ANS-C01 Mock Exam 72 — 25 Questions

Question 1

A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can read objects. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Create an S3 bucket policy with a condition that allows access only from the VPC endpoint.. An S3 bucket policy can use the aws:SourceVpce condition key to allow access only from a specific VPC endpoint, restricting requests to those originating from that endpoint. Option C is correct because a VPC endpoint policy controls what actions principals within the VPC can perform on the S3 bucket, providing an additional layer of access control. Option A is incorrect because security groups are not supported for gateway VPC endpoints (which are used for S3); they cannot be assigned to such endpoints. Option D is incorrect because network ACLs operate at the subnet level and cannot enforce restrictions based on the source VPC or VPC endpoint; they control traffic entering/exiting subnets but do not apply to S3 bucket access directly. Option E is incorrect because IAM roles grant permissions to identities (users or services) but do not restrict traffic origin; they do not limit access to traffic from a specific VPC.

Answer

Assign a security group to the VPC endpoint that allows inbound traffic from the VPC.

Answer

Configure a network ACL on the subnet to deny all inbound traffic except from the VPC.

Answer

Use an IAM role to grant the VPC access to the S3 bucket.

Question 2

A company has a VPC with multiple subnets across two AZs. The VPC is connected to an on-premises data center via AWS Direct Connect. The company wants to ensure that traffic between the VPC and on-premises is load-balanced across two Direct Connect virtual interfaces (VIFs) for high availability. Which configuration should be used?

Accepted Answer

Configure two VIFs and use BGP to advertise the same prefixes with equal metrics to enable ECMP.. Configuring two Direct Connect virtual interfaces (VIFs) with BGP and advertising the same prefixes with equal metrics (e.g., equal MED or AS-path length) enables Equal-Cost Multi-Path (ECMP) routing. This allows the VPC and on-premises routers to load-balance traffic across both VIFs, providing high availability and active-active utilization of the Direct Connect connections.

Answer

Configure a VPN connection over each VIF and use equal-cost routes between the VPN tunnels.

Answer

Configure a single Direct Connect VIF with a 10 Gbps connection and a single BGP session.

Answer

Configure two VIFs with static routes pointing to different on-premises IPs.

Question 3

A company wants to centralize logging of VPC Flow Logs from multiple accounts into a single Amazon S3 bucket. The logs must be encrypted at rest using an AWS KMS CMK. What is the recommended approach?

Accepted Answer

Create a centralized S3 bucket with default encryption using a KMS CMK and a bucket policy that allows cross-account writes from the source accounts.. The recommended approach uses a centralized S3 bucket with default encryption using a KMS CMK and a bucket policy that allows cross-account writes. This ensures logs are encrypted at rest centrally without requiring per-account KMS keys. Option A is wrong because KMS keys in each account would complicate key management and cross-account access. Option C is wrong because SSE-S3 encryption does not use a CMK and does not provide the same level of control. Option D is wrong because denying access unless encryption headers are present is not a reliable way to enforce encryption; bucket policies can be bypassed if headers are not included, and shared KMS keys are not recommended.

Answer

Enable encryption on VPC Flow Logs using a KMS key in each account and aggregate logs using AWS Logs cross-account subscription.

Answer

Create a bucket with SSE-S3 encryption and have each account write flow logs directly.

Answer

Use a single bucket with a bucket policy that denies access unless encryption headers are present, and use a KMS key shared across accounts.

Question 4

A company has a hybrid network architecture with multiple VPCs connected via a transit gateway and on-premises via Direct Connect. The network team wants to automate the response to a BGP session failure on a Direct Connect virtual interface. Which AWS service can be used to monitor the BGP status and trigger an automated action?

Accepted Answer

AWS CloudWatch Events (EventBridge) with Direct Connect BGP metric alarms. AWS CloudWatch Events (EventBridge) can monitor Direct Connect BGP session status via the `bgp_session_state` metric in the `AWS/DX` namespace. When the BGP session transitions to the `down` state, you can create an EventBridge rule that triggers an automated action, such as invoking a Lambda function or sending an SNS notification, enabling a rapid response to BGP failures without manual intervention.

Answer

AWS Lambda with VPC Flow Logs

Answer

AWS Systems Manager Automation

Answer

AWS Config rules

Question 5

A company is designing a VPC for a three-tier application (web, application, database). The database tier should not be accessible from the internet, but the web tier must be accessible. Which subnet design should the network engineer use?

Accepted Answer

Place web servers in public subnets with an internet gateway, and app and database servers in private subnets.. It places the web servers in a public subnet with an Internet Gateway (IGW) to allow inbound HTTP/HTTPS traffic from the internet, while the application and database servers are placed in private subnets with no direct internet path. This design ensures the database tier is isolated from the internet, meeting the security requirement, while the web tier remains accessible. The application servers can communicate with the database via private IP addresses within the VPC, and outbound internet access for the private subnets (if needed) can be provided through a NAT Gateway in a public subnet.

Answer

Place web and app servers in public subnets, and database servers in private subnets.

Answer

Place all servers in private subnets and use a NAT Gateway for internet access.

Answer

Place all servers in public subnets and rely on security group rules to restrict access.

Question 6

A Network Engineer is troubleshooting a cross-account VPC endpoint connection. The service provider account (123456789012) has the above IAM policy attached to the endpoint service. The consumer account (111111111111) has created a VPC endpoint (vpce-abc123) and is trying to accept the connection. The consumer receives an 'AccessDenied' error when calling ec2:AcceptVpcEndpointConnections. What is the MOST likely cause?

Accepted Answer

The consumer account does not have permission to accept the connection; only the service provider can accept.. The 'AccessDenied' error occurs because the consumer account (111111111111) is attempting to call ec2:AcceptVpcEndpointConnections, which is an API action that only the service provider account (123456789012) can perform. The IAM policy shown is attached to the endpoint service in the provider account, but the consumer does not have permission to accept its own connection; instead, the provider must accept the endpoint connection request. This is a fundamental AWS VPC endpoint service behavior where the provider controls acceptance, not the consumer.

Answer

The policy action should be 'ec2:CreateVpcEndpoint' instead.

Answer

The policy condition 'aws:SourceArn' does not match the consumer's endpoint ARN.

Answer

The policy resource ARN is incorrect; it should be the endpoint service ARN.

Question 7

A company is deploying a multi-tier application across multiple VPCs connected via AWS Transit Gateway. The web tier must be able to initiate connections to the app tier, but the app tier must not be able to initiate connections to the web tier. How can this be achieved?

Accepted Answer

Deploy a centralized firewall appliance in a shared VPC and use Transit Gateway to route all inter-VPC traffic through it.. Routing all inter-VPC traffic through a centralized firewall appliance in a shared VPC via Transit Gateway allows you to enforce stateful inspection and access control policies. The firewall can be configured to permit only outbound connections from the web tier to the app tier while blocking any inbound connections initiated by the app tier, thus meeting the requirement without relying on VPC-native constructs that cannot enforce unidirectional stateful filtering across VPCs.

Answer

Configure network ACLs on the web tier subnets to allow outbound traffic and deny inbound from app tier.

Answer

Establish VPC peering between the web and app VPCs and restrict routes.

Answer

Use security groups across the VPCs by referencing each other's CIDR blocks.

Question 8

A company wants to enable communication between two VPCs (VPC A and VPC B) in the same AWS account and region. They want to use private IP addresses and avoid using the internet. Which THREE options can achieve this?

Accepted Answer

VPC peering connection. VPC peering connection (Option A) allows direct, private IP connectivity between two VPCs using the AWS global network, with no internet gateway or VPN required. Traffic stays within AWS's internal infrastructure, meeting the requirement for private IP addresses and avoiding the internet.

Answer

Internet gateway attached to both VPCs

Answer

NAT gateway in each VPC

Question 9

A company uses AWS Direct Connect with a private VIF to connect its data center to a VPC. The VPC has multiple subnets. The on-premises network team reports that they can ping the VPC's private IP addresses but cannot connect to an EC2 instance's port 443. The EC2 instance's security group allows HTTPS from the on-premises CIDR. What should the engineer check NEXT?

Accepted Answer

Check the EC2 instance's operating system firewall (e.g., iptables, Windows Firewall) to see if port 443 is blocked.. Since the on-premises team can ping the EC2 instance (ICMP works) but cannot connect to port 443 (HTTPS), the network path is functional at Layer 3. The security group already allows HTTPS from the on-premises CIDR, so the next logical step is to check the EC2 instance's OS-level firewall (e.g., iptables, Windows Firewall), which operates at Layer 4 and can independently block TCP port 443 even when the security group permits it.

Answer

Check the security group's inbound rules for port 443.

Answer

Confirm that the Direct Connect virtual interface is in the 'up' state.

Answer

Verify that the route tables in the VPC have a route back to the on-premises CIDR.

Question 10

A company has a VPC with resources that need to access an S3 bucket in the same region. To minimize latency and avoid internet traffic, which configuration should be used?

Accepted Answer

Create a VPC Gateway Endpoint for S3. A VPC Gateway Endpoint for S3 provides private connectivity without traversing the internet, minimizing latency and avoiding data transfer costs. It is the recommended approach for accessing S3 from a VPC. While VPC Interface Endpoints for S3 also provide private access, they incur hourly charges and additional data processing fees. In most scenarios, Gateway Endpoints are preferred for S3 and DynamoDB due to their simplicity and cost-effectiveness. NAT Gateway (A) is used for internet-bound traffic, not private S3 access. VPC peering (C) connects VPCs but does not provide direct access to S3.

Answer

Use a NAT Gateway in a public subnet and route traffic through it

Answer

Use VPC peering to connect to an S3 bucket

Answer

Create a VPC Interface Endpoint for S3

Question 11

A company is deploying a web application across multiple Availability Zones in a single AWS Region. The application consists of an Application Load Balancer (ALB) in front of EC2 instances in an Auto Scaling group, and an Amazon RDS Multi-AZ database. The company needs to ensure that the application can survive the loss of an entire Availability Zone. Which THREE actions should they take? (Select THREE.)

Accepted Answer

Configure the Auto Scaling group to launch instances in at least two Availability Zones. Configuring the Auto Scaling group to launch instances in at least two Availability Zones ensures that if one AZ fails, the remaining AZ(s) still have healthy EC2 instances to serve traffic. This is a fundamental requirement for multi-AZ high availability, as the Auto Scaling group will automatically replace failed instances in the remaining AZs.

Answer

Use larger EC2 instance types to handle the load

Answer

Deploy a single NAT Gateway in one AZ for outbound traffic

Question 12

A company has a web application behind an Application Load Balancer (ALB) in a VPC. The ALB is internet-facing and has a security group that allows inbound HTTP/HTTPS from 0.0.0.0/0. The EC2 instances are in a private subnet with a security group that allows inbound traffic only from the ALB's security group. The application works correctly. However, the security team wants to add an additional layer of protection by using AWS WAF. What is the best way to integrate AWS WAF with the ALB to filter malicious requests?

Accepted Answer

Create a web ACL in AWS WAF and associate it with the ALB.. AWS WAF can be associated directly with an ALB to filter incoming requests before they reach the ALB. Option B is incorrect because WAF works at the application layer, not at CloudFront unless CloudFront is used. Option C is incorrect because WAF is not applied at the security group level. Option D is incorrect because WAF is not a Network Load Balancer feature.

Answer

Replace the ALB with a Network Load Balancer and use AWS WAF with it.

Answer

Configure the security group of the ALB to only allow traffic that passes AWS WAF inspection.

Answer

Use AWS WAF in front of Amazon CloudFront and then forward requests to the ALB.

Question 13

A company uses AWS Certificate Manager (ACM) to provision SSL/TLS certificates for their Application Load Balancer (ALB). They want to ensure that the ALB only accepts connections using TLS 1.2 or higher. How should they configure this?

Accepted Answer

Configure the ALB with an appropriate security policy that enforces TLS 1.2.. The Application Load Balancer supports security policies that allow you to enforce TLS 1.2 or higher. Option A is incorrect because ACM provides certificates but does not dictate the TLS version; that is determined by the load balancer's security policy. Option C is incorrect because while CloudFront can enforce TLS policies, it is an additional service and not required; the ALB itself can enforce TLS 1.2. Option D is incorrect because Route 53 is a DNS service and does not handle TLS version enforcement.

Answer

Use ACM to generate a certificate that only supports TLS 1.2.

Answer

Configure the ALB to use a CloudFront distribution with a TLS policy.

Answer

Use AWS Route 53 to enforce TLS version at the DNS level.

Question 14

An IAM policy attached to a user allows creating and deleting VPCs and subnets only in us-east-1. The user attempts to create a VPC in eu-west-1. What will happen?

Accepted Answer

The API call will be denied with an authorization error.. The IAM policy explicitly restricts the ec2:CreateVpc action to us-east-1 using a Condition element with ec2:Region. When the user attempts to create a VPC in eu-west-1, the condition is not satisfied, so the request is denied with an authorization error (HTTP 403). IAM policies are evaluated before any API call is executed, and if the condition fails, the action is blocked regardless of the resource-level permissions.

Answer

The VPC will be created but the user will receive a warning.

Answer

The user can create the VPC because the condition is not applicable to VPC creation.

Answer

The VPC will be created successfully because the policy allows ec2:CreateVpc.

Question 15

A company is experiencing intermittent SSH connection failures to their EC2 instances in a VPC. The instances are in a private subnet with a NAT gateway. The security group allows inbound SSH from the corporate CIDR. The network ACL is set to default allow all. The route table has a route to the NAT gateway for 0.0.0.0/0. What is the most likely cause of the intermittent failures?

Accepted Answer

The NAT gateway does not have an Elastic IP associated.. The NAT gateway requires an associated Elastic IP to function correctly. Without it, the NAT gateway cannot be created or fails to operate, leading to intermittent connectivity issues for instances in the private subnet. Since the instances rely on the NAT gateway for outbound traffic (e.g., to reach configuration endpoints or DNS), any failure in the NAT gateway can disrupt SSH sessions that depend on such outbound communication. Option A is incorrect because the network ACL is set to default allow all, so it does not block ephemeral ports. Option B is incorrect because a proxy is not typically required for SSH connections in this setup. Option C is incorrect because security groups are stateful, meaning outbound rules do not block return traffic from allowed inbound connections.

Answer

The network ACL inbound rule is blocking ephemeral ports.

Answer

The instances are behind a proxy that is not configured.

Answer

The security group outbound rules are not allowing return traffic.

Question 16

A company is setting up a new AWS account and wants to centrally manage VPC network traffic inspection across multiple accounts using a central VPC. The company uses AWS Organizations. Which architecture meets these requirements?

Accepted Answer

Use AWS Transit Gateway with a central inspection VPC that has firewall appliances.. AWS Transit Gateway acts as a hub-and-spoke router, enabling centralized network traffic inspection by routing inter-VPC and VPN traffic through a central inspection VPC that hosts firewall appliances (e.g., third-party NGFWs or AWS Network Firewall). This architecture scales across multiple accounts in AWS Organizations using resource sharing via AWS Resource Access Manager, and it supports granular route tables to force traffic through the inspection VPC without requiring peering mesh or single points of failure.

Answer

Create VPC peering connections between each account's VPC and the central VPC.

Answer

Use VPC endpoints to route traffic to the central VPC.

Answer

Deploy a Network Load Balancer in each VPC and route traffic through it.

Question 17

A company has set up a Direct Connect connection with a private VIF to its VPC. The BGP session is up, but traffic is not passing between the on-premises network and the VPC. Which configuration should be verified?

Accepted Answer

Check the BGP advertised routes and the VPC route tables. For traffic to flow between on-premises and the VPC over a Direct Connect private VIF, the on-premises network must advertise the appropriate routes via BGP, and the VPC route tables must have routes pointing to the virtual private gateway (VGW). Option A is wrong because jumbo frames are not required for basic connectivity. Option B is wrong because the VIF type (private vs public) is not the issue—the BGP session is already up, indicating the VIF is correctly configured as private. Option C is wrong because CloudWatch metrics are for monitoring performance, not for diagnosing routing issues.

Answer

Ensure jumbo frames are enabled on the Direct Connect interface

Answer

Verify that the VIF is a public VIF

Answer

Review the Direct Connect virtual interface metrics in CloudWatch

Question 18

A company runs a critical application on EC2 instances behind an Application Load Balancer. They need to ensure that if an instance fails health checks, it is automatically terminated and replaced. Which AWS service should they use?

Accepted Answer

Auto Scaling group. An Auto Scaling group (Option C) is the correct service because it automatically replaces unhealthy EC2 instances by integrating with the Application Load Balancer's health checks. When an instance fails the configured health check (e.g., HTTP 5xx or TCP timeout), the Auto Scaling group marks it as unhealthy, terminates it, and launches a new instance to maintain the desired capacity. This lifecycle management is a core feature of Auto Scaling groups, not available in the other options.

Answer

AWS Lambda

Answer

EC2 Instance Connect

Answer

Amazon CloudWatch

Question 19

A company has deployed an application across multiple AWS Regions using Application Load Balancers (ALBs). The company wants to route traffic to the nearest healthy endpoint using latency-based routing. Which AWS service should be used to distribute traffic across the ALBs?

Accepted Answer

Amazon Route 53 with latency routing policy.. Amazon Route 53 with a latency routing policy is the correct choice because it directs traffic to the ALB endpoint that provides the lowest latency for the end user, based on measured round-trip times between the user and each AWS Region. This aligns with the requirement to route traffic to the nearest healthy endpoint using latency-based routing, as Route 53 evaluates health checks on the ALBs and only considers healthy endpoints when determining the lowest latency.

Answer

Amazon CloudFront with multiple origins.

Answer

AWS Network Load Balancer with cross-zone load balancing.

Answer

AWS Global Accelerator.

Question 20

A company has a VPC with public and private subnets. The private subnets have a route to a NAT gateway. The network team wants to monitor DNS queries from EC2 instances in private subnets to a custom DNS resolver on-premises over a VPN. Which TWO services can capture this traffic?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic at the network interface level, including DNS queries (port 53) to any destination, such as a custom on-premises resolver over VPN. AWS Network Firewall can inspect and log DNS traffic that passes through it, including queries to custom resolvers. Option A (Route 53 Resolver query logs) is incorrect because it only logs queries made to Amazon Route 53 Resolver, not to custom on-premises resolvers. Option B (CloudWatch) is incorrect because CloudWatch does not directly capture network traffic; it can aggregate logs but cannot capture raw DNS packets. Option E (CloudTrail) is incorrect because it logs API calls to AWS services, not network traffic.

Answer

Amazon Route 53 Resolver query logs

Answer

Amazon CloudWatch

Answer

AWS CloudTrail