AWS Firewall Manager provides a centralized way to apply security group rules across accounts and VPCs in an organization. Option B is wrong because Network ACLs are stateless and not as flexible for application-level rules. Option C is wrong because AWS Config is for compliance and auditing, not enforcement. Option D is wrong because VPC Flow Logs are for monitoring, not enforcement.

Answer

Deploy a centralized network ACL in each VPC.

Answer

Enable VPC Flow Logs and analyze using Amazon Detective.

Answer

Use AWS Config rules to remediate non-compliant security groups.

Question 19

A company is designing a VPN connection between an on-premises network and AWS. The network engineer wants to ensure high availability and fast failover. Which TWO actions should the engineer take? (Select TWO.)

Accepted Answer

Enable BGP and configure BFD (Bidirectional Forwarding Detection) on the VPN tunnels. Options A and C are correct. A: Two tunnels on two separate AWS endpoints provide redundancy. C: BGP with BFD provides fast failover detection. Option B is wrong because static routes do not provide dynamic failover. Option D is wrong because the same customer gateway IP is used for both tunnels. Option E is wrong because multiple VPN connections to the same VPC are not needed if the tunnels are diverse.

Answer

Use the same customer gateway IP address for both tunnels

Answer

Use static routes instead of BGP to simplify configuration

Answer

Create two separate VPN connections to the same VPC

Question 20

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The network team notices intermittent packet loss and latency spikes during peak hours. Which action should the team take to diagnose the issue?

Accepted Answer

Enable Bidirectional Forwarding Detection (BFD) on the virtual interfaces. Option B is correct because enabling Bidirectional Forwarding Detection (BFD) on the virtual interfaces allows rapid detection of connectivity failures, which can help isolate whether the issue is on the AWS side or the customer side. Option A is wrong because increasing bandwidth may not resolve intermittent issues caused by routing problems. Option C is wrong because changing the private ASN does not affect performance. Option D is wrong because tagging does not impact network performance.

Answer

Increase the bandwidth of the Direct Connect connection

Answer

Apply a tag to the Direct Connect connection for monitoring

Answer

Change the private ASN on the customer router