ANS-C01 Practice Exam 63 — 20 Questions

Question 1

A company is deploying a new application in a VPC that requires high throughput and low latency for traffic between instances in different subnets within the same Availability Zone. The instances are in private subnets and use a Network Load Balancer (NLB) for internal traffic distribution. The company wants to minimize data transfer costs and ensure that traffic does not leave the Availability Zone. Which configuration should the network engineer implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disable cross-zone load balancing on the NLB and place targets only in the same Availability Zone as the NLB nodes.. To keep traffic within the same Availability Zone and minimize costs, cross-zone load balancing must be disabled on the NLB. With cross-zone disabled, each NLB node routes only to targets in its own Availability Zone. Placing targets only in the same zone as the NLB nodes ensures that all traffic remains local, achieving low latency and avoiding cross-AZ data transfer charges.

Answer

Use an Application Load Balancer (ALB) instead of an NLB and enable sticky sessions.

Answer

Enable cross-zone load balancing on the NLB and ensure all targets are in the same Availability Zone.

Answer

Configure the NLB with a target group that uses the 'ip' target type and register instances from all Availability Zones.

Question 2

A healthcare company is deploying a multi-VPC environment with a central transit gateway in us-east-1. The security team requires that traffic between the production VPC and the shared-services VPC be inspected by a third-party appliance VPC, while all VPCs must retain the ability to reach an on-premises network over a Site-to-Site VPN attached to the transit gateway. The company uses non-overlapping RFC 1918 CIDRs throughout. Which TWO design elements are required to meet these requirements? (Choose two.)

Accepted Answer

Enable appliance mode on the transit gateway attachment for the appliance VPC so that flow symmetry is maintained for traffic passing through the appliance.. Steering inter-VPC traffic through a third-party appliance requires transit gateway route tables and static routes that point the inspected VPC attachments at the appliance attachment, plus appliance mode so stateful inspection sees symmetric flows. Together these elements force traffic through the appliance and keep return packets on the same Availability Zone path.

Answer

Attach an internet gateway to the appliance VPC and route inspected traffic through the internet gateway to force symmetric return paths.

Answer

Configure a transit gateway Connect attachment using GRE and BGP between each VPC and the appliance VPC to carry inspected traffic.

Answer

Create a separate transit gateway in each VPC and peer the transit gateways together to isolate production traffic from shared services.

Question 3

A company uses AWS Transit Gateway to connect 50 VPCs across multiple AWS accounts. The network team notices that traffic between two VPCs attached to the same transit gateway is being dropped. The VPC route tables have routes pointing to the transit gateway, and the transit gateway route table has a default route to a blackhole. The attachments for both VPCs are in the 'available' state. What is the most likely reason for the dropped traffic?

Accepted Answer

The transit gateway route table lacks a specific route for the destination VPC CIDR, and the default route points to a blackhole.. Transit gateway route tables use longest prefix match for route selection. If a default route (0.0.0.0/0) points to a blackhole and no more specific route exists for the destination VPC CIDR, traffic matching the default route is dropped. The VPC route tables correctly direct traffic to the transit gateway, but the transit gateway cannot forward it because the only matching route is a blackhole. Adding a specific route for the destination VPC CIDR to the correct attachment resolves the issue.

Answer

The transit gateway route table has a default route to a blackhole, which takes precedence over more specific routes.

Answer

The VPC route tables are missing a route to the transit gateway for the destination VPC CIDR.

Answer

The transit gateway attachments for the VPCs are in different AWS accounts, which prevents routing between them.

Question 4

A network engineer is designing connectivity for a VPC that will host a three-tier web application. The application tier must reach an Amazon RDS for MySQL database, and the engineering team wants to enforce that all database traffic stays on the AWS backbone and never traverses the public internet. The database resides in a different VPC in the same AWS account and Region, and the two VPCs are already peered. Which configuration should the engineer implement to meet the requirement with the LEAST operational overhead?

Accepted Answer

Configure the VPC peering connection with routes in both route tables pointing to the peer CIDR, and restrict the RDS security group to accept traffic only from the application tier's security group.. Because the two VPCs are already peered in the same Region, adding reciprocal routes for the peer CIDR and tightening the RDS security group keeps all database traffic on the private AWS backbone with no new infrastructure. Peering traffic does not traverse the public internet, so the requirement is met without introducing an NLB, endpoint service, or NAT gateway.

Answer

Deploy a NAT gateway in the database VPC and route application-tier traffic through it to reach the RDS endpoint.

Answer

Create an AWS PrivateLink endpoint service in the database VPC backed by a Network Load Balancer, and create an interface VPC endpoint in the application VPC.

Answer

Attach an internet gateway to both VPCs and add routes so the application tier can reach the database over its public endpoint.

Question 5

A company runs a global web application behind Amazon Route 53. They want to route users to the closest healthy endpoint and automatically fail over if an endpoint becomes unhealthy. The endpoints are Application Load Balancers in three Regions. The network team must also ensure that users in a specific country are always routed to a designated Region for data residency, regardless of latency. Which Route 53 configuration should the team implement?

Accepted Answer

A latency-based routing policy with health checks on all three Regions and a geolocation routing policy for the specific country.. Latency-based routing with health checks sends users to the lowest-latency healthy endpoint and provides automatic failover when an endpoint is unhealthy. Adding a geolocation record for the specific country enforces data residency because Route 53 prefers a matching geolocation record over latency records for those users. This combination satisfies both proximity-based routing and residency in one hosted zone.

Answer

A failover routing policy with a primary record for the designated Region and secondary records for the other two Regions.

Answer

A multivalue answer routing policy with health checks and a geolocation record for the specific country.

Answer

A weighted routing policy with equal weights for all three Regions and a geolocation record for the specific country.

Question 6

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They have a centralized security VPC that hosts AWS Network Firewall for inspecting traffic between VPCs. The security team wants to ensure that all inter-VPC traffic is inspected by the firewall, but they notice that some traffic between two VPCs is bypassing the firewall. What is the most likely cause and how to fix it?

Accepted Answer

The transit gateway route tables are not configured to route traffic through the security VPC. Update the route tables to send traffic to the security VPC attachment.. Transit gateway route tables control the flow of traffic between attachments. To force all inter-VPC traffic through the security VPC for inspection, the route tables associated with the source and destination VPC attachments must have routes that point to the security VPC attachment. If these routes are missing or incorrect, traffic will use a direct path between VPCs, bypassing the firewall. The fix is to update the transit gateway route tables to route traffic through the security VPC attachment.

Answer

The VPCs are using a peering connection instead of the transit gateway. Remove the peering connection and force traffic through the transit gateway.

Answer

The security VPC's firewall subnet route table does not have a route back to the source VPC. Add a route to the source VPC CIDR.

Answer

The AWS Network Firewall is not configured with a rule group that allows the traffic. Add a rule to allow the traffic.

Question 7

A company has a VPC with a CIDR block of 10.0.0.0/16. They have a subnet with CIDR 10.0.1.0/24 that hosts a web server. The company wants to allow inbound HTTP traffic from the internet to the web server. They have configured an internet gateway and a route in the subnet's route table to the internet gateway. They have also configured a security group allowing inbound TCP port 80 from 0.0.0.0/0. However, users cannot access the web server. What is the most likely cause?

Accepted Answer

The network ACL for the subnet is denying inbound traffic on port 80.. The most likely cause is that the network ACL for the subnet is denying inbound traffic on port 80. Network ACLs are stateless and must explicitly allow both inbound and outbound traffic. Even if the security group allows the traffic, the network ACL can block it. This is a common oversight when troubleshooting connectivity.

Answer

The security group is not associated with the web server's network interface.

Answer

The route table for the subnet does not have a route to the internet gateway.

Answer

The web server's operating system firewall is blocking port 80.

Question 8

A company runs a Transit Gateway with several VPC attachments and a Site-to-Site VPN attachment to an on-premises data center. On-premises servers must resolve and reach an Amazon Route 53 private hosted zone that is associated with one spoke VPC. The network team has already created the Transit Gateway, attached the VPCs and VPN, and added routes. Name resolution from on-premises still fails. Which configuration change is required?

Accepted Answer

Configure a Route 53 Resolver inbound endpoint in the VPC that owns the private hosted zone and point the on-premises DNS forwarder at its IP addresses.. On-premises DNS resolution of a private hosted zone requires a Route 53 Resolver inbound endpoint placed in the VPC that has the zone associated. The on-premises DNS forwarder then targets the endpoint IPs over the hybrid connection. Outbound endpoints handle the opposite direction, and Transit Gateway associations do not exist for hosted zones.

Answer

Enable DNS support and DNS hostnames on every VPC attached to the Transit Gateway.

Answer

Create a Route 53 Resolver outbound endpoint and a resolver rule that forwards the on-premises domain to the on-premises DNS servers.

Answer

Associate the private hosted zone with the Transit Gateway so that all attached VPCs and the VPN can resolve it.

Question 9

A startup is deploying a web application in a single VPC. The application instances run in private subnets and must download software patches from the internet during boot. The security team does not want to attach public IP addresses to the instances or expose them through an internet gateway. Which AWS service should the network engineer configure to allow outbound internet access for the private instances?

Accepted Answer

A NAT gateway placed in a public subnet, with a route in the private subnet route table pointing 0.0.0.0/0 to the NAT gateway.. A NAT gateway in a public subnet allows instances in private subnets to initiate outbound connections to the internet without receiving inbound connections or requiring public IP addresses. The private subnet route table must have a default route pointing to the NAT gateway for this to work.

Answer

A Gateway Load Balancer endpoint in the private subnet, with a route in the private subnet route table pointing 0.0.0.0/0 to the endpoint.

Answer

An internet gateway attached to the VPC, with a route in the private subnet route table pointing 0.0.0.0/0 to the internet gateway.

Answer

A virtual private gateway attached to the VPC, with a route in the private subnet route table pointing 0.0.0.0/0 to the virtual private gateway.

Question 10

A company uses AWS Organizations to manage multiple AWS accounts. They want to enforce that all VPCs in all accounts have flow logs enabled and that any attempt to disable flow logs is automatically remediated. Which combination of AWS services should they use to achieve this with the least operational overhead?

Accepted Answer

AWS Config with an organization-wide aggregator and automatic remediation using AWS Systems Manager Automation.. AWS Config with an organization-wide aggregator can monitor VPC flow log status across all accounts. It evaluates resources against desired configurations and can trigger automatic remediation using AWS Systems Manager Automation. This combination provides centralized, automated enforcement with low operational overhead.

Answer

AWS CloudTrail with Amazon CloudWatch Events and AWS Lambda functions in each account.

Answer

AWS Security Hub with custom insights and manual remediation.

Answer

AWS Trusted Advisor with organizational view and AWS Lambda remediation.

Question 11

A company is deploying a multi-tier application in a VPC. The web tier runs in a public subnet and must be accessible from the internet. The application tier runs in a private subnet and must initiate outbound connections to the internet for software updates, but must not be directly accessible from the internet. The company wants to minimize cost and management overhead. Which solution meets these requirements?

Accepted Answer

Attach an internet gateway to the VPC, place the web tier in a public subnet with a route to the internet gateway, and place the application tier in a private subnet with a route to a NAT gateway. The standard design uses an internet gateway for the public subnet and a NAT gateway for the private subnet. This allows the web tier to be internet-facing and the application tier to initiate outbound connections without inbound internet access. A NAT gateway is managed by AWS, reducing operational overhead compared to a NAT instance.

Answer

Use an internet gateway for both subnets and assign Elastic IP addresses to the application tier instances

Answer

Use AWS PrivateLink to provide outbound internet access for the application tier

Answer

Use a NAT instance instead of a NAT gateway for the application tier to reduce cost

Question 12

A company is deploying a global application that uses Amazon Route 53 for DNS. The application is hosted in two AWS Regions, each with an Application Load Balancer. The company wants to route users to the Region that provides the lowest latency, but also wants to be able to shift traffic away from a Region during maintenance. The company needs the ability to control the proportion of traffic sent to each Region during the shift. Which Route 53 routing policy should be used?

Accepted Answer

Weighted routing with health checks, where weights are adjusted to shift traffic between Regions.. Weighted routing is the only Route 53 routing policy that lets you specify the proportion of traffic sent to each resource record set. By adjusting weights, you can shift traffic gradually between Regions, which is ideal for maintenance. Health checks can be added to automatically remove an unhealthy Region. Latency-based routing optimizes for latency but does not offer proportional control, while failover and geolocation routing do not support gradual traffic shifting.

Answer

Geolocation routing with a default record and health checks.

Answer

Failover routing with a primary and secondary record and health checks.

Answer

Latency-based routing with health checks and a failover record for each Region.

Question 13

A network engineer is designing a VPC that uses a Gateway Load Balancer to insert a third-party firewall appliance fleet into the traffic path for east-west and inbound flows. The engineer needs to ensure that the Gateway Load Balancer endpoint and target appliances function correctly. Which TWO actions are required? (Choose two.)

Accepted Answer

Create a Gateway Load Balancer endpoint in the consumer VPC and update the route tables to send traffic to that endpoint.. The two essential pieces are the Gateway Load Balancer endpoint in the consumer VPC with route table entries that steer traffic to it, and the target group that registers the appliances using GENEVE on port 6081. Together they form the transparent bump-in-the-wire path that the firewall fleet inspects.

Answer

Attach an internet gateway to the appliance VPC and assign public IP addresses to the appliance instances.

Answer

Create a Network Load Balancer in front of the appliances and point the Gateway Load Balancer endpoint to the Network Load Balancer.

Answer

Enable client IP preservation on the Gateway Load Balancer target group.

Question 14

A network engineer is analyzing a VPC Flow Log that records traffic for an EC2 instance. The log shows a record with source IP 10.0.1.5, destination IP 10.0.2.10, source port 49152, destination port 443, protocol 6, and action NODATA. The engineer needs to determine what this record signifies. What does the NODATA action indicate in this context?

Accepted Answer

No packets were captured for this flow during the aggregation interval.. NODATA in VPC Flow Logs means that no packets were captured for the specified flow during the aggregation interval. This can occur when traffic is blocked before reaching the logging point, or when no traffic was sent. The engineer should investigate potential causes such as security group rules, network ACLs, or routing issues. Unlike REJECT, which explicitly indicates a denial, NODATA is ambiguous and requires further analysis to determine why no packets were seen.

Answer

The traffic was allowed by the security group but denied by the network ACL.

Answer

The flow was rejected by a security group rule.

Answer

The flow log record is incomplete and will be updated later.

Question 15

A network engineer is deploying a new AWS Transit Gateway to connect multiple VPCs and on-premises networks. The engineer needs to ensure that the TGW can route traffic between all attachments and that the necessary route table associations and propagations are configured. Which two actions should the engineer take to meet these requirements? (Choose two.)

Accepted Answer

Create a TGW route table and associate all VPC and VPN attachments with it.. To enable full routing between all attachments on a Transit Gateway, you must associate each attachment with a TGW route table and enable route propagation. Association determines which route table an attachment uses for forwarding, and propagation populates that route table with routes from the attachment. Without both, traffic cannot be routed correctly. Static routes and other methods are not required for basic full-mesh connectivity.

Answer

Create a VPC peering connection between each VPC and the TGW.

Answer

Attach an Internet Gateway to the TGW to allow internet access.

Answer

Configure a static route in the TGW route table pointing to each attachment.

Question 16

A company has a VPC with a CIDR block of 10.0.0.0/16 and an on-premises network of 192.168.0.0/16, connected by an AWS Site-to-Site VPN. The company now wants to add a second VPC with a CIDR block of 10.1.0.0/16 in the same Region and allow instances in both VPCs to communicate with each other and with on-premises resources. The company wants to minimize the number of VPN tunnels and simplify routing. Which design should a network engineer implement?

Accepted Answer

Attach both VPCs to an AWS Transit Gateway, create a VPN attachment on the transit gateway, and associate the VPC and VPN attachments with the same transit gateway route table.. A transit gateway is a regional routing hub that lets multiple VPCs and a single VPN attachment share one route table. Attaching both VPCs and the VPN to the transit gateway and associating them with the same route table gives the VPCs connectivity to each other and to on-premises through one set of tunnels, which minimizes tunnels and simplifies routing as required.

Answer

Create a second Site-to-Site VPN connection from the on-premises customer gateway to the second VPC's virtual private gateway, and configure BGP between the two.

Answer

Replace the VPN with an AWS Direct Connect connection to the first VPC and use a transit gateway only for the second VPC's outbound internet access through a NAT gateway.

Answer

Create a VPC peering connection between the two VPCs and add a route in each VPC's route table pointing to the peering connection for the other VPC's CIDR block, while leaving the existing VPN attachment on the first VPC.

Question 17

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to add a second CIDR block to the VPC to accommodate additional subnets. Which AWS action allows this?

Accepted Answer

Associate a new CIDR block with the VPC using the AWS Management Console or CLI.. AWS VPCs support multiple CIDR blocks. You can associate additional IPv4 CIDR blocks with a VPC to expand its address space. The new CIDR must not overlap with existing CIDRs or routes. This is done via the console, CLI, or API. Other options either do not expand the VPC's CIDR or are not supported.

Answer

Create a new VPC with the additional CIDR and peer it with the existing VPC.

Answer

Use AWS Resource Access Manager to share a subnet from another VPC.

Answer

Modify the existing CIDR block to a larger size.

Question 18

A company uses AWS Client VPN to allow employees to access resources in a VPC. The VPC has a CIDR of 10.0.0.0/16. The Client VPN endpoint is associated with a subnet in the VPC. Users can connect to the VPN but cannot access an EC2 instance in a private subnet with IP 10.0.2.10. The security group on the EC2 instance allows all inbound traffic from the VPC CIDR. The Client VPN endpoint's security group allows all outbound traffic. What is the most likely cause?

Accepted Answer

The Client VPN endpoint does not have an authorization rule that allows access to the VPC CIDR.. Client VPN endpoints require authorization rules to allow clients to access network resources. Without an authorization rule that permits access to the VPC CIDR, clients cannot reach resources in the VPC, even if security groups and routes are correctly configured. The authorization rule is a separate access control mechanism specific to Client VPN.

Answer

The Client VPN endpoint's route table does not have a route to the VPC CIDR.

Answer

The Client VPN endpoint is associated with a subnet that does not have a route to the private subnet.

Answer

The EC2 instance's network ACL is blocking inbound traffic from the VPN clients.

Question 19

A company has an on-premises data center and a VPC connected via AWS Site-to-Site VPN. They want to ensure that traffic from the on-premises network to the VPC is encrypted and that the VPN connection uses dynamic routing. Which configuration should they use?

Accepted Answer

Configure the VPN connection with dynamic routing and enable BGP on both the customer gateway and the virtual private gateway.. For dynamic routing over a Site-to-Site VPN, you must configure the VPN connection to use BGP. This requires BGP configuration on both the customer gateway and the AWS side (virtual private gateway or transit gateway). Static routes cannot be combined with BGP on the same VPN connection. Using a virtual private gateway is sufficient; a transit gateway is not required.

Answer

Configure the VPN connection with a static route and use a virtual private gateway with route propagation enabled.

Answer

Configure the VPN connection with dynamic routing and use a transit gateway instead of a virtual private gateway.

Answer

Configure the VPN connection with a static route and enable BGP on the customer gateway.

Question 20

A company is deploying a microservices application on Amazon ECS. The services need to communicate with each other using service discovery. The company wants to minimize operational overhead and ensure that service discovery works across multiple VPCs in the same Region. Which solution should they use?

Accepted Answer

Use AWS Cloud Map with a private DNS namespace and associate it with the VPCs that need to discover services.. AWS Cloud Map with a private DNS namespace is the recommended solution for service discovery across multiple VPCs. It supports automatic registration and deregistration of services, and private DNS namespaces can be shared across VPCs using AWS Resource Access Manager or by associating the namespace with multiple VPCs. This minimizes operational overhead and keeps traffic private.

Answer

Use Amazon Route 53 private hosted zones and manually create DNS records for each ECS task.

Answer

Use AWS App Mesh with virtual nodes and virtual services to handle service discovery.

Answer

Use AWS Cloud Map with a public DNS namespace and register services with public IP addresses.