ANS-C01 Practice Exam 60 — 20 Questions

Question 1

A company is designing a multi-Region architecture with active-active failover for a web application. The application uses Application Load Balancers (ALBs) in two AWS Regions. Traffic must be routed to the closest healthy Region with automatic failover. Which AWS service should be used to route traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon Route 53 with latency-based routing and health checks. Amazon Route 53 with latency-based routing and health checks is the correct choice because it directs traffic to the AWS Region with the lowest latency for each user, and health checks automatically fail over to the next best healthy Region if an ALB becomes unhealthy. This satisfies the active-active failover requirement without introducing additional caching or anycast complexities.

Answer

Network Load Balancer with cross-zone load balancing

Answer

Amazon CloudFront with multiple origins

Answer

AWS Global Accelerator

Question 2

A company is designing a multi-VPC architecture with VPC peering. They need to ensure that traffic between VPCs is encrypted. What should they do?

Accepted Answer

Use a third-party VPN appliance in each VPC to create an IPsec tunnel between them. VPC peering does not encrypt traffic natively. To ensure encryption between VPCs, you need to establish an IPsec tunnel, which can be achieved by deploying a third-party VPN appliance in each VPC. Option B is incorrect because a VPN connection using virtual private gateways is typically used to connect a VPC to an on-premises network, not directly between VPCs. Option C is incorrect because VPC peering does not support enabling encryption on the peering connection itself; encryption must be added via an overlay. Option D is incorrect because AWS Direct Connect is used for dedicated connections to on-premises data centers, not for inter-VPC traffic.

Answer

Establish a VPN connection between the VPCs using virtual private gateways

Answer

Enable encryption on the VPC peering connection

Answer

Use AWS Direct Connect to connect the VPCs

Question 3

Which THREE components are required to enable AWS Shield Advanced automatic application layer DDoS mitigation for an Application Load Balancer? (Choose three.)

Accepted Answer

AWS Shield Advanced subscription. Options A, D, and E are correct. AWS Shield Advanced requires an active subscription (A) to enable automatic application layer DDoS mitigation. It integrates with AWS WAF, so a web ACL (E) must be associated with the ALB, and a rate-based rule (D) is needed to trigger automatic mitigation. Option B (CloudFront) is not required because Shield Advanced can directly protect ALBs without a CDN. Option C (Route53) is also not required for this specific feature.

Answer

Amazon CloudFront distribution in front of the ALB

Answer

Amazon Route53 DNS configuration

Question 4

A company has a production VPC with a public and private subnet across two Availability Zones. The public subnet hosts a Network Load Balancer (NLB) that distributes traffic to EC2 instances in the private subnet. The application experiences periodic failures where the NLB marks all targets as unhealthy for about 2 minutes, then they recover. The health checks are HTTP on port 80 with a 5-second interval, 2 consecutive successes to be healthy, and 2 consecutive failures to be unhealthy. The target group health check timeout is 5 seconds. The EC2 instances are behind an Auto Scaling group with a minimum of 2 instances per AZ. CPU utilization on the instances is stable at 40%. The NLB's CloudWatch metrics show HealthyHostCount drops to zero suddenly. The network engineer suspects a network issue. What is the most likely cause?

Accepted Answer

The health check timeout is equal to the interval, causing timeouts under transient network delays.. The health check timeout equals the interval (both 5 seconds). Under transient network delays, a health check response can be delayed beyond the timeout, causing the NLB to count a failure. With 2 consecutive failures required to mark unhealthy, a brief period of latency can cause all targets to be marked unhealthy for about 2 minutes (2 intervals × 5 seconds = 10 seconds of failures, but the recovery requires 2 consecutive successes, leading to the observed ~2-minute duration due to repeated timeouts). The instances are not overloaded (CPU 40%), and security groups and route tables are configured correctly since normal operation resumes. This configuration violates the best practice of setting the timeout lower than the interval to allow for retries.

Answer

The security group for the private subnet is blocking inbound traffic from the NLB.

Answer

The NLB's cross-zone load balancing is disabled, causing all traffic to go to one AZ.

Answer

The route tables for the private subnets are missing a route to the NLB's subnet.

Question 5

A company has a VPC with multiple subnets. They have an Application Load Balancer (ALB) in a public subnet and a web server fleet in private subnets. The security team wants to ensure that only the ALB can communicate with the web servers. Which security group configuration should be used?

Accepted Answer

Set the web server security group inbound rule to allow traffic from the ALB's security group.. Referencing the ALB's security group as the source allows only traffic from instances or resources associated with that security group, strictly limiting access to the web servers. This follows the principle of least privilege. Option B is wrong because allowing traffic from the public subnet CIDR is too broad and would permit any instance in that subnet, not just the ALB. Option C is wrong because allowing traffic from the VPC CIDR permits any resource in the VPC, which is overly permissive. Option D is wrong because allowing traffic from 0.0.0.0/0 exposes the web servers to the internet.

Answer

Set the web server security group inbound rule to allow traffic from the public subnet CIDR.

Answer

Set the web server security group inbound rule to allow traffic from the VPC CIDR.

Answer

Set the web server security group inbound rule to allow traffic from 0.0.0.0/0.

Question 6

A company has a VPC with a CIDR of 10.0.0.0/16. The company needs to add a new subnet for a container cluster that requires at least 2000 IP addresses. Which TWO subnet CIDR blocks meet this requirement? (Choose two.)

Accepted Answer

10.0.0.0/20. (10.0.0.0/20) provides 2^(32-20) = 4096 IP addresses, and option D (10.0.0.0/21) provides 2^(32-21) = 2048 IP addresses. Both meet the requirement of at least 2000 usable IP addresses (after subtracting AWS reserved addresses, each still offers well over 2000).

Answer

10.0.0.0/24

Answer

10.0.0.0/25

Answer

10.0.0.0/26

Question 7

Refer to the exhibit. A company has an S3 bucket policy that allows public read access only from a specific IP range (203.0.113.0/24). Users outside this range report that they can still access objects in the bucket. What is the most likely reason?

Accepted Answer

The bucket also has a bucket ACL that grants public read access, overriding the policy condition. The most likely reason is that the bucket also has a bucket ACL that grants public read access. When both a bucket policy and an ACL are present, the effective permissions are the union of allowed actions. If the ACL allows everyone to read objects, then the IP restriction in the bucket policy is not effective because the ACL already permits the access. Option D correctly identifies this scenario. Option A is incorrect because the condition key for source IP is aws:SourceIp, not aws:SourceIpAddress, but that is a minor typo; however, the policy would still be evaluated. Option B is incorrect because bucket policies are evaluated regardless of region. Option C is incorrect because server-side encryption does not affect policy evaluation.

Answer

The bucket policy uses the wrong condition key; it should be aws:SourceIpAddress

Answer

The bucket policy is not being evaluated because the bucket is in a different region

Answer

The bucket is configured with server-side encryption, which prevents the policy from being applied

Question 8

A company needs to encrypt data at rest in Amazon S3. Which AWS service manages the encryption keys?

Accepted Answer

AWS KMS. AWS KMS (Key Management Service) is the AWS service that manages encryption keys for Amazon S3. AWS KMS allows you to create, rotate, and control access to encryption keys used to encrypt data at rest in S3. Option A (AWS Secrets Manager) is incorrect because it manages secrets like database credentials, not encryption keys for S3. Option B (AWS Certificate Manager) is incorrect because it manages SSL/TLS certificates, not encryption keys. Option C (AWS CloudHSM) is incorrect because while it provides hardware security modules for key storage, it is not the default or primary key manager for S3; AWS KMS is the integrated service for S3 encryption.

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager

Answer

AWS CloudHSM

Question 9

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to a partner VPC with CIDR 10.0.0.0/16. Both VPCs are in the same region. They want to use VPC Peering. After creating the peering connection and adding routes, connectivity fails. What is the most likely cause?

Accepted Answer

Overlapping CIDR blocks prevent VPC peering connectivity.. The most likely cause of connectivity failure is the overlapping CIDR blocks. VPC peering requires non-overlapping IP ranges for proper routing. Even if the peering connection is active and routes are added, the identical CIDR blocks (both 10.0.0.0/16) prevent the route tables from distinguishing the traffic destination, resulting in no connectivity. Option A is incorrect because VPC peering does not support transitive routing, but that is not the issue here. Option B is incorrect because the status would need to be 'active' for connectivity, but the problem is overlapping CIDRs. Option D is incorrect because although routes may be missing, the primary issue is the overlapping CIDRs.

Answer

The peering connection is not set up for transitive routing.

Answer

The peering connection status is 'pending-acceptance'.

Answer

The route tables do not have a route to the peering connection.

Question 10

A company is designing a VPC for a three-tier application. The web tier must be accessible from the internet, the application tier must only be accessible from the web tier, and the database tier must only be accessible from the application tier. Which THREE design elements are required? (Choose THREE.)

Accepted Answer

A public subnet for the web tier with an internet gateway. The web tier requires direct internet accessibility, which is achieved by placing it in a public subnet associated with an internet gateway. The internet gateway provides a target for the subnet's route table to allow inbound traffic from the internet and outbound responses, enabling users to reach the web application.

Answer

A NAT gateway in the public subnet for outbound traffic from private subnets

Answer

A VPN connection to on-premises

Question 11

A network engineer is troubleshooting connectivity between an on-premises data center and a VPC over an AWS Site-to-Site VPN. The tunnel status shows UP, but traffic from on-premises to the VPC is intermittently dropped. Which TWO of the following are likely causes? (Choose 2.)

Accepted Answer

Asymmetric routing across multiple tunnels. Asymmetric routing across multiple tunnels can cause intermittent drops because traffic from on-premises to the VPC may take one tunnel, while return traffic takes a different tunnel. If the stateful firewall (e.g., security groups, network ACLs, or on-premises firewall) sees packets from a different source IP or interface than expected, it may drop the return packets, leading to connectivity issues even though both tunnels are UP.

Answer

Dead Peer Detection (DPD) timeout configuration

Answer

BGP hold timer expiration

Answer

IPsec SA lifetime mismatch between peers

Question 12

A company is using AWS Direct Connect with a private VIF. They want to monitor the BGP session status and receive alerts if the session goes down. Which AWS service should they use?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the correct service because it can monitor the BGP session status of a Direct Connect private VIF by publishing metrics such as 'bgp_session_state' (0=down, 1=up) and 'connection_state' to CloudWatch. You can then create a CloudWatch alarm that triggers an alert (e.g., via SNS) when the BGP session state transitions to 0, providing real-time notification of a session failure.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

AWS CloudTrail

Question 13

A company is using AWS WAF to protect its web application. The security team notices that the WAF logs show a high number of requests from a specific IP address range that are being blocked by the SQL injection rule. However, the application team reports that legitimate users from that IP range are unable to access the application. Which action should the security team take to resolve this issue while maintaining security?

Accepted Answer

Create a rate-based rule to limit requests from the IP range.. Creating a rate-based rule can limit the request rate from the specific IP range, allowing legitimate traffic while still blocking excessive requests that may be part of a SQL injection attempt. This maintains security by not outright allowing the IP range or disabling protections. Option A is wrong because disabling the SQL injection rule for the IP range removes protection against actual SQL injection attacks from that range. Option B is wrong because increasing the rate limit for the entire WAF is not granular and may affect other traffic. Option C is wrong because adding the IP range to the allow list completely bypasses security, leaving the application vulnerable.

Answer

Disable the SQL injection rule for the specific IP range.

Answer

Increase the rate limit for the entire WAF.

Answer

Add the IP range to the allow list in the WAF.

Question 14

A company has deployed a VPC with public and private subnets. They have an Internet Gateway attached to the VPC and a NAT Gateway in the public subnet. The private subnet instances need to download patches from the internet. Which configuration ensures that the private instances can reach the internet while preventing inbound traffic from the internet?

Accepted Answer

Add a route in the private subnet route table pointing 0.0.0.0/0 to the NAT Gateway.. Adding a route in the private subnet route table pointing 0.0.0.0/0 to the NAT Gateway allows private instances to initiate outbound traffic to the internet while preventing inbound connections from the internet. Option A is incorrect because a VPC Gateway Endpoint only provides access to specific AWS services (e.g., S3, DynamoDB), not general internet traffic. Option B is incorrect because routing 0.0.0.0/0 to the Internet Gateway would expose the private instances to inbound traffic from the internet (assuming the route is in the private subnet route table, it would still allow inbound traffic if the instances have public IPs, but more importantly, it bypasses the NAT Gateway's security). Option D is incorrect because VPC Peering does not provide internet access; it only connects two VPCs.

Answer

Add a VPC Gateway Endpoint for Amazon S3 to the private subnet route table.

Answer

Add a route in the private subnet route table pointing 0.0.0.0/0 to the Internet Gateway.

Answer

Create a VPC Peering connection to a public VPC and route traffic through it.

Question 15

A network engineer is configuring an AWS Site-to-Site VPN connection between a VPC and an on-premises network. The engineer creates a customer gateway, VPN connection, and virtual private gateway. The VPN tunnel status shows 'down'. Which configuration step is most likely missing?

Accepted Answer

Configure the on-premises router with the correct pre-shared key and tunnel IP addresses. The VPN tunnel status will remain down if the on-premises router is not configured with the correct pre-shared key and tunnel IP addresses as specified in the AWS VPN tunnel configuration. While attaching the VPN connection to the virtual private gateway (option A) is necessary, it is typically done during creation. Option B (enable route propagation) and option C (add static route) are related to routing, not tunnel establishment. Therefore, the most likely missing step is configuring the on-premises router.

Answer

Attach the VPN connection to the virtual private gateway

Answer

Enable route propagation on the virtual private gateway

Answer

Add a static route to the VPN connection in the route table

Question 16

A company has a VPC with multiple subnets. They have an AWS Network Firewall deployed in a firewall subnet. They want to inspect all outbound traffic from the VPC to the internet. Currently, the VPC route table has a default route (0.0.0.0/0) pointing to an internet gateway. What routing change is required to route outbound traffic through the firewall?

Accepted Answer

Add a route in the subnet route tables that sends 0.0.0.0/0 traffic to the Network Firewall endpoint's elastic network interface.. To route traffic through AWS Network Firewall, you must add a route in the subnet route tables that sends 0.0.0.0/0 traffic to the firewall endpoint's elastic network interface (ENI). This forces outbound traffic to be inspected by the firewall before reaching the internet gateway. Option A is incorrect because a VPC Gateway Endpoint is used for private access to AWS services, not for routing traffic through a firewall. Option B is incorrect because a NAT gateway provides outbound connectivity but does not inspect traffic; adding another hop to the firewall would be redundant and not supported. Option D is incorrect because a transit gateway is used to connect multiple VPCs or on-premises networks, not to route traffic through a single firewall.

Answer

Create a VPC Gateway Endpoint for the firewall service.

Answer

Add a NAT gateway in a public subnet and route 0.0.0.0/0 to the NAT gateway, then point the NAT gateway to the firewall.

Answer

Add a transit gateway and attach the VPC and the internet gateway to it, then route traffic through the firewall.

Question 17

A company needs to ensure that all outbound traffic from a VPC goes through a centralized inspection appliance in a different VPC. Which TWO actions must be taken to achieve this?

Accepted Answer

Use AWS Transit Gateway with appropriate route tables to direct traffic to the inspection VPC.. The correct answers are D and E. D: AWS Transit Gateway enables transitive routing between VPCs. By configuring appropriate route tables, traffic from source VPCs can be directed to the inspection VPC for centralized inspection. E: After the inspection appliance processes the traffic, it must be forwarded to its final destination. This requires proper routing in the inspection VPC to send the inspected traffic out to the internet or to another VPC. Option A is incorrect because VPC endpoints only provide private access to AWS services, not general internet traffic routing. Option B is incorrect because AWS Direct Connect Gateway is used for connecting on-premises networks to AWS, not for routing between VPCs. Option C is incorrect because VPC peering does not support transitive routing; it only allows direct communication between two VPCs, not through a third VPC.

Answer

Deploy VPC endpoints for all AWS services used.

Answer

Use AWS Direct Connect Gateway to route traffic between VPCs.

Answer

Create VPC peering connections between all VPCs.

Question 18

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that no security group allows inbound SSH (port 22) from 0.0.0.0/0. Which policy type should be used?

Accepted Answer

Service Control Policy (SCP). The Service Control Policy (SCP). SCPs are used in AWS Organizations to centrally control the maximum available permissions for all accounts in an organization. They can be used to prevent security groups from allowing inbound SSH from 0.0.0.0/0 by denying the ability to create or modify security group rules that permit such traffic. Network ACLs (Option A) operate at the subnet level and are not account-wide; they control traffic entering/exiting subnets, but cannot enforce organizational policies across multiple accounts. IAM policies (Option B) apply to users, groups, or roles, and cannot directly restrict security group configurations. AWS Config rules (Option D) are detective controls that can evaluate compliance but are not preventive; they do not block the creation of non-compliant security group rules. Therefore, SCP is the appropriate preventive policy type.

Answer

Network ACL

Answer

IAM policy

Answer

AWS Config rule

Question 19

A network engineer is designing a multi-region application that requires low-latency traffic between EC2 instances in two different AWS Regions. The engineer needs to ensure that traffic between the instances uses the AWS global network and not the public internet. Which AWS service should be used?

Accepted Answer

VPC Peering. (VPC Peering). Inter-region VPC peering connects VPCs in different regions using the AWS global network backbone, providing low-latency and private connectivity between EC2 instances. Option A (AWS Direct Connect) is used for on-premises to AWS connectivity, not between instances. Option B (AWS Global Accelerator) optimizes internet-facing traffic and adds unnecessary hops for internal traffic. Option C (AWS Transit Gateway) supports inter-region transit but requires additional configuration and is not the simplest solution for direct instance-to-instance connectivity.

Answer

AWS Direct Connect

Answer

AWS Global Accelerator

Answer

AWS Transit Gateway

Question 20

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team wants to centrally inspect and filter traffic between VPCs using a third-party firewall appliance. Which architecture should be used?

Accepted Answer

Transit Gateway with appliance mode and a dedicated inspection VPC. Transit Gateway with appliance mode and a dedicated inspection VPC is the correct architecture because it enables symmetric routing, forcing traffic through the inspection VPC for centralized inspection. Option A (AWS PrivateLink) is incorrect; PrivateLink provides private connectivity to services, not traffic inspection between VPCs. Option B (AWS Network Firewall in each VPC) is incorrect because deploying a firewall in each VPC is distributed, not centralized, and does not leverage Transit Gateway. Option C (VPC peering) is incorrect because VPC peering does not support transitive routing; peering each VPC to an inspection VPC would be complex and does not take advantage of Transit Gateway's centralized routing capabilities.

Answer

AWS PrivateLink endpoints in each VPC

Answer

AWS Network Firewall deployed in each VPC

Answer

VPC peering between each VPC and the inspection VPC