ANS-C01 Practice Exam 66 — 20 Questions

Question 1

A company has a VPC with CIDR 10.0.0.0/16 and two subnets: Public Subnet A (10.0.1.0/24) and Private Subnet B (10.0.2.0/24). They launch a Network Load Balancer (NLB) in Public Subnet A. The NLB must forward traffic to targets in Private Subnet B. However, the targets are not receiving traffic, and the NLB target group shows all targets as unhealthy. The security groups and network ACLs are correctly configured to allow traffic. What is the most likely cause of the unhealthy targets?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The target group health check is configured to use a protocol or port that the targets are not listening on.. The targets are unhealthy because the NLB target group health check is likely misconfigured. NLB health checks must use the same protocol and port that the target application is listening on. Even with correct security groups and NACLs, an incorrect health check port or protocol will cause targets to fail health checks and be marked unhealthy. Ensuring the health check settings match the application configuration resolves the issue.

Answer

The NLB requires targets to be in the same subnet as the load balancer nodes.

Answer

The NLB requires the targets to have Elastic IP addresses assigned to them.

Answer

The NLB does not support targets in private subnets; they must be in public subnets.

Question 2

A network engineer is configuring an AWS Site-to-Site VPN connection between an on-premises router and a VPC. The on-premises router uses BGP to exchange routes with the AWS virtual private gateway (VGW). The engineer wants to ensure that the VPN tunnel stays up and that routes are advertised correctly. Which configuration on the customer gateway device is required for the VPN to establish?

Accepted Answer

Configure the customer gateway to use a public IP address and set up the VPN tunnels with pre-shared keys and BGP peering.. A Site-to-Site VPN requires the customer gateway device to have a public IP address and to be configured with pre-shared keys and BGP peering for dynamic routing. The customer gateway ASN must differ from the VGW ASN. Using a private IP without a public NAT device, matching ASNs, or static routing would not satisfy the BGP requirement.

Answer

Configure the customer gateway to use a private IP address and enable NAT traversal (NAT-T) for the VPN tunnels.

Answer

Configure the customer gateway with the same BGP ASN as the virtual private gateway.

Answer

Configure the customer gateway to use IKEv1 with a single tunnel and static routing instead of BGP.

Question 3

A network engineer is designing a hybrid architecture where an on-premises data center connects to a VPC using AWS Site-to-Site VPN over a single IPSec tunnel. The company requires that the on-premises routers run dynamic routing with AWS and that the tunnel fail over automatically if the primary path degrades. The on-premises router supports BGP. Which combination of configuration steps should the engineer take to meet these requirements?

Accepted Answer

Configure the customer gateway with BGP ASN 65000, enable route propagation on the VPC route table, and configure both tunnels of the VPN connection for redundancy.. AWS Site-to-Site VPN always creates two tunnels for redundancy. To achieve dynamic routing and automatic failover, the customer gateway must use BGP, and the VPC route table must have route propagation enabled so it can learn routes from both tunnels. BGP will then select the best path and fail over to the secondary tunnel if the primary degrades. Static routes or a single tunnel cannot meet the dynamic routing and automatic failover requirements.

Answer

Configure the customer gateway with BGP ASN 65000, disable route propagation, and manually add static routes for each tunnel.

Answer

Configure the customer gateway with BGP ASN 65000, enable route propagation, and use a single tunnel with BGP graceful restart.

Answer

Configure the customer gateway with static routes, enable route propagation, and use a single tunnel with Dead Peer Detection (DPD) enabled.

Question 4

A network engineer is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The engineer needs to monitor the traffic flow between specific VPC attachments and the on-premises network. The engineer has enabled Transit Gateway Flow Logs and sent them to Amazon CloudWatch Logs. Which additional step is necessary to analyze the traffic from a specific VPC attachment to on-premises?

Accepted Answer

Use CloudWatch Logs Insights to query the flow logs by filtering on the attachment ID and the destination IP range of the on-premises network.. Transit Gateway Flow Logs capture traffic at the attachment level and include the attachment ID and IP addresses. To analyze traffic from a specific VPC attachment to on-premises, you filter the logs using CloudWatch Logs Insights, querying by attachment ID and on-premises CIDR. This provides the necessary visibility without additional services.

Answer

Use AWS CloudTrail to log Transit Gateway API calls and identify the attachment ID.

Answer

Enable VPC Flow Logs on the VPC that contains the attachment and correlate with Transit Gateway Flow Logs.

Answer

Configure a CloudWatch metric filter on the Transit Gateway Flow Logs to count packets from the attachment to on-premises.

Question 5

A company runs a two-tier web application in a VPC. The web tier consists of EC2 instances behind an internet-facing Application Load Balancer (ALB). The app tier runs on EC2 instances in private subnets and must accept traffic only from the web tier. A network engineer needs to configure the app tier security group to allow the web tier to connect on port 8080. Which source should the engineer specify in the inbound rule?

Accepted Answer

The security group ID of the web tier instances.. Security groups can reference other security groups as sources. When the app tier's inbound rule specifies the web tier's security group ID, only instances that are members of that group can connect on port 8080. This approach is identity-based rather than IP-based, so it remains accurate as instances scale and their addresses change.

Answer

The CIDR block of the VPC.

Answer

The IP address of the Application Load Balancer's elastic network interface.

Answer

The public IP addresses of the web tier instances.

Question 6

A company has a hybrid network with an AWS Direct Connect connection and a Site-to-Site VPN as backup. The company wants to ensure that traffic prefers the Direct Connect connection and fails over to the VPN only when Direct Connect is unavailable. The network engineer has configured BGP on both connections. Which BGP attribute should the engineer manipulate to achieve this preference?

Accepted Answer

LOCAL_PREF. To prefer Direct Connect over Site-to-Site VPN for outbound traffic, the engineer should set a higher LOCAL_PREF on routes learned from Direct Connect. LOCAL_PREF is exchanged within the same autonomous system and is the primary attribute for outbound path selection. This ensures that as long as Direct Connect is available, traffic will use it; if it fails, BGP will fall back to the VPN.

Answer

MED

Answer

AS_PATH

Answer

Weight

Question 7

A financial services company has a VPC with a CIDR block of 10.0.0.0/16. They need to add a secondary CIDR block of 100.64.0.0/16 to support a new containerized application that requires a large number of IP addresses. The VPC currently has subnets in three Availability Zones, and all route tables have a default route to a NAT gateway. After adding the secondary CIDR, instances in the new subnets cannot reach the internet through the existing NAT gateway. What is the most likely cause of this issue?

Accepted Answer

The route table associated with the new subnets does not have a route for the NAT gateway, or the NAT gateway is not in a subnet that can route to the new CIDR.. After adding a secondary CIDR to a VPC, new subnets created from that CIDR must be associated with a route table that has a route to the NAT gateway. Additionally, the NAT gateway's subnet route table must have a route to the secondary CIDR to return traffic. Without these routes, instances in the new subnets cannot reach the internet.

Answer

The NAT gateway does not support traffic from the 100.64.0.0/16 CIDR block because it falls within the Carrier-Grade NAT range.

Answer

The VPC's main route table automatically updates to include the new CIDR, but the NAT gateway requires a new elastic IP address for the secondary CIDR.

Answer

The secondary CIDR block 100.64.0.0/16 overlaps with the NAT gateway's private IP address range, causing a routing conflict.

Question 8

A company has a VPC with an internet-facing Application Load Balancer (ALB) and a fleet of EC2 instances in private subnets. The security team wants to ensure that the EC2 instances only accept traffic from the ALB and that all other inbound traffic is blocked. They also want to log any unauthorized attempts to access the instances. Which combination of steps should they take?

Accepted Answer

Configure the EC2 instances' security group to allow inbound traffic only from the ALB's security group. Enable VPC Flow Logs on the instances' network interfaces to capture rejected traffic.. The most secure and maintainable approach is to reference the ALB's security group in the EC2 instances' security group inbound rules. This ensures that only the ALB can reach the instances, regardless of IP changes. VPC Flow Logs can be enabled on the instances' network interfaces to capture rejected traffic, providing an audit trail of unauthorized attempts. This combination satisfies both access control and logging.

Answer

Configure the EC2 instances' security group to allow inbound traffic from the ALB's IP addresses. Enable AWS CloudTrail to log all API calls to the instances.

Answer

Configure a network ACL on the private subnets to allow inbound traffic only from the ALB's subnet CIDR. Enable VPC Flow Logs on the subnet to capture rejected traffic.

Answer

Configure the EC2 instances' security group to allow inbound traffic from the ALB's security group. Enable AWS Shield Advanced to log unauthorized attempts.

Question 9

A company is designing a new VPC for a web application that will be accessed by users from the internet. The application consists of web servers that must be publicly accessible and database servers that must not be accessible from the internet. The company wants to use a single VPC with two subnets: one public and one private. Which AWS resource should be used to allow the web servers in the public subnet to access the internet while preventing the database servers in the private subnet from being directly accessible from the internet?

Accepted Answer

An internet gateway attached to the VPC, with a route in the public subnet's route table pointing to the internet gateway, and a NAT gateway in the public subnet for the private subnet's outbound traffic.. The correct design uses an internet gateway for the public subnet to allow inbound and outbound internet access for web servers, and a NAT gateway in the public subnet for the private subnet to allow outbound internet access for database updates without exposing them to inbound internet traffic.

Answer

A NAT gateway in the public subnet, with routes in both subnets' route tables pointing to the NAT gateway.

Answer

A virtual private gateway attached to the VPC, with routes in both subnets' route tables pointing to the virtual private gateway.

Answer

An internet gateway attached to the VPC, with routes in both subnets' route tables pointing to the internet gateway.

Question 10

A startup is deploying a two-tier web application in a single VPC. The web tier runs in public subnets behind an Application Load Balancer, and the database tier runs in private subnets. The security team requires that the database instances never have a route to the internet, even indirectly. Which VPC component should the engineer verify is absent from the private subnet route tables?

Accepted Answer

A route to a NAT gateway. The only listed component that provides outbound internet access from a private subnet is a NAT gateway. Removing or omitting the NAT gateway route from the private subnet route tables ensures the database instances cannot reach the internet directly or indirectly, which is the security team's requirement.

Answer

A route to an interface VPC endpoint

Answer

A route to a transit gateway

Answer

A route to a VPC peering connection

Question 11

A company is deploying a latency-sensitive trading application across two AWS Regions: us-east-1 and eu-west-1. The application uses a Network Load Balancer (NLB) in each Region. The company wants to route users to the lowest-latency Region and also needs the ability to fail over between Regions if one becomes unavailable. The solution must minimize latency and provide automatic failover. Which AWS service should be used?

Accepted Answer

AWS Global Accelerator with endpoint groups in both Regions and health checks.. AWS Global Accelerator is designed for latency-sensitive, multi-Region applications that require automatic failover. It uses the AWS global network to route traffic to the optimal endpoint, reducing latency and jitter. With endpoint groups in multiple Regions and health checks, it can fail over within seconds if an endpoint becomes unhealthy. NLBs are supported as endpoints, making it a natural fit for this scenario. Route 53 latency-based routing relies on DNS and is slower to fail over, while CloudFront and Direct Connect do not meet the low-latency, automatic failover requirements for this use case.

Answer

Amazon CloudFront with origin groups and origin failover.

Answer

Amazon Route 53 latency-based routing with health checks and failover.

Answer

AWS Direct Connect with a virtual private gateway in each Region.

Question 12

A company uses AWS Site-to-Site VPN to connect its on-premises data center to a VPC. The VPN connection shows as UP, but the company's monitoring tools report intermittent packet loss and high latency for traffic traversing the VPN. The VPN uses two tunnels, and both are configured with BGP. Which action should the network engineer take FIRST to troubleshoot the issue?

Accepted Answer

Check the BGP session status on both tunnels and verify that the on-premises router is advertising the correct prefixes.. The first step in troubleshooting a Site-to-Site VPN with intermittent issues is to verify the health of the BGP sessions and the routes being advertised. BGP flapping or misconfigured route advertisements can cause packet loss and latency by directing traffic through a failing tunnel. Checking BGP status provides actionable insights before making changes.

Answer

Restart the VPN tunnels by resetting the connection from the AWS Management Console.

Answer

Modify the VPN connection to use a single tunnel instead of two to simplify routing.

Answer

Increase the VPN tunnel's bandwidth by enabling accelerated site-to-site VPN.

Question 13

A company has a VPC with a CIDR block of 172.31.0.0/16 and an on-premises network with 192.168.0.0/16. They have established an AWS Site-to-Site VPN connection with dynamic routing using BGP. The on-premises firewall blocks all traffic except that which originates from the AWS-side tunnel IP addresses. After a VPN tunnel rekey, some on-premises applications lose connectivity to AWS resources. What is the MOST likely cause?

Accepted Answer

The AWS Site-to-Site VPN tunnel IP addresses changed after the rekey, and the on-premises firewall rules were not updated to allow the new addresses.. AWS Site-to-Site VPN tunnels have AWS-side public IP addresses that can change when a tunnel is rekeyed or recreated. If the on-premises firewall permits traffic only from specific AWS tunnel IPs, those rules must be updated whenever the addresses change. The other options describe issues that would either prevent initial connectivity or cause different symptoms.

Answer

The VPC route table lacks a route for the on-premises CIDR, so return traffic is dropped after the rekey.

Answer

The BGP hold time expired, causing the tunnel to flap and the on-premises firewall to drop the new tunnel IP addresses.

Answer

The on-premises customer gateway device is using an outdated IKE version that is not compatible with the rekeyed tunnel.

Question 14

A security team needs to verify that no Amazon EC2 instances in a production VPC can reach the public internet over IPv4, even if an instance is accidentally launched into a public subnet with a public IP. The VPC has an internet gateway attached and route tables that point 0.0.0.0/0 to that gateway. Which action will definitively block outbound IPv4 internet access for every instance in the VPC while leaving intra-VPC traffic intact?

Accepted Answer

Remove the internet gateway from the VPC and delete the 0.0.0.0/0 route from every route table.. Detaching the internet gateway and removing the default routes eliminates the only network path from the VPC to the public internet. Because instances in the VPC still use the implicit local route for internal communication, intra-VPC traffic is unaffected. Filtering approaches such as security groups or network ACLs can be undermined by a single misconfigured resource, whereas removing the gateway enforces the guarantee structurally.

Answer

Enable VPC Flow Logs with a filter that rejects traffic to 0.0.0.0/0 and configure Amazon CloudWatch alarms on the rejected flows.

Answer

Attach a security group that has no outbound rules and remove the default allow-all egress rule from each instance's security group.

Answer

Apply an inbound network ACL rule on each subnet that denies all traffic from 0.0.0.0/0.

Question 15

A company needs to ensure that all VPC flow logs are encrypted at rest and that access to the logs is restricted to a specific set of IAM principals. The flow logs are delivered to an Amazon S3 bucket. Which two actions should a network engineer take to meet these requirements? (Choose two.)

Accepted Answer

Attach a bucket policy to the S3 bucket that denies access to all principals except the specified IAM principals.. To encrypt flow logs at rest and restrict access, the engineer should enable SSE-KMS with a customer managed key and attach a bucket policy that denies access to all principals except the specified set. SSE-KMS allows the use of key policies to control who can decrypt the logs, while the bucket policy enforces access restrictions at the S3 layer. Together, they provide the required confidentiality and access control.

Answer

Enable default encryption on the S3 bucket using Amazon S3 managed keys (SSE-S3).

Answer

Use AWS CloudTrail to log all access to the S3 bucket and configure an Amazon CloudWatch alarm for unauthorized access attempts.

Answer

Enable versioning on the S3 bucket to protect against accidental deletion of flow logs.

Question 16

A media company uses AWS Network Firewall in a centralized inspection VPC. A security engineer must produce evidence that all traffic entering the inspection VPC from a transit gateway gateway endpoint is evaluated by a stateful rule group before it leaves toward the workload VPCs. The team also needs to know which rule matched each flow during an incident review. Which combination of features should the engineer enable?

Accepted Answer

Network Firewall alert logging on the stateful rule group and flow logging on the firewall, both delivered to a CloudWatch log group.. To show that stateful evaluation occurred and to attribute each flow to a specific rule, the firewall must emit both alert records from matching rules and flow records describing the connection and verdict. Network Firewall logging configuration supports alert and flow log types delivered to CloudWatch Logs, S3, or Kinesis Data Firehose, so the engineer can meet the audit and incident-response needs from the firewall's own telemetry.

Answer

Network Firewall TLS inspection logging with Suricata rule metadata exported to Amazon S3 through a Kinesis Data Firehose delivery stream.

Answer

VPC Flow Logs on the inspection VPC subnets with the maximum aggregation interval and Traffic Mirroring on the firewall endpoints.

Answer

Flow logs on the transit gateway attachment plus AWS CloudTrail data events on the firewall policy.

Question 17

A company is designing a hybrid network architecture that connects its on-premises data center to multiple VPCs in different AWS Regions. The company wants to use AWS Transit Gateway to simplify connectivity and reduce operational overhead. The on-premises network is connected to a Transit Gateway in us-east-1 via AWS Direct Connect. The company also has a Transit Gateway in eu-west-1. They need to enable communication between the VPCs attached to both Transit Gateways and the on-premises network. Which two actions must be taken to allow traffic to flow between the VPCs in different Regions and the on-premises network? (Choose two.)

Accepted Answer

Create a Transit Gateway peering attachment between the Transit Gateway in us-east-1 and the Transit Gateway in eu-west-1.. To enable communication between VPCs in different Regions and the on-premises network via Transit Gateway, you must create a Transit Gateway peering attachment between the Transit Gateways in each Region. Then, you must configure the Transit Gateway route tables to propagate routes between the peering attachment and the Direct Connect attachment so that traffic can be routed correctly.

Answer

Attach a virtual private gateway to each VPC and establish a VPN connection between the virtual private gateways.

Answer

Enable equal-cost multi-path (ECMP) routing on the Direct Connect connection to load balance traffic across multiple VPN tunnels.

Answer

Create a VPC peering connection between each VPC and the on-premises network.

Question 18

A financial services company uses AWS Transit Gateway to connect 50 VPCs and an on-premises network via AWS Site-to-Site VPN. The security team requires that all traffic between VPCs be inspected by a central firewall appliance running in a dedicated inspection VPC. The appliance supports transparent bridging and must see the original source and destination IP addresses. Which Transit Gateway configuration should be implemented to meet these requirements?

Accepted Answer

Create two Transit Gateway route tables: one for the inspection VPC and one for all other VPCs. Associate the inspection VPC with the inspection route table and all other VPCs with the other route table. In the other route table, add a default route pointing to the inspection VPC attachment. In the inspection route table, add routes for each VPC CIDR pointing to the respective VPC attachments.. To force all inter-VPC traffic through a central inspection VPC, you need separate Transit Gateway route tables. The route table associated with the spoke VPCs should have a default route to the inspection VPC attachment, ensuring all traffic goes there first. The inspection VPC's route table should have specific routes for each spoke VPC CIDR pointing to their attachments, so inspected traffic can be forwarded to the correct destination. This design maintains original IP addresses and avoids loops.

Answer

Create a separate Transit Gateway route table for each VPC attachment and associate the inspection VPC attachment with all of them.

Answer

Use a single Transit Gateway route table, associate all VPC attachments with it, and add a static route for each VPC CIDR pointing to the inspection VPC attachment.

Answer

Enable appliance mode on the inspection VPC attachment and use a single route table with a default route to the inspection VPC.

Question 19

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to add a secondary CIDR block to the VPC. The company requires that the secondary CIDR be from the 10.0.0.0/8 range and not overlap with any existing subnets or routes. Which CIDR block should be added?

Accepted Answer

10.1.0.0/16. The company requires the secondary CIDR to be from the 10.0.0.0/8 range and not overlap with existing subnets or routes. The primary CIDR is 10.0.0.0/16, so a non-overlapping block like 10.1.0.0/16 is valid. Other options either overlap or fall outside the required range. Thus, 10.1.0.0/16 is the correct choice.

Answer

192.168.0.0/16

Answer

10.0.0.0/16

Answer

10.0.1.0/24

Question 20

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access the internet to download updates, but should not be directly accessible from the internet. The company has already created a NAT Gateway in the public subnet. What else must the network engineer configure to allow the private instance to access the internet?

Accepted Answer

Add a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT Gateway.. For a private subnet instance to access the internet, its route table must have a default route pointing to a NAT Gateway in a public subnet. The NAT Gateway translates the private IP to its own Elastic IP and sends traffic to the Internet Gateway. This allows outbound internet access while keeping the instance private.

Answer

Assign an Elastic IP address to the private EC2 instance.

Answer

Create a VPC endpoint for the internet.

Answer

Attach an Internet Gateway directly to the private subnet.