ANS-C01 Practice Exam 69 — 20 Questions

Question 1

Refer to the exhibit. A network engineer is creating an IAM policy for a junior engineer who needs to set up a VPC with public and private subnets and an internet gateway. The junior engineer reports that they cannot create a VPC peering connection. Based on the policy, what is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The policy has an explicit Deny statement for ec2:CreateVpcPeeringConnection.. The policy includes an explicit Deny statement for the ec2:CreateVpcPeeringConnection action. In IAM, an explicit Deny overrides any Allow, so even though the policy allows other VPC-related actions, the Deny prevents the junior engineer from creating VPC peering connections. Therefore, the most likely reason is that the policy has an explicit Deny for that action, which corresponds to option A. Option B is incorrect because the policy does allow ec2:CreateVpc and does not implicitly deny peering; an explicit Deny is required. Option C is irrelevant because the policy does not mention MFA. Option D is incorrect because the policy does not allow the action, but the explicit Deny is the stronger reason and is listed as option A.

Answer

The policy allows ec2:CreateVpc which implicitly denies peering.

Answer

The policy requires multi-factor authentication to create VPC peering connections.

Answer

The policy does not allow the ec2:CreateVpcPeeringConnection action.

Question 2

A company has a VPC with public and private subnets across two Availability Zones. The private subnets require outbound internet access for updates, but must not be directly reachable from the internet. The company has a NAT gateway in each public subnet. Security team reports that instances in private subnets cannot reach the internet. Which configuration should be verified first?

Accepted Answer

Verify that the route table for the public subnets has a default route pointing to an internet gateway, and the private subnets' route table has a default route pointing to the NAT gateway. For instances in private subnets to reach the internet via a NAT gateway, the private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT gateway, and the NAT gateway must be placed in a public subnet whose route table has a default route pointing to an internet gateway. If either route is missing, outbound internet access will fail. Option B is incorrect because VPC endpoints are for accessing specific AWS services (e.g., S3), not general internet access. Option C is incorrect because NACLs are stateless and by default allow all outbound traffic; although custom NACLs could block traffic, routing misconfiguration is a more common first issue. Option D is incorrect because security groups are stateful and outbound traffic is allowed by default; blocking outbound HTTPS would be an intentional change, not the first thing to verify.

Answer

Verify that the VPC has a VPC endpoint for S3 configured

Answer

Verify that the network ACLs for the private subnets allow outbound traffic to 0.0.0.0/0

Answer

Verify that the security groups attached to the instances allow outbound HTTPS traffic

Question 3

Refer to the exhibit. A company has created a VPC endpoint for S3. However, an EC2 instance in the subnet associated with the route table cannot access S3 via the endpoint. The route table has a route to the endpoint. What is the most likely cause?

Accepted Answer

Private DNS is not enabled. The endpoint policy is set to Allow all, which is fine. However, the PrivateDnsEnabled is false, meaning that DNS resolution for S3 endpoints does not resolve to the endpoint IP. To use the endpoint, either enable Private DNS or use the endpoint-specific DNS name. Option A is wrong because the endpoint state is 'available'. Option B is wrong because the route table is associated. Option D is wrong because the security group is not specified (empty), but default SG allows all outbound traffic.

Answer

The endpoint is in 'pending' state

Answer

The route table is not associated with the subnet

Answer

The security group is blocking traffic

Question 4

A company has a VPC with a public subnet containing a NAT gateway and a private subnet containing EC2 instances. The EC2 instances need to download patches from the internet. The security team wants to ensure that the EC2 instances cannot initiate outbound connections to any other internet destinations. What should the network engineer do?

Accepted Answer

Assign a security group to the EC2 instances that allows outbound HTTPS traffic only to the patch server's IP address.. Security groups act as a virtual firewall for EC2 instances, allowing you to specify outbound rules that restrict traffic to only the necessary destinations, such as the patch server's IP address on HTTPS. This provides granular control over outbound traffic. Option A is incorrect because removing the NAT gateway and attaching an internet gateway to the private subnet would give instances direct internet access, violating the restriction. Option B is incorrect because an egress-only internet gateway is used for IPv6 traffic only, not IPv4. Option C is incorrect because network ACLs are stateless and apply to the subnet as a whole, making them less suitable for per-instance granular control; they also require rules for return traffic, complicating the configuration.

Answer

Remove the NAT gateway and attach an Internet Gateway to the private subnet route table.

Answer

Attach an egress-only Internet Gateway to the VPC and route private subnet traffic to it.

Answer

Configure a network ACL on the private subnet to allow outbound traffic only to the patch server's IP address.

Question 5

An organization uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. They want to implement traffic inspection between VPCs using a third-party firewall appliance in a central VPC. The firewall must inspect traffic for all inter-VPC flows. Which architecture meets this requirement?

Accepted Answer

Configure Transit Gateway route tables to send inter-VPC traffic to the inspection VPC's attachment, and enable appliance mode on the attachment.. Enabling appliance mode on a Transit Gateway attachment forces the Transit Gateway to preserve the source MAC address and use flow hash-based load balancing for traffic sent to the inspection VPC. This ensures that all inter-VPC traffic is routed through the third-party firewall appliance in the central VPC, allowing stateful inspection to work correctly. Without appliance mode, the Transit Gateway would perform MAC address rewriting, breaking the firewall's ability to track sessions.

Answer

Create VPC peering connections between all VPCs and route traffic through the central VPC.

Answer

Use a Network Load Balancer in the central VPC to distribute traffic to the firewall appliances.

Answer

Set up Direct Connect gateways and route all traffic through the on-premises network for inspection.

Question 6

A company has an AWS Direct Connect connection and wants to connect to multiple VPCs in the same region. Which TWO services can be used to achieve this? (Choose TWO.)

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway (Option B) acts as a central hub that interconnects VPCs and on-premises networks via a single Direct Connect connection, allowing you to connect to multiple VPCs in the same region without needing individual virtual interfaces. Direct Connect Gateway (Option D) enables you to associate multiple VPCs in the same or different regions with a single Direct Connect connection by using a single private virtual interface (VIF) and transit virtual interfaces (VIFs) to reach those VPCs through Transit Gateway or virtual private gateways.

Answer

VPC Peering

Answer

AWS Site-to-Site VPN

Answer

AWS CloudHub

Question 7

A company is designing a VPC with private subnets for databases and public subnets for web servers. They need to allow the web servers to make outbound internet requests for software updates but prevent inbound traffic from the internet. Which configuration should they use?

Accepted Answer

Deploy a NAT Gateway in a public subnet and add a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT Gateway.. Deploying a NAT Gateway in a public subnet allows instances in private subnets to initiate outbound internet traffic (e.g., for software updates) while blocking unsolicited inbound traffic from the internet. Option B is incorrect because a NAT Gateway must be in a public subnet to access the internet. Option C is incorrect because an Internet Gateway allows both inbound and outbound traffic, which would expose the private subnets to inbound internet traffic. Option D is incorrect because while a proxy server could work, it is more complex and not the simplest or recommended AWS solution.

Answer

Deploy a NAT Gateway in the private subnet and route the private subnet traffic through it.

Answer

Attach an Internet Gateway to the VPC and route the private subnet traffic through it.

Answer

Deploy a proxy server in the private subnet and configure the web servers to use it.

Question 8

A company has a VPC with a CIDR of 10.0.0.0/16. They want to create a subnet that can host at least 2000 EC2 instances. Which subnet size should they choose?

Accepted Answer

/21. A /21 subnet provides 2,048 usable IP addresses (2^(32-21) - 5 = 2,048 - 5 = 2,043 for AWS, but the key is that 2,048 total addresses minus the 5 reserved by AWS yields 2,043, which exceeds the requirement of 2,000 EC2 instances). AWS reserves 5 IP addresses per subnet (network, VPC router, DNS, future use, broadcast), so the usable count is total addresses minus 5. A /21 is the smallest subnet that meets the 2,000-instance requirement.

Answer

/22

Answer

/24

Answer

/20

Question 9

Refer to the exhibit. A network engineer is analyzing a VPC Flow Log record from a VPC with CIDR 10.0.0.0/16. The record indicates a REJECT action. Which component is most likely blocking the traffic?

Accepted Answer

The destination instance's security group. Flow logs record traffic after security group and NACL evaluation. A REJECT indicates the traffic was dropped by a security group or NACL. Since the destination port is 80 (HTTP), a security group is likely blocking inbound HTTP. Option C is correct. Option A is wrong because the source IP is within the VPC. Option B is wrong because there is no indication of a missing route. Option D is wrong because NACL rules are stateless and would show REJECT if they block, but security groups are more common for instance-level blocking.

Answer

The destination instance's operating system firewall

Answer

A missing route in the route table

Answer

The network ACL of the destination subnet

Question 10

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16 and needs to connect to an on-premises network using AWS Site-to-Site VPN. The on-premises network uses 10.0.0.0/8. What should be done to avoid overlapping CIDRs?

Accepted Answer

Create a new VPC with a non-overlapping CIDR and migrate resources. AWS Site-to-Site VPN requires non-overlapping IP CIDRs between the VPC and the on-premises network for proper routing. The VPC uses 10.0.0.0/16, which falls entirely within the on-premises 10.0.0.0/8, causing a conflict that prevents the VPN from establishing routes correctly. Creating a new VPC with a non-overlapping CIDR (e.g., 172.16.0.0/16) and migrating resources resolves the overlap, enabling the VPN connection.

Answer

Configure a VPN with overlapping CIDRs, it will still work

Answer

Use NAT on the customer gateway to translate addresses

Answer

Use VPC peering to connect to on-premises

Question 11

Refer to the exhibit. An EC2 instance in the PrivateSubnet is unable to download patches from the internet. What is the most likely cause?

Accepted Answer

The PrivateRoute resource references the NAT gateway before it is created.. The PrivateRoute resource references the NAT gateway using a NatGatewayId, but the NAT gateway is defined after the route in the CloudFormation template. Without a DependsOn attribute on the route to ensure the NAT gateway is created first, the route will attempt to reference a non-existent resource, causing a creation failure. This is the most likely cause of the EC2 instance's inability to download patches. Option A is incorrect because the private subnet is indeed associated with a route table (the PrivateRouteTable). Option B is incorrect because the issue pertains to IPv4 traffic, not IPv6; NAT gateway supports IPv4. Option C is incorrect because MapPublicIpOnLaunch is a setting for public subnets and does not affect internet access via NAT gateway.

Answer

The private subnet is not associated with any route table.

Answer

The NAT gateway does not support IPv6 traffic.

Answer

The private subnet does not have MapPublicIpOnLaunch set to true.

Question 12

A company is using AWS Client VPN to provide remote access to their VPC. Users report that they can connect to the VPN but cannot reach resources in the VPC. Which THREE configuration items should the engineer verify?

Accepted Answer

The authorization rules allow access to the VPC's CIDR.. Authorization rules in AWS Client VPN define which networks (CIDRs) users are allowed to access. If the rule does not include the VPC's CIDR, traffic to resources in the VPC will be dropped even though the VPN tunnel is established. This is a common misconfiguration that prevents resource reachability.

Answer

The Client VPN endpoint has a public IP address.

Answer

The client certificate is issued by a valid CA.

Question 13

A company runs a critical application on EC2 instances in a VPC. The application needs to send data to an S3 bucket and an SQS queue, both in the same AWS account. The security team requires that all traffic to these AWS services must stay within the AWS network and not traverse the internet. The VPC has private subnets with no NAT gateway or Internet Gateway. The EC2 instances have an IAM role that grants necessary permissions. The S3 bucket and SQS queue are configured with bucket policies and queue policies that deny all access except from the VPC. However, the application is failing to send data to both S3 and SQS. What should the network engineer do to resolve this issue?

Accepted Answer

Create a gateway endpoint for S3 and an interface endpoint for SQS in the VPC, and update the route tables for S3 and the security groups for SQS. VPC endpoints for S3 (Gateway endpoint) and SQS (Interface endpoint) provide private connectivity within the AWS network, meeting the security requirement. Option D is correct because it creates the necessary endpoints and updates route tables and security groups. For the Gateway endpoint, route tables must be updated to direct S3 traffic through the endpoint. For the Interface endpoint, security groups must allow inbound traffic from the EC2 instances. Option A is wrong because CloudFront is a content delivery service, not a private connectivity solution for S3 or SQS. Option B is wrong because a NAT gateway would route traffic over the internet, violating the requirement. Option C is wrong because Direct Connect is an overkill and does not directly provide VPC endpoint connectivity for S3 and SQS.

Answer

Deploy an Amazon CloudFront distribution in front of S3 and use its public endpoint

Answer

Create a NAT gateway in a public subnet and update the route tables to send traffic to it

Answer

Set up an AWS Direct Connect connection and route traffic through it

Question 14

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. They need to add an additional non-overlapping CIDR to the VPC. What is a valid CIDR block they can add?

Accepted Answer

10.1.0.0/16. (10.1.0.0/16) is correct because it is a non-overlapping IPv4 CIDR block that does not conflict with the existing VPC CIDR of 10.0.0.0/16. In AWS, when adding a secondary CIDR to a VPC, the new block must be from the private IP address ranges (RFC 1918) and must not overlap with any existing CIDR blocks in the VPC. The 10.1.0.0/16 range is entirely separate from 10.0.0.0/16, as they are different /16 subnets within the 10.0.0.0/8 space.

Answer

10.0.1.0/24

Answer

10.0.0.0/8

Answer

10.0.0.0/16

Question 15

A company is setting up a Direct Connect connection to connect its on-premises data center to AWS. The connection is established, and a private virtual interface (VIF) is configured. The on-premises router can ping the VIF's Amazon side IP address, but cannot ping an EC2 instance in the VPC. The VPC has a virtual private gateway attached, and the route tables are correctly configured. What should the company check next?

Accepted Answer

Verify that the on-premises router is advertising the VPC CIDR to the Direct Connect router.. The on-premises router can ping the VIF's Amazon side IP, confirming that Layer 2 and Layer 3 connectivity over the Direct Connect link is working, and BGP is established. However, the inability to ping the EC2 instance indicates that return traffic from the VPC is not reaching the on-premises network. For return traffic to be routed correctly, the on-premises router must advertise the VPC CIDR (or a specific prefix) to the Direct Connect router via BGP; otherwise, the AWS side will not forward traffic destined for the on-premises network over the VIF.

Answer

Check that the NACLs on the EC2 instance's subnet allow inbound ICMP.

Answer

Confirm that the private VIF is associated with the correct virtual private gateway.

Answer

Ensure that BGP is established and receiving routes.

Question 16

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. After adding a new VPC attachment, traffic from the on-premises network cannot reach the new VPC. The on-premises BGP route table shows the prefixes of the new VPC as received. What should the engineer check?

Accepted Answer

Verify that the new VPC attachment is associated with the Transit Gateway route table that has the on-premises routes.. For traffic from an on-premises network to reach a new VPC via Transit Gateway, the new VPC attachment must be associated with a Transit Gateway route table that contains a route (static or propagated) pointing to the on-premises network. Without this association, the Transit Gateway will not forward traffic to the new VPC even if the on-premises BGP route table has learned the VPC prefixes. Option A is incorrect because the on-premises router already receives the VPC prefixes via BGP, so advertising is not the issue. Option B is incorrect: the VPC's route table controls outbound traffic from the VPC, but inbound traffic from on-premises is governed by the Transit Gateway route table. Option D is irrelevant because DNS resolution does not affect IP routing.

Answer

Verify that the on-premises router is advertising the correct prefix to AWS.

Answer

Verify that the new VPC has a route to the Transit Gateway in its route table.

Answer

Verify that the new VPC's DNS resolution is enabled.

Question 17

A company wants to securely connect two VPCs in the same region. The VPCs must be able to communicate using private IP addresses, and connectivity should be highly available. Which solution meets these requirements?

Accepted Answer

Create a VPC peering connection between the two VPCs.. A VPC peering connection allows two VPCs in the same region to communicate using private IPv4 or IPv6 addresses as if they were on the same network, with no single point of failure. It is highly available by design since traffic flows directly between the VPCs using the AWS global network infrastructure, without any intermediate devices or bandwidth limits.

Answer

Set up a VPN connection between the two VPCs using virtual private gateways.

Answer

Create an inter-region VPC peering connection.

Answer

Use an AWS Transit Gateway to connect the two VPCs.

Question 18

A company is designing a network for a multi-account AWS environment using AWS Organizations. They need to centralize network management and enable VPC connectivity across accounts. Which THREE services should they consider? (Choose THREE.)

Accepted Answer

AWS Resource Access Manager. AWS Resource Access Manager (RAM) is correct because it enables you to share centrally managed resources, such as Transit Gateways and VPC subnets, across multiple AWS accounts within an AWS Organization. This eliminates the need to create duplicate resources in each account and allows for centralized network management without requiring cross-account IAM roles or complex peering configurations.

Answer

VPC Peering

Answer

AWS Direct Connect

Question 19

A company has a VPC with a CIDR of 10.0.0.0/16. They need to connect to two on-premises data centers, each with overlapping CIDR blocks (192.168.0.0/16). The company wants to use AWS Site-to-Site VPN with dynamic routing (BGP). Which design allows the VPC to reach both data centers without route conflicts?

Accepted Answer

Create two separate virtual private gateways, each in a different VPC, and use VPC peering. Alternatively, use a transit gateway with separate VPN attachments and BGP communities to tag routes.. Overlapping CIDR blocks cannot be advertised to the same virtual private gateway (VPG) without causing route conflicts. By using a transit gateway with separate VPN attachments, each data center's routes are isolated in separate route tables, and BGP communities can be used to tag and differentiate routes. This design allows the VPC to reach both data centers by leveraging the transit gateway's ability to manage overlapping prefixes through separate route tables and path selection.

Answer

Create two VPN connections to a single virtual private gateway and advertise the same CIDR from both data centers. Use BGP AS_PATH prepending to influence routing.

Answer

Create a single VPN connection with two tunnels to the same virtual private gateway. Use different BGP ASNs for each data center.

Answer

Create two VPN connections to the same virtual private gateway. Use static routes with different metric values.

Question 20

A company has an AWS Transit Gateway with multiple VPC attachments. They need to inspect traffic between VPCs using a third-party firewall appliance. What is the best approach?

Accepted Answer

Create a firewall VPC with the appliance and use Transit Gateway route tables to direct traffic through it. The best approach is to create a dedicated firewall VPC that hosts the third-party firewall appliance and use Transit Gateway (TGW) route tables to steer inter-VPC traffic through that VPC. By attaching the firewall VPC to the TGW and configuring route tables with static routes pointing to the firewall VPC attachment, all traffic between other VPCs can be forced to traverse the firewall for inspection. This provides centralized, scalable traffic inspection without requiring changes to individual VPC routing or security group configurations.

Answer

Use VPC security groups across VPCs

Answer

Use AWS Network Firewall directly in each VPC

Answer

Use network ACLs on each VPC subnet