ANS-C01 Mock Exam 73 — 25 Questions

Question 1

A company has a large AWS environment with hundreds of VPCs connected via Transit Gateway. They want to centrally manage network traffic flow and enforce security policies. Which service should they use to create a central network inspection architecture?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Network Firewall. AWS Network Firewall provides managed firewall services that can be centrally deployed in a dedicated VPC and route traffic through it for inspection.

Answer

AWS WAF

Answer

Security groups

Answer

AWS Shield Advanced

Question 2

A company designs a multi-account AWS environment using AWS Organizations. The networking team wants a centralized inspection VPC for traffic between VPCs and on-premises. Which architecture ensures that all inter-VPC traffic passes through the inspection VPC?

Accepted Answer

AWS Transit Gateway with centralized routing to the inspection VPC.. AWS Transit Gateway enables centralized routing by attaching all VPCs and the on-premises network to a single transit gateway, then configuring route tables to force all inter-VPC traffic through a dedicated inspection VPC appliance (e.g., firewall or NGFW). This ensures traffic flows via the inspection VPC without requiring full-mesh peering or per-VPC firewalls.

Answer

VPC peering between all VPCs and the inspection VPC.

Answer

AWS Network Firewall deployed in each VPC.

Answer

AWS Direct Connect Gateway with virtual interfaces.

Question 3

A company is setting up a site-to-site VPN connection between an on-premises network and AWS. The VPN uses two tunnels for high availability. The network engineer needs to ensure that if one tunnel goes down, traffic automatically fails over to the other tunnel. Which THREE steps should the engineer perform? (Choose THREE.)

Accepted Answer

Configure BGP on both VPN tunnels.. BGP is the correct choice for automatic failover because it enables dynamic route advertisement and withdrawal over the VPN tunnels. When a tunnel fails, BGP withdraws the corresponding routes, causing the VPC route table to automatically use the remaining tunnel's routes. This eliminates the need for manual intervention or static route manipulation.

Answer

Configure static routes pointing to the VPN connection.

Answer

Use a single customer gateway device with multiple BGP sessions.

Question 4

A company has a VPC with a CIDR of 10.0.0.0/16. They have two subnets: subnet A (10.0.1.0/24) and subnet B (10.0.2.0/24). They launch an EC2 instance in subnet A and another in subnet B. The security groups for both instances allow all traffic from the other instance's private IP. However, the instances cannot communicate. What is the most likely cause?

Accepted Answer

The network ACLs are blocking the traffic. The most likely cause is that the network ACLs (NACLs) are blocking the traffic. Security groups are stateful and allow return traffic automatically, but NACLs are stateless and require explicit inbound and outbound rules for both directions. By default, custom NACLs deny all traffic, so even though the security groups permit communication, the NACLs on subnets A and B must allow the traffic. The correct answer is B.

Answer

The instances are in different Availability Zones

Answer

The security groups are stateful and block return traffic

Answer

The route tables do not have a local route

Question 5

A company uses AWS Organizations with multiple accounts. The security team wants to centrally enforce that no Amazon S3 buckets are publicly accessible across all accounts. Which solution meets this requirement with the least operational overhead?

Accepted Answer

Apply a service control policy (SCP) in AWS Organizations that denies the s3:PutBucketPublicAccessBlock action or enforces a bucket policy condition.. A service control policy (SCP) can be applied at the root organizational unit to deny the s3:PutBucketPublicAccessBlock action and enforce that no S3 buckets are publicly accessible across all accounts. Option A is incorrect because Trusted Advisor provides recommendations, not enforcement. Option C is incorrect because IAM roles are per-account and cannot centrally enforce across all accounts without additional overhead. Option D is incorrect because security groups apply to EC2 instances, not S3 buckets.

Answer

Use AWS Trusted Advisor to check for public buckets and send alerts.

Answer

Create an IAM role in each account with a policy to deny public bucket access, and require users to assume that role.

Answer

Configure security group rules to block public internet access to the S3 endpoints.

Question 6

A company is deploying a VPC with a public and private subnet in each of three Availability Zones. They need to provide internet access to instances in the private subnets while ensuring that all outbound traffic is logged and that traffic to a particular on-premises CIDR (10.0.0.0/8) is routed via an AWS Direct Connect Virtual Private Gateway. The company has a VPN connection as a backup. Which design should they use?

Accepted Answer

Create a centralized egress VPC with NAT Gateways in each AZ. Peer the application VPCs to the egress VPC. Configure route tables in the application VPCs to send 0.0.0.0/0 to the egress VPC and 10.0.0.0/8 to the Direct Connect Virtual Private Gateway.. It uses a centralized egress VPC with NAT Gateways in each AZ to provide internet access to private subnets while logging all outbound traffic. By peering the application VPCs to the egress VPC, the route tables can direct 0.0.0.0/0 traffic to the egress VPC for NAT, and 10.0.0.0/8 traffic to the Direct Connect Virtual Private Gateway, ensuring on-premises traffic uses the dedicated connection with VPN backup. This design meets all requirements: internet access, logging, and specific routing for on-premises CIDR.

Answer

Place a NAT Gateway in each AZ in the application VPC. Configure route tables to send 0.0.0.0/0 to the NAT Gateway. Use a VPN connection for on-premises traffic.

Answer

Use a Transit Gateway to connect all VPCs and on-premises. Attach a NAT Gateway in one AZ to the Transit Gateway. Configure route tables to send 0.0.0.0/0 to the NAT Gateway and 10.0.0.0/8 to the Direct Connect Virtual Private Gateway.

Answer

Create a NAT instance in each private subnet and configure each instance's route table to send 0.0.0.0/0 to the NAT instance. For on-premises traffic, use a VPC peering connection to an on-premises network.

Question 7

An IAM policy is applied to a user. The user reports that they cannot run 'aws ec2 describe-instances --region eu-west-1' but can run the same command in us-east-1. What is the most likely reason?

Accepted Answer

The policy denies ec2:Describe* when the region is not us-east-1.. The condition 'StringNotEquals' with 'aws:RequestedRegion' denies the action if the region is not us-east-1. Option A is wrong because the policy explicitly denies ec2:Describe* actions. Option B is wrong because the condition is StringNotEquals, not StringEquals. Option D is wrong because the policy does not specify resource-level conditions.

Answer

The policy only applies to resources in us-east-1, so other regions are implicitly denied.

Answer

The policy condition uses StringEquals, which only allows requests from us-east-1.

Answer

The policy allows ec2:Describe* in all regions, but the user lacks permissions in eu-west-1.

Question 8

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access the internet to download software updates. The company has a NAT gateway in the public subnet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT gateway. However, the EC2 instance cannot access the internet. The network engineer verifies that the NAT gateway has an Elastic IP, the security group for the EC2 instance allows outbound HTTPS traffic, and the network ACL for the private subnet allows inbound and outbound ephemeral ports. What is the most likely cause of the issue?

Accepted Answer

The route table for the public subnet does not have a route to an internet gateway.. The NAT gateway resides in the public subnet, which must have a route table with a default route (0.0.0.0/0) pointing to an internet gateway (IGW) for the NAT gateway to forward traffic to the internet. Without this route, the NAT gateway cannot reach the IGW, so traffic from the private subnet EC2 instance fails even though the private subnet route is correctly configured. The security group and network ACL settings are irrelevant if the NAT gateway itself lacks internet connectivity.

Answer

The security group attached to the NAT gateway does not allow outbound traffic.

Answer

The route table for the private subnet does not have a route to the NAT gateway.

Answer

The NAT gateway does not support UDP traffic.

Question 9

A company is using AWS Transit Gateway to connect multiple VPCs. They notice that traffic between two VPCs in different Availability Zones is taking a suboptimal path, resulting in cross-AZ data transfer costs. How can they optimize the path and reduce costs?

Accepted Answer

Use Availability Zone affinity by launching resources in the same AZ and using Transit Gateway to route within the same AZ.. Configuring resources in the same Availability Zone (AZ) and using Transit Gateway to route within that AZ eliminates cross-AZ data transfer costs. AWS Transit Gateway charges for cross-AZ traffic, so keeping traffic local to a single AZ avoids these charges while still leveraging Transit Gateway for centralized routing.

Answer

Replace Transit Gateway with VPC Peering between the VPCs.

Answer

Enable Transit Gateway multicast to replicate traffic across AZs.

Answer

Configure the Transit Gateway to use a single Availability Zone for all attachments.

Question 10

A company has a multi-account AWS environment using AWS Organizations. They want to centralize VPC flow logs from all accounts into a single Amazon S3 bucket in the management account. The management account S3 bucket policy allows the log delivery service to write logs. However, flow logs are failing to deliver from member accounts. What is the most likely reason?

Accepted Answer

The S3 bucket policy does not include a principal condition for the member account's log delivery service. The S3 bucket policy must explicitly allow the log delivery service principal (delivery.logs.amazonaws.com) from the member account to write objects. Option A is incorrect because flow logs can be delivered cross-account with proper permissions. Option B is incorrect because the bucket policy is evaluated, not the member account's VPC flow log role. Option D is incorrect because encryption is not the issue.

Answer

Flow logs cannot be delivered cross-account; they must be in the same account

Answer

The member account's IAM role for flow logs does not have permission to write to the bucket

Answer

The S3 bucket uses SSE-KMS encryption and the member account does not have access to the KMS key

Question 11

A company has a VPC with CIDR 172.16.0.0/16. They have two subnets: 172.16.1.0/24 (public) and 172.16.2.0/24 (private) in us-west-2a. They have an EC2 instance in the private subnet that needs to access an S3 bucket for log uploads. The company wants to avoid using a NAT Gateway to reduce costs. The S3 bucket is in the same region. Which solution should the network engineer implement?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and add a route from the private subnet to the endpoint.. A VPC Gateway Endpoint for S3 allows private subnet resources to access S3 without traversing the internet or requiring a NAT Gateway. The endpoint uses AWS PrivateLink to route traffic directly to S3 over the AWS network, and you must add a route in the private subnet's route table pointing to the endpoint (prefix list ID) to enable connectivity.

Answer

Assign an IAM instance profile to the EC2 instance that allows S3 access.

Answer

Set up a VPN connection from the VPC to the S3 bucket.

Answer

Create an S3 access point and configure the VPC to use it.

Question 12

A company has a VPC with a CIDR of 10.0.0.0/16. The VPC contains a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). An EC2 instance in the private subnet needs to access an S3 bucket. The company wants to use a VPC endpoint for S3. Which TWO configurations are required?

Accepted Answer

Create an endpoint policy that allows access to the S3 bucket.. To access S3 from a private subnet using a VPC endpoint, two configurations are required. First, an endpoint policy must be created (Option B is correct) to control which S3 buckets and actions are allowed. Second, a route must be added in the private subnet's route table pointing to the gateway endpoint (Option D is correct) to direct S3 traffic through the endpoint. Option A is incorrect because assigning a public IP to the EC2 instance is not needed; the endpoint provides private connectivity. Option C is incorrect because a NAT gateway is not required when using a VPC endpoint. Option E is incorrect because gateway endpoints do not use security groups; they use endpoint policies for access control.

Answer

Assign a public IP address to the EC2 instance.

Answer

Deploy a NAT gateway in the public subnet.

Answer

Attach a security group to the gateway endpoint.

Question 13

A company has a VPC with public and private subnets. The private subnets must access an S3 bucket without traversing the internet. Which TWO methods can achieve this? (Choose TWO.)

Accepted Answer

Create a VPC gateway endpoint for S3 and associate it with the private subnet route tables.. A VPC gateway endpoint for S3 uses AWS's internal network to route traffic to S3 without traversing the internet. This endpoint is a horizontally scaled, redundant, and highly available gateway that is added to the route table of the private subnets, enabling direct, private connectivity to S3.

Answer

Attach an internet gateway to the VPC and route traffic through it.

Answer

Set up a VPN connection to the on-premises network and access S3 from there.

Answer

Place a NAT gateway in the public subnet and route traffic through it.

Question 14

A company has a VPC with public and private subnets. The security team wants to implement a web application firewall to protect against common web exploits. Which TWO AWS services can be used together to achieve this?

Accepted Answer

Application Load Balancer (ALB). An Application Load Balancer (ALB) operates at Layer 7 and can be associated with AWS WAF to inspect HTTP/HTTPS traffic for common web exploits. AWS WAF provides a managed rule set that blocks SQL injection, cross-site scripting (XSS), and other OWASP Top 10 threats. Together, they form a web application firewall (WAF) solution that protects resources in the VPC's private subnets.

Answer

Network Load Balancer (NLB)

Answer

NAT Gateway

Answer

Amazon CloudFront

Question 15

A company wants to enable DNS resolution for hybrid network using Route 53 Resolver. The on-premises DNS servers are reachable via Direct Connect. The company wants to forward queries for a custom domain (example.corp) from VPC to on-premises. Which resource should be created in the VPC?

Accepted Answer

Route 53 Resolver outbound endpoint and associate a resolver rule.. To forward DNS queries from a VPC to on-premises DNS servers, you need a Route 53 Resolver outbound endpoint, which initiates outbound DNS traffic from the VPC. You then associate a resolver rule that specifies the domain (example.corp) and the target on-premises DNS server IPs, enabling conditional forwarding via Direct Connect.

Answer

A VPC endpoint for Route 53 Resolver service.

Answer

Route 53 Resolver rule that forwards example.corp to on-premises DNS servers.

Answer

Route 53 Resolver inbound endpoint.

Question 16

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance is behind a NAT Gateway in the public subnet. The download is failing. Which configuration should the network engineer check FIRST?

Accepted Answer

The route table associated with the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway.. For an EC2 instance in a private subnet to reach the internet via a NAT Gateway, the private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway. Without this route, traffic from the instance destined for the internet has no path to the NAT Gateway, causing the download to fail.

Answer

The network ACL for the private subnet allows inbound HTTP/HTTPS traffic.

Answer

The EC2 instance has a public IP address assigned.

Answer

The Internet Gateway is attached to the private subnet.

Question 17

Which THREE factors should be considered when designing a highly available AWS Site-to-Site VPN connection?

Accepted Answer

Enable BGP for dynamic route propagation. BGP (Border Gateway Protocol) enables dynamic route propagation across the VPN tunnels, allowing automatic failover and route convergence if one tunnel goes down. This is critical for high availability because it eliminates the need for manual route updates and supports path selection based on BGP attributes, ensuring traffic is rerouted through the remaining healthy tunnel.

Answer

Use two VPN tunnels with the same customer gateway IP

Answer

Use a single VPN tunnel with a static route

Question 18

A company runs a multi-tier web application on AWS. The web servers in public subnets need to send traffic to the application servers in private subnets. The application servers must only accept traffic from the web servers. Both tiers are in the same VPC. Which design meets these requirements without introducing a single point of failure or unnecessary complexity?

Accepted Answer

Place the web servers in a public subnet with a security group that allows inbound from 0.0.0.0/0 on port 443. Place the app servers in a private subnet with a security group that allows inbound from the web server security group on the application port.. It uses security group referencing, which allows the app servers' security group to dynamically allow traffic from any instance associated with the web servers' security group, regardless of IP address changes. This design avoids a single point of failure by not introducing any load balancer or gateway, and it minimizes complexity by leveraging native VPC security group behavior within the same VPC.

Answer

Place the web servers and app servers in the same private subnet behind an internal Network Load Balancer. Route web traffic through the NLB.

Answer

Place the web servers in a public subnet with an Internet Gateway. Place the app servers in a private subnet with a NAT Gateway for outbound traffic. Use NACLs to allow inbound from the web subnet CIDR.

Answer

Place the web servers in a public subnet with a NACL allowing inbound on port 443. Place the app servers in a private subnet with a NACL allowing inbound from the web subnet CIDR on the application port.

Question 19

A company has a VPC with a CIDR of 10.0.0.0/16. They need to peer with another VPC that has a CIDR of 10.0.0.0/24. What will happen?

Accepted Answer

The peering connection will fail because the CIDRs overlap.. AWS VPC peering requires that the CIDR blocks of the two VPCs do not overlap. When both VPCs use the same IP range (10.0.0.0/16 and 10.0.0.0/24), the peering connection request will fail because overlapping CIDRs create routing ambiguity and are not supported by the VPC peering service. This is a hard limit enforced at the time of peering creation, not during route table configuration.

Answer

The peering connection will be established, but only the first VPC's CIDR will be used.

Answer

The peering connection will be established, but routes with overlapping CIDRs will not be added automatically.

Answer

The peering connection will be established, and the overlapping CIDRs will be ignored.

Question 20

A company wants to restrict access to an Amazon S3 bucket so that only traffic from a specific AWS Direct Connect virtual interface (VIF) can access it. Which combination of steps should the company take?

Accepted Answer

Create a VPC endpoint for S3 with a VPC endpoint policy that allows access only from the VPC, and configure the VPC route table to route S3 traffic through the Direct Connect VIF.. Option B. To restrict access to an S3 bucket to only traffic from a specific Direct Connect VIF, you can create a VPC endpoint for S3 and attach a VPC endpoint policy that allows access only from the VPC. Then, configure the VPC route table to route traffic destined for S3 through the Direct Connect VIF, ensuring that only traffic coming through that VIF can reach the endpoint. Option A is incorrect because the Direct Connect VIF does not have a public IP address; it uses private IPs. Option C is incorrect because network ACLs are stateless and cannot enforce path-specific restrictions; also they operate at the subnet level, not for specific services like S3. Option D is incorrect because Direct Connect VIFs do not have public IP addresses; they use private IPs and traffic goes through private virtual interfaces.

Answer

Attach an S3 bucket policy that denies access unless the source IP is the public IP address of the Direct Connect VIF.

Answer

Create a network ACL that allows S3 traffic only from the Direct Connect CIDR block and associate it with the VPC subnet connected to the VIF.

Answer

Configure the Direct Connect VIF with a public IP address and use an S3 bucket policy that allows access only from that IP address.