ANS-C01 Practice Exam 63 — 20 Questions

Question 1

A company has a VPC with a public subnet and a private subnet. The public subnet has a bastion host (EC2) with a security group that allows SSH from a specific IP range. The private subnet has an RDS instance. The company wants to enable the bastion host to connect to the RDS instance. Which TWO steps are required?

Accepted Answer

Add a rule to the NACL for the private subnet to allow inbound traffic from the bastion host's IP.. The bastion host needs network-level access to the RDS instance. The RDS security group must allow inbound from the bastion's security group, and the bastion must be in the same VPC or have network connectivity. The NACL must allow the traffic.

Answer

Configure the RDS instance to use a custom DB parameter group with SSL enabled.

Answer

Assign a public IP address to the RDS instance.

Answer

Create a route in the public subnet's route table to the RDS instance.

Question 2

A company is using AWS Database Migration Service (DMS) to replicate data from an on-premises Oracle database to an Amazon RDS for Oracle instance. The replication is failing intermittently with connection timeouts. The network connectivity uses a Direct Connect private VIF. What should the network team investigate first?

Accepted Answer

The MTU settings on the on-premises router and the AWS Direct Connect interface.. Option B is correct because the MTU mismatch between on-premises and AWS can cause packet fragmentation or drops, leading to timeouts. Option A is wrong because security groups do not apply to on-premises traffic. Option C is wrong because routing is point-to-point, no internet. Option D is wrong because VPN is not used.

Answer

The route table of the VPC to ensure it has a route to the on-premises CIDR via the Direct Connect virtual interface.

Answer

The VPN connection status as a backup path.

Answer

The security group of the RDS instance to ensure it allows traffic from the on-premises IP range.

Question 3

A financial services company is deploying a multi-account environment using AWS Organizations. The security team requires that all network traffic to and from the internet must flow through a centralized inspection VPC that hosts third-party firewall appliances. The architecture uses a single AWS Transit Gateway with a centralized inspection VPC attached. Which THREE steps are necessary to enforce this architecture? (Choose THREE.)

Accepted Answer

Configure each VPC's route table with a default route (0.0.0.0/0) pointing to the transit gateway attachment.. Option A is correct because all VPCs need default routes pointing to the transit gateway for internet-bound traffic. Option C is correct because the inspection VPC must have routes to send inspected traffic to an egress VPC or Direct Connect for internet access. Option D is correct because the transit gateway route tables must be configured with blackhole routes or specific routes to force traffic through the inspection VPC. Option B is wrong because VPC endpoints do not route internet traffic. Option E is wrong because service control policies do not enforce routing.

Answer

Use AWS Organizations service control policies to prevent direct internet access from spoke VPCs.

Answer

Deploy VPC Gateway Endpoints for S3 and DynamoDB in each spoke VPC.

Question 4

A network engineer is troubleshooting connectivity issues from an on-premises network to an AWS VPC over a Site-to-Site VPN. The VPN tunnel status shows as UP. The on-premises network can ping the virtual private gateway (VGW) IP address, but cannot reach EC2 instances inside the VPC. What is the most likely cause?

Accepted Answer

The VPC route tables do not have a route to the on-premises network pointing to the virtual private gateway.. Option B is correct because the route table for the subnets must have a route to the on-premises network via the VGW. Option A is wrong because the tunnel is UP. Option C is wrong because security groups are stateful and allow return traffic. Option D is wrong because the VGW does not have security groups.

Answer

The VPN tunnel is not properly configured with the correct pre-shared key.

Answer

The security groups on the EC2 instances are blocking inbound traffic from the on-premises network.

Answer

The virtual private gateway has its own security group that blocks traffic.

Question 5

A company has a VPC with a public subnet hosting a web server. The security group for the web server allows inbound HTTP (port 80) from 0.0.0.0/0. The network ACL for the public subnet allows inbound HTTP from 0.0.0.0/0. Users report that they cannot access the website. The engineer verifies that the web server is running and has a public IP. What is the most likely issue?

Accepted Answer

The network ACL outbound rule is blocking return traffic.. Even if inbound rules allow traffic, if the network ACL's outbound rule (stateless) does not allow return traffic (ephemeral ports), the connection will fail. Security groups are stateful and allow return traffic automatically.

Answer

The web server is listening on a different port.

Answer

The internet gateway is not attached to the VPC.

Answer

The security group outbound rule is blocking return traffic.

Question 6

A company has a VPC with a NAT Gateway in a public subnet. The network team notices that instances in private subnets cannot access the internet. Reviewing the route tables, the private subnet route table has a default route (0.0.0.0/0) pointing to the NAT Gateway. What is the most likely cause of the issue?

Accepted Answer

The NAT Gateway's subnet route table does not have a default route pointing to an Internet Gateway.. The NAT Gateway must have a route to an Internet Gateway. If the NAT Gateway's subnet route table does not have a default route pointing to an IGW, it cannot route traffic to the internet. Security groups, NACLs, or EIP are less likely to be the issue.

Answer

The network ACL in the private subnet blocks outbound traffic.

Answer

The NAT Gateway does not have an Elastic IP address attached.

Answer

The security group attached to the NAT Gateway blocks outbound traffic.

Question 7

A company wants to centralize logging of VPC Flow Logs from multiple accounts into a single Amazon S3 bucket. The logs must be encrypted at rest using an AWS KMS CMK. What is the recommended approach?

Accepted Answer

Create a centralized S3 bucket with default encryption using a KMS CMK and a bucket policy that allows cross-account writes from the source accounts.. Option D is correct because using a centralized S3 bucket with appropriate bucket policies to allow cross-account writes and enabling default encryption with a KMS CMK is the best practice. Option A is wrong because SSE-S3 is not a CMK. Option B is wrong because enabling encryption at the flow log level uses SSE-S3 or CloudWatch Logs encryption, not S3 bucket encryption. Option C is wrong because bucket policies control access, not encryption.

Answer

Enable encryption on VPC Flow Logs using a KMS key in each account and aggregate logs using AWS Logs cross-account subscription.

Answer

Create a bucket with SSE-S3 encryption and have each account write flow logs directly.

Answer

Use a single bucket with a bucket policy that denies access unless encryption headers are present, and use a KMS key shared across accounts.

Question 8

A company has a VPC with an AWS Direct Connect private VIF connected to a virtual private gateway. The on-premises network uses BGP to advertise routes to AWS. The network team wants to ensure that only specific prefixes from on-premises are accepted. They configure the virtual private gateway with a BGP community. However, after configuration, they notice that all prefixes are still being accepted. What is the MOST likely reason?

Accepted Answer

The virtual private gateway does not filter routes based on BGP communities; you need to use a prefix list.. BGP communities are used for tagging routes, but the virtual private gateway does not filter based on communities by default. To filter, you must use a customer-managed prefix list or a route table that only accepts specific prefixes. Option C is correct. Option A is not a common issue. Option B is not required. Option D is false because BGP communities are supported.

Answer

The virtual private gateway needs to have the BGP community enabled.

Answer

The BGP community is not being advertised by the on-premises router.

Answer

The BGP community must be configured on the customer gateway device.

Question 9

A company manages multiple VPCs connected via a transit gateway. Each VPC has a VPN connection to an on-premises data center. The network team wants to monitor the bandwidth utilization on each VPN connection. Which approach is the most efficient?

Accepted Answer

Use Amazon CloudWatch metrics for the VPN tunnels.. Option A is correct because CloudWatch metrics for VPN tunnels provide bandwidth utilization. Option B is wrong because VPC Flow Logs are for packet-level logs, not metrics. Option C is wrong because AWS Config tracks configuration. Option D is wrong because Transit Gateway Network Manager provides topology, not bandwidth metrics.

Answer

Enable VPC Flow Logs on each VPC and aggregate them in CloudWatch Logs Insights.

Answer

Use Transit Gateway Network Manager to view VPN bandwidth.

Answer

Use AWS Config rules to monitor VPN bandwidth changes.

Question 10

A company uses AWS Direct Connect to connect its data center to a VPC. The VIF is up, and the BGP session is established. However, the on-premises router cannot ping the VPC's private IP addresses. Which configuration is most likely missing?

Accepted Answer

The VPC route table does not have a route pointing to the Virtual Private Gateway for the on-premises CIDR.. For traffic to reach VPC private IPs, the VPC route table must have a route pointing to the Virtual Private Gateway (VGW) for the on-premises CIDR. Even with BGP up, without this route, traffic won't be sent to the VGW.

Answer

The Direct Connect virtual interface is in the wrong VLAN.

Answer

The BGP password is incorrect.

Answer

The on-premises router is not advertising the VPC CIDR via BGP.

Question 11

A company is using AWS Direct Connect with a private VIF to connect its on-premises data center to a VPC. The network team wants to monitor the link health and receive alarms if the connection goes down. Which AWS service should they use?

Accepted Answer

Amazon CloudWatch with Direct Connect metrics.. Option A is correct because CloudWatch provides metrics for Direct Connect connections, such as connection state and BGP status, and can trigger alarms. Option B is wrong because VPC Flow Logs capture IP traffic logs, not link health. Option C is wrong because AWS Config tracks configuration changes, not operational status. Option D is wrong because Amazon Inspector is for security assessments.

Answer

Amazon Inspector.

Answer

AWS Config.

Answer

VPC Flow Logs.

Question 12

A company has a hybrid network with multiple VPCs connected via AWS Transit Gateway and an on-premises network via Direct Connect. The network team is planning to migrate a legacy application from on-premises to a new VPC. The application requires low-latency access to an RDS database running in an existing VPC. The team wants to minimize changes to the existing routing. What should the team do to meet these requirements?

Accepted Answer

Attach the new VPC to the existing transit gateway and ensure the transit gateway route tables permit traffic between the new VPC and the RDS VPC.. Option D is correct because attaching the new VPC to the existing transit gateway allows immediate connectivity to the RDS VPC without changing existing routes, provided the route tables are configured correctly. Option A is wrong because VPC peering requires route table updates in both VPCs. Option B is wrong because a VPN connection adds complexity and latency. Option C is wrong because moving the RDS instance changes the database endpoint and may cause downtime.

Answer

Set up a VPN connection from the new VPC to the on-premises network, and route traffic through on-premises to the RDS VPC.

Answer

Create a VPC peering connection between the new VPC and the RDS VPC.

Answer

Migrate the RDS database to the new VPC to keep the application and database in the same VPC.

Question 13

A company has an AWS Site-to-Site VPN connection between an on-premises network and a VPC. The VPN uses virtual private gateways and static routes. The network team reports that the VPN tunnel is up, but traffic from the on-premises network cannot reach some EC2 instances in the VPC. The EC2 instances have security groups that allow inbound traffic from the on-premises network. The VPC route table has a route pointing to the virtual private gateway for the on-premises CIDR. The tunnel status shows 'UP' from both sides. What is the MOST likely cause of the connectivity issue?

Accepted Answer

The VPC route table does not have a route for the on-premises subnet that the traffic originates from, but only for a larger CIDR.. The security group may be allowing traffic from the on-premises CIDR but not from the tunnel endpoint IP. However, the more common issue is that the on-premises network's source IP is being translated or the VPC route table is missing a route for the specific subnet. Option A is a typical cause: if the on-premises CIDR is not exactly matched, the VPC may not route traffic back. Option C could cause issues if the VPN is not in the main route table. Option D would cause tunnel issues.

Answer

The VPC has a network ACL that denies inbound traffic from the on-premises CIDR.

Answer

The customer gateway device is using a different pre-shared key than configured in AWS.

Answer

The virtual private gateway is not attached to the correct VPC.

Question 14

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. The network team needs to monitor the BGP session status for each VPN attachment. Which TWO services can be used to monitor BGP status and receive alerts if a session goes down?

Accepted Answer

Amazon CloudWatch Alarms on the BGP status metric.. Options A and D are correct. CloudWatch can monitor VPN tunnel metrics including BGP status, and CloudWatch Alarms can trigger alerts. Option B is wrong because VPC Flow Logs do not include BGP status. Option C is wrong because AWS Config does not monitor BGP. Option E is wrong because CloudTrail does not monitor BGP.

Answer

AWS Config rules.

Answer

VPC Flow Logs.

Answer

AWS CloudTrail logs.

Question 15

A company has a hybrid network with an AWS Direct Connect connection and an AWS Site-to-Site VPN as a backup. The network team notices that traffic is asymmetrically routing through both connections, causing performance issues. Which TWO steps should the team take to ensure traffic uses the primary Direct Connect and only fails over to the VPN? (Choose two.)

Accepted Answer

Configure BGP communities on the Direct Connect to influence route preference.. Option A is correct because adjusting the BGP metrics (AS path prepend or MED) on the Direct Connect side makes it preferred. Option D is correct because using a more specific prefix for the Direct Connect route attracts traffic to it. Option B is wrong because enabling VPN is not needed. Option C is wrong because disabling AS path prepend would make Direct Connect less preferred. Option E is wrong because increasing the VPN BGP metric would make VPN less preferred, but the goal is to prefer Direct Connect.

Answer

Increase the BGP MED value on the VPN connection to make it less preferred.

Answer

Enable VPN automatic failover using AWS VPN CloudHub.

Answer

Disable AS path prepend on the Direct Connect BGP session.

Question 16

A company has a VPC with a CIDR of 172.16.0.0/16. The VPC contains an Amazon RDS for MySQL database in a private subnet. The database is accessed by EC2 instances in the same VPC and by on-premises servers via a Site-to-Site VPN. The network team recently enabled VPC Flow Logs and noticed that the database is receiving a high number of SYN packets from an IP address that is not part of the VPC or on-premises network. The security group for the database only allows inbound traffic on port 3306 from the EC2 instances' security group and the on-premises CIDR (10.0.0.0/8). The network ACL for the database subnet allows inbound and outbound traffic on all ports from all sources. What is the most likely cause of the unexpected traffic?

Accepted Answer

The network ACL for the database subnet allows all inbound traffic, so packets from the internet reach the database subnet's network ACL before being evaluated by the security group.. Option B is correct because a network ACL is stateless and allows traffic from any source, including the internet, because it allows all inbound traffic. Even though the security group blocks the traffic, the NACL allows it, so the packets reach the NACL and are logged. Option A is wrong because the security group is blocking the traffic, not allowing it. Option C is wrong because RDS is not publicly accessible. Option D is wrong because the VPN is only for on-premises traffic; the IP is not from on-premises.

Answer

The security group for the database has an inbound rule that allows traffic from 0.0.0.0/0.

Answer

The RDS database has a public endpoint that is accessible from the internet.

Answer

The Site-to-Site VPN is misconfigured and routing internet traffic into the VPC.

Question 17

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises data centers. The network team notices that traffic between two VPCs is taking an unexpected path through the on-premises network instead of staying within the Transit Gateway. What is the most likely cause?

Accepted Answer

The on-premises network is advertising more specific routes via BGP that override the Transit Gateway routes.. Option B is correct because route propagation from the on-premises network via the VPN or Direct Connect can introduce more specific routes that override the local Transit Gateway routes. Option A is wrong because route tables are attached to the Transit Gateway, not specific VPC attachments. Option C is wrong because VPC peering is not used with Transit Gateway. Option D is wrong because subnet associations do not affect Transit Gateway routing.

Answer

The Transit Gateway route table is not associated with the VPC attachments.

Answer

The VPC subnet route tables are not pointing to the Transit Gateway as the target.

Answer

VPC peering connections are being used alongside Transit Gateway, creating conflicting routes.

Question 18

A company has a multi-account AWS environment using AWS Organizations. Each account contains a VPC with a private subnet and a public subnet. The company uses a centralized inspection VPC in the network account with third-party firewall appliances. All internet-bound traffic from the VPCs must be routed through the inspection VPC via an AWS Transit Gateway. The network team has configured the transit gateway with separate route tables: one for the inspection VPC and one for the spoke VPCs. The spoke VPCs have a default route (0.0.0.0/0) pointing to the transit gateway. The inspection VPC has a default route pointing to an egress VPC that has an internet gateway. However, traffic from a spoke VPC is not reaching the internet. The network engineer has verified that the firewall appliances are running and that the security groups and NACLs allow traffic. What is the most likely cause of the issue?

Accepted Answer

The inspection VPC route table does not have a route to the transit gateway for the spoke VPC CIDRs.. Option B is correct because in a centralized inspection architecture, spoke VPCs must send traffic to the inspection VPC, and the inspection VPC must have a route to send traffic back to the transit gateway for egress. If the inspection VPC's route table does not have a route pointing to the transit gateway for the spoke VPCs' CIDRs, the return traffic will be dropped. Option A is wrong because the inspection VPC does not need a route to the spoke VPCs via the transit gateway; it needs a route to the transit gateway for return traffic. Option C is wrong because the transit gateway route table for spoke VPCs needs a route to the inspection VPC, not the egress VPC. Option D is wrong because the inspection VPC route table should not have a blackhole route for spoke VPCs.

Answer

The inspection VPC route table does not have a route to the spoke VPC CIDRs via the transit gateway.

Answer

The inspection VPC route table has a blackhole route for the spoke VPC CIDRs.

Answer

The transit gateway route table for the spoke VPCs does not have a route to the egress VPC.

Question 19

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The connection uses a private virtual interface (VIF) and BGP. The network team recently added a new CIDR block (10.0.3.0/24) to the VPC. They updated the VPC's route table to include a route to the on-premises network. However, the on-premises network cannot reach resources in the new subnet. The BGP session is up, and the Direct Connect gateway is configured. What should the network team do to resolve the issue?

Accepted Answer

Add the new CIDR block (10.0.3.0/24) to the Direct Connect gateway's allowed prefixes.. When adding a new CIDR to a VPC, the Direct Connect gateway does not automatically advertise the new prefix to the on-premises router. The team needs to ensure that the VPC's CIDR is allowed in the Direct Connect gateway's allowed prefixes. Option A is correct because the new CIDR must be added to the allowed prefixes list for the Direct Connect gateway to advertise it via BGP. Option D is incorrect as it would cause traffic to be routed through VPN, not Direct Connect.

Answer

Add a static route in the on-premises router pointing to the Direct Connect interface.

Answer

Set up a new VPN connection as a backup and route traffic over VPN.

Answer

Create a new private VIF for the new CIDR block.

Question 20

A network engineer is troubleshooting an EC2 instance that cannot connect to S3 via a VPC endpoint. The describe-vpc-endpoints output shows the endpoint is associated with a route table but no subnets. What is the likely issue?

Accepted Answer

The subnet's route table does not include a route for the S3 prefix list via the endpoint.. Option B is correct because Gateway Endpoints for S3 are associated with route tables, not subnets. The instance needs a route in its subnet's route table pointing to the endpoint. If the route table associated with the endpoint is not the same as the subnet's route table, the traffic will not use the endpoint. Option A is wrong because the endpoint state is available. Option C is wrong because endpoint policy allows all. Option D is wrong because the DNS name is present.

Answer

The DNS entry for the endpoint is not resolving.

Answer

The VPC endpoint policy denies access to S3.

Answer

The VPC endpoint state is not available.