ANS-C01 Practice Exam 54 — 20 Questions

Question 1

A company has a VPC with public and private subnets. They launch an Amazon RDS for MySQL DB instance in a private subnet. The DB instance needs to be accessible from an on-premises application that connects via an AWS Site-to-Site VPN. What is the MOST secure way to allow the on-premises application to connect to the DB instance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Place the DB instance in a private subnet and configure a security group to allow inbound traffic from the on-premises CIDR.. Placing the RDS DB instance in a private subnet ensures it has no public IP address, and configuring a security group to allow inbound traffic from the on-premises CIDR over the Site-to-Site VPN provides a secure, direct connection without exposing the database to the internet. Security groups act as a stateful firewall at the instance level, allowing only specified traffic from the on-premises network through the VPN tunnel.

Answer

Assign a public IP address to the DB instance and restrict access using a security group.

Answer

Place the DB instance in a private subnet and use a NAT gateway to allow inbound traffic.

Answer

Place the DB instance in a public subnet and configure a network ACL to allow traffic from the on-premises CIDR.

Question 2

A company has a VPC with a CIDR block of 10.0.0.0/16 and needs to establish connectivity to an on-premises network via AWS Site-to-Site VPN. The on-premises network uses a CIDR block of 192.168.0.0/16. The VPN connection will be redundant using two tunnels. Which THREE actions are required to enable this connectivity?

Accepted Answer

Create a Customer Gateway (CGW) in the same AWS region.. Option A is correct because a Site-to-Site VPN requires a Customer Gateway (CGW) resource in AWS that represents the on-premises VPN device's public IP address and BGP ASN, which is necessary to terminate the VPN tunnels on the customer side. Option C is correct because a Virtual Private Gateway (VGW) must be created and attached to the VPC to serve as the AWS-side VPN endpoint that the two redundant tunnels connect to. Option E is correct because the VPC route tables must have a route for the on-premises CIDR 192.168.0.0/16 targeting the VGW so that traffic destined for the on-premises network is forwarded through the VPN connection. Option B is incorrect because a Direct Connect virtual interface is used for AWS Direct Connect dedicated connections, not for a Site-to-Site VPN. Option D is incorrect because a NAT Gateway provides outbound internet access for private subnets and plays no role in establishing VPN connectivity to an on-premises network.

Answer

Create a Direct Connect virtual interface.

Answer

Configure a NAT Gateway in the VPC.

Question 3

A company has multiple VPCs that need to communicate with each other and with an on-premises network. They want to minimize operational overhead and avoid peering mesh complexity. Which AWS service should be used?

Accepted Answer

AWS Transit Gateway.. AWS Transit Gateway acts as a central hub to interconnect multiple VPCs and on-premises networks using a single gateway, eliminating the need for a full mesh of VPC peering connections. It simplifies network management by providing transitive routing between all attached networks, which directly addresses the requirement to minimize operational overhead and avoid peering mesh complexity.

Answer

AWS PrivateLink.

Answer

AWS VPN CloudHub.

Answer

VPC Peering.

Question 4

A company is deploying a new application in a VPC with public and private subnets. The application needs to access an S3 bucket in the same AWS Region. Which configuration provides the MOST secure and cost-effective connectivity?

Accepted Answer

Create an S3 Gateway Endpoint in the VPC and add a route to it.. An S3 Gateway Endpoint allows private subnet resources to access S3 over the AWS network without traversing the internet, eliminating the need for a NAT gateway or proxy. This provides the most secure connectivity (no public exposure) and is cost-effective because there are no hourly or data processing charges for the endpoint itself, only standard S3 data transfer costs.

Answer

Configure a proxy server in the public subnet to forward requests to S3.

Answer

Set up an AWS Direct Connect connection to S3.

Answer

Create a NAT gateway in the public subnet and route traffic through it.

Question 5

A company is using AWS Direct Connect with a private VIF to connect to a VPC. They want to ensure high availability by having a second Direct Connect connection. Which configuration provides the most resilient setup?

Accepted Answer

Two Direct Connect connections from different providers to different Direct Connect locations.. Using two Direct Connect connections from different providers to different AWS Direct Connect locations eliminates single points of failure. A single provider outage or location failure will not disrupt connectivity. Option A is incorrect because two connections from the same provider to the same location share the same physical infrastructure, so a single failure can affect both. Option C is incorrect because a Site-to-Site VPN backup typically offers lower bandwidth and higher latency compared to Direct Connect, and it relies on the public internet, which is less reliable than a dedicated connection. Option D is incorrect because two private VIFs on a single Direct Connect connection still share the same physical link; a link failure impacts both VIFs.

Answer

Two Direct Connect connections from the same provider to the same Direct Connect location with separate VIFs.

Answer

One Direct Connect connection and one Site-to-Site VPN as backup.

Answer

One Direct Connect connection with two private VIFs.

Question 6

A company is implementing a hybrid network using AWS Direct Connect and VPN backup. They have multiple VPCs in a single AWS Region. Which design minimizes the number of Direct Connect virtual interfaces while providing connectivity to all VPCs?

Accepted Answer

Create one private VIF attached to a Direct Connect gateway and associate the gateway with all VPCs.. A Direct Connect gateway allows a single private virtual interface (VIF) to connect to multiple VPCs in the same AWS Region. By attaching the Direct Connect gateway to all target VPCs, you eliminate the need for separate private VIFs per VPC, minimizing operational overhead and cost while maintaining private connectivity.

Answer

Set up a transit VPC with EC2-based routers.

Answer

Create a separate private VIF for each VPC.

Answer

Use a single public VIF and route through the internet.

Question 7

A company has a Direct Connect connection with a public VIF to access AWS public services. The on-premises network team reports that they can reach S3 but not DynamoDB. The route table on the customer router shows a default route to the public VIF. What is the most likely cause?

Accepted Answer

The on-premises firewall is blocking outbound traffic to the DynamoDB IP ranges.. A public VIF on Direct Connect provides access to AWS public service endpoints via BGP-advertised AWS prefixes, and S3 and DynamoDB both use public IP ranges reachable through the same public VIF. Since S3 works, the VIF, BGP session, and default route are functioning; the most likely cause is that the on-premises firewall is filtering outbound traffic to DynamoDB's specific public IP ranges (which differ from S3's).

Answer

The Direct Connect connection is degraded and only supports S3 traffic.

Answer

The BGP session between the customer router and AWS is down.

Answer

The VPC route table does not have a route to the DynamoDB endpoint.

Question 8

A company has multiple VPCs across different AWS Regions and wants to enable communication between them using AWS's global network backbone. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Use AWS Transit Gateway with inter-Region peering.. AWS Transit Gateway with inter-Region peering is correct because it allows you to connect multiple VPCs across different AWS Regions using AWS's global network backbone, providing a hub-and-spoke architecture that scales easily. This solution minimizes operational overhead by centralizing routing and eliminating the need to manage individual connections between each VPC, as Transit Gateway automatically handles route propagation and traffic distribution across peered transit gateways.

Answer

Set up AWS Direct Connect connections to each VPC.

Answer

Create VPC peering connections between each pair of VPCs.

Answer

Use AWS Site-to-Site VPN between VPCs.

Question 9

A company is using AWS Site-to-Site VPN connections to connect multiple branch offices to a central VPC. The network team wants to ensure high availability and automatic failover if one VPN tunnel goes down. Which configuration should be implemented?

Accepted Answer

Use the two tunnels provided by the VPN connection with dynamic routing (BGP). Each AWS Site-to-Site VPN connection provides two tunnels for high availability. By using dynamic routing (BGP) with both tunnels, the VPN automatically fails over to the second tunnel if the first goes down, without manual intervention. This meets the requirement for automatic failover and high availability.

Answer

Configure a second VPN connection to the same customer gateway and use BGP with equal-cost multipath

Answer

Use a single tunnel and rely on AWS automatic recovery

Answer

Configure static routes with a higher metric for the secondary tunnel

Question 10

A company has a VPC with public and private subnets. They launch an Amazon RDS for MySQL DB instance in a private subnet. The DB instance needs to be accessible from an on-premises application that connects via an AWS Site-to-Site VPN. What is the MOST secure way to allow the on-premises application to connect to the DB instance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a VPC Gateway Endpoint for S3 and attach a policy allowing access from the private subnets.. A VPC Gateway Endpoint for S3 allows private subnet instances to access S3 over the AWS network without traversing the internet or a NAT gateway, eliminating data transfer costs for the NAT gateway and avoiding internet egress charges. This is the most cost-effective solution because gateway endpoints are free and use prefix lists in the route table to direct traffic to S3 via the AWS backbone.

Answer

Configure an S3 bucket policy that restricts access to the VPC's public IP addresses.

Answer

Route traffic to the NAT gateway and then to the S3 bucket using a VPC peering connection.

Answer

Create a VPC Interface Endpoint for S3 and associate with the private subnets.

Question 11

A company is designing a network for a real-time gaming application that requires the lowest possible latency across AWS Regions. The application uses UDP traffic. Which AWS service should be used to optimize traffic routing?

Accepted Answer

AWS Global Accelerator.. AWS Global Accelerator uses the Anycast IP address concept to route UDP traffic over the AWS global network, minimizing latency by directing traffic to the nearest healthy endpoint. It is specifically designed for real-time applications like gaming that require low latency and jitter, and it supports UDP traffic natively.

Answer

AWS Direct Connect with multiple connections.

Answer

Amazon Route 53 with latency-based routing.

Answer

Amazon CloudFront with custom origins.

Question 12

A company has a Direct Connect connection with a private virtual interface to a VPC. The network team wants to monitor the bandwidth utilization of the Direct Connect connection. They have enabled VPC Flow Logs for the VPC, but the flow logs do not show traffic that traverses the Direct Connect. The team needs a solution to capture the bandwidth usage of the Direct Connect connection. Which solution should they implement?

Accepted Answer

Use CloudWatch metrics for the Direct Connect connection.. Amazon CloudWatch provides native metrics for AWS Direct Connect connections, including ConnectionBpsEgress, ConnectionBpsIngress, ConnectionPpsEgress, and ConnectionPpsIngress, which directly measure bandwidth utilization. VPC Flow Logs capture IP traffic within the VPC but do not record traffic traversing a Direct Connect virtual interface, so CloudWatch metrics are the correct solution.

Answer

Enable AWS CloudTrail for the Direct Connect connection.

Answer

Enable VPC Flow Logs on the Direct Connect virtual interface.

Answer

Use AWS Config rules to monitor bandwidth.

Question 13

A company has a VPC with a CIDR block of 10.0.0.0/16. It has two subnets: subnet A (10.0.1.0/24) and subnet B (10.0.2.0/24). Both subnets have a route to an Internet Gateway. An EC2 instance in subnet A has a security group that allows inbound HTTP from 0.0.0.0/0. The instance's network ACL allows inbound HTTP from 0.0.0.0/0. Users report they cannot access the web server. What is the most likely cause?

Accepted Answer

The instance does not have a public IP address. The most likely cause is that the EC2 instance does not have a public IP address. Even though the security group and network ACL allow inbound HTTP from 0.0.0.0/0, and the subnet has a route to an Internet Gateway (IGW), the instance must have a public IPv4 address (or an Elastic IP) for the IGW to translate its private IP to a public IP and route traffic from the internet. Without a public IP, the IGW cannot forward inbound traffic to the instance, making it unreachable from the internet.

Answer

The network ACL inbound rule is incorrectly configured

Answer

The security group is not associated with the instance

Answer

The route table does not have a route to the Internet Gateway

Question 14

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to add IPv6 connectivity to the VPC and allow resources in a private subnet to access the internet via IPv6. Which design should be used?

Accepted Answer

Allocate an IPv6 CIDR block, create an egress-only Internet Gateway, and add a route to it from the private subnet.. An egress-only Internet Gateway (EIGW) is the correct AWS-managed service for enabling outbound-only IPv6 traffic from a VPC's private subnet to the internet, while preventing any unsolicited inbound connections. Unlike an Internet Gateway (IGW), which allows bidirectional traffic, an EIGW is specifically designed for IPv6 and ensures that resources in private subnets can initiate outbound connections without being directly reachable from the internet.

Answer

Allocate an IPv6 CIDR block and add a route to an Internet Gateway from the private subnet.

Answer

Use a NAT instance with IPv6 support in a public subnet.

Answer

Allocate an IPv6 CIDR block and use a NAT Gateway for IPv6 traffic.

Question 15

A company has a VPC with public and private subnets. They launch an Amazon RDS for MySQL DB instance in a private subnet. The DB instance needs to be accessible from an on-premises application that connects via an AWS Site-to-Site VPN. What is the MOST secure way to allow the on-premises application to connect to the DB instance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

NAT Gateway in each Availability Zone with route tables pointing to the NAT Gateway. D is correct because a NAT Gateway in each Availability Zone provides highly available, automatically scaling outbound internet access for private subnets while blocking unsolicited inbound traffic. NAT Gateways are managed by AWS, scale up to 45 Gbps, and are redundant per AZ, meeting the requirements for high availability and automatic scaling without manual intervention.

Answer

NAT instances in each Availability Zone

Answer

VPC endpoint for S3 and DynamoDB

Answer

Internet Gateway attached to the VPC with route tables pointing to the Internet Gateway

Question 16

A security engineer is designing a VPC with public and private subnets. The company requires that instances in the private subnet can initiate outbound connections to the internet but cannot receive inbound connections from the internet. Which TWO components are necessary? (Choose 2)

Accepted Answer

NAT Gateway in the public subnet. Option C is correct because a NAT Gateway must be deployed in a public subnet (with an Elastic IP) to perform source NAT, allowing private-subnet instances to initiate outbound internet traffic while remaining unreachable from inbound internet connections. Option E is correct because the private subnet's route table must contain a route (typically 0.0.0.0/0) targeting that NAT Gateway so the instances' outbound packets are actually forwarded to it. Option A is incorrect because a VPC Gateway Endpoint for S3 only provides private access to S3, not general internet connectivity. Option B is incorrect because allowing inbound 0.0.0.0/0 would permit inbound internet connections, violating the requirement. Option D is incorrect because an Internet Gateway is attached to a VPC (not a subnet) and is used by public subnets; attaching it to a private subnet would make resources publicly reachable.

Answer

VPC Gateway Endpoint for S3

Answer

Security group allowing inbound traffic from 0.0.0.0/0

Answer

Internet Gateway attached to the private subnet

Question 17

A company has a VPC with multiple subnets. The network ACL for a subnet is configured to deny all inbound traffic. A security group attached to an EC2 instance in that subnet allows SSH from a specific IP range. Will SSH traffic from that IP range reach the instance?

Accepted Answer

No, because the network ACL denies all inbound traffic.. The network ACL is stateless and evaluated before the security group. Since it denies all inbound traffic, packets are dropped at the subnet boundary and never reach the instance, regardless of the security group's permissive rules. Security groups cannot override network ACLs; they operate at different layers and the NACL takes precedence for inbound traffic.

Answer

Yes, because the security group allows SSH.

Answer

Yes, because the security group overrides the network ACL.

Answer

It depends on the rule number order in the network ACL.

Question 18

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to communicate with an on-premises server using an IPsec VPN. The company has set up a Virtual Private Gateway (VGW) and a Customer Gateway (CGW) with a Site-to-Site VPN connection. The VPN tunnel is established. However, the EC2 instance cannot ping the on-premises server. The security groups and network ACLs allow all traffic. What is the most likely cause?

Accepted Answer

The private subnet route table does not have a route for the on-premises CIDR pointing to the VGW. The most likely cause is that the private subnet's route table lacks a route for the on-premises CIDR pointing to the Virtual Private Gateway (VGW). Even though the VPN tunnel is established, traffic from the EC2 instance in the private subnet will be dropped at the subnet level if there is no explicit route directing the on-premises destination to the VGW. Security groups and network ACLs are permissive, so the issue is routing, not filtering.

Answer

The VGW is not configured with the correct BGP ASN

Answer

The VGW is not attached to the VPC

Answer

The VPN tunnel is not in the UP state

Question 19

A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can read objects. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Create an S3 bucket policy with a condition that allows access only from the VPC endpoint.. Option B is correct because an S3 bucket policy can include a condition such as aws:sourceVpce (or aws:sourceVpc) that allows access to the bucket only when requests originate through the specified VPC endpoint, which is the standard way to restrict S3 access to a VPC. Option C is correct because a VPC endpoint policy is an IAM resource policy attached to the gateway endpoint that controls which S3 actions and resources can be accessed through that endpoint, so it must allow the desired read actions on the bucket for traffic to succeed. Together, the bucket policy enforces the VPC-endpoint restriction at the bucket level while the endpoint policy governs what the endpoint permits. Option A is not correct because security groups apply to interface endpoints (and other ENI-based resources), not to S3 gateway endpoints, and security groups do not control S3 bucket access. Option D is not correct because network ACLs operate at the subnet level on IP traffic and cannot identify or allow access based on a VPC endpoint or S3 bucket policy. Option E is not correct because an IAM role grants permissions to an identity, not to a VPC, and does not by itself restrict bucket access to traffic from a specific VPC.

Answer

Assign a security group to the VPC endpoint that allows inbound traffic from the VPC.

Answer

Configure a network ACL on the subnet to deny all inbound traffic except from the VPC.

Answer

Use an IAM role to grant the VPC access to the S3 bucket.

Question 20

A company uses AWS CloudFormation to manage its network infrastructure. After a recent update, the stack fails to update, with an error indicating that a security group rule conflicts with an existing rule. What is the most likely cause?

Accepted Answer

The template attempts to add a security group rule that already exists.. CloudFormation treats each AWS::EC2::SecurityGroupIngress/Egress resource as a distinct object. If the template declares a rule with the same protocol, port range, and source/destination as one already present on the security group (whether added manually or by another stack), the API returns InvalidPermission.Duplicate and the stack update rolls back. The fix is to import the existing rule or remove the duplicate declaration from the template.

Answer

The CIDR block in the rule is not in the same VPC.

Answer

The referenced security group was deleted outside of CloudFormation.

Answer

The stack update exceeded the service quota for security groups.