ANS-C01 Practice Exam 59 — 20 Questions

Question 1

A company is deploying a latency-sensitive trading application that must distribute traffic across endpoints in us-east-1 and eu-west-1. The application uses TCP on port 443 and requires static anycast IP addresses that clients can allowlist. The company also wants automatic failover if an endpoint becomes unhealthy, without relying on DNS caching behavior. Which AWS service should the network engineer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Global Accelerator with an accelerator and endpoint groups in both Regions. AWS Global Accelerator is designed for latency-sensitive TCP and UDP workloads that need static anycast IP addresses and fast, DNS-independent failover. The accelerator provides two static IPs that can be allowlisted, and endpoint groups in us-east-1 and eu-west-1 allow health-based traffic shifting. Route 53 and CloudFront depend on DNS and do not offer static anycast addresses, and Regional Network Load Balancer IPs are not anycast.

Answer

Amazon Route 53 latency-based routing with health checks and a short TTL

Answer

Network Load Balancers in each Region with Route 53 multivalue answer routing

Answer

Amazon CloudFront with origin groups and Lambda@Edge for failover

Question 2

A company has a VPC with a CIDR block of 10.0.0.0/16. The company wants to add a second CIDR block of 10.1.0.0/16 to the VPC to support additional workloads. The company also has an AWS Direct Connect connection to its on-premises network, which uses the 10.1.0.0/16 range for its own internal services. The company needs to ensure that traffic from the VPC to on-premises does not conflict with the new VPC CIDR. Which action should the network engineer take before associating the new CIDR block?

Accepted Answer

Ensure the new CIDR block does not overlap with the existing VPC CIDR or the on-premises 10.1.0.0/16 range, and if it does, choose a different non-overlapping CIDR block.. VPC CIDR blocks must be unique and non-overlapping with each other and with any networks reachable over Direct Connect or VPN. If the new CIDR overlaps with the on-premises 10.1.0.0/16 range, BGP will not advertise the overlapping routes correctly, causing connectivity failures. The engineer must select a non-overlapping CIDR block before associating it with the VPC.

Answer

Verify that the new CIDR block does not overlap with any existing VPC CIDR blocks, and then associate it. Overlap with on-premises is not a concern because Direct Connect uses BGP.

Answer

Associate the new CIDR block and then use AWS Resource Access Manager to share the overlapping range with the on-premises network.

Answer

Associate the new CIDR block and create a route table entry that specifically routes the overlapping range to a blackhole.

Question 3

A company is designing a VPC peering architecture between three VPCs: VPC A (10.0.0.0/16), VPC B (10.1.0.0/16), and VPC C (10.2.0.0/16). VPC A must communicate with both VPC B and VPC C, but VPC B and VPC C must not communicate with each other. The company wants to minimize the number of peering connections and avoid transitive routing. Which peering topology should the network engineer implement?

Accepted Answer

Hub-and-spoke peering with VPC A as the hub, and VPC B and VPC C as spokes.. In a hub-and-spoke peering topology with VPC A as the hub, only two peering connections are needed: A-B and A-C. Because VPC peering does not support transitive routing, VPC B cannot reach VPC C through VPC A. This satisfies the requirements to minimize peering connections and prevent B-C communication. Full mesh, VPN, or transit gateway solutions either add unnecessary connections or do not align with the peering architecture requirement.

Answer

A single peering connection between VPC A and VPC B, and a VPN connection between VPC A and VPC C.

Answer

Full mesh peering between all three VPCs, with route tables in VPC B and VPC C that block traffic to each other.

Answer

A transit gateway with VPC A, VPC B, and VPC C attached, and route tables that prevent B and C from communicating.

Question 4

A gaming company runs a UDP-based real-time multiplayer service behind a Network Load Balancer in a single AWS Region. Players connect from around the world, and the company wants to reduce connection latency and improve availability by directing players to the closest healthy endpoint. The company also wants to avoid managing its own global DNS health-check logic. Which solution should a network engineer recommend?

Accepted Answer

Create an AWS Global Accelerator accelerator with endpoint groups in multiple Regions, and add the Network Load Balancer as an endpoint in each group.. AWS Global Accelerator is designed for UDP and TCP workloads that need low-latency global entry points and fast regional failover. It uses anycast IP addresses to bring player traffic onto the AWS backbone at the nearest edge, and endpoint groups with health checks direct traffic to healthy Network Load Balancer endpoints in multiple Regions. DNS-based options do not optimize the data path or provide the same failover behavior.

Answer

Create a Route 53 multivalue answer record with health checks that returns the Network Load Balancer IP addresses in each Region.

Answer

Create an Amazon Route 53 latency-based routing record with health checks for each Region and point it to the Network Load Balancer.

Answer

Deploy an Amazon CloudFront distribution with a custom origin pointing to the Network Load Balancer and enable WebSocket support.

Question 5

A company is planning to use AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network engineer must ensure that traffic between specific VPC attachments is isolated and that routing is deterministic. Which TWO configuration steps are required to achieve this? (Choose two.)

Accepted Answer

Create a separate transit gateway route table for each isolated group and propagate routes only from the desired attachments.. To isolate traffic between VPC attachments on a transit gateway, you must associate each attachment with a specific route table and control route propagation. By creating separate route tables and only propagating routes from the desired attachments, you ensure that each VPC only learns routes to permitted destinations. This provides deterministic routing and isolation. ECMP, internet gateway attachments, and RAM sharing do not address the isolation requirement.

Answer

Configure AWS Resource Access Manager (RAM) to share the transit gateway with other accounts.

Answer

Attach an internet gateway to the transit gateway to allow internet access.

Answer

Enable equal-cost multi-path (ECMP) routing on the transit gateway to load balance traffic.

Question 6

A company has a VPC with a CIDR block of 10.0.0.0/16. They have a subnet in each of three Availability Zones. They need to deploy a Network Load Balancer (NLB) that will handle TCP traffic on port 443. The NLB must be able to fail over automatically if an Availability Zone becomes unavailable. The company also wants to minimize latency by ensuring that clients in each AZ are routed to targets in the same AZ. Which configuration should be implemented?

Accepted Answer

Create an NLB with one subnet in each Availability Zone, disable cross-zone load balancing, and register targets in all three AZs.. To achieve low latency and high availability, the NLB should be deployed with subnets in multiple Availability Zones and have cross-zone load balancing disabled. This ensures that each NLB node routes traffic only to targets in its own AZ, minimizing cross-AZ latency. If an AZ fails, the NLB nodes in the remaining AZs continue to operate, and targets in those AZs handle the traffic. Registering targets in all AZs ensures that each AZ has local targets to serve requests.

Answer

Create an NLB with subnets in only one Availability Zone and register targets in all three AZs.

Answer

Create an NLB with one subnet in each Availability Zone, enable cross-zone load balancing, and register targets in only one AZ.

Answer

Create an NLB with one subnet in each Availability Zone, enable cross-zone load balancing, and register targets in all three AZs.

Question 7

A company runs a two-tier application in a VPC. The web tier sits in an Auto Scaling group across three Availability Zones, and the database tier runs on EC2 instances in a separate subnet. The security team requires that the database tier accept connections only from the web tier, and that the web tier be reachable from the internet on TCP 443. A network engineer must design the security group configuration. Which combination of security group rules meets these requirements with the LEAST administrative overhead?

Accepted Answer

Create one security group for the web tier allowing inbound TCP 443 from 0.0.0.0/0, and a separate security group for the database tier allowing inbound TCP 3306 with the web tier's security group ID as the source. Attach each group to its respective tier.. Security groups can reference other security groups as a source, which authorizes the group's members by identity rather than by address. Since the web tier is an Auto Scaling group whose instance addresses change, the group-reference rule is the only approach that satisfies the restriction to the web tier while requiring no ongoing rule maintenance as instances scale in and out.

Answer

Create one security group for the web tier allowing inbound TCP 443 from 0.0.0.0/0, and a database security group allowing inbound TCP 3306 from an AWS-managed prefix list for the Region. Attach each group to its respective tier.

Answer

Create one security group for the web tier allowing inbound TCP 443 from 0.0.0.0/0, and a database security group allowing inbound TCP 3306 from the web tier's subnet CIDR blocks. Attach each group to its respective tier.

Answer

Create one security group for the web tier allowing inbound TCP 443 from 0.0.0.0/0, and a database security group allowing inbound TCP 3306 from the VPC CIDR range. Attach each group to its respective tier.

Question 8

A company operates a VPC with a CIDR block of 10.0.0.0/16 and an on-premises data center using 10.1.0.0/16. The company attaches a virtual private gateway to the VPC and creates a Site-to-Site VPN connection over the internet. The on-premises router advertises 10.1.0.0/16 over BGP, and the VPN tunnel comes up. Instances in the VPC can ping the on-premises router's tunnel address, but cannot reach any on-premises application servers behind that router. Routes for 10.1.0.0/16 appear in the VPC route table pointing at the virtual private gateway. What is the MOST likely cause?

Accepted Answer

The on-premises network is not advertising the application server subnets over BGP, or those subnets fall outside the advertised 10.1.0.0/16 summary.. BGP reachability to the tunnel endpoint only proves the control plane and IPsec are functioning. End-to-end access to application servers depends on the on-premises router advertising the prefixes that contain those servers, or on a summary prefix that encompasses them, so that the VPC route table receives a usable route.

Answer

The VPC security group attached to the instances does not permit outbound ICMP to the on-premises ranges, so replies are blocked.

Answer

The VPN connection is using a single tunnel, and AWS only forwards traffic over the second tunnel when both are established.

Answer

The virtual private gateway requires a static route for 10.1.0.0/16 in addition to the propagated BGP route before traffic can be forwarded.

Question 9

A company is deploying AWS Transit Gateway to connect 30 VPCs and two on-premises sites over AWS Direct Connect. The network team wants to segment routing so that production VPCs can reach shared services while development VPCs cannot reach production, and both environments can reach on-premises. Which TWO transit gateway features should the team use to satisfy these routing requirements? (Choose two.)

Accepted Answer

Use transit gateway route table associations and propagations to prevent development route propagation into the production route table.. Segmentation on a transit gateway is achieved through route table associations and propagations. Distinct route tables per environment, with each attachment associated to the correct table and only the intended routes propagated into it, let both environments reach shared services and on-premises while keeping development traffic out of production.

Answer

Enable transit gateway appliance mode on the Direct Connect attachment so that traffic between environments is inspected before forwarding.

Answer

Attach a VPN connection to the transit gateway for each environment and use BGP communities to separate the routing domains.

Answer

Configure transit gateway peering between the production and development attachments to filter routes at the peering boundary.

Question 10

A company is deploying a global application that uses Amazon Route 53 for DNS. They have resources in multiple AWS Regions and want to route users to the closest healthy endpoint. The company also needs to comply with data sovereignty requirements that require certain users to be routed to a specific Region regardless of latency. Which two Route 53 routing policies should be combined to meet these requirements? (Choose two.)

Accepted Answer

Latency-based routing. Latency-based routing sends users to the lowest-latency Region, satisfying the closest healthy endpoint requirement. Geolocation routing sends users to a specific Region based on their geographic location, satisfying data sovereignty. Together, they can be used in a hierarchical DNS design where geolocation takes precedence for certain users, and latency-based routing handles the rest.

Answer

Multivalue answer routing

Answer

Weighted routing

Answer

Failover routing

Question 11

A company has a VPC with a CIDR block of 10.0.0.0/16. They want to connect this VPC to their on-premises network, which uses the CIDR block 192.168.0.0/16. They set up an AWS Site-to-Site VPN connection with a virtual private gateway (VGW). After configuring the VPN, they find that instances in the VPC cannot reach servers in the on-premises network. The VPN tunnel status is UP, but no traffic flows. What is the most likely cause?

Accepted Answer

The VPC route table does not have a route for the on-premises CIDR block pointing to the virtual private gateway.. The most likely cause is that the VPC route table lacks a route for the on-premises CIDR block pointing to the virtual private gateway. Without this route, instances in the VPC cannot send traffic to the on-premises network. The VPN tunnel being UP indicates that the IPsec and BGP sessions are established, so the problem is likely a routing configuration issue in the VPC.

Answer

The security group on the EC2 instances does not allow outbound traffic to the on-premises CIDR block.

Answer

The on-premises router does not have a route back to the VPC CIDR block over the VPN tunnel.

Answer

The VPN connection is using dynamic routing with BGP, but the ASN numbers do not match.

Question 12

A company is deploying a new application in a VPC. The application requires a fixed, public IP address that does not change, and the company wants to avoid managing a load balancer. The application runs on a single EC2 instance. Which AWS service or feature should they use to assign a static public IP to the instance?

Accepted Answer

Assign an Elastic IP address to the EC2 instance.. An Elastic IP address is a static public IPv4 address that can be associated with an EC2 instance. It remains fixed even if the instance is stopped and started, providing a consistent public endpoint. This is the simplest and most cost-effective solution for a single instance requiring a static public IP, without the need for a load balancer.

Answer

Configure the EC2 instance to use a public IP address from the subnet's CIDR block.

Answer

Use an Application Load Balancer with a fixed IP address.

Answer

Use a Network Load Balancer with an Elastic IP address.

Question 13

A company has a VPC with a CIDR block of 172.31.0.0/16 and a single subnet 172.31.1.0/24 in which all EC2 instances reside. The company needs to add a new subnet to the VPC to support a separate application tier. A network engineer attempts to create a subnet with CIDR block 172.31.1.128/25 but receives an error that the CIDR block conflicts with an existing subnet. Which action should the engineer take to successfully create the new subnet?

Accepted Answer

Create the new subnet with CIDR block 172.31.2.0/24, which does not overlap with any existing subnet.. Subnets within a VPC must not overlap. The existing subnet 172.31.1.0/24 encompasses the entire range from 172.31.1.0 to 172.31.1.255, so any CIDR block within that range, such as 172.31.1.128/25 or 172.31.1.0/25, will conflict. Choosing a different non-overlapping block within the VPC CIDR, such as 172.31.2.0/24, is the correct approach. Deleting and recreating the existing subnet is disruptive and unnecessary, and 172.31.1.128/24 is invalid due to CIDR alignment rules.

Answer

Create the new subnet with CIDR block 172.31.1.128/24, which uses a larger prefix to avoid conflict.

Answer

Create the new subnet with CIDR block 172.31.1.0/25, which splits the existing subnet into two smaller subnets.

Answer

Delete the existing subnet 172.31.1.0/24 and recreate it with a smaller CIDR block, then create the new subnet with 172.31.1.128/25.

Question 14

A solutions architect is designing a VPC that must provide outbound internet access for instances in private subnets without assigning public IPv4 addresses. The architecture must be highly available across two Availability Zones and must not allow inbound connections from the internet. Which combination of components should the architect use?

Accepted Answer

A NAT gateway in each Availability Zone's public subnet, with private subnet route tables pointing to the NAT gateway in the same Availability Zone.. Instances in private subnets need a NAT device in a public subnet to reach the internet without public IPv4 addresses. A NAT gateway per Availability Zone, referenced by the route table of the private subnets in the same zone, meets the outbound-only and high availability requirements while avoiding cross-zone dependency.

Answer

A NAT instance in one private subnet with an Elastic IP, and a single route in all private subnet route tables pointing to that instance.

Answer

An internet gateway attached to the VPC and a route in the private subnet route tables pointing to the internet gateway.

Answer

A VPC peering connection to a shared services VPC that has an internet gateway, and a route in the private subnet route tables to the peering connection.

Question 15

A company is deploying a web application in a VPC. The application instances are in a private subnet and must be accessible from the internet via an Application Load Balancer (ALB). The ALB must be in public subnets. The company wants to ensure that the instances are not directly accessible from the internet and that outbound internet access for software updates is available. Which combination of components should be used?

Accepted Answer

Place the ALB in public subnets, the instances in private subnets, and configure a NAT gateway in a public subnet for outbound internet access.. The correct architecture uses public subnets for the internet-facing ALB and a NAT gateway, and private subnets for the application instances. The ALB distributes incoming traffic to the instances, while the NAT gateway allows the instances to initiate outbound internet connections for updates. This design isolates the instances from direct internet access and provides the necessary outbound connectivity.

Answer

Place the ALB in private subnets, the instances in public subnets, and use an internet gateway for outbound access.

Answer

Place the ALB in public subnets, instances in private subnets, and configure an internet gateway in the private subnet for outbound access.

Answer

Place both the ALB and instances in public subnets, and use a NAT gateway for outbound access.

Question 16

A company runs a critical web application in a VPC that spans three Availability Zones. The application must be highly available and support millions of concurrent TCP connections. The network team needs to distribute traffic across EC2 instances while preserving the client source IP address for logging and security analysis. Which AWS load balancer should they use?

Accepted Answer

Network Load Balancer (NLB). The Network Load Balancer is the correct choice because it operates at layer 4, preserves the client source IP address, and is built to handle millions of concurrent TCP connections with low latency. It also supports cross-zone load balancing and high availability across multiple Availability Zones, directly addressing the application's requirements.

Answer

Classic Load Balancer (CLB)

Answer

Application Load Balancer (ALB)

Answer

Gateway Load Balancer (GWLB)

Question 17

A company has an AWS Site-to-Site VPN connection between its on-premises data center and a VPC. The VPN uses a virtual private gateway (VGW) and dynamic BGP routing. The on-premises router advertises 172.16.0.0/16, and the VPC advertises 10.0.0.0/16. The company wants to ensure that if the primary VPN tunnel fails, traffic automatically fails over to the secondary tunnel within seconds, without manual intervention. The on-premises router supports BGP and is configured with both tunnels as neighbors. What should the network engineer verify to meet this requirement?

Accepted Answer

That the BGP hold time and keepalive timers on both the on-premises router and the AWS VPN endpoints are tuned so that a dead tunnel is detected quickly and its routes are withdrawn.. For a Site-to-Site VPN with dynamic BGP routing, failover between tunnels depends on how quickly the on-premises router detects that the primary tunnel is down. BGP hold time and keepalive timers control this detection. Tuning them on both the customer gateway and the AWS VPN endpoints ensures that a failed tunnel's routes are withdrawn promptly, allowing the secondary tunnel to take over automatically within seconds.

Answer

That the on-premises router is configured with BGP graceful restart and that both tunnels are in the same BGP peer group.

Answer

That the VGW is configured with a higher BGP weight for the secondary tunnel and that the on-premises router uses the same autonomous system number for both tunnels.

Answer

That the VGW is advertising the VPC CIDR with a higher BGP local preference on the secondary tunnel than on the primary tunnel.

Question 18

A network engineer is deploying an Application Load Balancer (ALB) in front of a fleet of EC2 instances in private subnets. The ALB must be reachable from the internet, and the instances must never receive traffic directly from the internet. The engineer has created public subnets in two Availability Zones. Which configuration is correct?

Accepted Answer

Place the ALB nodes in the public subnets, place the EC2 instances in the private subnets, and configure the instance security group to allow traffic only from the ALB security group.. Internet-facing ALB nodes must live in public subnets with a route to an internet gateway, while backend targets stay in private subnets. Restricting the instance security group to accept traffic only from the ALB security group enforces that clients cannot bypass the load balancer, satisfying both reachability and isolation.

Answer

Place the ALB nodes in the private subnets, create a Network Load Balancer in the public subnets, and chain the NLB to the ALB as its target.

Answer

Place the ALB nodes in the private subnets and attach an Elastic IP to each ALB node so that internet clients can reach the load balancer directly.

Answer

Place the ALB nodes in the public subnets and place the instances in the same public subnets, relying on the instance security group to block all inbound traffic except from the ALB.

Question 19

A network engineer is designing a VPC that will host a fleet of EC2 instances needing to reach both Amazon S3 and an on-premises database over AWS Direct Connect. The S3 traffic must never traverse the public internet, and the on-premises traffic must use a private virtual interface (VIF). The engineer creates a gateway VPC endpoint for S3 and a private VIF with a virtual private gateway (VGW). After deployment, instances in the private subnet can reach S3 but cannot reach the on-premises database. Route tables show the S3 prefix list pointing to the gateway endpoint and a propagated route to the on-premises CIDR via the VGW. What is the MOST likely cause of the connectivity failure to the on-premises database?

Accepted Answer

The on-premises router is not advertising the database subnet over BGP to the VGW, so the route is present but the return path is missing.. When a propagated BGP route to an on-premises CIDR appears in a VPC route table but connectivity still fails, the missing piece is usually the reverse advertisement from the customer edge router. The VGW will install whatever it learns, so a route's presence does not validate bidirectional reachability. Confirming the on-premises device advertises the database subnet, and that no route map filters it, resolves this class of asymmetric routing failure.

Answer

The gateway VPC endpoint for S3 is overriding the propagated VGW route because prefix lists take precedence over BGP-propagated routes.

Answer

The security group on the EC2 instances is blocking outbound traffic to the on-premises CIDR range.

Answer

The private VIF must be associated with a Direct Connect gateway instead of a VGW to carry traffic to on-premises networks.

Question 20

A company has an on-premises data center connected to AWS over a 10 Gbps AWS Direct Connect dedicated connection. The network team needs to advertise a summary route of 172.16.0.0/16 to AWS while also ensuring that a more specific 172.16.5.0/24 prefix is preferred for a migration cutover. The on-premises router supports BGP. Which approach should the engineer use?

Accepted Answer

Advertise both 172.16.0.0/16 and 172.16.5.0/24 from the on-premises router over the same BGP session; AWS will prefer the more specific prefix for matching destinations.. BGP forwarding decisions use the longest matching prefix before comparing path attributes, so advertising both the aggregate and the more specific prefix naturally sends 172.16.5.0/24 traffic over the specific route. This supports a staged migration cutover while keeping the summary for all other destinations.

Answer

Use a Direct Connect gateway with a transit virtual interface and advertise 172.16.0.0/16 only, because a transit VIF does not support more specific prefix advertisements.

Answer

Advertise only 172.16.0.0/16 and rely on AS_PATH prepending on the more specific prefix to make AWS prefer 172.16.5.0/24.

Answer

Advertise 172.16.0.0/16 with a longer AS_PATH and 172.16.5.0/24 with a shorter AS_PATH to force the specific prefix to be preferred.