ANS-C01 Practice Exam 67 — 20 Questions

Question 1

A company has a transit gateway with multiple VPC attachments and a VPN attachment to on-premises. The security team wants to inspect all traffic between VPCs and between VPCs and on-premises using a centralized AWS Network Firewall. They also need to ensure that traffic cannot bypass the firewall. Which solution should be implemented?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a dedicated inspection VPC with a Network Firewall, attach it to the transit gateway, and configure transit gateway route tables to send all traffic through the inspection VPC.. Centralized inspection with AWS Network Firewall is achieved by deploying the firewall in a dedicated inspection VPC and attaching that VPC to the transit gateway. Transit gateway route tables are then configured to route all traffic from other VPCs and VPN attachments through the inspection VPC. This ensures that all traffic is inspected and cannot bypass the firewall.

Answer

Use AWS Firewall Manager to enforce Network Firewall policies across all VPCs, with each VPC having its own firewall.

Answer

Configure the transit gateway to use a Network Firewall as a middlebox by associating the firewall with the transit gateway attachment.

Answer

Attach the Network Firewall to each VPC and configure route tables to send traffic through the firewall endpoints.

Question 2

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team needs to monitor the amount of data transferred over the Transit Gateway and set up alerts when traffic exceeds a threshold. Which combination of AWS services should the team use to achieve this?

Accepted Answer

Amazon CloudWatch and AWS Transit Gateway metrics. AWS Transit Gateway publishes metrics such as BytesIn and BytesOut to Amazon CloudWatch. The network team can use CloudWatch to monitor these metrics and create alarms that trigger when data transfer exceeds a defined threshold. This provides a native, efficient solution for monitoring and alerting on Transit Gateway traffic. Other services like VPC Flow Logs, CloudTrail, Network Manager, and CloudWatch Logs do not provide the necessary aggregate metrics for this purpose.

Answer

AWS Network Manager and AWS CloudFormation

Answer

Amazon CloudWatch Logs and AWS Lambda

Answer

VPC Flow Logs and AWS CloudTrail

Question 3

A company is expanding its AWS presence and needs to connect 50 VPCs across multiple AWS accounts to a central on-premises data center. They require a hub-and-spoke topology with transitive routing between VPCs and the data center. The solution must be scalable and minimize the number of connections. Which AWS service should they use?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway is designed for hub-and-spoke topologies, allowing you to connect many VPCs and on-premises networks through a central gateway. It supports transitive routing, so VPCs can communicate with each other and with the data center without full mesh peering. This scales efficiently and reduces management overhead compared to other options.

Answer

AWS Direct Connect gateway

Answer

VPC peering

Answer

AWS Site-to-Site VPN with dynamic routing

Question 4

A network engineer is designing a VPC that must host a latency-sensitive trading application. The design requires that each subnet can reach every other subnet in the same VPC without additional routing configuration, and that the VPC can be extended to a second VPC with minimal management overhead. The company also wants to control which Availability Zones the subnets use. Which TWO statements are correct about the VPC design elements involved? (Choose two.)

Accepted Answer

A VPC peering connection requires a route in both VPCs and does not support transitive routing to a third VPC.. The local route in every VPC route table enables all subnets in the VPC to communicate without extra configuration, satisfying the intra-VPC requirement. VPC peering provides a deliberate, non-transitive connection between two VPCs with routes in both, which extends the design to a second VPC while keeping management overhead low. Subnets remain single-AZ constructs and the local route cannot be removed.

Answer

The local route in a VPC route table can be removed and replaced with a more specific route to control intra-VPC traffic.

Answer

VPC peering connections support transitive routing so a peered VPC can forward traffic to a third VPC.

Answer

A subnet can span multiple Availability Zones to provide high availability for the trading application.

Question 5

A company has a VPC with a CIDR block of 10.0.0.0/16. They have a private subnet with CIDR 10.0.1.0/24 that contains EC2 instances. The instances need to access an Amazon S3 bucket to download objects. The company wants to ensure that traffic to S3 does not traverse the public internet. Which solution should they implement?

Accepted Answer

Create a VPC endpoint for Amazon S3 and update the route table for the private subnet.. To access S3 without using the public internet, use a VPC endpoint for S3. A gateway endpoint is a target for a route in the route table. When you associate the endpoint with the private subnet's route table, traffic to S3 is routed through the endpoint and stays within the AWS network. This is the recommended and most secure method. Other options either use the public internet or are not applicable.

Answer

Configure an internet gateway and route S3 traffic through it.

Answer

Create a NAT gateway in a public subnet and route S3 traffic through it.

Answer

Set up an AWS Site-to-Site VPN connection to the S3 service.

Question 6

A company is designing a VPC that will host a critical application. The security team requires that all traffic entering and leaving the VPC be inspected by a centralized firewall appliance. The appliance must be able to scale horizontally and maintain high availability across multiple Availability Zones. Which design should the company implement?

Accepted Answer

Use AWS Network Firewall with endpoints in multiple Availability Zones and a transit gateway for centralized routing.. AWS Network Firewall is a managed, highly available firewall service that can be deployed across multiple Availability Zones. When combined with AWS Transit Gateway, it enables centralized inspection of traffic between VPCs and to/from the internet. This satisfies the need for scalability, high availability, and centralized security enforcement without managing third-party appliances.

Answer

Deploy a third-party firewall appliance on EC2 instances in an auto scaling group behind a Network Load Balancer.

Answer

Enable VPC Flow Logs and use Amazon GuardDuty for traffic inspection.

Answer

Deploy a firewall appliance in a single public subnet and route all traffic through it using a NAT gateway.

Question 7

A security team wants to prove that no traffic can traverse an AWS Site-to-Site VPN connection to an on-premises data center without being inspected. They have a transit gateway with a VPN attachment and a VPC attachment, and they plan to route all inter-network traffic through an AWS Network Firewall endpoint in a dedicated inspection VPC. Which configuration ensures that the transit gateway enforces inspection before traffic reaches the destination VPC?

Accepted Answer

Create separate transit gateway route tables, associate the VPN and workload VPC attachments with a route table whose default route points to the inspection VPC attachment, and enable appliance mode on the inspection VPC attachment.. Centralized inspection with a transit gateway requires explicit route table segmentation so that traffic from the VPN attachment is directed to the inspection VPC attachment rather than straight to workloads. Pairing that routing with appliance mode on the inspection attachment keeps bidirectional flows on the same firewall endpoint, which is essential for stateful inspection to see both directions of each connection.

Answer

Associate a transit gateway route table with the inspection VPC attachment and enable appliance mode on that attachment.

Answer

Enable transit gateway route propagation from the VPN attachment to the workload VPC route table and rely on the VPN tunnel's built-in inspection.

Answer

Attach an AWS Network Firewall policy directly to the transit gateway and set the policy's default action to drop.

Question 8

A company runs a latency-sensitive application on EC2 instances in a VPC. The instances must communicate with each other using a protocol that requires multicast. Which AWS networking feature should be used to enable multicast communication within the VPC?

Accepted Answer

AWS Transit Gateway Multicast. Transit Gateway Multicast is the correct choice because it is the only AWS-native feature that enables multicast communication within a VPC. It allows you to create a multicast domain, associate subnets, and manage group membership using IGMP or static configurations. Other options either do not support multicast or are intended for different use cases such as hybrid connectivity or public service access.

Answer

VPC peering with multicast enabled

Answer

AWS Direct Connect with a public VIF

Answer

AWS Site-to-Site VPN with multicast support

Question 9

A healthcare company is designing a hub-and-spoke network in AWS. The hub VPC contains shared services, and multiple spoke VPCs host application workloads. The company wants centralized inspection of traffic between spokes and centralized connectivity to an on-premises data center through a single AWS Direct Connect connection. The design must minimize the number of VPC attachments and support transitive routing between spokes. (Choose two.)

Accepted Answer

Attach the on-premises network to the transit gateway using a Direct Connect gateway and a transit virtual interface.. A transit gateway provides transitive routing between attached VPCs and centralizes the hub-and-spoke topology, while transit gateway route tables enforce segmentation and inspection. A Direct Connect gateway with a transit virtual interface connects on-premises to the same transit gateway, so all spokes reach the data center through one connection. VPC peering, PrivateLink, and per-spoke transit gateways do not meet the transitivity and centralization requirements.

Answer

Use AWS PrivateLink to connect each spoke VPC to the hub VPC and to the on-premises data center.

Answer

Create a full mesh of VPC peering connections between every spoke VPC and the hub VPC, and enable route propagation between all peering connections.

Answer

Create a transit gateway in each spoke VPC and peer the transit gateways together to form a global network.

Question 10

A retail company wants instances in a newly created VPC to reach an Amazon S3 bucket in the same Region without traversing the public internet and without consuming NAT gateway capacity. The VPC has private subnets only and no internet gateway attached. Which action should the network engineer take?

Accepted Answer

Create a gateway VPC endpoint for Amazon S3 and add a route for the endpoint prefix list to the private subnets' route tables.. Gateway VPC endpoints for Amazon S3 attach to route tables and route service traffic over the AWS network, so private subnets with no internet gateway can reach S3 without NAT. The prefix-list route in each subnet's route table is what actually directs the traffic, and this approach carries no hourly endpoint charges.

Answer

Create an interface VPC endpoint for Amazon S3 and attach a security group that permits HTTPS from the VPC CIDR.

Answer

Deploy a NAT gateway in a public subnet and add a default route from the private subnets to the NAT gateway.

Answer

Attach an internet gateway to the VPC and add a default route in the private subnet route tables so S3 traffic exits through the gateway.

Question 11

A media company runs a live video streaming platform with EC2 instances spread across three Availability Zones in a single VPC. The instances must communicate with each other using IP multicast for real-time stream distribution. The company wants to minimize latency and avoid managing additional infrastructure. Which AWS service or feature should they use to enable multicast communication?

Accepted Answer

AWS Transit Gateway multicast. AWS Transit Gateway multicast is the only native AWS service that provides managed multicast within and across VPCs. It eliminates the need for custom IGMP proxies or overlay networks, and it integrates with VPC attachments to deliver multicast traffic to participating instances. The other options either do not support multicast or are unrelated to VPC-internal communication.

Answer

VPC peering with IGMP proxy on each instance

Answer

Network Load Balancer with UDP listener

Answer

AWS Direct Connect with a public virtual interface

Question 12

A company is setting up a VPC peering connection between two VPCs in different AWS accounts and different AWS Regions. They need to ensure that the connection is properly configured for bidirectional traffic. Which TWO of the following steps are required to enable communication between the VPCs? (Choose two.)

Accepted Answer

Accept the VPC peering connection request in the accepter VPC's account.. To enable communication over a VPC peering connection, you must update the route tables in both VPCs to direct traffic for the peer CIDR to the peering connection. Additionally, for cross-account peering, the accepter VPC owner must accept the peering request. These two steps are essential for establishing the connection and allowing traffic to flow bidirectionally. Security group and NACL configurations are also important but are not part of the peering setup itself.

Answer

Ensure that security groups in both VPCs allow traffic from the peer VPC's CIDR block.

Answer

Create a VPN connection between the two VPCs to secure the traffic.

Answer

Configure a NAT gateway in each VPC to allow traffic to the peer VPC.

Question 13

A network engineer needs to capture and analyze all traffic entering and leaving a VPC for security auditing. The VPC contains many EC2 instances with elastic network interfaces. The engineer must ensure that flow logs record accepted and rejected traffic, including traffic to and from the instances, and that the logs are delivered to Amazon CloudWatch Logs for real-time analysis. Which configuration should the engineer use?

Accepted Answer

Create a VPC Flow Log at the VPC level with a filter of ALL and deliver to CloudWatch Logs.. VPC Flow Logs at the VPC level capture IP traffic for all ENIs in the VPC. Setting the filter to ALL includes both accepted and rejected traffic, which is necessary for security auditing. Delivering to CloudWatch Logs allows real-time querying and alerting. Per-ENI flow logs with ACCEPT-only filtering would miss rejected traffic and would not scale as new ENIs are added.

Answer

Create a flow log on each EC2 instance's elastic network interface with a filter of ACCEPT and deliver to Amazon S3.

Answer

Configure a VPC traffic mirror session that sends all traffic to an Amazon CloudWatch Logs log group.

Answer

Enable AWS CloudTrail data events for the VPC and deliver to CloudWatch Logs.

Question 14

A company uses AWS Site-to-Site VPN to connect its on-premises network to a VPC. The VPN connection is configured with two tunnels for redundancy. The network engineer notices that traffic is only flowing through one tunnel, and the other tunnel is idle. The engineer wants to ensure that both tunnels are used simultaneously to maximize throughput. The on-premises router supports BGP and is configured with equal BGP attributes for both tunnels. What should the engineer do to achieve this?

Accepted Answer

Configure the on-premises router to use ECMP for the BGP routes learned over the VPN tunnels.. AWS Site-to-Site VPN provides two tunnels for redundancy. To use both tunnels simultaneously for increased throughput, the on-premises router must support and be configured for ECMP. With equal BGP attributes, ECMP will load-balance traffic across both tunnels. Other options either do not enable simultaneous use or would make one tunnel preferred.

Answer

Set the BGP local preference to be higher on one tunnel than the other.

Answer

Configure the VPN connection to use a single tunnel with higher bandwidth.

Answer

Enable acceleration for the VPN connection using AWS Global Accelerator.

Question 15

A media company is deploying a real-time video processing application across multiple VPCs in the same AWS Region. The VPCs are in different AWS accounts and are managed by separate teams. The application requires high-throughput, low-latency communication between instances in these VPCs. The company wants to minimize management overhead and avoid complex peering meshes. They also need to ensure that traffic between VPCs does not traverse the public internet. Which solution should a network engineer recommend?

Accepted Answer

Use AWS Transit Gateway with a single transit gateway shared across accounts via AWS Resource Access Manager (RAM).. AWS Transit Gateway provides a hub-and-spoke topology that simplifies connectivity across many VPCs and accounts. Sharing the transit gateway via AWS RAM allows cross-account attachments without complex peering. Traffic remains on the AWS private network, ensuring it does not traverse the public internet. This reduces management overhead and scales well, unlike a full mesh of peering connections or third-party appliances.

Answer

Establish AWS Site-to-Site VPN connections between each pair of VPCs using virtual private gateways.

Answer

Deploy a third-party virtual appliance in each VPC and create a mesh of IPsec tunnels between them.

Answer

Create a full mesh of VPC peering connections between all VPCs and update route tables accordingly.

Question 16

A company operates a VPC with CIDR 10.50.0.0/16 and has an AWS Site-to-Site VPN to its data center. The data center advertises 192.168.10.0/24 and 192.168.20.0/24 over BGP. The company needs instances in the VPC to reach both prefixes, but the VPN tunnel should carry only the 192.168.10.0/24 traffic while 192.168.20.0/24 must be dropped. Which configuration achieves this?

Accepted Answer

Create a route in the VPC route table for 192.168.10.0/24 pointing to the virtual private gateway, and do not create a route for 192.168.20.0/24.. VPC route tables are explicit: a destination prefix is reachable only when a route for it points to a target such as a virtual private gateway. Adding a route for 192.168.10.0/24 to the virtual private gateway carries that prefix over the VPN, while omitting a route for 192.168.20.0/24 drops traffic to it. This gives deterministic, per-prefix control without touching BGP.

Answer

Add a network ACL rule to the subnet that permits 192.168.10.0/24 and denies 192.168.20.0/24 on both inbound and outbound traffic.

Answer

Configure an outbound security group rule that denies traffic to 192.168.20.0/24 while allowing 192.168.10.0/24.

Answer

Enable route propagation from the virtual private gateway and rely on the BGP advertisement to install both prefixes automatically.

Question 17

A network engineer needs to capture and analyze traffic that is traversing an AWS Transit Gateway. The engineer wants to use VPC Flow Logs to capture this traffic. What should the engineer do?

Accepted Answer

Enable Transit Gateway Flow Logs on the Transit Gateway or its attachments.. To capture traffic traversing an AWS Transit Gateway, you must use Transit Gateway Flow Logs. These logs provide detailed information about IP traffic going through the Transit Gateway, including source and destination IP addresses, ports, protocol, and whether the traffic was accepted or rejected. VPC Flow Logs are limited to VPC-level resources and cannot capture Transit Gateway transit traffic. CloudTrail is for API activity, not network traffic. Therefore, enabling Transit Gateway Flow Logs is the correct action.

Answer

Enable VPC Flow Logs on the VPCs that are attached to the Transit Gateway.

Answer

Use AWS CloudTrail to log Transit Gateway API calls and analyze traffic.

Answer

Enable VPC Flow Logs on the Transit Gateway attachment's ENI.

Question 18

A company is deploying a global web application across three AWS Regions. The application uses Network Load Balancers (NLBs) in each Region. The company wants to provide a single global static IP address to clients and route traffic to the nearest healthy Regional endpoint based on latency. The solution must also support automatic failover if an entire Region becomes unavailable. Which AWS service should be used?

Accepted Answer

AWS Global Accelerator with a standard accelerator and endpoint groups in each Region.. AWS Global Accelerator provides static anycast IP addresses that serve as a fixed global entry point. It uses the AWS global network to route traffic to the lowest-latency healthy endpoint and automatically fails over if an endpoint or Region becomes unavailable. This matches the need for a single static IP and resilient global routing.

Answer

AWS Transit Gateway with inter-Region peering and equal-cost multipath routing.

Answer

Amazon CloudFront with origin groups and Lambda@Edge for failover.

Answer

Amazon Route 53 with latency-based routing and health checks.

Question 19

A company has a hybrid network with an AWS Site-to-Site VPN connection to an on-premises data center. The VPN connection is established, but users report intermittent connectivity to instances in a VPC. The network engineer suspects issues with the VPN tunnel. Which TWO actions should the engineer take to troubleshoot the intermittent connectivity? (Choose two.)

Accepted Answer

Check the VPN tunnel status in the AWS Management Console and review CloudWatch metrics for TunnelState and TunnelDataIn/Out.. Intermittent VPN connectivity often stems from tunnel flapping or IKE rekey issues. Monitoring CloudWatch metrics like TunnelState and TunnelDataIn/Out provides visibility into tunnel stability. Reviewing on-premises VPN device logs for IKEv2 rekey failures or dead peer detection timeouts helps identify the root cause. These two actions together address both the AWS-side and on-premises-side diagnostics.

Answer

Verify that the on-premises VPN device is configured with the correct pre-shared key and IKE identifiers.

Answer

Increase the VPN tunnel's bandwidth by enabling accelerated VPN.

Answer

Enable VPC Flow Logs on the VPN attachment and analyze for rejected traffic.

Question 20

A company uses AWS Transit Gateway to connect multiple VPCs. They want to enforce that all traffic between VPCs is inspected by a centralized AWS Network Firewall. They have deployed the firewall in a dedicated inspection VPC and associated it with the transit gateway. However, they notice that traffic between two VPCs is not being inspected. What is the most likely reason?

Accepted Answer

The transit gateway route tables for the VPCs do not have routes that point to the inspection VPC.. Centralized inspection with AWS Transit Gateway requires that the transit gateway route tables direct traffic from source VPCs to the inspection VPC, and then from the inspection VPC to the destination VPCs. Without these routes, inter-VPC traffic bypasses the firewall. The missing routes are the most likely reason for uninspected traffic.

Answer

The VPC attachments are not associated with the correct transit gateway route table.

Answer

The Network Firewall policy is not associated with the transit gateway.

Answer

The Network Firewall subnet is not in the same Availability Zone as the transit gateway attachment.