ANS-C01 Mock Exam 71 — 25 Questions

Question 1

A company is setting up a Direct Connect connection to AWS. They have a virtual private gateway (VGW) attached to their VPC. They need to establish a single logical connection over the Direct Connect link to access all subnets in the VPC. Which resource should they create on the Direct Connect virtual interface?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A private virtual interface (VIF) with a BGP session to the VGW.. A private virtual interface (VIF) is the correct resource because it allows you to connect your on-premises network directly to a VPC via a Direct Connect link. By associating the private VIF with a virtual private gateway (VGW) and establishing a BGP session, you create a single logical connection that provides Layer 3 access to all subnets in the VPC, as the VGW handles routing between the Direct Connect link and the VPC's route tables.

Answer

A hosted virtual interface (VIF) provided by an AWS Partner.

Answer

A public virtual interface (VIF) with a BGP session to the VGW.

Answer

A transit virtual interface (VIF) to the VGW.

Question 2

A company has a requirement to encrypt all data in transit between EC2 instances and an RDS database. The database is in a private subnet, and the application connects using an SSL connection. The security team wants to ensure that even if the network is compromised, the data remains confidential. What additional measure should be taken?

Accepted Answer

Use a client-side encryption library to encrypt data before sending.. Client-side encryption adds an additional layer of security beyond SSL. Even if the network is compromised and SSL is bypassed, the data remains encrypted, ensuring confidentiality. Option D is incorrect: IAM database authentication provides authentication, not encryption; it does not enhance data confidentiality beyond what SSL already offers. Option A is wrong: a VPN between EC2 and RDS adds unnecessary complexity and does not replace or augment SSL encryption. Option C is wrong: encryption at rest protects stored data, not data in transit.

Answer

Deploy a VPN connection between the EC2 instances and the RDS database.

Answer

Enable encryption at rest on the RDS instance.

Answer

Use IAM database authentication with SSL.

Question 3

A company is deploying a web application in a VPC and wants to protect it from common web exploits like cross-site scripting (XSS). Which AWS service should be used to filter and monitor HTTP requests?

Accepted Answer

AWS WAF. AWS WAF, is the correct choice because it is a web application firewall specifically designed to filter and monitor HTTP/HTTPS requests to protect against common web exploits like cross-site scripting (XSS), SQL injection, and other OWASP Top 10 threats. Option A is incorrect because Security Groups act as a virtual firewall at the instance level, controlling inbound and outbound traffic based on IP addresses and ports, not at the application layer. Option B is incorrect because Network ACLs are stateless subnet-level firewalls that also operate at the network layer, not the application layer. Option D is incorrect because AWS Shield Advanced provides DDoS protection, not web application filtering or monitoring of HTTP requests.

Answer

Security Group

Answer

Network ACL

Answer

AWS Shield Advanced

Question 4

A company has a Direct Connect connection with a private VIF to a VPC. They want to use BGP to advertise a specific /24 prefix from their on-premises network to AWS. After configuration, the prefix is not visible in the VPC route tables. The BGP session is established. What should the company check?

Accepted Answer

Verify that the prefix is included in the allowed prefixes list for the Direct Connect virtual interface. When a BGP session is established but the advertised prefix does not appear in VPC route tables, the most likely cause is that the prefix is not included in the allowed prefixes list configured on the Direct Connect virtual interface. AWS uses this list as a prefix filter; any prefix received via BGP that is not in the allowed list is silently ignored and not installed in the VPC route tables.

Answer

Ensure that route propagation is enabled on the VPC route table

Answer

Check that the BGP ASN on the customer gateway is unique and not conflicting

Answer

Add a static route in the VPC route table for the on-premises prefix

Question 5

A company needs to connect its on-premises data center to AWS using a dedicated, low-latency connection. Which AWS service should be used?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct choice because it provides a dedicated, private, low-latency network connection from an on-premises data center directly to AWS, bypassing the public internet. This service uses industry-standard 802.1Q VLANs to create virtual interfaces, ensuring consistent performance and reduced latency for mission-critical workloads.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

VPC Peering

Question 6

A company has a Direct Connect connection with a private VIF to a VPC. They want to add redundant connectivity using a second Direct Connect connection from a different provider. They need to ensure that if the primary connection fails, traffic automatically fails over to the secondary. Which THREE components are required?

Accepted Answer

A second Direct Connect connection from a different provider. The requirement specifies redundant connectivity using a second Direct Connect connection from a different provider. This ensures diverse physical paths and provider independence, which is essential for true high availability. A single provider or connection cannot provide the required fault isolation.

Answer

An AWS Site-to-Site VPN as a backup

Answer

A second private VIF on the same Direct Connect connection

Question 7

A company is using AWS Direct Connect to connect on-premises to AWS. The security team wants to encrypt all traffic traversing the Direct Connect link. Which TWO options can achieve this?

Accepted Answer

Establish an IPsec VPN tunnel over the Direct Connect virtual interface. You can establish an IPsec VPN tunnel over a Direct Connect virtual interface to encrypt traffic at Layer 3. Option B is correct because MACsec (802.1ae) provides encryption at Layer 2 for dedicated connections. Option C is incorrect because TLS only encrypts specific application traffic, not all traffic traversing the link. Option D is incorrect because VPC gateway endpoints are used for private connectivity to S3 and DynamoDB, but they do not encrypt data across the Direct Connect link itself. Option E is incorrect because physical security does not provide encryption of data in transit.

Answer

Use TLS on all applications

Answer

Use VPC gateway endpoints for S3

Answer

Rely on Direct Connect's physical security

Question 8

A company is designing a highly available network architecture using AWS Direct Connect. Which TWO actions should be taken to ensure redundancy?

Accepted Answer

Provision two Direct Connect connections at different locations. To ensure redundancy for AWS Direct Connect, you should provision two Direct Connect connections at different locations (option C) to eliminate a single point of failure, and configure BGP with different ASNs on each connection (option E) to enable path diversity and automatic failover. Option A is incorrect because a single private VIF (or multiple VIFs) on a single connection still creates a single point of failure. Option B is incorrect because while a VPN backup provides some redundancy, it is not one of the two required actions for a highly available Direct Connect architecture—the question specifically asks for actions using Direct Connect. Option D is incorrect because multiple VIFs on a single connection do not provide physical path diversity; they share the same underlying connection.

Answer

Create a single private VIF on the Direct Connect connection

Answer

Set up a VPN connection over the internet as a backup

Answer

Use a single Direct Connect connection with multiple VIFs

Question 9

A financial services company is designing a hybrid network architecture using AWS Direct Connect. They have a Direct Connect connection with a public VIF and a private VIF. The private VIF is associated with a Direct Connect gateway that is attached to a Transit Gateway in us-east-1. The Transit Gateway has attachments to a production VPC and a shared services VPC. The company wants to ensure that all traffic from the on-premises network to the production VPC flows through a centralized inspection appliance in the shared services VPC for security compliance. Additionally, traffic from the production VPC to the internet must use a NAT gateway in the shared services VPC. The inspection appliance in the shared services VPC performs stateful inspection and must see both directions of traffic. The network engineer configured the following route tables: In the Transit Gateway route table associated with the Direct Connect gateway attachment, a static route for 0.0.0.0/0 points to the shared services VPC attachment. In the Transit Gateway route table associated with the production VPC attachment, a static route for the on-premises CIDR (10.0.0.0/8) points to the shared services VPC attachment. In the Transit Gateway route table associated with the shared services VPC attachment, a static route for the on-premises CIDR points to the Direct Connect gateway attachment, and a static route for 0.0.0.0/0 points to the Direct Connect gateway attachment (for outbound internet traffic, the shared services VPC has its own internet gateway and NAT gateway). The production VPC has a default route (0.0.0.0/0) pointing to the Transit Gateway. The shared services VPC has a default route pointing to the NAT gateway. However, traffic from on-premises to the production VPC is not being inspected; it goes directly to the production VPC. What is the most likely reason?

Accepted Answer

The Transit Gateway route table associated with the Direct Connect gateway attachment has propagation enabled, which installs a more specific route for the production VPC CIDR directly to the production VPC attachment, bypassing the shared services VPC.. When propagation is enabled on the Transit Gateway route table associated with the Direct Connect gateway attachment, the production VPC CIDR is automatically learned as a more specific route (e.g., 10.1.0.0/16) pointing directly to the production VPC attachment. This more specific route overrides the static 0.0.0.0/0 route that was intended to force traffic through the shared services VPC, causing on-premises traffic to bypass the inspection appliance.

Answer

The shared services VPC has a default route pointing to the NAT gateway, which is not a valid next hop for traffic coming from the Transit Gateway.

Answer

The production VPC route table has a default route pointing to the Transit Gateway, but the NAT gateway is in the shared services VPC, causing asymmetric routing.

Answer

The Transit Gateway route table associated with the shared services VPC attachment does not have a route for the production VPC CIDR pointing to the production VPC attachment, so return traffic cannot reach production.

Question 10

A network engineer runs the AWS CLI command shown in the exhibit. The VPC has an Amazon Route 53 private hosted zone associated. What is the impact of this setting?

Accepted Answer

No instances in the VPC can resolve DNS records from the private hosted zone.. The AWS CLI command shown in the exhibit sets the `enableDnsHostnames` and `enableDnsSupport` attributes to `false` for the VPC. When `enableDnsSupport` is false, Amazon Route 53 private hosted zones cannot be resolved by instances within that VPC because the VPC's DNS resolution is disabled entirely. This means no instances in the VPC can query the Route 53 Resolver for private hosted zone records, making option A correct.

Answer

Only instances in public subnets can resolve private hosted zone records.

Answer

The DHCP option set must be updated to provide DNS resolution.

Answer

The private hosted zone is automatically deleted.

Question 11

A company has an AWS Site-to-Site VPN connection between its on-premises network and a VPC. The tunnel status is up, but traffic from on-premises cannot reach an EC2 instance in the VPC. The instance's security group allows inbound traffic from the on-premises CIDR. Which configuration should be checked first?

Accepted Answer

Verify that the VPC route table includes a route to the on-premises CIDR with the VPN gateway as target.. For traffic from on-premises to reach an EC2 instance in a VPC via a Site-to-Site VPN, the VPC route table must contain a route pointing the on-premises CIDR to the VPN gateway (virtual private gateway or transit gateway). Without this route, the VPC has no path to send return traffic back to on-premises, causing asymmetric routing and connectivity failure even if the tunnel is up.

Answer

Ensure the VPN connection is attached to a transit gateway instead of a virtual private gateway.

Answer

Check the network ACL associated with the EC2 instance's subnet to ensure it allows inbound traffic from on-premises.

Answer

Confirm that BGP session is established and exchanging routes.

Question 12

A company has a VPC with a public subnet hosting a web server and a private subnet hosting a database. The web server must connect to the database on port 3306. Security groups are configured: Web SG allows inbound HTTP/HTTPS from 0.0.0.0/0 and outbound to DB SG on port 3306. DB SG allows inbound from Web SG on port 3306. Network ACLs are default. The web server can connect to the database, but the security team notices that the database is also receiving connections from an unexpected IP address. What is the MOST likely cause?

Accepted Answer

An unauthorized EC2 instance has been launched with the same Web security group attached.. Security groups are stateful and allow outbound responses automatically, but the unexpected connections are likely due to another instance with the Web SG attached. The DB SG inbound rule allows traffic from the Web SG, which applies to all instances with that SG, including unauthorized ones. Option A is incorrect because default NACLs allow all traffic, but inbound NACL rules could be the issue if they were modified, but they are default. Option B is incorrect because the DB SG inbound rule is from the Web SG, not 0.0.0.0/0. Option D is incorrect because while security groups are stateful, that does not cause unexpected connections; it only ensures return traffic is allowed.

Answer

The network ACL on the private subnet allows inbound traffic from all IPs.

Answer

The DB security group has an inbound rule allowing traffic from 0.0.0.0/0 on port 3306.

Answer

Security groups are stateful, so the DB SG automatically allows inbound responses.

Question 13

A network administrator attached the IAM policy shown to a user. The user tries to create an internet gateway in us-east-1 without any tags. What will happen?

Accepted Answer

The internet gateway creation is denied because the Deny statement applies.. The first statement allows CreateInternetGateway in us-east-1. The second statement denies CreateInternetGateway if the resource tag 'purpose' is not 'production'. When creating a resource without tags, the condition StringNotEquals evaluates to true (since no tag, it's not equal to 'production'), so the Deny applies. The Deny overrides the Allow, so the action is denied. Therefore, option C is correct because the Deny statement applies. Option A is incorrect because the first statement does allow it in us-east-1, but the Deny overrides. Option B is incorrect because the creation is denied, not permitted with a warning. Option D is incorrect because the Deny overrides the Allow.

Answer

The internet gateway creation fails because the first statement does not allow it in us-east-1.

Answer

The internet gateway is created but the user receives a warning.

Answer

The internet gateway is created successfully because the first statement allows it.

Question 14

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The network team notices that traffic is intermittently dropping and the BGP session between the on-premises router and the AWS Direct Connect virtual interface goes down. Which configuration should be checked first to resolve this issue?

Accepted Answer

Ensure the BGP hold timer values are consistent on both ends. Ensure the BGP hold timer values are consistent on both ends. A mismatch in BGP hold timers can cause the BGP session to flap intermittently. Configuring consistent hold times on both routers stabilizes the session. Option B is incorrect because increasing the keepalive timer may postpone failure detection but does not fix the root cause. Option C is incorrect because disabling BGP authentication is unnecessary and insecure. Option D is incorrect because enabling MD5 authentication is optional and unrelated to the flapping.

Answer

Increase the BGP keepalive timer on the on-premises router to 90 seconds

Answer

Disable BGP authentication on the virtual interface

Answer

Enable BGP MD5 authentication on the on-premises router

Question 15

A company is running a web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application needs to store session state in an ElastiCache Redis cluster. The Redis cluster should not be accessible from the internet. Which network design should be used?

Accepted Answer

Place both the EC2 instances and the Redis cluster in private subnets with appropriate security groups.. Placing both the EC2 instances and the ElastiCache Redis cluster in private subnets ensures that the Redis cluster is not accessible from the internet, meeting the security requirement. The EC2 instances can communicate with the Redis cluster within the same VPC using private IP addresses, and security groups can be used to restrict traffic to only the necessary ports (e.g., TCP 6379 for Redis) from the EC2 instances' security group. This design avoids exposing the Redis cluster to any public network, aligning with best practices for internal caching layers.

Answer

Place the Redis cluster in a public subnet and restrict access via security group.

Answer

Place the Redis cluster in a private subnet and the EC2 instances in a private subnet, with a NAT Gateway for outbound traffic.

Answer

Place the Redis cluster in a private subnet and the EC2 instances in a public subnet.

Question 16

A company is designing a VPC with public and private subnets. The private subnets must have outbound internet access for software updates, but must not be directly reachable from the internet. Which two components are required for this design? (Choose two.)

Accepted Answer

NAT Gateway in a public subnet. A NAT Gateway in a public subnet (A) provides outbound internet access for instances in private subnets while preventing inbound connections from the internet. A route table for the private subnets with a 0.0.0.0/0 route pointing to the NAT Gateway (E) directs outbound traffic to the NAT Gateway. Option B (Security Group allowing outbound HTTPS) is not a component; security groups control traffic but don't provide routing or internet access. Option C (Internet Gateway attached to the VPC) is required for public subnets but alone does not enable private subnet outbound access. Option D (Site-to-Site VPN) is for hybrid connectivity, not internet access.

Answer

Security Group allowing outbound HTTPS

Answer

Internet Gateway attached to the VPC

Answer

AWS Site-to-Site VPN connection

Question 17

A company's security team is designing a solution to restrict S3 bucket access based on the requester's network. The company has a set of on-premises IP ranges and wants to ensure that only requests originating from those IPs can access the bucket. Which combination of actions should be taken? (Choose TWO.)

Accepted Answer

Create a VPC endpoint for S3 and attach a VPC endpoint policy that restricts access to the specific bucket. To restrict S3 bucket access based on the requester's network, you can use an S3 bucket policy with the aws:SourceIp condition to allow only requests from specified on-premises IP ranges (option E). However, if requests originate from within a VPC, they might appear to come from the VPC's public IPs (e.g., through a NAT gateway) rather than the on-premises IPs. To handle this, you can create a VPC endpoint for S3 and attach a VPC endpoint policy that restricts access to the specific bucket (option B). This ensures traffic from the VPC to S3 goes through the endpoint and can be controlled separately. Option A is incorrect because using Elastic IPs does not reliably restrict access; the bucket policy would need to allow specific Elastic IPs, but this does not account for on-premises IPs. Option C is incorrect because AWS WAF is for web application traffic, not S3 bucket access. Option D is incorrect because S3 Block Public Access prevents public access but does not restrict based on the requester's network.

Answer

Configure the EC2 instances in the VPC to use Elastic IPs and allow those IPs in the bucket policy

Answer

Use AWS WAF to inspect HTTP requests to the bucket

Answer

Enable S3 Block Public Access on the bucket

Question 18

A company wants to ensure that all traffic to and from its VPC is inspected by a security appliance. The appliance must be able to inspect traffic between subnets within the VPC. Which architecture should the company use?

Accepted Answer

Use a Gateway Load Balancer with security appliances in a separate inspection VPC and configure route tables to send traffic to the GWLB endpoint.. A Gateway Load Balancer (GWLB) with security appliances in a separate inspection VPC allows you to centrally inspect all traffic, including east-west traffic between subnets within the same VPC. By configuring route tables to send traffic to the GWLB endpoint, you can enforce stateful inspection for all inbound, outbound, and inter-subnet traffic without introducing a single point of failure or complex routing.

Answer

Deploy a NAT Gateway and route all internet traffic through it.

Answer

Create a VPC Peering connection to a centralized VPC with security appliances.

Answer

Attach an Internet Gateway and use Security Groups to log traffic.

Question 19

A company has a Direct Connect connection with multiple virtual interfaces (VIFs). The network team notices that traffic to a specific VPC is intermittently failing. The team suspects an issue with BGP routing. Which THREE steps should the team take to troubleshoot the BGP session? (Choose THREE.)

Accepted Answer

View the BGP route advertisements received by the on-premises router from AWS.. Viewing the BGP route advertisements received by the on-premises router from AWS directly reveals whether the expected prefixes are being advertised. If the routes are missing or incorrect, the VPC traffic will fail intermittently, making this a primary troubleshooting step for BGP routing issues.

Answer

Check the Direct Connect endpoint health in the AWS Management Console.

Answer

Examine VPC Flow Logs for dropped packets on the virtual interface.

Question 20

A network engineer is configuring an AWS Transit Gateway to connect multiple VPCs and an on-premises network via Direct Connect. The on-premises network advertises a prefix 10.0.0.0/8. One of the VPCs has a CIDR of 10.0.0.0/16. What will happen to traffic destined to 10.0.0.5 from another VPC attached to the Transit Gateway?

Accepted Answer

Traffic is routed to the VPC because of a more specific route. AWS Transit Gateway uses longest prefix match routing. The VPC's CIDR 10.0.0.0/16 is more specific than the on-premises prefix 10.0.0.0/8, so traffic destined to 10.0.0.5 will be routed to the VPC. Option B is incorrect; routes conflict only if they have the same prefix length, but here different lengths allow the longest prefix to win. Option C is incorrect because the on-premises route is less specific and will not be used. Option D is incorrect because there is no load-balancing; the more specific route takes precedence.

Answer

Traffic is dropped due to conflicting routes

Answer

Traffic is routed to the on-premises network because it is learned via Direct Connect

Answer

Traffic is load-balanced between the VPC and on-premises