ANS-C01 Mock Exam 74 — 25 Questions

Question 1

A network engineer is setting up a site-to-site VPN connection between an on-premises network and an AWS VPC. The engineer configures the customer gateway device with the correct parameters. However, the VPN tunnel status remains 'DOWN'. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The pre-shared key on the customer gateway device does not match the pre-shared key configured in the VPN connection.. The most likely cause is a mismatch in the pre-shared key (PSK) between the customer gateway device and the VPN connection configuration in AWS. IPsec tunnel establishment requires both ends to authenticate using identical PSK values; if they differ, the Internet Key Exchange (IKE) phase 1 negotiation fails, leaving the tunnel status 'DOWN'. This is a common configuration error that directly prevents the VPN from coming up.

Answer

The virtual private gateway is not attached to the customer gateway.

Answer

The VPN connection is not associated with a subnet.

Answer

The security group associated with the VPN endpoint is blocking the traffic.

Question 2

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. Network engineers report intermittent connectivity issues between VPC A and the on-premises network. The transit gateway route table shows the on-premises CIDR (10.0.0.0/8) propagated from the VPN attachment. VPC A has a subnet route pointing to the transit gateway for 10.0.0.0/8. Which step should the engineer take FIRST to diagnose the issue?

Accepted Answer

In the transit gateway route table, verify that the VPN attachment is correctly associated and that the 10.0.0.0/8 route is propagated and has the correct attachment.. The first diagnostic step for intermittent connectivity through a transit gateway is to verify the route table configuration. The engineer must confirm that the VPN attachment is correctly associated with the transit gateway route table and that the 10.0.0.0/8 route is propagated from the VPN attachment, as a missing or misassociated route would cause traffic to be dropped even if the VPN tunnel is up.

Answer

Verify that the VPN tunnel status shows as UP on both sides.

Answer

Enable VPC Flow Logs on VPC A to verify traffic reaching the transit gateway.

Answer

Check the security group rules on the EC2 instances in VPC A for outbound traffic.

Question 3

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. The VPC uses a virtual private gateway (VGW). The on-premises network advertises a route to a specific subnet (10.0.0.0/24) via BGP. However, traffic from the VPC to that subnet is failing. What should the network engineer check first?

Accepted Answer

Verify that route propagation is enabled on the VPC's route tables associated with the subnets.. The most common cause of traffic failure from a VPC to an on-premises subnet over Direct Connect is that the VPC route tables do not have a route for the on-premises subnet. Even if the VGW is attached and BGP is established, the VPC subnets must have route propagation enabled on their route tables to automatically learn the routes advertised by the on-premises network via BGP. Without this, the VPC has no path to send traffic to the 10.0.0.0/24 subnet.

Answer

Verify that the customer gateway device is advertising the subnet route.

Answer

Verify that the virtual interface is in the 'available' state and BGP session is established.

Answer

Verify that the VGW is attached to the VPC.

Question 4

A company is running a multi-tier web application across two AWS Regions (us-east-1 and eu-west-1) for disaster recovery. The application uses an Application Load Balancer (ALB) in each Region. The company uses Amazon Route 53 with latency-based routing to direct traffic to the closest Region. Recently, during a regional failure in us-east-1, users experienced timeouts instead of being redirected to eu-west-1. The DNS TTL is set to 60 seconds. The Route 53 health checks for the us-east-1 ALB are configured to check the HTTP endpoint every 30 seconds with 3 consecutive failures required to mark it unhealthy. The eu-west-1 ALB is healthy. The company's network design includes a VPC in each Region with public and private subnets. The ALBs are internet-facing and have proper security groups. The Route 53 records are configured correctly. What is the MOST likely cause of the timeout?

Accepted Answer

The health check interval and failure threshold cause a delay in detecting the failure, and DNS caching causes clients to still resolve to the unhealthy endpoint.. The most likely cause is that the health check interval and failure threshold create a delay in detection, and DNS caching causes clients to still resolve to the unhealthy endpoint. Route 53 health checks check the endpoint every 30 seconds and require 3 consecutive failures to mark it unhealthy, resulting in up to 90 seconds (3 * 30s) before the health check fails. Additionally, DNS resolvers cache the resolved IP address for the TTL of 60 seconds. Therefore, even after the health check marks the endpoint unhealthy, some clients may still have the cached IP and attempt to connect to the failed us-east-1 ALB, causing timeouts. Option A is incorrect because latency-based routing does fail over when health checks fail; the issue is the delay. Option B is incorrect because cross-zone load balancing is irrelevant to multi-region failover. Option D is incorrect because Route 53 health checks are global and can reach any region.

Answer

The latency-based routing policy does not fail over to the other region when a health check fails.

Answer

The ALB in us-east-1 is not configured to be cross-zone load balancing, causing it to fail.

Answer

The Route 53 health check is not able to reach the ALB in us-east-1 from eu-west-1 due to network ACLs.

Question 5

A company has multiple VPCs connected via a Transit Gateway. They want to implement network segmentation so that only specific VPCs can communicate with each other. Which TWO methods can achieve this? (Choose two.)

Accepted Answer

Deploy AWS Network Firewall in a centralized inspection VPC. AWS Network Firewall can be deployed in a centralized inspection VPC to filter traffic between VPCs attached to a Transit Gateway. By routing inter-VPC traffic through the firewall appliance, you can enforce stateful inspection and allow or deny traffic based on source/destination VPCs, achieving network segmentation.

Answer

Assign instances to different security groups

Answer

Configure network ACLs on each subnet

Answer

Create separate VPC peering connections

Question 6

Which TWO statements about AWS Transit Gateway are correct? (Choose two.)

Accepted Answer

It supports transitive routing between attached VPCs. AWS Transit Gateway (TGW) acts as a central hub that enables transitive routing between all attached VPCs. When you attach multiple VPCs to the same TGW, their route tables are configured to point to the TGW, allowing traffic to flow from one VPC to another through the hub without needing individual VPC peering connections. This transitive behavior is a core feature of TGW, simplifying network architecture and reducing the number of routing paths required.

Answer

It provides internet access for attached VPCs

Answer

It can replace AWS Direct Connect for on-premises connectivity

Answer

It only supports VPN attachments

Question 7

A company is implementing a hybrid network using AWS Direct Connect and VPN backup. The company has two Direct Connect connections from different providers and a site-to-site VPN as a backup. The company wants to ensure that traffic is always routed through the Direct Connect connections when they are healthy, and only fails over to the VPN if both Direct Connect connections fail. Which BGP configuration should be used on the customer gateway device (CGW) to achieve this?

Accepted Answer

Set a lower BGP Local Preference value for routes received from the VPN connection.. BGP Local Preference is a well-known mandatory attribute used to influence outbound traffic from the AS. By setting a lower Local Preference value for routes received from the VPN connection, the customer gateway device (CGW) will prefer routes learned via Direct Connect (which have a default or higher Local Preference) over those learned via VPN. This ensures traffic is routed through Direct Connect connections when they are healthy, and only fails over to the VPN if both Direct Connect connections fail.

Answer

Apply a BGP community tag to routes received over the VPN to signal less preference.

Answer

Set a higher BGP Multi-Exit Discriminator (MED) value for routes advertised over the VPN.

Answer

Prepend AS_PATH on routes advertised over the Direct Connect connections.

Question 8

A company uses AWS Shield Advanced to protect against DDoS attacks. They notice that some legitimate traffic is being throttled during a DDoS event. The security team wants to ensure that legitimate traffic from specific business partners is not affected. Which action should they take?

Accepted Answer

Create a rate-based rule in AWS WAF with an IP set that includes the partners' IPs and set the rate limit high for that rule.. AWS WAF allows you to create rate-based rules that can include an IP set with the partners' IPs and set a high rate limit for that specific rule, thereby excluding legitimate traffic from rate limiting while maintaining protection against DDoS. Option A is wrong because disabling rate-based rules removes protection against DDoS. Option B is wrong because increasing the global rate limit may still throttle legitimate traffic and is not a precise solution. Option C is wrong because AWS Shield Advanced does not have a whitelist for individual IPs at the application layer; IP whitelisting is done via AWS WAF.

Answer

Disable the rate-based rule in AWS WAF during the DDoS event.

Answer

Increase the global rate limit in AWS Shield Advanced.

Answer

Add the partners' IP addresses to the AWS Shield Advanced whitelist.

Question 9

A company has multiple VPCs connected via a transit gateway. Each VPC has a security group that allows traffic from the other VPCs' CIDR blocks. The security group rules are getting complex. How can the company simplify security group management while maintaining the same level of security?

Accepted Answer

Use managed prefix lists in security group rules.. Use managed prefix lists. Prefix lists allow you to group CIDR blocks and reference them in security group rules, simplifying management. Option B is wrong because VPC endpoints are for accessing AWS services privately, not for inter-VPC communication. Option C is wrong because AWS Network Firewall adds another layer of complexity and cost; prefix lists achieve simplification more directly. Option D is wrong because network ACLs are stateless and less granular than security groups, and they cannot use prefix lists for rule simplification.

Answer

Use VPC endpoints for inter-VPC communication.

Answer

Deploy AWS Network Firewall to centralize rules.

Answer

Replace security groups with network ACLs.

Question 10

A company is configuring a site-to-site VPN connection between its on-premises network and AWS. The VPN tunnel is up, but traffic is not passing. The company has verified that routes are correct on both sides. Which TWO actions should the company take to troubleshoot the issue?

Accepted Answer

Check the security group rules for the EC2 instances in the VPC.. Security groups act as a virtual firewall for EC2 instances, controlling inbound and outbound traffic at the instance level. Even if the VPN tunnel is up and routes are correct, the security group rules must allow the desired traffic (e.g., from the on-premises network CIDR) to reach the EC2 instances. Without proper inbound rules, traffic will be dropped at the instance level, preventing communication.

Answer

Verify that the virtual private gateway is attached to the VPC.

Answer

Ensure that the on-premises firewall is configured to allow IPSec traffic.

Answer

Verify that the VPN tunnel is using the correct encryption algorithm.

Question 11

A company is deploying a multi-tier web application across two AWS Regions with an active-passive failover architecture. The application uses Application Load Balancers (ALBs) in each Region, and traffic must be directed to the active Region using DNS. Which routing policy should be used for the Amazon Route 53 record set to achieve this?

Accepted Answer

Failover routing policy. The failover routing policy in Amazon Route 53 is designed specifically for active-passive failover architectures. It uses health checks to monitor the primary endpoint (active Region) and automatically routes traffic to the secondary endpoint (passive Region) only when the primary health check fails. This matches the requirement of directing traffic to the active Region using DNS.

Answer

Geolocation routing policy

Answer

Weighted routing policy

Answer

Latency routing policy

Question 12

A company is designing a VPC with a public subnet and a private subnet. The private subnet hosts an RDS database, and the public subnet hosts a web server. The web server needs to access the database. Which TWO of the following are required to allow the web server to connect to the database?

Accepted Answer

An inbound rule in the database's security group that references the web server's security group.. Security group rules can reference other security groups as a source, allowing traffic from any instance associated with the referenced security group (the web server's security group) without needing to specify individual IP addresses. This is the recommended AWS best practice for inter-instance communication within a VPC, as it dynamically adapts to changes in the web server's IP or scaling events.

Answer

An inbound rule in the database's security group that allows traffic from the web server's private IP address.

Answer

An internet gateway attached to the VPC.

Answer

A NAT gateway in the public subnet.

Question 13

A security engineer is troubleshooting connectivity issues between two VPCs connected via a VPC Peering connection. The VPCs are in different accounts. The security groups in both VPCs allow traffic between the CIDRs. The route tables have the appropriate entries. However, instances in VPC A cannot communicate with instances in VPC B. What is the most likely cause?

Accepted Answer

The VPC Peering connection does not support transitive routing through an intermediate VPC or on-premises network.. VPC Peering connections do not support transitive routing. If traffic must pass through an intermediate VPC or on-premises network, the peering connection alone cannot route it. Option B is incorrect because VPC Peering does not require an IAM role for cross-account communication; instead, the accepter must accept the request and route tables must be updated. Option C is incorrect because security groups are stateful and automatically allow return traffic, and the scenario states security groups allow traffic between CIDRs. Option D is incorrect because the issue is not about NACLs; if NACLs were blocking traffic, the problem would likely be related to stateless filtering, but the question focuses on security groups and routing.

Answer

The VPC Peering connection requires an IAM role to be assumed for cross-account communication.

Answer

The security group in VPC A does not allow inbound traffic from VPC B's CIDR.

Answer

The network ACL in VPC A does not allow return traffic from VPC B.

Question 14

A company has a hub-and-spoke network architecture using AWS Transit Gateway. The hub VPC contains a central inspection appliance (NVA) for traffic inspection. Spoke VPCs are attached to the Transit Gateway and have routes pointing to the Transit Gateway for all traffic. The Transit Gateway has a default route table that routes traffic to the NVA for inspection. Recently, the network team noticed that traffic between two spoke VPCs is not being inspected. The team verified that the Transit Gateway route tables are correctly configured and that the NVA is healthy. What should the team do to ensure that inter-spoke traffic is inspected?

Accepted Answer

Configure route propagation in the Transit Gateway route tables to propagate routes from the spoke attachments. Configuring route propagation in the Transit Gateway route tables from the spoke attachments allows the Transit Gateway to learn the specific CIDR blocks of each spoke VPC. With these routes, the Transit Gateway can forward inter-spoke traffic to the NVA for inspection. Option B is incorrect because VPC Flow Logs only capture traffic logs and do not affect routing. Option C is incorrect because adding static routes in the spoke VPC route tables pointing to the NVA would bypass the Transit Gateway and break the hub-and-spoke design. Option D is incorrect because bandwidth increase does not address the routing issue.

Answer

Enable VPC Flow Logs on the spoke VPCs to capture traffic

Answer

Add static routes in the spoke VPC route tables pointing to the NVA

Answer

Increase the bandwidth of the Transit Gateway attachments

Question 15

A company has deployed an application in a VPC with public and private subnets across two Availability Zones. The application uses an Application Load Balancer (ALB) in the public subnets to distribute traffic to EC2 instances in the private subnets. The company wants to use AWS WAF to protect against SQL injection attacks. Where should the AWS WAF web ACL be associated?

Accepted Answer

The Application Load Balancer.. AWS WAF is a web application firewall that protects web resources from common exploits like SQL injection. It integrates directly with Application Load Balancers (ALBs) by allowing you to associate a web ACL with the ALB, which inspects HTTP/HTTPS traffic before it reaches the backend EC2 instances. This is the only supported integration point among the options for protecting application-layer traffic in this architecture.

Answer

Amazon Route 53 hosted zone.

Answer

The security group of the EC2 instances.

Answer

The VPC internet gateway.

Question 16

A company is designing a network for a real-time gaming application that requires extremely low latency between players. The application will be deployed on EC2 instances in multiple AWS regions. Which AWS service provides the best latency performance by using the AWS global network and anycast IPs?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator uses the AWS global network and anycast IPs to route traffic to the optimal edge location, then over the AWS backbone to the nearest healthy endpoint. This minimizes internet hops and latency, making it ideal for real-time gaming applications that require consistent low latency across multiple regions.

Answer

AWS Direct Connect

Answer

Amazon CloudFront

Answer

Amazon Route 53 Latency Routing

Question 17

A company wants to centrally manage firewall rules across multiple VPCs in different AWS accounts. Which AWS service should they use?

Accepted Answer

AWS Network Firewall with AWS Firewall Manager. AWS Network Firewall can be centrally managed using AWS Firewall Manager, which provides a single pane of glass to apply firewall rules across multiple VPCs and accounts. Option B is wrong because Security Groups are per-VPC and not centrally managed. Option C is wrong because AWS WAF is for web application layer protection, not network firewall. Option D is wrong because Network ACLs are per-subnet and cannot be centrally managed across accounts.

Answer

Security Groups

Answer

AWS WAF

Answer

Network ACLs

Question 18

Which TWO of the following are valid methods to provide outbound internet access to instances in a private subnet?

Accepted Answer

Deploy a NAT instance in a public subnet and configure routing. The correct answers are C and D. A NAT instance (C) or a NAT gateway (D) deployed in a public subnet with a default route pointing to them from the private subnet provides outbound internet access while keeping instances private. Option A is incorrect because VPC endpoints only provide private access to AWS services, not general internet. Option B is incorrect because an internet gateway is attached to the VPC, not directly to a subnet, and instances in private subnets cannot use it without a NAT device. Option E is incorrect because a VPN connection is for private connectivity to on-premises networks, not internet access.

Answer

Use a VPC endpoint for internet access

Answer

Attach an internet gateway directly to the private subnet

Answer

Use a VPN connection to the internet

Question 19

A network engineer is analyzing VPC Flow Logs for a VPC with CIDR 10.0.0.0/16. The exhibit shows a sample log entry. The engineer notices that traffic from 10.0.1.10 to 10.0.2.10 on port 443 is being accepted. However, the application team reports that the connection is failing. What is the most likely reason for the disconnect?

Accepted Answer

The application layer is failing to establish a proper connection.. The VPC Flow Logs show that traffic from 10.0.1.10 to 10.0.2.10 on port 443 is being accepted (ACCEPT record), which indicates that the network layer (security groups, network ACLs, and routing) is permitting the traffic. Since the application team reports the connection is failing, the issue must be at a higher layer, specifically the application layer (e.g., TLS handshake failure, certificate mismatch, or the application not listening on port 443). Flow logs capture only network-layer metadata (IP, port, protocol, action) and cannot detect application-layer errors.

Answer

The security groups are blocking the traffic.

Answer

The route tables are incorrectly configured, causing packet loss.

Answer

The flow logs are misconfigured and not capturing all traffic.

Question 20

A company has a VPC with CIDR 10.0.0.0/16. They have two Availability Zones (us-east-1a and us-east-1b). In each AZ, there is a public subnet (10.0.1.0/24 and 10.0.2.0/24) and a private subnet (10.0.3.0/24 and 10.0.4.0/24). A NAT Gateway is deployed in the public subnet of us-east-1a. The private route tables for both private subnets have a default route pointing to the NAT Gateway. An application team has deployed EC2 instances in the private subnets. They report that instances in us-east-1b cannot access the internet, while instances in us-east-1a can. The NAT Gateway is healthy and has an Elastic IP attached. The route tables for the public subnets have a default route to the Internet Gateway. What is the most likely cause of the issue?

Accepted Answer

The NAT Gateway has reached the maximum number of concurrent connections. The most likely cause is that the NAT Gateway has reached its maximum number of concurrent connections. When connection limits are exceeded, new outbound connections from instances in any private subnet may fail, leading to internet access issues. This explains why instances in us-east-1a (which may have established connections earlier) can still access the internet, while instances in us-east-1b cannot. Option A is incorrect because the NAT Gateway is correctly placed in a public subnet. Option B is incorrect because the route table of the public subnet in us-east-1b does not affect traffic from private instances; they route directly to the NAT Gateway in us-east-1a. Option D is incorrect because cross-AZ data transfer charges are a cost concern and do not block network traffic. Therefore, the most plausible technical cause is option C.

Answer

The NAT Gateway is deployed in a private subnet

Answer

The route table for the public subnet in us-east-1b does not have a default route to the Internet Gateway

Answer

The NAT Gateway is in a different Availability Zone than the private subnet instances, causing cross-AZ data transfer charges