ANS-C01 Practice Exam 60 — 20 Questions

Question 1

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to add a second CIDR block to the VPC to accommodate additional subnets. The new CIDR block must not overlap with the existing one. Which action should a network engineer take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Associate a new CIDR block with the VPC using the AWS Management Console or AWS CLI.. To add a second CIDR block to an existing VPC, you associate a new CIDR block with the VPC. This is a supported operation in AWS. The new block must not overlap with any existing CIDR block in the VPC or with any routes in your route tables. Other options either create separate VPCs or attempt unsupported modifications.

Answer

Use AWS Direct Connect to advertise the new CIDR block to the VPC.

Answer

Modify the existing VPC CIDR block to a larger range that includes the additional addresses.

Answer

Create a new VPC with the desired CIDR block and peer it with the existing VPC.

Question 2

A network engineer is designing a VPC that will host a latency-sensitive trading application. The application requires that traffic between two EC2 instances in different subnets within the same Availability Zone never leave the physical hardware of that Availability Zone, and that the instances use enhanced networking with the lowest possible jitter. Which combination of instance configuration and placement should the engineer choose?

Accepted Answer

Launch the instances with Elastic Network Adapter (ENA) enabled and place them in a cluster placement group within the same Availability Zone.. Enhanced networking with ENA reduces latency and jitter, and a cluster placement group packs instances tightly within a single Availability Zone so that traffic stays on low-latency local hardware. This combination is the standard choice for latency-sensitive workloads that must remain within one AZ.

Answer

Launch the instances with ENA enabled and place them in a partition placement group spanning multiple Availability Zones.

Answer

Launch the instances with the Intel 82599 Virtual Function interface and place them in a spread placement group across three Availability Zones.

Answer

Launch the instances with ENA enabled and place them in a spread placement group within a single Availability Zone.

Question 3

A network engineer is configuring a VPC peering connection between two VPCs in different AWS accounts. The VPCs have non-overlapping CIDR blocks. The engineer needs to ensure that instances in both VPCs can communicate. Which additional configuration is required after the peering connection is accepted?

Accepted Answer

Update the route tables in both VPCs to route traffic destined for the other VPC's CIDR block to the peering connection.. After accepting a VPC peering connection, you must add routes in both VPCs' route tables to direct traffic for the peer VPC's CIDR block to the peering connection. Additionally, security groups and network ACLs must permit the traffic. The other options involve services that are not used for VPC peering and would not enable the required communication.

Answer

Attach an internet gateway to both VPCs and route traffic through it.

Answer

Create a VPN connection between the two VPCs to enable communication.

Answer

Configure a NAT instance in each VPC to translate traffic between the VPCs.

Question 4

A solutions architect is deploying a latency-sensitive application that requires a static IP address per Availability Zone and must preserve the source IP address of clients when forwarding traffic to backend instances. The backend instances are in an Auto Scaling group spread across three Availability Zones, and the application must handle millions of requests per second with extreme low latency. Which load balancer configuration meets these requirements?

Accepted Answer

A Network Load Balancer with one Elastic IP per Availability Zone and client IP preservation enabled.. A Network Load Balancer provides static Elastic IP addresses per Availability Zone and preserves client source IP addresses by default, while operating at Layer 4 for extremely high throughput and low latency. These characteristics align exactly with the static IP, source IP preservation, and performance constraints. Other load balancer types either lack static IP support or are intended for different traffic patterns.

Answer

An Application Load Balancer with cross-zone load balancing enabled and a static Elastic IP per subnet.

Answer

A Gateway Load Balancer with a private IP per Availability Zone and source IP preservation disabled.

Answer

A Classic Load Balancer with an Elastic IP attached to each backend instance.

Question 5

A network engineer is designing a VPC that uses AWS PrivateLink to expose an internal service to consumers in other VPCs. The service runs behind a Network Load Balancer in the provider VPC. The engineer must ensure that consumers can reach the service without VPC peering, and that the provider retains control over which accounts can connect. Which two actions should the engineer take? (Choose two.)

Accepted Answer

Accept the connection request from each consumer account in the endpoint service configuration.. To publish a service with AWS PrivateLink, the provider creates a VPC endpoint service configuration that references the Network Load Balancer. Consumers then create interface VPC endpoints in their own VPCs. If the service is not configured to auto-accept, the provider must accept each connection request, which gives the provider control over which accounts can connect. These two actions together enable private, controlled access without VPC peering.

Answer

Create an interface VPC endpoint in the provider VPC for the service.

Answer

Add a route in the consumer VPC route table pointing to the Network Load Balancer's private IP address.

Answer

Attach an internet gateway to the provider VPC and configure the NLB as internet-facing.

Question 6

A company has a VPC with a CIDR block of 10.0.0.0/16 and an on-premises network using 10.1.0.0/16. They establish an AWS Site-to-Site VPN connection to a virtual private gateway. The on-premises firewall allows only specific protocols. A network engineer notices that traffic from on-premises to a private EC2 instance fails, but traffic between EC2 instances in different subnets works. The VPN tunnel status is UP. Which action should the engineer take first to diagnose the issue?

Accepted Answer

Verify that the route table for the subnet associated with the EC2 instance has a route to 10.1.0.0/16 pointing to the virtual private gateway.. The most likely cause is a missing route in the subnet's route table for the on-premises CIDR pointing to the virtual private gateway. Even with the VPN tunnel up, without this route the VPC does not know how to send return traffic to the on-premises network. Verifying the route table is the correct first step.

Answer

Confirm that the customer gateway device is configured with the correct BGP ASN.

Answer

Ensure that the VPC has an internet gateway attached and that the subnet is public.

Answer

Check the security group on the EC2 instance to ensure it allows traffic from 10.1.0.0/16.

Question 7

A company wants to provide internet access to instances in a private subnet without assigning public IP addresses to those instances. The instances must be able to initiate outbound connections to the internet but must not be reachable from the internet. Which component should the network engineer configure?

Accepted Answer

A NAT gateway in a public subnet, with the private subnet route table pointing 0.0.0.0/0 to the NAT gateway.. A NAT gateway placed in a public subnet gives private instances outbound internet access by translating their source addresses, while remaining unreachable from the internet. Directing the private subnet's default route to that NAT gateway is the intended design for the stated requirement.

Answer

A virtual private gateway with a Site-to-Site VPN connection, and the private subnet route table pointing 0.0.0.0/0 to the virtual private gateway.

Answer

An internet gateway attached to the VPC, with the private subnet route table pointing 0.0.0.0/0 to the internet gateway.

Answer

A Gateway Load Balancer endpoint in the private subnet, with the private subnet route table pointing 0.0.0.0/0 to the endpoint.

Question 8

A network engineer is deploying a new VPC and needs instances in a private subnet to reach the public AWS Systems Manager service endpoints without traversing the internet or a NAT gateway. The VPC has no internet gateway attached. The engineer creates interface VPC endpoints for ssm, ssmmessages, and ec2messages in the private subnet, but the instances still cannot register with Systems Manager. Security groups and route tables have been verified as correct, and the endpoint ENIs show an available state. Which additional configuration is required for the interface endpoints to function?

Accepted Answer

Enable Private DNS names for the interface endpoints in the VPC.. Interface endpoints for Systems Manager require Private DNS to be enabled so the SSM agent's calls to the standard service hostnames resolve to the endpoint ENIs inside the VPC. Without it, DNS still returns public addresses and the agent's traffic has no path in an internet-free VPC. Enabling Private DNS completes the private connectivity design without adding internet egress.

Answer

Add a gateway endpoint for ssm and associate it with the private subnet route table.

Answer

Attach an internet gateway to the VPC and add a route to it from the private subnet.

Answer

Create a NAT gateway in a public subnet and update the private subnet route table.

Question 9

A network engineer is configuring a Network Load Balancer (NLB) to distribute traffic to a target group of EC2 instances. The instances must receive the original client IP address for logging and security purposes. The NLB is internet-facing and uses TCP listeners. Which configuration should the engineer implement to preserve the client IP address?

Accepted Answer

Ensure the target group is configured with the instance target type and that client IP preservation is enabled (default for instance targets).. For a Network Load Balancer with an instance target group, client IP preservation is enabled by default. This allows the backend EC2 instances to see the original client IP address as the source IP of the connection. No proxy protocol or additional headers are required, and the application can use the source IP directly for logging and security decisions.

Answer

Enable proxy protocol v2 on the NLB target group, and configure the application to parse the proxy protocol header.

Answer

Configure the target group to use the instance target type and disable client IP preservation, then use X-Forwarded-For headers.

Answer

Create an Application Load Balancer in front of the NLB and enable X-Forwarded-For headers to capture the client IP.

Question 10

A company is using AWS Direct Connect to connect their on-premises network to a VPC. They have a private virtual interface (VIF) with a BGP session. The company wants to advertise a summary route of 192.168.0.0/16 to AWS instead of individual /24 routes. Which action should they take?

Accepted Answer

Configure the customer gateway to advertise the summary route 192.168.0.0/16 over the BGP session.. To advertise a summary route over Direct Connect, you configure the customer gateway to advertise the aggregate prefix via BGP. This reduces the number of routes AWS learns and simplifies routing. The other options do not achieve this because they involve VPC route tables or unrelated services.

Answer

Create a static route in the VPC route table for 192.168.0.0/16 pointing to the virtual private gateway.

Answer

Use AWS Resource Access Manager to share the summary route with the VPC.

Answer

Enable route propagation on the virtual private gateway for the summary route.

Question 11

A company is deploying a new application in a VPC that uses an AWS Network Load Balancer (NLB) to distribute TCP traffic to targets in multiple Availability Zones. The security team requires that the source IP address of the client is preserved for logging and access control. The NLB is configured with an IP target group containing EC2 instances. Which configuration change should the network engineer make to ensure client IP preservation?

Accepted Answer

Ensure that the target group's client IP preservation attribute is enabled, which is the default for IP targets.. Network Load Balancers with IP targets preserve the client IP address by default. The client IP preservation attribute is automatically enabled for IP target groups, so no extra configuration is required. This allows the application to see the original client IP for logging and access control.

Answer

Configure the NLB to use a TLS listener with a certificate, which automatically preserves the client IP address.

Answer

Enable proxy protocol v2 on the NLB target group and configure the application to parse the proxy protocol header.

Answer

Disable client IP preservation on the target group, which forces the NLB to use the client IP address.

Question 12

A network engineer is designing a hybrid architecture in which an on-premises data center connects to a VPC using AWS Site-to-Site VPN over the internet. The security team requires that traffic between on-premises and AWS be encrypted, that the connection survive a single tunnel failure, and that the on-premises router prefer the AWS side for outbound traffic. Which TWO configuration elements should the engineer implement? (Choose two.)

Accepted Answer

Set the on-premises BGP local preference higher for routes learned from AWS than for other paths.. An AWS Site-to-Site VPN connection provides two tunnels terminating on different endpoints, and running BGP or static routing on both allows automatic failover if one tunnel fails. On the on-premises side, raising BGP local preference for routes learned from AWS makes the AWS path the preferred egress, meeting the routing preference requirement while IPsec keeps traffic encrypted.

Answer

Attach an internet gateway to the VPC and advertise the VPC CIDR to on-premises over the internet gateway.

Answer

Enable AWS PrivateLink between the on-premises network and the VPC to encrypt traffic without a VPN.

Answer

Use AWS Direct Connect with a public virtual interface to carry the encrypted traffic instead of the VPN.

Question 13

A network engineer is configuring a VPC peering connection between two VPCs in the same AWS Region. VPC A has a CIDR block of 10.0.0.0/16, and VPC B has a CIDR block of 10.1.0.0/16. The engineer needs to ensure that instances in VPC A can communicate with instances in VPC B. After creating the peering connection and accepting it, what should the engineer do next?

Accepted Answer

Add a route to the route tables in both VPCs that points to the peering connection for the other VPC's CIDR block.. After creating and accepting a VPC peering connection, the next step is to add routes in both VPCs' route tables. Each VPC must have a route that points the other VPC's CIDR block to the peering connection. Without these routes, traffic will not flow, even if security groups and NACLs are correctly configured.

Answer

Configure a NAT gateway in VPC A and a route in VPC B to point to the NAT gateway's elastic IP address.

Answer

Enable DNS resolution for the peering connection and update the security groups to allow all traffic.

Answer

Create a transit gateway and attach both VPCs to it, then route traffic through the transit gateway.

Question 14

A network engineer is designing a VPC that must support both IPv4 and IPv6. Instances in a private subnet need outbound IPv6 internet access without inbound IPv6 connections from the internet, and they also need to reach an Amazon S3 gateway endpoint. The VPC is associated with an IPv6 CIDR block, and the subnet has an IPv6 CIDR assigned. Which two configurations are required to meet these requirements? (Choose two.)

Accepted Answer

Create an egress-only internet gateway and add a route for ::/0 pointing to it in the subnet's route table.. Outbound-only IPv6 requires an egress-only internet gateway with a ::/0 route in the subnet route table, since internet gateway routes would permit inbound connections. Reaching S3 privately requires a gateway endpoint plus a route to the endpoint using the S3 prefix list and an endpoint policy that allows the needed actions.

Answer

Attach an internet gateway and add a route for ::/0 pointing to it in the subnet's route table.

Answer

Create a NAT gateway and add a route for ::/0 pointing to it in the subnet's route table.

Answer

Enable IPv6 on the internet gateway and add a route for the S3 prefix list to the internet gateway.

Question 15

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. They have a requirement to route traffic between two VPCs that are both attached to the same Transit Gateway. However, they want to prevent traffic from one VPC from reaching a third VPC that is also attached. Which feature of Transit Gateway should they use to meet this requirement?

Accepted Answer

Transit Gateway route tables. Transit Gateway route tables are the correct feature to control routing between VPC attachments. By associating VPC attachments with specific route tables and controlling route propagation, you can allow traffic between some VPCs while preventing it from reaching others. This provides granular control over network segmentation.

Answer

Transit Gateway VPC attachments with security groups

Answer

Transit Gateway peering connections

Answer

Transit Gateway Network Manager

Question 16

A company uses AWS Global Accelerator in front of Application Load Balancers in two Regions to serve a global user base. The network team wants to guarantee that if the primary Region becomes unhealthy, new TCP connections are directed to the secondary Region within seconds, while existing connections follow the accelerator's standard behavior. The team has configured endpoint groups for both Regions with health checks enabled. Which statement describes how Global Accelerator handles failover in this setup?

Accepted Answer

Global Accelerator directs new connections to healthy endpoints based on health checks, but existing TCP connections to an unhealthy endpoint are not automatically migrated.. Global Accelerator assigns static anycast IPs and steers new flows to healthy endpoints using health-check-based endpoint group selection. Existing TCP sessions are not migrated between Regions, so clients must reconnect after a failure. This gives fast failover for new connections without DNS caching dependency, matching the stated requirement.

Answer

Global Accelerator uses BGP to withdraw the anycast IP address from the unhealthy Region and announce it from the healthy Region.

Answer

Global Accelerator terminates TCP connections at the edge and re-establishes them to the healthy endpoint during failover.

Answer

Global Accelerator relies on client DNS TTL expiration to redirect traffic, so failover time depends on the client resolver cache.

Question 17

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to add a second CIDR block to the VPC to accommodate additional subnets. The new CIDR block must not overlap with the existing one. Which action should a network engineer take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Associate an additional IPv4 CIDR block with the VPC and create a new subnet from that block in the desired Availability Zone.. Associating an additional non-overlapping IPv4 CIDR block with the VPC expands the address space natively, and subnets created from that block are routable within the VPC without peering. This meets the requirement to support a new workload in a different Availability Zone while keeping the original CIDR intact.

Answer

Add a secondary CIDR block to the subnet and extend the subnet into the new Availability Zone.

Answer

Modify the existing VPC CIDR block from 10.0.0.0/16 to 10.0.0.0/15 to expand the address space.

Answer

Create a new VPC with the additional CIDR block and peer it with the original VPC.

Question 18

A company is migrating a legacy application to AWS. The application requires multicast traffic between EC2 instances. Which AWS service can support multicast within a VPC?

Accepted Answer

Transit Gateway with multicast domain. AWS Transit Gateway supports multicast traffic through the creation of a multicast domain, which allows EC2 instances in different VPCs or subnets to send and receive multicast traffic. This is the only native AWS service that supports multicast within a VPC environment, making it the correct choice for migrating a legacy application that requires multicast.

Answer

VPC native multicast

Answer

Amazon CloudFront

Answer

Application Load Balancer

Question 19

A company is deploying a multi-tier application on AWS and needs to ensure that traffic between the web tier and the application tier does not traverse the internet. Both tiers are deployed in the same VPC but in different subnets. What is the MOST secure way to meet this requirement?

Accepted Answer

Use route tables and security groups to allow traffic within the VPC. The most secure way to ensure that traffic between the web tier and the application tier does not traverse the internet is to use route tables and security groups to allow traffic within the VPC. Both tiers are in the same VPC but in different subnets, so traffic stays within the VPC by default if routing is configured correctly. Route tables direct traffic between subnets, and security groups act as virtual firewalls to control inbound and outbound traffic. Option D is correct. Option A is wrong because an Internet Gateway is used for internet access, not for routing within a VPC. Option B is wrong because VPC Peering connects different VPCs, not subnets within the same VPC. Option C is wrong because a NAT Gateway is for outbound internet access from private subnets, not for inter-subnet communication.

Answer

Use an Internet Gateway to route traffic between subnets

Answer

Use VPC Peering between the subnets

Answer

Use a NAT Gateway in each subnet for inter-subnet communication

Question 20

A company wants to allow their employees to securely access resources in a VPC from their home offices. Which AWS service should they use?

Accepted Answer

AWS Client VPN. AWS Client VPN is a managed, cloud-based VPN service that allows individual users to securely access AWS resources from remote locations, such as home offices, using a VPN client installed on their device. It supports OpenVPN-based connections and integrates with Active Directory for user authentication, making it ideal for remote employee access to a VPC without requiring dedicated hardware or complex site-to-site configurations.

Answer

AWS Direct Connect

Answer

AWS Site-to-Site VPN

Answer

Amazon CloudFront