ANS-C01 Practice Exam 63 — 20 Questions

Question 1

A company is designing a network architecture for a critical application that must be highly available across AWS Regions. The application uses an Application Load Balancer (ALB) in each Region, and the company wants to use a global DNS name that automatically routes traffic to the healthy Region with the lowest latency. The company also needs to be able to perform planned failover for maintenance. Which THREE components are required to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon Route 53 weighted routing policy for each ALB endpoint. The correct components are a latency-based routing policy to automatically route to the lowest latency healthy region, health checks to determine endpoint health, and a weighted routing policy to enable planned failover by adjusting weights. While latency and weighted routing policies cannot be used simultaneously on the same record set, the question tests the knowledge of the required policies: latency for automatic routing, health checks for failover, and weighted for manual traffic shifting during maintenance. In practice, you would implement latency-based routing with health checks, and for planned maintenance, you would temporarily change the routing policy to weighted or use a separate record.

Answer

Amazon Route 53 geolocation routing policy

Answer

Amazon Route 53 failover routing policy

Question 2

A company has an Amazon Route 53 private hosted zone associated with a VPC. The company wants to resolve custom domain names for resources within that VPC. Which configuration is required for EC2 instances in the VPC to resolve these private hosted zone records?

Accepted Answer

Ensure that the VPC has the enableDnsHostnames and enableDnsSupport attributes set to true. For EC2 instances in a VPC to resolve records in a Route 53 private hosted zone, the VPC must have both the `enableDnsHostnames` and `enableDnsSupport` attributes set to `true`. These settings enable the VPC's built-in DNS resolver (the Amazon-provided DNS server at the VPC's base CIDR +2 address) to query the private hosted zone and return the custom domain names to instances. Without these attributes, the VPC DNS resolver cannot perform resolution for private hosted zones, even if the zone is associated with the VPC.

Answer

Configure a Route 53 Resolver inbound endpoint in the VPC

Answer

Create a Route 53 Resolver outbound endpoint in the VPC

Answer

Establish a VPC peering connection with the Route 53 hosted zone

Question 3

A company is designing a multi-region architecture with an active-active setup. They need to route traffic to the nearest healthy endpoint. Which AWS service should they use?

Accepted Answer

Amazon Route 53 latency-based routing. Amazon Route 53 latency-based routing directs traffic to the AWS Region that provides the lowest latency for the end user, based on measurements between the user's DNS resolver and AWS endpoints. It also supports health checks, automatically excluding unhealthy endpoints from the routing pool, which enables an active-active multi-region architecture by routing each request to the nearest healthy endpoint. AWS Global Accelerator also routes to the nearest healthy endpoint but uses anycast IPs at the network layer, making it more suitable for optimizing TCP/UDP traffic rather than general DNS-level routing.

Answer

Application Load Balancer (ALB)

Answer

AWS Global Accelerator

Answer

Amazon CloudFront

Question 4

A company is using AWS Direct Connect with a private virtual interface (VIF) to connect its on-premises data center to a VPC. The VPC has a virtual private gateway (VGW) attached. The company has recently added a second VPC and wants to use the same Direct Connect connection to access both VPCs. The network engineer proposes using a Direct Connect gateway (DXGW) with two private VIFs, one for each VPC. However, the engineer wants to minimize complexity and cost. Which configuration should the engineer use to allow both VPCs to use the same Direct Connect connection?

Accepted Answer

Create a Direct Connect gateway and associate it with the private VIF. Then associate both VPCs' virtual private gateways with the Direct Connect gateway.. A Direct Connect gateway (DXGW) can be associated with a single private virtual interface (VIF) and then attached to multiple virtual private gateways (VGWs) in different VPCs, allowing both VPCs to use the same Direct Connect connection with minimal complexity and cost. Option B is incorrect because it requires creating two private VIFs, increasing cost and complexity. Option C is incorrect because a public VIF is used for accessing public AWS services, not for connecting to VPCs. Option D is incorrect because a single private VIF cannot be directly attached to multiple VPCs; a DXGW is needed to aggregate the connections.

Answer

Create a private VIF for each VPC on the same Direct Connect connection.

Answer

Create a public virtual interface on the Direct Connect connection and attach both VPCs to it.

Answer

Create a single private VIF and attach both VPCs directly to it.

Question 5

A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application experiences intermittent timeouts during peak hours. The network team suspects that the security group or network ACL is misconfigured. They enable VPC Flow Logs and notice that outbound traffic from the ALB to the EC2 instances on port 8080 shows 'ACCEPT' records, but the ALB returns 504 errors. The ALB health check is configured to hit the EC2 instances on port 8080/health. What is the most likely cause of the 504 errors?

Accepted Answer

The ALB idle timeout is set too low, and the application takes longer to respond.. The ALB idle timeout is set too low. When the application takes longer than the idle timeout to respond, the ALB terminates the connection and returns a 504 error. Flow logs show ACCEPT for traffic from ALB to EC2 on port 8080, indicating no network ACL or security group blocking. Option A is incorrect because a blocking NACL would show REJECT records. Option B is incorrect because security groups are stateful; outbound rules on the EC2 instance are not needed for returning traffic to the ALB. Option C is incorrect because a misconfigured health check path would cause the ALB to mark targets as unhealthy, leading to 503 errors rather than intermittent 504s.

Answer

The network ACL for the private subnet is blocking inbound traffic from the ALB.

Answer

The security group for the EC2 instances is missing an outbound rule to allow traffic from the ALB.

Answer

The health check path is incorrectly configured, causing the ALB to mark all targets as unhealthy.

Question 6

A company needs to provide internet access to instances in a private subnet. The instances must not be directly accessible from the internet. Which AWS service should be used?

Accepted Answer

NAT Gateway. A NAT Gateway enables instances in a private subnet to initiate outbound IPv4 traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet. It resides in a public subnet with an Elastic IP and uses source network address translation (SNAT) to translate the private IPs of the instances to the gateway's public IP, ensuring the instances remain inaccessible from the outside.

Answer

VPC Peering

Answer

AWS Direct Connect

Answer

Internet Gateway

Question 7

Refer to the exhibit. An EC2 instance in a VPC is assigned a public IP via an Elastic IP address. The instance is not reachable from the internet, although it has a security group allowing inbound HTTP traffic from 0.0.0.0/0. The VPC has an Internet Gateway attached to the route table of the subnet. What is the MOST likely cause?

Accepted Answer

The subnet route table does not have a default route (0.0.0.0/0) to the Internet Gateway. The most likely cause is that the subnet's route table lacks a default route (0.0.0.0/0) pointing to the Internet Gateway (IGW). Without this route, traffic destined for the internet from the instance has no path to the IGW, and return traffic from the internet cannot reach the instance. Even with a public Elastic IP and a permissive security group, the VPC's routing logic prevents internet-bound packets from being forwarded to the IGW.

Answer

The source/destination check is enabled and should be disabled

Answer

The security group is blocking inbound traffic

Answer

The Elastic IP is not correctly associated with the instance

Question 8

A company needs to connect multiple VPCs to a common on-premises network through a single AWS Direct Connect connection. Which AWS service should be used to simplify this architecture?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway acts as a central hub to interconnect multiple VPCs and on-premises networks through a single Direct Connect connection. It simplifies the architecture by replacing complex mesh or star topologies with a single gateway that manages routing and attachments, reducing operational overhead and cost.

Answer

AWS VPN CloudHub

Answer

VPC peering

Answer

Virtual Private Gateway (VGW)

Question 9

A company is using a centralized egress VPC model with a NAT gateway for outbound traffic from multiple VPCs. The network team notices that some EC2 instances are having connectivity timeouts when accessing the internet. The team has verified the route tables and security groups. Which additional check should be performed to troubleshoot the issue?

Accepted Answer

Check the NAT gateway CloudWatch metrics for error packets and connection counts. NAT Gateway CloudWatch metrics, specifically `ErrorPortAllocation` and `PacketsDropCount`, directly indicate whether the NAT Gateway is running out of available ports or dropping packets due to connection limits. In a centralized egress model with multiple VPCs, high connection counts can exhaust the NAT Gateway's ephemeral port capacity (65,535 per IP), causing connectivity timeouts even when route tables and security groups are correctly configured.

Answer

Check the security group rules for outbound traffic

Answer

Check the VPC Flow Logs for denied traffic

Answer

Check the route tables for the internet gateway

Question 10

A company has multiple VPCs connected via AWS Transit Gateway. One VPC contains a shared services endpoint (e.g., Amazon S3) using a VPC Gateway Endpoint. How can other VPCs access this endpoint?

Accepted Answer

Create Gateway Endpoints in each VPC that needs access. A VPC Gateway Endpoint is a regional service that uses route table entries to direct traffic to AWS services like S3 or DynamoDB without leaving the AWS network. Since Gateway Endpoints are not transitive across VPCs, each VPC that needs to access the shared S3 endpoint must have its own Gateway Endpoint created in that VPC, with the appropriate route table entries pointing to the endpoint. The Transit Gateway does not propagate Gateway Endpoint routes, so other VPCs cannot reach the endpoint through the Transit Gateway alone.

Answer

Use AWS PrivateLink to access the S3 endpoint

Answer

Configure Direct Connect to access the endpoint

Answer

Create a route in Transit Gateway pointing to the endpoint

Question 11

A company wants to allow its developers to access Amazon RDS databases from their on-premises network without traversing the public internet. Which solution meets this requirement?

Accepted Answer

Establish an AWS Site-to-Site VPN connection. An AWS Site-to-Site VPN connection establishes a secure, encrypted tunnel between the on-premises network and the Amazon VPC, allowing resources like RDS databases to be accessed privately without traversing the public internet. Option A is incorrect because a NAT gateway enables outbound internet traffic from a private subnet, not inbound private access from on-premises. Option B is incorrect because while Amazon RDS supports interface VPC endpoints, these endpoints are only accessible from within the VPC and do not provide connectivity from an on-premises network; a VPC endpoint alone does not meet the requirement. Option C is incorrect because VPC Peering connects two VPCs within AWS, not an on-premises network to a VPC.

Answer

Use a NAT gateway in the VPC

Answer

Create a VPC endpoint for RDS

Answer

Configure VPC Peering between the on-premises network and the VPC

Question 12

Match each AWS Direct Connect term to its definition.

Accepted Answer

Virtual Interface (VIF): A logical connection over a Direct Connect line that connects to a VPC or other AWS services.. Correct matches: VIF is a logical connection; Direct Connect Gateway interconnects VPCs and on-premises. Common confusions: LAG is a bundle of physical connections, not a VPN endpoint; VGW is a VPN endpoint, not a bundle.

Answer

Link Aggregation Group (LAG): The AWS VPN endpoint that provides connectivity to on-premises networks over IPsec.

Answer

Virtual Private Gateway (VGW): A bundle of multiple physical connections aggregated to increase bandwidth and provide redundancy.

Question 13

A company is deploying a VPC with both public and private subnets. They have an EC2 instance in a private subnet that needs to access the internet for software updates. Which AWS service should be placed in a public subnet to enable this?

Accepted Answer

NAT gateway. A NAT gateway is correct because it enables EC2 instances in a private subnet to initiate outbound connections to the internet (e.g., for software updates) while preventing the internet from initiating inbound connections to those instances. The NAT gateway must be placed in a public subnet with an associated Internet Gateway to translate private IP addresses to the public IP of the NAT gateway for outbound traffic.

Answer

Internet gateway

Answer

VPC endpoint

Answer

Direct Connect virtual interface

Question 14

A company is building a hybrid network with an AWS Transit Gateway connecting multiple VPCs and an on-premises network via Direct Connect. The on-premises network uses BGP to advertise routes to the Transit Gateway. One of the VPCs has an overlapping CIDR (10.0.0.0/16) with the on-premises network (10.0.0.0/8). The company wants to ensure that traffic from other VPCs to 10.0.0.0/16 goes to the VPC, not on-premises. What configuration is required?

Accepted Answer

No additional configuration is needed; the more specific route will be preferred automatically. AWS Transit Gateway route tables follow the longest prefix match rule. The VPC advertises 10.0.0.0/16, which is a more specific route than the on-premises 10.0.0.0/8. Therefore, traffic destined for 10.0.0.0/16 will automatically be forwarded to the VPC attachment without any additional configuration.

Answer

Use AS_PATH prepending on the on-premises BGP advertisements to make them less preferred

Answer

Add a static route in the Transit Gateway route table for 10.0.0.0/16 pointing to the VPC attachment

Answer

Disable route propagation from the Direct Connect virtual interface to the Transit Gateway

Question 15

A network engineer needs to verify the routing path between two EC2 instances in different subnets within the same VPC. Which AWS tool can provide this information?

Accepted Answer

VPC Reachability Analyzer. VPC Reachability Analyzer can test connectivity and provide the routing path between two resources in the same VPC. Option A is incorrect because Amazon CloudWatch Logs is used for collecting log data, not for analyzing network paths. Option C is incorrect because AWS Config tracks configuration changes and compliance, not real-time path analysis. Option D is incorrect because running traceroute is not an AWS tool; it is a manual command-line utility that requires access to the instances and does not provide a holistic view of the VPC routing path.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Run traceroute from one instance to the other

Question 16

A company has deployed a web application behind an Application Load Balancer (ALB) in a VPC. The ALB is in public subnets, and the web servers are in private subnets. The ALB is configured with a target group pointing to the web servers. Users report intermittent 503 errors. The web servers are healthy according to the target group health checks. What is the most likely cause?

Accepted Answer

The ALB subnets do not have a route to an internet gateway. An internet-facing ALB must be deployed in public subnets that have a route to an internet gateway. Since the web servers are healthy but users get intermittent 503 errors, the issue is likely that the ALB's subnets lack a route to an internet gateway, preventing the ALB from sending responses to clients. Option B is wrong because a long health check interval would not cause 503 errors if the targets are healthy. Option C is wrong because the ALB is described as being in public subnets and should be internet-facing; if it were internal, it would not receive internet traffic. Option D is wrong because cross-zone load balancing being disabled affects traffic distribution but does not cause intermittent 503 errors when targets are healthy.

Answer

The target group health check interval is too long

Answer

The ALB is configured as internal instead of internet-facing

Answer

Cross-zone load balancing is disabled

Question 17

A company is designing a highly available architecture for a web application using an Application Load Balancer (ALB) across multiple Availability Zones. The application requires that user sessions are maintained (sticky sessions) and that the ALB can offload SSL/TLS termination. Which configuration should they use?

Accepted Answer

Create an Application Load Balancer with a target group that has stickiness enabled and an HTTPS listener that terminates SSL.. An Application Load Balancer (ALB) natively supports both sticky sessions (via a generated cookie or application-based cookie) and SSL/TLS termination at the HTTPS listener. This allows the ALB to decrypt traffic before forwarding it to targets over HTTP, reducing backend processing overhead while maintaining session affinity across multiple Availability Zones for high availability.

Answer

Create a Network Load Balancer with a target group that has stickiness enabled and an SSL listener.

Answer

Launch EC2 instances as reverse proxy servers in front of the application servers, configure SSL on the reverse proxy, and use an Application Load Balancer to distribute traffic to the reverse proxies.

Answer

Create a Classic Load Balancer with sticky sessions and SSL termination.

Question 18

A company needs to connect its on-premises data center to AWS with a dedicated, private network connection that provides consistent performance. Which AWS service should they use?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet. This ensures consistent, low-latency performance and can reduce bandwidth costs for high-volume data transfer, making it the ideal choice for the stated requirement.

Answer

Internet Gateway

Answer

VPC Endpoint

Answer

Site-to-Site VPN

Question 19

Refer to the exhibit. A CloudFormation template creates a VPC with public and private subnets. The template includes an Internet Gateway and a route table with a default route to the IGW, associated with the public subnet. An EC2 instance launched in the public subnet cannot be reached from the internet. The security group allows inbound HTTP from 0.0.0.0/0. What is the MOST likely missing resource?

Accepted Answer

An Elastic IP address assigned to the instance or auto-assign public IP enabled on the subnet. The EC2 instance in the public subnet cannot be reached from the internet because it lacks a publicly routable IP address. Even though the subnet has a default route to the Internet Gateway (IGW) and the security group allows inbound HTTP from 0.0.0.0/0, the instance must have either an Elastic IP address assigned directly or the subnet must have the 'Auto-assign public IPv4 address' attribute enabled. Without a public IP, the IGW cannot perform 1-to-1 NAT to translate the instance's private IP to a public IP, making it unreachable from the internet.

Answer

A VPN connection to the VPC

Answer

A NAT Gateway in the public subnet

Answer

A route table for the private subnet

Question 20

Which THREE of the following are required to establish a highly available site-to-site VPN connection between an on-premises network and an AWS VPC? (Choose three.)

Accepted Answer

Two VPN tunnels (one primary, one secondary). AWS Site-to-Site VPN requires two tunnels per VPN connection to provide high availability. Each tunnel uses separate endpoints and paths; if one tunnel fails, traffic automatically fails over to the other. This design ensures continuous connectivity even during maintenance or failures.

Answer

Two separate VPN connections

Answer

An AWS Direct Connect connection