ANS-C01 Practice Exam 64 — 20 Questions

Question 1

Refer to the exhibit. A security engineer is reviewing this S3 bucket policy. The bucket contains sensitive data that should only be accessible from the corporate network (192.0.2.0/24). What is a potential security issue with this policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The policy does not require authentication; anonymous access is allowed from the specified IP range. The policy allows any principal (Principal: '*') to perform the s3:GetObject action under the condition that the request comes from the specified IP range. However, this condition only checks the IP address; it does not require authentication. If the bucket is publicly accessible (no bucket policy or ACL denying anonymous access), then unauthenticated requests from the allowed IP range would be allowed, which is a security issue. Option A is wrong because the condition belongs on the Action element, not the Principal. Option B is wrong because the Resource ARN includes the bucket name correctly (arn:aws:s3:::example-bucket/*). Option D is wrong because the IP range is specific and appropriate for the requirement.

Answer

The condition should be applied to the Principal element

Answer

The Resource ARN is missing the bucket name

Answer

The IP address range is not specific enough

Question 2

A network engineer is troubleshooting SSH connectivity to an EC2 instance in subnet subnet-0abcd1234efgh5678, which is associated with the network ACL shown. The security group allows inbound SSH. Why can't the engineer SSH to the instance?

Accepted Answer

The network ACL rule 200 denies SSH traffic, overriding rule 100. The network ACL exhibit shows inbound rule 100 allowing HTTP traffic (port 80) and rule 200 denying SSH traffic (port 22). Since NACL rules are evaluated in ascending order, when an SSH packet arrives, rule 100 does not match (it allows HTTP, not SSH), so rule 200 matches and denies the traffic. Thus, SSH is blocked. Option A is wrong because the security group allows SSH. Option B is wrong because the subnet is associated with the NACL as stated. Option C is wrong because rule 300 is a higher-numbered rule and would only be evaluated if no earlier rule matched; here rule 200 already matches and denies SSH.

Answer

The security group is blocking SSH traffic

Answer

The network ACL is not associated with the subnet

Answer

The network ACL has a rule that denies all traffic (rule 300) which overrides the allow rule

Question 3

A company is deploying a hybrid network using AWS Direct Connect and a VPN backup. The Direct Connect connection is established, and BGP is running over the private VIF. The company wants to use the VPN as a backup only when Direct Connect fails. The network engineer configures BGP communities on the Direct Connect VIF to influence route preference. However, during a Direct Connect failure, failover to VPN takes several minutes. What can the engineer do to reduce failover time?

Accepted Answer

Enable Bidirectional Forwarding Detection (BFD) on the Direct Connect VIF. BFD provides sub-second failure detection, which significantly reduces failover time compared to BGP timers. Option A is wrong because AS path prepending influences route preference and does not affect failover detection speed. Option B is wrong because static routes do not provide dynamic failover and increase administrative overhead. Option D is wrong because while decreasing BGP timers can reduce failover time, BFD is much faster and is the recommended approach.

Answer

Configure AS path prepending on the VPN BGP session to deprioritize it

Answer

Use static routes instead of BGP for the Direct Connect VIF

Answer

Decrease the BGP keepalive and hold timers on both the Direct Connect and VPN BGP sessions

Question 4

A company is designing a network for a critical application that requires maximum availability. The application will be deployed across multiple Availability Zones in a single region. Which THREE design choices improve network availability?

Accepted Answer

Use an Application Load Balancer with targets in multiple Availability Zones. An Application Load Balancer (ALB) with targets in multiple Availability Zones (AZs) improves availability by distributing incoming traffic across healthy targets in different AZs. If one AZ fails, the ALB automatically routes traffic to targets in the remaining AZs, ensuring the application remains accessible. This design eliminates a single point of failure at the load balancer level and leverages the regional nature of the ALB to provide cross-AZ fault tolerance.

Answer

Use a single NAT gateway in one Availability Zone

Answer

Use a single subnet per Availability Zone

Question 5

A company has a VPC with a public subnet and a private subnet. They have a NAT Gateway in the public subnet. They also have an EC2 instance in the private subnet that needs to access the internet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway. The security group for the EC2 instance allows outbound HTTPS traffic. The network ACL for the private subnet allows inbound and outbound ephemeral ports. However, the EC2 instance cannot reach the internet. The network engineer checks the NAT Gateway and sees that it has an Elastic IP attached. The engineer also checks the route table for the public subnet and finds no route to the internet. What should the engineer do to fix the issue?

Accepted Answer

Add a route in the public subnet route table to 0.0.0.0/0 via the internet gateway.. The NAT Gateway resides in the public subnet, and for the NAT Gateway to forward traffic to the internet, the public subnet's route table must have a default route (0.0.0.0/0) pointing to an internet gateway. Without that route, the NAT Gateway cannot send traffic to the internet, even though the private subnet's route points to the NAT Gateway. Options A, C, and D are incorrect: A is unnecessary because a NAT Gateway in the private subnet would not have direct internet access; C would bypass the NAT Gateway and require a route to the internet gateway directly from the private subnet, which is not the standard design; D is wrong because adding another Elastic IP does not solve the missing route issue.

Answer

Deploy a second NAT Gateway in the private subnet.

Answer

Add a route in the private subnet route table to 0.0.0.0/0 via the internet gateway.

Answer

Attach a second Elastic IP to the NAT Gateway.

Question 6

Refer to the exhibit. A company has an S3 bucket policy that denies PutObject if the object is not encrypted with SSE-KMS. However, uploads are still being allowed without encryption. What is the most likely reason?

Accepted Answer

The condition key 's3:x-amz-server-side-encryption' is not present in the upload request, so the condition is not evaluated and the Deny is not applied.. The bucket policy uses a condition key 's3:x-amz-server-side-encryption' to deny uploads that are not encrypted with SSE-KMS. However, if the upload request does not include the 'x-amz-server-side-encryption' header at all, the condition key is not present in the request, so the condition is not evaluated. As a result, the Deny effect is not applied, and the upload is allowed. Option A is incorrect because the policy is valid JSON and would be enforced if the condition were met. Option B is incorrect because an explicit Allow in an IAM policy cannot override a Deny in a bucket policy; the Deny would still apply. Option D is incorrect because bucket policies are evaluated regardless of region as long as the bucket is in the same region as the request's endpoint; the region is not the issue here.

Answer

The bucket policy has a syntax error and is not being enforced.

Answer

The IAM user has an explicit Allow that overrides the Deny in the bucket policy.

Answer

The bucket policy must be attached to the bucket in the same region as the request.

Question 7

A company has a VPC with public and private subnets. An application in the private subnet needs to access an S3 bucket. Which design meets security best practices without exposing the application to the internet?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and update the route table. A VPC Gateway Endpoint for S3 allows private subnet resources to access S3 without internet exposure. Option B (NAT Gateway) would provide internet access but is unnecessary and could expose the application indirectly. Option C (VPN) is overkill and not needed for S3 access within AWS. Option D (Internet Gateway) would expose the application to the internet, violating security best practices.

Answer

Use a NAT Gateway in the public subnet and route traffic through it

Answer

Set up a VPN connection to AWS and route through it

Answer

Attach an Internet Gateway to the VPC and update route tables

Question 8

A networking engineer is troubleshooting connectivity issues between two VPCs that are peered using a VPC peering connection. The VPCs are in different AWS accounts. The engineer has verified that the route tables are correct and the security groups allow traffic. However, ICMP ping fails from an instance in VPC A to an instance in VPC B. What is a likely cause?

Accepted Answer

There is a VPN connection attached to both VPCs that creates a transitive routing issue.. A VPN connection attached to both VPCs can introduce transitive routing, which is not supported by VPC peering. VPC peering does not allow transitive routing; traffic must flow directly between the peered VPCs. If both VPCs have a VPN connection to the same on-premises network or another network, the VPN can create a path that interferes with the direct peering path, causing ICMP pings to fail even when route tables and security groups are correctly configured.

Answer

The route tables in both VPCs do not have the route propagation enabled.

Answer

The VPC CIDR blocks overlap.

Answer

The security group in VPC A does not allow inbound ICMP from VPC B.

Answer

The network ACLs are not configured correctly for return traffic.

Question 9

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that no EC2 instance in any account can be launched with a public IP address unless it is in a specific VPC. Which solution will meet this requirement?

Accepted Answer

Create a service control policy (SCP) that denies ec2:RunInstances if the request includes an association with a public IP address, unless the VPC is the allowed one.. An SCP applied at the root OU can deny ec2:RunInstances when the request includes a public IP address, using the ec2:AssociatePublicIpAddress condition key, and can further limit based on VPC using conditions like ec2:Vpc. This centrally prevents non-compliant EC2 launches across all accounts. Option B is incorrect because IAM policies must be attached to each user/role individually and do not scale across accounts; SCPs are designed for this purpose. Option C is incorrect because AWS Config can detect non-compliant instances but cannot prevent the initial launch. Option D is incorrect because CloudWatch Events can trigger actions after launch but does not prevent the launch itself.

Answer

Create an IAM policy that denies ec2:RunInstances if the subnet is not in the allowed VPC, and attach it to all IAM users.

Answer

Enable AWS CloudTrail and create a CloudWatch Events rule to stop any instance with a public IP.

Answer

Use AWS Config rules to detect non-compliant instances and automatically terminate them.

Question 10

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They have a VPC with a CIDR of 10.0.0.0/16 and an on-premises network with CIDR 10.0.0.0/8. The Transit Gateway route table has a static route for 10.0.0.0/8 pointing to the VPN attachment. However, traffic from on-premises to the VPC is not working. What is the most likely cause?

Accepted Answer

The VPC route table does not have a route pointing to the Transit Gateway for on-premises traffic.. For traffic from on-premises to reach the VPC, the VPC's route table must have a route pointing to the Transit Gateway (TGW) attachment as the target for the on-premises CIDR (10.0.0.0/8). Without this route, the VPC subnet will not forward return traffic to the TGW, causing a one-way communication failure. The TGW route table already has a static route for 10.0.0.0/8 pointing to the VPN attachment, so the issue is on the VPC side, not the TGW.

Answer

The VPN attachment is in the wrong TGW route table.

Answer

The VPC CIDR overlaps with the on-premises CIDR.

Answer

The Transit Gateway route table does not have a route for the VPC CIDR.

Question 11

A network engineer needs to monitor network performance between two EC2 instances in different Availability Zones. Which THREE metrics from Amazon CloudWatch should the engineer use?

Accepted Answer

NetworkPacketsIn. Options A, D, and E are correct. NetworkPacketsIn, NetworkOut, and NetworkIn are standard EC2 CloudWatch metrics that measure network traffic volume and packet counts, useful for monitoring network performance between instances. Option B (VolumeQueueLength) is an EBS metric, not network. Option C (NetworkPacketsDropped) is not a standard CloudWatch metric for EC2.

Answer

VolumeQueueLength

Answer

NetworkPacketsDropped

Question 12

A company is designing a multi-region network with Direct Connect. They have two Direct Connect connections in each region. They want to achieve the HIGHEST availability and lowest latency for cross-region traffic. Which THREE design elements should they include?

Accepted Answer

Configure BGP ASN prepending to influence path selection. Options A, B, and C are correct. Using different Direct Connect providers in each region avoids a single point of failure and enhances availability. Using different Direct Connect locations within each region provides physical diversity, further increasing resilience. ASN prepending allows you to influence BGP path selection, enabling you to choose lower-latency paths for cross-region traffic. Option D is incorrect because multiple virtual interfaces per connection are not necessary for the highest availability; they would still share the same underlying physical connection. Option E is incorrect because using the same BGP ASN for all connections can cause routing issues and does not improve availability or latency.

Answer

Use multiple virtual interfaces per Direct Connect connection

Answer

Use the same BGP ASN for all Direct Connect connections

Question 13

A company has a VPC with public and private subnets. An EC2 instance in the private subnet needs to download patches from the internet. The company wants to use a proxy server running on an EC2 instance in the public subnet. The security group for the proxy server must allow inbound HTTP/HTTPS from the instance in the private subnet. The security group for the private instance must allow outbound HTTP/HTTPS to the proxy server. However, the private instance cannot connect to the proxy. What is the most likely cause?

Accepted Answer

The route table for the private subnet has a default route pointing to a NAT gateway instead of the proxy server.. The route table for the private subnet likely has a default route pointing to a NAT gateway or internet gateway, causing traffic to bypass the proxy server. Even though security groups are configured correctly, routing decisions are made first. Traffic from the private instance to the proxy server would be directed to the default gateway (NAT/internet gateway) instead of the proxy's IP address. Option A is incorrect: the security group for the private instance does allow outbound HTTP/HTTPS to the proxy. Option B is incorrect: network ACLs are stateless and must allow both inbound and outbound; but if they blocked inbound from the proxy, that would affect return traffic, not the initial connection. Option D is incorrect: the proxy's security group is configured to allow inbound from the private instance.

Answer

The security group for the private instance does not allow outbound traffic to the proxy server.

Answer

The network ACL for the private subnet blocks inbound traffic from the proxy.

Answer

The security group for the proxy server does not allow inbound traffic from the private instance's security group.

Question 14

A company uses AWS Direct Connect to connect its on-premises network to a VPC. They have a private VIF attached to a virtual private gateway. They want to use AWS Site-to-Site VPN as a backup connection. Which configuration ensures automatic failover?

Accepted Answer

Use BGP on both the Direct Connect private VIF and the VPN connection, and advertise the same prefixes with a longer AS path for the VPN.. Using BGP on both the Direct Connect private VIF and the VPN connection allows you to manipulate route selection via AS path prepending. By advertising the same prefixes with a longer AS path on the VPN, the Direct Connect path is preferred, and if it fails, BGP withdraws the routes, causing traffic to automatically fail over to the VPN.

Answer

Attach the VPN connection to a separate virtual private gateway and use a transit gateway to combine them.

Answer

Use static routes on the Direct Connect private VIF and BGP on the VPN connection.

Answer

Create a second Direct Connect connection and use equal-cost multipath (ECMP) between the two.

Question 15

A company has a VPC with a CIDR block of 10.0.0.0/16. The company needs to add a secondary CIDR block for additional subnets. Which CIDR block can be used?

Accepted Answer

10.1.0.0/16. Options A (10.1.0.0/16), B (172.16.0.0/16), and C (192.168.0.0/16) are all valid secondary CIDR blocks for a VPC with a primary CIDR of 10.0.0.0/16. They are all RFC 1918 private IP ranges that do not overlap with the primary CIDR. AWS allows adding any non-overlapping private CIDR block as a secondary, regardless of whether it belongs to the same /8 range. Option D (10.0.0.0/16) is invalid because it overlaps exactly with the primary CIDR. Note: This question has multiple correct answers; you must select all that apply.

Answer

10.0.0.0/16

Question 16

A company uses AWS Global Accelerator to improve performance for a global application. The application is deployed in two AWS regions behind Network Load Balancers. Users in Asia report high latency even though the accelerator should route them to the nearest endpoint. What is the most likely reason?

Accepted Answer

The endpoint in the closer region is marked unhealthy. If the endpoint in the closer region is marked unhealthy, Global Accelerator will automatically route traffic to the next nearest healthy endpoint, which may be in a distant region, causing high latency. Option B is incorrect because if Traffic Dial were set to 100% for the distant region, traffic would be intentionally routed there, so users would not expect routing to the nearest endpoint. Option C is incorrect because on-premises endpoints are not typical for Global Accelerator, and even if used, they would not cause high latency specifically for Asian users if the closer region has healthy endpoints. Option D is incorrect because client affinity affects stickiness, not overall latency; it would not cause all Asian users to experience high latency.

Answer

Traffic Dial is set to 100% for the distant region

Answer

The accelerator is configured with on-premises endpoints

Answer

Client affinity is set to source IP

Question 17

A company wants to provide its employees with secure access to internal applications running on AWS without using a VPN. Which AWS service can be used?

Accepted Answer

AWS Client VPN. AWS Client VPN is a managed, cloud-based VPN solution that allows employees to securely access AWS resources and internal applications from their devices using OpenVPN or IKEv2 protocols, without requiring a traditional site-to-site VPN or dedicated hardware. It provides per-user authentication via Active Directory, SAML, or mutual authentication, making it ideal for remote user access to internal applications without a VPN appliance on-premises.

Answer

AWS Site-to-Site VPN

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Question 18

A network engineer is troubleshooting connectivity between two VPCs connected via a VPC peering connection. Security groups and NACLs are configured correctly. The engineer verifies that the route tables have the necessary entries. However, traffic from an EC2 instance in VPC A to an RDS instance in VPC B fails. Which TWO additional checks should be performed? (Choose two.)

Accepted Answer

Check that the security group attached to the RDS instance allows inbound traffic from the CIDR block of VPC A.. The correct checks to perform when troubleshooting VPC peering connectivity are to ensure the VPC peering connection is in the 'active' state (Option E) and that the security group attached to the RDS instance allows inbound traffic from the CIDR block of VPC A (Option A). Without an active peer connection, traffic cannot flow even if route tables are correct. Similarly, security group rules are stateful and must explicitly permit inbound traffic; NACLs are stateless but since the issue is within the same VPC peering, security groups are a likely culprit. IAM roles and Internet Gateways are not required for VPC peering traffic.

Answer

Verify that the network ACLs in both VPCs have appropriate inbound and outbound rules for the traffic.

Answer

Confirm that the VPCs have an Internet Gateway attached.

Answer

Check that the EC2 instance has an IAM role that allows it to communicate with RDS.

Question 19

A company has a Direct Connect connection to AWS with a private VIF to a VPC. They also have a VPN connection as a backup. The BGP sessions are established. They want to ensure that traffic from on-premises to the VPC prefers the Direct Connect path over the VPN. The on-premises router is advertising the same prefix to both connections. What should the network engineer configure on the AWS side?

Accepted Answer

Configure the on-premises router to prepend AS path for routes advertised over the VPN connection.. To prefer the Direct Connect path over the VPN for traffic from on-premises to the VPC, the on-premises router should prepend its AS number multiple times for the routes advertised over the VPN connection. This increases the AS path length, making the Direct Connect path more preferred. AWS does not allow manipulation of BGP attributes on the customer side of the Direct Connect or VPN connections, so the change must be made on the on-premises router. Option A is incorrect because local preference is a Cisco-specific feature and affects outbound traffic, not inbound. Option B is incorrect because VPC route tables only apply to traffic inside the VPC, not to BGP path selection. Option C is incorrect because MED is typically used to influence outbound traffic from AWS to on-premises and is not as effective as AS path prepending for this scenario.

Answer

Set a higher local preference value on the on-premises router for the Direct Connect route.

Answer

Update the VPC route table to give higher priority to the Direct Connect route.

Answer

Set a lower MED value on the Direct Connect virtual interface.

Question 20

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. They have also set up a Site-to-Site VPN as a backup. The VPC has a virtual private gateway (VGW) attached. The on-premises network uses BGP over the Direct Connect and static routes for the VPN. The network engineer notices that traffic from the VPC to on-premises is not using the Direct Connect when it is available; instead, it goes over the VPN. The VPC route table has a route for the on-premises CIDR (10.0.0.0/8) to the VGW. The VPN connection is configured with static routes. What is the MOST likely cause of this behavior?

Accepted Answer

The VPN static route has higher precedence than the BGP route from Direct Connect. When a VPC route table has a route for the on-premises CIDR (10.0.0.0/8) pointing to the VGW, AWS uses the longest prefix match to select the route. If both the Direct Connect BGP route and the VPN static route have the same prefix length, static routes are preferred over propagated BGP routes. Therefore, the VPN static route takes precedence, causing traffic to flow over the VPN even when Direct Connect is available. To fix this, the VPN should use BGP instead of static routes, or the static route should be removed so that the BGP route from Direct Connect is used.

Answer

The VPC route table does not have a route for the on-premises CIDR

Answer

The VGW is not attached to the VPC

Answer

The Direct Connect virtual interface is not associated with the VGW