ANS-C01 Practice Exam 62 — 20 Questions

Question 1

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. They have a Transit Gateway with multiple route tables. A network engineer needs to ensure that traffic from a specific VPC (VPC-A) can reach an on-premises network via a VPN attachment, but VPC-A should not be able to communicate with another VPC (VPC-B). Which configuration should the engineer implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Associate VPC-A and the VPN attachment with a dedicated Transit Gateway route table that contains routes to each other, and associate VPC-B with a different route table.. Transit Gateway route tables provide segmentation. By associating VPC-A and the VPN attachment with a route table that includes routes to each other, and placing VPC-B in a separate route table without routes to VPC-A, the engineer ensures VPC-A can reach on-premises but not VPC-B. This is the standard method for network isolation in a hub-and-spoke topology.

Answer

Use a network ACL on the subnet in VPC-A to deny traffic to VPC-B's CIDR.

Answer

Create a new Transit Gateway and attach VPC-A and the VPN to it, leaving VPC-B on the original Transit Gateway.

Answer

Modify the VPC route tables in VPC-A to remove the route to VPC-B's CIDR.

Question 2

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They have a transit gateway with multiple attachments. The security team wants to inspect all traffic between VPCs using AWS Network Firewall. They deploy a Network Firewall in a dedicated VPC and attach it to the transit gateway. However, they find that traffic between VPCs is not being inspected. What is the most likely reason?

Accepted Answer

The transit gateway route tables are not configured to route traffic through the Network Firewall VPC attachment.. To inspect inter-VPC traffic with AWS Network Firewall via a transit gateway, you must configure transit gateway route tables to steer traffic through the firewall VPC attachment. This involves creating a separate transit gateway route table for the firewall VPC, associating the firewall attachment with it, and configuring the other VPC attachments to propagate routes to that route table. Without these routing configurations, traffic will bypass the firewall and go directly between VPCs.

Answer

The Network Firewall policy must be associated with the transit gateway.

Answer

The Network Firewall must be deployed in the same VPC as the transit gateway.

Answer

The VPC attachments must be in the same AWS Region as the Network Firewall.

Question 3

A startup runs a web application on EC2 instances in a private subnet across two Availability Zones. The instances must fetch objects from Amazon S3 without traversing the internet, and the security team requires that traffic to S3 never leave the AWS network. The VPC has no NAT gateway. Which solution meets these requirements with the least operational effort?

Accepted Answer

Create a gateway VPC endpoint for Amazon S3 and update the private subnet route tables to use the endpoint prefix list.. A gateway VPC endpoint for Amazon S3 adds a prefix-list route to the subnet route table, keeping S3 traffic on the AWS backbone without NAT or internet gateways. It has no hourly charge and requires only a route table update, making it the least-effort solution that also satisfies the requirement that traffic never leave the AWS network.

Answer

Configure a NAT gateway in a public subnet and point the private subnet route table at it.

Answer

Deploy an interface VPC endpoint for Amazon S3 in each Availability Zone and enable private DNS names.

Answer

Attach an internet gateway to the VPC and add a route to 0.0.0.0/0 in the private subnet route tables.

Question 4

A network engineer needs to capture IP traffic metadata for all traffic entering and leaving a specific network interface in a VPC. The logs must be stored in Amazon S3 for long-term analysis. Which AWS service or feature should be used?

Accepted Answer

VPC Flow Logs. VPC Flow Logs is the correct service because it captures IP traffic metadata for network interfaces, subnets, or VPCs. You can create a flow log for a specific network interface and direct the logs to Amazon S3. This provides the needed visibility for troubleshooting and analysis. Other services either log different types of data or are scoped to different resources.

Answer

AWS Network Firewall Logging

Answer

AWS CloudTrail

Answer

AWS Transit Gateway Flow Logs

Question 5

A company uses AWS Direct Connect with a private virtual interface to connect its on-premises data center to a VPC. The network team wants to monitor the amount of data transferred over the Direct Connect connection and receive alerts when utilization exceeds a threshold. Which AWS service should they use to collect and alarm on these metrics?

Accepted Answer

Amazon CloudWatch with Direct Connect metrics. Amazon CloudWatch is the AWS service that collects Direct Connect metrics, including connection and virtual interface byte rates. You can create CloudWatch alarms on these metrics to alert when utilization exceeds a defined threshold. CloudTrail, VPC Flow Logs, and Trusted Advisor do not provide the required real-time utilization monitoring and alarming for Direct Connect connections.

Answer

VPC Flow Logs with a custom format for Direct Connect virtual interfaces

Answer

AWS CloudTrail with data events for Direct Connect

Answer

AWS Trusted Advisor with Direct Connect checks

Question 6

A company is designing a network for a new application that will be deployed in a single VPC across three Availability Zones. The application requires high availability and fault tolerance. The network engineer needs to create subnets for the application tier and the database tier. The application tier must be able to communicate with the database tier, but the database tier must not have direct internet access. The application tier must be accessible from the internet via an Application Load Balancer (ALB). Which subnet design should the engineer implement?

Accepted Answer

Create three public subnets for the ALB, three private subnets for the application tier, and three private subnets for the database tier. Place the ALB in the public subnets, the application instances in the private subnets, and the database instances in the database private subnets.. The correct design separates tiers into public and private subnets. The ALB must reside in public subnets to receive internet traffic. The application instances and database instances should be in private subnets to prevent direct internet access. This architecture provides high availability across three Availability Zones and meets the security requirements.

Answer

Create three public subnets for the application tier and three public subnets for the database tier. Place the ALB in the application subnets and the database instances in the database subnets.

Answer

Create three public subnets for the application tier and three private subnets for the database tier. Place the ALB in the public subnets and the EC2 instances in the private subnets.

Answer

Create three private subnets for the application tier and three private subnets for the database tier. Place the ALB in the private subnets and use a NAT gateway for internet access.

Question 7

A financial services company needs to connect its on-premises data center to AWS using AWS Direct Connect. The company requires a highly available connection that can tolerate the failure of a single Direct Connect location or a single device. They have two Direct Connect locations available, each with a dedicated 10 Gbps connection. The company also wants to minimize costs. Which configuration should a network engineer recommend?

Accepted Answer

Order one dedicated 10 Gbps connection at each of the two Direct Connect locations and configure them as separate connections with BGP failover.. To tolerate the failure of a single Direct Connect location, the company must have at least one connection at each of two different Direct Connect locations. Using one dedicated connection at each location with BGP failover provides the required redundancy against location and device failures. Adding more connections at each location would increase cost without being necessary to meet the stated availability target.

Answer

Order two dedicated 10 Gbps connections at the same Direct Connect location and configure them as a link aggregation group (LAG).

Answer

Order two dedicated 10 Gbps connections at each of the two Direct Connect locations and configure them as a LAG at each location.

Answer

Order one dedicated 10 Gbps connection at one Direct Connect location and use a Site-to-Site VPN as a backup over the internet.

Question 8

A company has a VPC with an internet gateway and a NAT gateway in a public subnet. Instances in a private subnet need to access the internet for software updates. The company wants to ensure that the NAT gateway is highly available and can handle increased traffic during peak times. Which action should be taken?

Accepted Answer

Create a NAT gateway in each Availability Zone and update the route tables in the private subnets to point to the NAT gateway in the same Availability Zone.. For high availability and scalability, deploy a NAT gateway in each Availability Zone and configure private subnet route tables to use the NAT gateway in the same AZ. This ensures that if one AZ fails, the others continue to provide internet access, and it distributes the traffic load across multiple NAT gateways.

Answer

Attach an Elastic IP address to the NAT gateway and enable enhanced networking on the instances in the private subnet.

Answer

Create a single NAT gateway and enable cross-zone load balancing on the NAT gateway.

Answer

Replace the NAT gateway with a NAT instance and configure it in an Auto Scaling group across multiple Availability Zones.

Question 9

A company's security team needs to enforce that all network traffic between a set of EC2 instances in a VPC and any external endpoint is inspected by a third-party firewall appliance running on EC2. The instances are in private subnets and must not have public IP addresses. The team wants to ensure that if the firewall appliance fails, traffic is automatically routed to a standby appliance. Which solution meets these requirements?

Accepted Answer

Deploy the firewall appliance behind a Gateway Load Balancer, and update the VPC route tables to send traffic through the Gateway Load Balancer endpoint.. Gateway Load Balancer is purpose-built for transparently inserting third-party security appliances. It uses a Gateway Load Balancer endpoint in the VPC, and route tables direct traffic to that endpoint. The load balancer then distributes traffic to a fleet of appliances, performing health checks and automatic failover. This architecture keeps the instances private and ensures all traffic is inspected.

Answer

Deploy the firewall appliance in a public subnet, and create a peering connection between the private subnets and the public subnet.

Answer

Deploy the firewall appliance with an Elastic IP address, and configure security groups to redirect traffic to the appliance's public IP.

Answer

Deploy the firewall appliance behind a Network Load Balancer, and configure the instances to use the Network Load Balancer as their default gateway.

Question 10

A security team wants to detect and alert on API calls that modify VPC security groups across all accounts in an AWS Organization. They enable AWS CloudTrail in all accounts and deliver logs to a central S3 bucket. They need a solution that evaluates the log events and sends a notification when a security group rule is changed. The team wants minimal operational overhead and no custom code. Which combination of services should they use?

Accepted Answer

Amazon EventBridge rule with an event pattern matching CloudTrail API calls, targeting an Amazon SNS topic.. EventBridge natively ingests CloudTrail management events and can match specific API calls like security group modifications. Routing those matched events to an SNS topic provides immediate notification with no custom code. This is the lowest-overhead approach for alerting on API-level changes across accounts when CloudTrail is already enabled.

Answer

AWS Config custom rule with a Lambda function that parses CloudTrail logs from S3 and publishes to SNS.

Answer

AWS CloudTrail Lake query scheduled with Amazon EventBridge Scheduler to run a query and publish results to SNS.

Answer

Amazon GuardDuty findings exported to S3, with an S3 event notification triggering a Lambda function to publish to SNS.

Question 11

A network engineer is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The engineer needs to monitor the traffic flow and troubleshoot connectivity issues. The engineer wants to enable Transit Gateway Flow Logs to capture information about IP traffic going through the Transit Gateway. Which TWO statements are true regarding Transit Gateway Flow Logs? (Choose two.)

Accepted Answer

Transit Gateway Flow Logs can be published to Amazon CloudWatch Logs, Amazon S3, or Amazon Kinesis Data Firehose.. Transit Gateway Flow Logs provide visibility into IP traffic traversing a Transit Gateway. They can be published to CloudWatch Logs, S3, or Kinesis Data Firehose, and they can be enabled for specific attachments or the entire Transit Gateway. They capture detailed 5-tuple information including ports. They do not enforce security groups; that is handled by VPC security groups. Understanding these capabilities helps in designing effective monitoring and troubleshooting strategies.

Answer

Transit Gateway Flow Logs include the source and destination IP addresses, but not the source and destination ports.

Answer

Transit Gateway Flow Logs can be used to capture traffic that is denied by security groups on the Transit Gateway.

Answer

Transit Gateway Flow Logs capture traffic only at the VPC attachment level, not at the Transit Gateway level.

Question 12

A network engineer is deploying a new application in a VPC that requires high availability and automatic scaling. The engineer configures an Application Load Balancer (ALB) with targets in multiple Availability Zones. During testing, the engineer notices that some requests are failing with HTTP 504 errors. The engineer suspects that the ALB health checks are not correctly configured. Which of the following should the engineer verify to ensure that the ALB can properly health check the targets?

Accepted Answer

The targets' security groups allow inbound traffic from the ALB's security group on the health check port.. The correct answer is that the targets' security groups must allow inbound traffic from the ALB's security group on the health check port. This ensures the ALB can reach the targets to perform health checks. Without this, targets are marked unhealthy, leading to 504 errors. Other options either reverse the direction or focus on less likely causes like network ACLs.

Answer

The ALB's security group allows outbound traffic to the targets on the health check port.

Answer

The security group attached to the ALB allows inbound traffic on the health check port from the target's security group.

Answer

The network ACLs associated with the target subnets allow inbound traffic from the ALB's subnet on the health check port.

Question 13

A network engineer must enforce that all traffic entering and leaving a production VPC is inspected by AWS Network Firewall, and that the firewall cannot be bypassed by changes to route tables made by application teams. The VPC has an internet gateway, a NAT gateway, and a transit gateway attachment. Which two controls should be implemented to meet these requirements? (Choose two.)

Accepted Answer

Create a firewall subnet with a Network Firewall endpoint and route the internet gateway and transit gateway traffic through that endpoint using route tables that application teams cannot modify.. Enforcement requires both a routing design that forces all ingress and egress through the Network Firewall endpoint and a governance guardrail that prevents unauthorized route changes. The dedicated firewall subnet with controlled route tables ensures traffic is inspected, while the service control policy denies route modification actions to application teams, closing the bypass path.

Answer

Use AWS PrivateLink to expose the Network Firewall endpoint to application subnets and require applications to connect through the endpoint.

Answer

Configure a Network Firewall stateless rule group with a default action of drop and associate it with the firewall policy for all subnets.

Answer

Enable VPC Flow Logs on all subnets and create an Amazon EventBridge rule that stops any instance that sends traffic outside the inspected path.

Question 14

A network engineer is responsible for monitoring a large AWS environment with multiple VPCs. The engineer needs to centrally collect and analyze VPC Flow Logs from all VPCs in an AWS Organizations account. Which AWS service should the engineer use to aggregate and query the flow logs efficiently?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is designed to collect, store, and analyze log data from various AWS services, including VPC Flow Logs. By sending flow logs from multiple VPCs to a central CloudWatch Logs log group, the engineer can use CloudWatch Logs Insights to run queries and gain insights into network traffic. This approach simplifies management and enables efficient analysis across a large environment. Other services like CloudTrail, AWS Config, and Amazon Inspector do not provide the necessary log aggregation and query capabilities for flow logs.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon Inspector

Question 15

A network engineer needs to verify that a newly created VPC Flow Log is correctly capturing traffic for a specific network interface. The engineer wants to quickly check the flow log records in near real-time. Where should the engineer look?

Accepted Answer

Amazon CloudWatch Logs log group associated with the flow log.. VPC Flow Logs can be published to CloudWatch Logs, which provides near real-time log viewing. This allows the engineer to quickly verify that the flow log is capturing the expected traffic. Other destinations like S3 or Kinesis Firehose involve delays and are not ideal for immediate verification.

Answer

Amazon Kinesis Data Firehose delivery stream.

Answer

AWS CloudTrail event history.

Answer

Amazon S3 bucket where the flow logs are delivered.

Question 16

A company is designing a VPC that requires a subnet to have a route to the internet for outbound traffic, but the instances in that subnet should not be directly reachable from the internet. Which AWS component should be used to meet these requirements?

Accepted Answer

NAT gateway. A NAT gateway enables instances in a private subnet to initiate outbound internet connections without allowing inbound connections from the internet. This is the standard solution for outbound-only internet access.

Answer

Transit gateway

Answer

Internet gateway

Answer

Virtual private gateway

Question 17

A company's network team needs to verify that traffic sourced from a specific Elastic Network Interface (ENI) in a VPC is allowed or denied by the attached security groups and network ACLs. They have enabled VPC Flow Logs for the VPC and want to capture only the traffic for that ENI, including both accepted and rejected packets. Which configuration should they use to achieve this with minimal overhead?

Accepted Answer

Create a flow log at the ENI level with a filter of 'ALL' and send it to CloudWatch Logs.. The requirement is to capture both accepted and rejected traffic for a specific ENI with minimal overhead. ENI-level flow logs with filter ALL directly provide this by scoping the capture to the interface and including all traffic decisions. Subnet or VPC level logs would capture more data than needed, and using a filter other than ALL would omit either accepted or rejected packets. Sending to CloudWatch Logs is a standard destination that supports querying.

Answer

Create a flow log at the subnet level with a filter of 'REJECT' and send it to S3.

Answer

Enable VPC Flow Logs on the VPC with a filter of 'ACCEPT' and use a subscription filter to forward only the ENI's logs to a Lambda function for analysis.

Answer

Create a flow log at the VPC level with a filter of 'ALL' and then filter the logs by the ENI ID using CloudWatch Logs Insights.

Question 18

A company is deploying a multi-tier web application in a VPC. The security team wants to implement microsegmentation to control traffic between the web tier, application tier, and database tier. They need to ensure that only the application tier can access the database tier on port 3306, and only the web tier can access the application tier on port 8080. They also want to log all accepted and rejected traffic for auditing. Which TWO AWS services or features should they use to meet these requirements? (Choose two.)

Accepted Answer

VPC Flow Logs to capture accepted and rejected traffic.. Security groups with references to other security groups allow you to define rules that permit traffic based on the membership of instances in other security groups, enabling precise microsegmentation. VPC Flow Logs capture accepted and rejected traffic for auditing, providing visibility into whether the rules are effective. Together, they meet the requirements for controlling and logging traffic between tiers.

Answer

AWS Network Firewall with stateful rule groups.

Answer

Network ACLs with allow rules for specific CIDR ranges.

Answer

AWS PrivateLink to create endpoints between tiers.

Question 19

A retail company is deploying a new VPC with public and private subnets. The company wants EC2 instances in the private subnets to initiate outbound connections to a third-party payment gateway on the internet, but the instances must not be directly reachable from the internet. The company also wants to minimize management overhead. Which solution should the company implement?

Accepted Answer

Deploy a NAT gateway in a public subnet and update the private subnet route tables to send 0.0.0.0/0 to the NAT gateway. A NAT gateway deployed in a public subnet enables instances in private subnets to initiate outbound traffic to the internet while blocking unsolicited inbound traffic. Pointing the private subnet route tables to the NAT gateway provides the required connectivity with minimal operational effort, since NAT gateways are managed by AWS.

Answer

Attach an internet gateway to the VPC and assign public IP addresses to the private instances

Answer

Configure a VPC peering connection between the private subnets and the payment gateway's VPC

Answer

Create a transit gateway and attach the VPC to it, then route all traffic through the transit gateway

Question 20

A network engineer has deployed AWS Network Firewall in a centralized inspection VPC and attached it to a Transit Gateway. After enabling the firewall, the engineer notices that traffic between VPCs is not being inspected and is bypassing the firewall. The Transit Gateway route tables show that the attachment for the inspection VPC is associated with the same route table as the other VPC attachments. What is the most likely cause?

Accepted Answer

The Transit Gateway route tables are not configured to route traffic through the firewall VPC attachment.. Centralized inspection with AWS Network Firewall and Transit Gateway requires that the Transit Gateway route tables have routes pointing to the firewall VPC attachment for the traffic that needs inspection. Simply associating the inspection VPC attachment with the same route table as other VPCs does not automatically route traffic through it; the route table must have explicit routes for the destination CIDRs with the inspection VPC attachment as the target. Without these routes, traffic flows directly between VPCs, bypassing the firewall.

Answer

The Transit Gateway attachment for the inspection VPC is not associated with any route table.

Answer

The Network Firewall is not configured with the correct subnet IDs.

Answer

The Network Firewall policy is not attached to the firewall.