ANS-C01 Practice Exam 66 — 20 Questions

Question 1

A company has multiple VPCs connected via a Transit Gateway. The security team wants to centrally inspect all traffic between VPCs using a third-party firewall appliance. The appliance must be deployed in a single VPC and all inter-VPC traffic must be routed through it. Which architecture should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the Transit Gateway with a central inspection VPC that hosts the firewall appliance. A Transit Gateway supports centralised inspection by attaching a dedicated inspection VPC that hosts the third‑party firewall appliance. By adjusting the Transit Gateway route tables, all inter‑VPC traffic can be forced through the inspection VPC using static routes or a default route pointing to the firewall’s elastic network interface, enabling full traffic inspection without modifying individual VPC route tables.

Answer

Create a Network Load Balancer in each VPC and point to the firewall

Answer

Deploy AWS Network Firewall in each VPC

Answer

Use VPC peering connections between all VPCs and route traffic through the inspection VPC

Question 2

A company is designing a highly available architecture for a web application using an Application Load Balancer (ALB) across multiple Availability Zones. Which TWO actions should be taken to ensure high availability?

Accepted Answer

Register EC2 instances in multiple Availability Zones.. Registering EC2 instances in multiple Availability Zones ensures that if one AZ becomes unavailable, the ALB can route traffic to healthy instances in another AZ. This is a fundamental requirement for high availability because the ALB distributes incoming traffic across targets in different AZs, and if all instances are in a single AZ, that AZ becomes a single point of failure.

Answer

Use a Network Load Balancer instead of an ALB.

Answer

Place the EC2 instances in a single Availability Zone.

Answer

Configure the ALB as internal.

Question 3

A company has a VPC (10.0.0.0/16) with two subnets: public (10.0.1.0/24) and private (10.0.2.0/24). They have an Application Load Balancer (ALB) in the public subnet that distributes traffic to EC2 instances in the private subnet. The ALB is internet-facing and has a security group that allows inbound HTTP/S from 0.0.0.0/0. The EC2 instances have a security group that allows inbound HTTP from the ALB's security group. Users report that they can access the application, but the application is slow and sometimes times out. The network engineer checks CloudWatch metrics and sees that the ALB's target response time is high. The engineer suspects that the EC2 instances are overwhelmed. Which action should the engineer take to improve performance?

Accepted Answer

Add EC2 instances in another Availability Zone and register them with the ALB.. Adding EC2 instances in another Availability Zone increases capacity and distributes traffic across multiple AZs, reducing the load on each instance and improving performance and fault tolerance. Option A is incorrect because a NAT gateway is for outbound internet access, not for reducing latency between ALB and targets. Option B is incorrect because an NLB does not automatically distribute traffic across AZs as effectively for HTTP applications and does not offload processing. Option C is incorrect because simply increasing instance size (vertical scaling) may not provide the same benefits as horizontal scaling across AZs for handling variable loads.

Answer

Add a NAT gateway in the public subnet to reduce latency.

Answer

Replace the ALB with a Network Load Balancer to reduce overhead.

Answer

Increase the size of the EC2 instances in the private subnet.

Question 4

A network engineer troubleshoots a VPN connection that shows 'available' state but traffic is not passing. The on-premises firewall logs show that the tunnel is established, but no traffic. The engineer checks the VPN configuration. Based on the exhibit, what is the MOST likely cause of the problem?

Accepted Answer

The VPN is configured for BGP (StaticRoutesOnly: false), but only a static route is added.. The VPN connection has `StaticRoutesOnly` set to `false`, which indicates that dynamic routing (BGP) is expected for route propagation. However, the route shown is a static route, so the VPN will not use it, as BGP is required. Without a proper BGP session or a static route with `StaticRoutesOnly` set to `true`, traffic cannot pass through the VPN. Option A is incorrect because the VPN state is indeed 'available'. Option C is incorrect because the outside IP addresses are routable over the internet. Option D is incorrect because the inside IP addresses (tunnel interfaces) are present in the configuration.

Answer

The VPN connection is not in 'available' state.

Answer

The outside IP addresses are not routable over the internet.

Answer

The inside IP addresses for the tunnels are missing.

Question 5

A company has a Direct Connect connection with a private VIF to a VPC. They want to add a second Direct Connect connection for redundancy. Both connections will terminate at the same Direct Connect gateway. Which TWO steps are required to enable BGP multipath (ECMP) across the two connections?

Accepted Answer

Ensure the same customer-side ASN is used on both virtual interfaces.. To enable BGP multipath (ECMP) across two Direct Connect connections terminating on the same Direct Connect gateway, you must use the same customer-side ASN on both virtual interfaces. This allows the Direct Connect gateway to treat both paths as equal-cost routes. Additionally, you must advertise the same BGP prefixes on both virtual interfaces so that the gateway sees identical routes from both paths and can load-balance traffic across them.

Answer

Use a different autonomous system number (ASN) on each virtual interface.

Answer

Advertise different BGP prefixes on each virtual interface.

Answer

Attach each virtual interface to a different VPC.

Question 6

The EC2 instance has a private IP 10.0.1.5. The first two hops are 10.0.1.1 (the subnet's default gateway) and 10.0.0.1. Based on the traceroute, what is the most likely configuration of the VPC?

Accepted Answer

The subnet is a private subnet with no route to an Internet Gateway, and the default route points to a NAT instance or is missing. The traceroute shows the first hop as 10.0.1.1 (the subnet's default gateway) and the second hop as 10.0.0.1 (the VPC router's IP for the main route table). The absence of a third hop to a public IP or NAT device indicates that the instance's traffic is not being forwarded beyond the VPC router. This is consistent with a private subnet that has no route to an Internet Gateway and either has no default route or a default route pointing to a NAT instance that is not responding or is missing, causing the traceroute to stop at the VPC router.

Answer

The subnet is a public subnet with a route to an Internet Gateway

Answer

The subnet is a private subnet with a route to a NAT Gateway

Answer

The subnet is connected to a VPN

Question 7

A company is designing a multi-region active-active application using Application Load Balancers (ALBs) behind AWS Global Accelerator. The application uses Aurora MySQL global database. Which design should be used to minimize cross-region latency for writes?

Accepted Answer

Deploy an ALB in each region with a Global Accelerator endpoint group containing both ALBs.. Deploying an ALB in each region and adding both to a Global Accelerator endpoint group enables active-active traffic distribution with optimal path routing via the AWS global network. Global Accelerator uses Anycast IPs to direct user traffic to the nearest healthy endpoint, minimizing latency. For writes to an Aurora MySQL global database, the primary region handles all write operations, but Global Accelerator ensures that write requests are routed to the primary region's ALB with the lowest possible latency from the client's location, while read traffic can be served locally from the secondary region's ALB.

Answer

Use Route 53 latency-based routing with a single ALB in the primary region.

Answer

Use Amazon CloudFront with origins in both regions and cache invalidation for writes.

Answer

Use Global Accelerator with a single ALB endpoint in one region and failover to the second region.

Question 8

A company has a Direct Connect connection with a private VIF to a VPC. They want to extend this connectivity to multiple VPCs in the same region without creating additional VIFs. Which solution should they implement?

Accepted Answer

Use a Direct Connect Gateway and attach the VPCs. A Direct Connect Gateway (DX Gateway) is a managed service that allows you to associate a single private virtual interface (VIF) with up to 10 VPCs in the same AWS Region (or across Regions with inter-region peering). This enables the company to extend their existing Direct Connect connection to multiple VPCs without provisioning additional VIFs, simplifying management and reducing costs.

Answer

Provision additional private VIFs for each VPC

Answer

Use VPC peering between the VPCs

Answer

Use a Transit VPC with VPN connections

Question 9

A developer wants to allow an EC2 instance in a VPC to access an Amazon S3 bucket without traversing the public internet. Which AWS service should be used?

Accepted Answer

VPC Gateway Endpoint for S3.. A VPC Gateway Endpoint for S3 allows EC2 instances to access S3 buckets privately using AWS’s internal network, without traversing the public internet. Gateway endpoints are specifically designed for services like S3 and DynamoDB, using route table entries to direct traffic to the service via the AWS backbone, with no data transfer costs for traffic within the same region.

Answer

AWS PrivateLink with an interface VPC endpoint.

Answer

NAT gateway in the public subnet.

Answer

AWS Direct Connect with a public VIF.

Question 10

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises data centers. They want to centralize internet traffic through a single VPC that has an internet gateway. Which Transit Gateway feature should they enable?

Accepted Answer

Transit Gateway route tables. To centralize internet traffic through a single VPC with an internet gateway, you need to control the routing of traffic from other VPCs and on-premises networks. Transit Gateway route tables allow you to isolate or share routes between attachments, enabling you to create a default route (0.0.0.0/0) pointing to the centralized VPC's attachment. This ensures all outbound internet traffic from other VPCs is forwarded to the egress VPC, which then uses its internet gateway.

Answer

VPN attachments

Answer

Multicast support

Answer

IPsec acceleration

Question 11

A company is deploying a new application on AWS and needs a highly available architecture across two Availability Zones (AZs) in a single region. The application consists of an Application Load Balancer (ALB) in front of a fleet of EC2 instances running in an Auto Scaling group, and an Amazon RDS for MySQL database with Multi-AZ deployment. The company requires that the application remain available even if an entire AZ fails. The network team has designed the VPC with two public subnets and two private subnets, each in a different AZ. The ALB is internet-facing and placed in the public subnets. The EC2 instances are in the private subnets. The RDS instance is also in the private subnets. The route tables are configured with a default route via an Internet Gateway for public subnets and via a NAT Gateway for private subnets. What change is MOST likely needed to ensure the architecture can survive an AZ failure?

Accepted Answer

Create a NAT Gateway in each Availability Zone. To survive an AZ failure, each AZ must have its own NAT Gateway to provide outbound internet access for instances in that AZ. If only one NAT Gateway is used and its AZ fails, instances in the other AZ lose internet connectivity. The architecture already has the ALB in public subnets across both AZs and RDS Multi-AZ, so the missing component is a NAT Gateway per AZ. Option A is incorrect because you cannot have an Internet Gateway per AZ; it is a regional resource. Option B is incorrect because an NLB is not needed; the ALB already provides load balancing. Option D is incorrect because the Auto Scaling group should already be configured to launch instances in both AZs; that's a prerequisite, not the most likely missing change.

Answer

Add a second Internet Gateway in the other AZ

Answer

Use a Network Load Balancer instead of an Application Load Balancer

Answer

Configure the Auto Scaling group to launch instances in both AZs

Question 12

A company has a VPC with a CIDR of 10.0.0.0/16. They have two Availability Zones, each with a public subnet (10.0.1.0/24 and 10.0.2.0/24) and a private subnet (10.0.3.0/24 and 10.0.4.0/24). They have an internet-facing ALB in the public subnets and EC2 instances in the private subnets. The EC2 instances need to download updates from the internet. They deploy a NAT Gateway in each public subnet and add routes in the private subnet route tables pointing to the respective NAT Gateway in the same AZ. However, the EC2 instances in AZ2 cannot access the internet, while those in AZ1 can. What is the most likely cause?

Accepted Answer

The NAT Gateway in AZ2 does not have an Elastic IP address assigned.. The NAT Gateway in AZ2 does not have an Elastic IP address assigned. A NAT Gateway requires an Elastic IP to enable outbound internet traffic. Without it, the NAT Gateway cannot route traffic to the internet, causing the EC2 instances in AZ2 to fail to download updates. Option A is incorrect because security group rules are account-level and would affect both AZs equally. Option C is incorrect because the route table in AZ2 is configured to point to the NAT Gateway in the same AZ, not cross-AZ. Option D is incorrect because the route table for the private subnet in AZ2 does have a route to the NAT Gateway, but the NAT Gateway itself is missing the Elastic IP.

Answer

The security group of the EC2 instances in AZ2 is blocking outbound traffic.

Answer

The private subnet in AZ2 is routing traffic to the NAT Gateway in AZ1, which is in a different Availability Zone and incurs cross-AZ charges but should still work.

Answer

The route table for the private subnet in AZ2 is missing a route to the NAT Gateway.

Question 13

A network engineer is designing a Direct Connect solution with a public VIF and a private VIF. The private VIF will connect to a VPC via a Direct Connect Gateway. Which TWO of the following statements are correct regarding this setup? (Choose 2.)

Accepted Answer

The Direct Connect Gateway allows the private VIF to connect to multiple VPCs in different AWS Regions. A Direct Connect Gateway enables a private VIF to connect to multiple VPCs, even across different AWS Regions, by acting as a transit hub. The gateway uses a single private VIF to route traffic to up to 10 VPCs (by default) in any region, provided the VPCs are associated via virtual private gateways and the appropriate route tables are configured.

Answer

The private VIF can be used without a virtual interface termination device on the customer side

Answer

The public VIF can be used to connect to a VPC via a Direct Connect Gateway

Answer

The private VIF can be used to access Amazon S3 over a private IP address

Question 14

A company wants to provide internet access to instances in a private subnet using a NAT gateway. The NAT gateway is deployed in a public subnet with an Elastic IP. The private subnet route table has a default route pointing to the NAT gateway. However, instances in the private subnet cannot access the internet. What is the most likely cause?

Accepted Answer

The public subnet route table does not have a route to the internet gateway.. The NAT gateway is deployed in a public subnet, but for it to route traffic to the internet, the public subnet's route table must have a default route (0.0.0.0/0) pointing to an internet gateway (IGW). Without this route, the NAT gateway cannot forward traffic from the private subnet to the internet, even though the private subnet's route table correctly points to the NAT gateway. This is the most likely cause because the NAT gateway itself needs internet access via the IGW to translate and forward traffic.

Answer

The security group assigned to the NAT gateway blocks outbound traffic.

Answer

The private subnet route table has a route to the internet gateway instead of the NAT gateway.

Answer

The NAT gateway does not have an Elastic IP associated.

Question 15

A company is implementing a hybrid network using AWS Direct Connect and VPN backup. They have multiple VPCs in a single AWS Region. Which design minimizes the number of Direct Connect virtual interfaces while providing connectivity to all VPCs?

Accepted Answer

Create one private VIF attached to a Direct Connect gateway and associate the gateway with all VPCs.. A Direct Connect gateway allows a single private virtual interface (VIF) to connect to multiple VPCs in the same AWS Region. By attaching the Direct Connect gateway to all target VPCs, you eliminate the need for separate private VIFs per VPC, minimizing operational overhead and cost while maintaining private connectivity.

Answer

Set up a transit VPC with EC2-based routers.

Answer

Create a separate private VIF for each VPC.

Answer

Use a single public VIF and route through the internet.

Question 16

A company is designing a multi-Region application using Amazon Route 53 latency-based routing. The application must be highly available and failover automatically if an AWS Region becomes unavailable. What should the company do to meet these requirements?

Accepted Answer

Configure active-passive failover with latency-based routing and associate health checks with each record.. It combines latency-based routing with health checks and active-passive failover, which allows Route 53 to route traffic to the region with the lowest latency under normal conditions and automatically fail over to the passive region if the active region's health check fails. This meets the high availability and automatic failover requirements by leveraging Route 53's DNS failover mechanism, which updates DNS responses based on health check status.

Answer

Configure latency-based routing with health checks and enable DNS failover.

Answer

Configure geolocation routing policies and associate health checks.

Answer

Configure weighted routing policies with equal weights for all regions.

Question 17

A network engineer needs to allow an EC2 instance in a private subnet to access an S3 bucket without traversing the internet. Which AWS service should be used?

Accepted Answer

VPC Gateway Endpoint. A VPC Gateway Endpoint allows private subnet resources to access S3 without traversing the internet by routing traffic through AWS's internal network. It uses prefix lists and route table entries to direct S3-bound traffic to a highly available, horizontally scaled gateway endpoint, avoiding NAT or internet gateway costs and latency.

Answer

VPC Peering

Answer

Internet Gateway

Answer

NAT Gateway

Question 18

A company has multiple VPCs across different AWS Regions and wants to enable communication between them using AWS's global network backbone. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Use AWS Transit Gateway with inter-Region peering.. AWS Transit Gateway with inter-Region peering is correct because it allows you to connect multiple VPCs across different AWS Regions using AWS's global network backbone, providing a hub-and-spoke architecture that scales easily. This solution minimizes operational overhead by centralizing routing and eliminating the need to manage individual connections between each VPC, as Transit Gateway automatically handles route propagation and traffic distribution across peered transit gateways.

Answer

Set up AWS Direct Connect connections to each VPC.

Answer

Create VPC peering connections between each pair of VPCs.

Answer

Use AWS Site-to-Site VPN between VPCs.

Question 19

A security engineer reviews the CloudTrail log entry above. What security concern does this event raise?

Accepted Answer

The root user is being used to perform administrative actions.. The event shows the AWS root user creating a security group. Best practice is to not use root for daily tasks. The source IP is external, but that is not necessarily a concern. The security group name is not the issue. The region is us-east-1, not a concern.

Answer

The security group was created with a permissive name.

Answer

The event took place in a region that is not used by the company.

Answer

The event originated from an external IP address.

Question 20

A company wants to connect an on-premises data center to AWS using a dedicated private connection that does not traverse the internet. Which AWS service should they use?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct choice because it provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the internet entirely. This service uses industry-standard 802.1Q VLANs to create a private virtual interface (VIF) that connects directly to a virtual private gateway or AWS Transit Gateway, ensuring low latency, consistent bandwidth, and compliance with data sovereignty requirements.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

VPC Peering