ANS-C01 Practice Exam 54 — 20 Questions

Question 1

A network engineer is troubleshooting connectivity issues between two VPCs that are peered. The VPCs are in the same region but different accounts. The engineer verifies that the route tables and security group rules are correctly configured. However, instances in VPC A cannot ping instances in VPC B. What is the most likely cause?

Accepted Answer

The route tables in VPC A point to a VPN gateway instead of the VPC peering connection. Option D is correct because VPC peering does not support transitive routing; if traffic goes through a VPN or another VPC, it will not work. Option A is wrong because security groups are stateful and return traffic is allowed. Option B is wrong because NACLs are stateless but can be checked; however, if correctly configured, they would not block. Option C is wrong because the VPC peering connection is established.

Answer

Network ACLs are not configured to allow inbound ICMP

Answer

Security groups are stateful and block return traffic

Answer

The VPC peering connection is in the 'failed' state

Question 2

A company uses AWS Client VPN to provide remote access to its corporate network. Users report that they can connect to the VPN but cannot reach resources in the VPC. The VPN is configured with mutual authentication and authorization rules. What should the network engineer verify first?

Accepted Answer

The authorization rules grant access to the target network. Option B is correct because authorization rules control which groups can access which networks. Option A is incorrect because if the connection succeeds, the security group is not the issue. Option C is incorrect because the client CIDR range does not affect access to VPC resources. Option D is incorrect because the server certificate is for authentication, not routing.

Answer

The security group associated with the VPN endpoint allows inbound traffic from the client CIDR

Answer

The server certificate is valid and trusted by the client

Answer

The client CIDR range does not overlap with the VPC CIDR

Question 3

A company wants to monitor network traffic between its EC2 instances and determine which IP addresses are generating the most traffic. Which AWS service should be used to capture and analyze this traffic?

Accepted Answer

VPC Flow Logs. Option C is correct because VPC Flow Logs capture IP traffic information and can be published to CloudWatch Logs or S3 for analysis. Option A is wrong because CloudTrail records API calls, not network traffic. Option B is wrong because AWS Config records resource configuration changes. Option D is wrong because Trusted Advisor provides best-practice checks, not traffic analysis.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

AWS Config

Question 4

A company has an AWS Direct Connect connection with a private VIF to a VPC. They notice that traffic from the on-premises network to the VPC is being routed through the internet instead of the Direct Connect. The VPC route table has a route pointing to the virtual private gateway for the on-premises CIDR. What is the most likely cause?

Accepted Answer

The on-premises router is not advertising the prefix via BGP over the Direct Connect. Option D is correct because if the on-premises router is advertising the prefix with a community that is not accepted by the Direct Connect BGP peer, the route will not be installed. Option A is incorrect because a more specific route would not cause traffic to go to the internet. Option B is incorrect because the virtual private gateway is the correct target. Option C is incorrect because security groups do not affect routing.

Answer

The virtual private gateway is not attached to the VPC

Answer

The security group on the VPC resources blocks the traffic

Answer

The on-premises CIDR is more specific than the VPC route table entry

Question 5

A company uses AWS Global Accelerator to improve performance for a global application. The application is deployed in two AWS regions behind Network Load Balancers. Users in Asia report high latency even though the accelerator should route them to the nearest endpoint. What is the most likely reason?

Accepted Answer

The endpoint in the closer region is marked unhealthy. Option A is correct because if the endpoints are unhealthy, Global Accelerator will route traffic to the other region. Option B is incorrect because Traffic Dial can shift traffic but does not cause high latency. Option C is incorrect because client affinity does not affect latency. Option D is incorrect because Global Accelerator endpoints are typically in AWS, not on-premises.

Answer

Traffic Dial is set to 100% for the distant region

Answer

The accelerator is configured with on-premises endpoints

Answer

Client affinity is set to source IP

Question 6

A network engineer is monitoring network traffic using VPC Flow Logs. The engineer wants to capture traffic that is rejected by security groups and network ACLs. Which flow log format should be used?

Accepted Answer

Custom format with 'action' field. Option D is correct because the default format includes only the first 20-30 bytes of the packet, not the action field. To capture rejections, the custom format must include 'action'. Option A is incorrect because the default format omits action. Option B is incorrect because the default format does not include it. Option C is incorrect because DNS is not involved.

Answer

Default format

Answer

Flow logs are delivered to CloudWatch Logs with DNS query logs

Answer

Custom format with 'srcaddr' and 'dstaddr' only

Question 7

Which TWO configuration steps are required to enable VPC Flow Logs to be published to an S3 bucket in a different AWS account? (Select TWO.)

Accepted Answer

Attach a resource-based policy to the S3 bucket that grants the source account's Flow Logs service permission to write.. For cross-account flow logs, you need an IAM role in the source account that the Flow Logs service can assume, and that role must have permissions to write to the destination bucket. Additionally, the S3 bucket policy must grant the source account (or the role) the necessary permissions.

Answer

Configure the Flow Logs destination as a CloudWatch Logs log group in the source account.

Answer

Create an IAM user in the source account with programmatic access and share the access keys.

Answer

Enable S3 cross-account replication.

Question 8

A company has a VPC with an Application Load Balancer (ALB) in front of EC2 instances. The security group for the ALB allows inbound HTTP traffic from 0.0.0.0/0. The security group for the EC2 instances allows inbound traffic only from the ALB security group. However, the health checks are failing. What is the most likely cause?

Accepted Answer

The EC2 security group does not allow inbound traffic from the ALB security group. Option C is correct because ALB health checks come from the ALB's private IP addresses, which are in the VPC CIDR; the security group must allow traffic from the ALB security group, not from the internet. Option A is wrong because the ALB security group is correct. Option B is wrong because the ALB subnet is not relevant. Option D is wrong because the target group configuration is separate.

Answer

The target group is not configured with the correct health check path

Answer

The ALB is in a private subnet

Answer

The ALB security group does not allow outbound traffic

Question 9

A company is using AWS Transit Gateway with multiple VPCs and Direct Connect Gateway. They want to ensure that traffic between VPCs and on-premises is encrypted. Which TWO solutions can achieve this?

Accepted Answer

Enable MACsec on the Direct Connect connection. Options B and D are correct. A VPN attachment on the Transit Gateway encrypts traffic between the Transit Gateway and on-premises VPN device. MACsec on the Direct Connect connection encrypts traffic at Layer 2. Option A is incorrect because IPsec over a private VIF is not possible; IPsec is used over public VIF or VPN. Option C is incorrect because Transit Gateway does not support IPsec natively. Option E is incorrect because VPC peering does not involve on-premises.

Answer

Use Transit Gateway IPsec VPN to encrypt traffic between VPCs

Answer

Enable IPsec on the private virtual interface

Answer

Use VPC peering with encryption

Question 10

A network engineer is configuring a site-to-site VPN connection between an on-premises network and AWS. The VPN tunnel is established, but traffic is not flowing. Which THREE components should the engineer check?

Accepted Answer

Security group rules on the VPC resources to allow inbound traffic from on-premises. Options A, C, and D are correct. The route table must have a route to the on-premises CIDR via the virtual private gateway. Security groups must allow traffic from on-premises. The on-premises firewall must allow IPsec traffic. Option B is incorrect because the internet gateway is not needed for VPN traffic. Option E is incorrect because NACLs are stateless and usually allow return traffic if outbound is permitted.

Answer

Network ACLs for the subnet to allow return traffic

Answer

Internet Gateway attachment to the VPC

Question 11

A company has a VPC with resources that need to access an S3 bucket in the same region. To minimize latency and avoid internet traffic, which configuration should be used?

Accepted Answer

Create a VPC Gateway Endpoint for S3. Option B is correct because a VPC Gateway Endpoint for S3 provides private connectivity to S3 without internet. Option A is wrong because NAT Gateway is for internet access. Option C is wrong because AWS PrivateLink for S3 is not supported; Gateway Endpoints are used. Option D is wrong because VPC peering does not provide S3 access.

Answer

Use a NAT Gateway in a public subnet and route traffic through it

Answer

Use VPC peering to connect to an S3 bucket

Answer

Create a VPC Interface Endpoint for S3

Question 12

A network engineer is troubleshooting intermittent connectivity issues between an on-premises data center and a VPC over a Direct Connect connection. The engineer reviews the CloudWatch metrics for the virtual interface and sees an increase in 'ConnectionReset' and 'PacketDropRate'. Which TWO actions should the engineer take to resolve the issue? (Choose TWO.)

Accepted Answer

Check the BGP session status and metrics on the virtual interface. Options B and D are correct. B: Checking BGP metrics can reveal route flapping. D: Checking physical layer metrics like light levels and signal strength can identify physical issues. A is wrong because increasing MTU could cause more drops. C is wrong because more routing peers is not directly relevant. E is wrong because VPN bandwidth does not affect Direct Connect.

Answer

Add additional BGP peers to the Direct Connect connection

Answer

Increase the MTU on the virtual interface to 1500

Answer

Increase the bandwidth of the VPN connection as a backup

Question 13

A network engineer is troubleshooting connectivity between two VPCs that are peered. The VPC peering connection is active, and the route tables have appropriate routes. However, instances in VPC A cannot reach instances in VPC B. The security groups in both VPCs allow all traffic. What is the most likely issue?

Accepted Answer

The route tables in both VPCs do not have routes pointing to the peering connection for the other VPC's CIDR. VPC peering does not support transitive routing; if there is an intermediate resource (like a VPN or another VPC) involved, it won't work. But the question doesn't mention that. Another common issue is that the VPC peering connection requires that the route tables of both VPCs have routes to each other's CIDR, and that security groups reference each other's CIDR or security group IDs. Since security groups allow all, the issue might be that the security group rules are not allowing traffic from the peer VPC's CIDR. However, since they allow all, the problem is likely that the instances are in different regions and the peering is intra-region? Actually, VPC peering works across regions but requires appropriate route table entries. The most likely issue is that the route tables are missing the necessary routes. Option A is correct.

Answer

The security groups are not allowing ICMP traffic

Answer

The VPC peering connection is not in the 'active' state

Answer

The instances are in different availability zones

Question 14

A network engineer is diagnosing connectivity issues between an on-premises network and AWS over a Direct Connect connection. The BGP session is established, and the engineer can ping the VPC's private IP addresses. However, TCP connections to EC2 instances are failing. Which TWO actions should the engineer take to identify the issue?

Accepted Answer

Review the security group rules associated with the EC2 instance. Options A and D are correct. Checking the host-based firewall (A) is essential because OS firewalls can block TCP while allowing ICMP. Checking security group rules (D) is also critical because security groups are stateful and may be blocking inbound TCP. Option B is incorrect because the BGP session is established. Option C is incorrect because the VPC route table is likely correct if pings work. Option E is incorrect because MTU issues would affect all traffic.

Answer

Review the VPC route table for the subnet

Answer

Verify the BGP session status

Answer

Check the MTU settings on the Direct Connect virtual interface

Question 15

A company uses AWS Direct Connect with a private VIF to connect to a VPC. The network team wants to monitor the bandwidth utilization of the Direct Connect connection in real time. Which AWS service should be used?

Accepted Answer

Amazon CloudWatch. Option D is correct because CloudWatch provides metrics for Direct Connect connections including bandwidth utilization. Option A is incorrect because VPC Flow Logs capture traffic per interface, not aggregate bandwidth. Option B is incorrect because CloudTrail logs API calls. Option C is incorrect because AWS Config records configuration changes.

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Answer

AWS Config

Question 16

A network engineer is troubleshooting an issue where an EC2 instance launched in VPC vpc-0abcd1234efgh5678 cannot resolve DNS names for other instances using their private DNS names. The VPC has DHCP options set with domain-name-servers=AmazonProvidedDNS. What is the most likely cause?

Accepted Answer

The VPC attribute 'enableDnsHostnames' is set to false. Option B is correct because the command shows that EnableDnsHostnames is false, which means instances do not get DNS hostnames. Option A is incorrect because the DHCP option set is correct. Option C is incorrect because VPC Flow Logs are for network traffic, not DNS. Option D is incorrect because security groups do not affect DNS resolution.

Answer

VPC Flow Logs are not enabled

Answer

The security group on the instances blocks DNS traffic

Answer

The DHCP options set is not using AmazonProvidedDNS

Question 17

A company has a global application deployed across multiple AWS regions. The application uses Application Load Balancers (ALBs) and Auto Scaling groups. The network team wants to route traffic to the nearest region based on latency, and also wants to failover to another region if the primary region becomes unhealthy. Which THREE services should be used together to achieve this? (Choose THREE.)

Accepted Answer

Amazon Route 53 latency-based routing. Options A, B, and D are correct. Route 53 latency routing routes to the region with lowest latency, CloudWatch alarms can monitor health, and Lambda can automate DNS changes for failover. C is wrong because Global Accelerator uses anycast and does not use Route 53 latency routing. E is wrong because CloudFront is for content delivery, not regional failover.

Answer

Amazon CloudFront with origin failover

Answer

AWS Global Accelerator

Question 18

A company has a VPC with public and private subnets. The private subnets need internet access for software updates. The company wants to minimize costs and management overhead. Which solution should they use?

Accepted Answer

Create a NAT gateway in a public subnet and add a route to the private subnet route table pointing to the NAT gateway. Option A is correct because a NAT gateway provides outbound internet access for private subnets with minimal management. Option B is incorrect because a NAT instance requires management. Option C is incorrect because an internet gateway alone does not provide outbound access for private subnets. Option D is incorrect because a VPC endpoint is for specific AWS services, not general internet.

Answer

Use a VPC endpoint for S3 and CloudFront

Answer

Attach an internet gateway to the VPC and add a default route to the private subnet route table pointing to the internet gateway

Answer

Launch a NAT instance on an EC2 instance in a public subnet

Question 19

An engineer is trying to create a VPC Flow Log that delivers to a CloudWatch Logs log group in the same account. The IAM role used has the above trust policy. However, the flow log creation fails with an error. What is the most likely reason?

Accepted Answer

The IAM role lacks a permissions policy that grants the actions on the log group.. The trust policy shown trusts the VPC Flow Logs service principal, but the IAM role itself must have a permissions policy that allows the actions on the log group. The exhibit only shows the trust policy; the permissions policy is missing. The error likely indicates that the role does not have the necessary permissions to perform the actions.

Answer

The log group does not exist yet.

Answer

The trust policy incorrectly specifies the service principal; it should be 'ec2.amazonaws.com'.

Answer

The resource ARN in the trust policy does not include the log group name.

Question 20

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team wants to monitor the amount of data transferred between VPCs for cost allocation. Which AWS feature should they use?

Accepted Answer

VPC Flow Logs for each VPC.. Option B is correct because VPC Flow Logs can be published to CloudWatch Logs or S3 and provide network traffic logs that include source/destination IP, ports, and byte counts, which can be used for cost allocation. Option A is wrong because CloudWatch Metrics for Transit Gateway only show aggregate metrics like bytes in/out per attachment, not per-flow. Option C is wrong because AWS Config records resource configuration changes, not traffic. Option D is wrong because CloudTrail records API calls.

Answer

CloudWatch Metrics for Transit Gateway.

Answer

AWS Config rules.

Answer

AWS CloudTrail logs.