ANS-C01 Mock Exam 76 — 25 Questions

Question 1

A company is using CloudFormation to deploy a VPC. The private subnet route table has a route to a NAT gateway. However, instances in the private subnet cannot access the internet. The NAT gateway is in a public subnet and has an attached Elastic IP. What is the most likely issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The NAT gateway's security group is blocking traffic from the private subnet.. The NAT gateway has a security group that by default denies all inbound traffic. For instances in the private subnet to send traffic to the internet, the NAT gateway's security group must allow inbound traffic from the private subnet's CIDR (or from the private subnet's network ACLs) and allow outbound traffic to the internet. Option D is correct because this is the most likely issue: the security group is blocking traffic. Option A is incorrect because the public subnet route to the IGW is presumptively configured correctly for the NAT gateway to reach the internet. Option B is incorrect because the route to the NAT gateway is present in the private route table. Option C is incorrect because the NAT gateway does not need to be in the same subnet as the private instances; it must be in a public subnet.

Answer

The public subnet does not have a route to the internet gateway.

Answer

The private subnet route table does not have a route to the NAT gateway.

Answer

The NAT gateway is not in the same subnet as the private instances.

Question 2

A security engineer needs to block traffic from a specific country from reaching an Application Load Balancer. Which AWS service should be used to accomplish this?

Accepted Answer

AWS WAF web ACL associated with the ALB. AWS WAF can be associated with an Application Load Balancer to create web ACLs with geographic match conditions, enabling geo-blocking. Option A (Network ACLs) is incorrect because NACLs operate at the subnet level and do not support geo-blocking. Option B (Security groups) is incorrect because security groups do not support geo-blocking. Option C (Route 53 Resolver DNS Firewall) is incorrect because it filters DNS queries, not HTTP traffic. Option D (AWS WAF web ACL associated with the ALB) is correct because WAF supports geographic match conditions to block traffic from specific countries.

Answer

Network ACLs on the VPC subnet

Answer

Security groups associated with the ALB

Answer

Route 53 Resolver DNS Firewall

Question 3

A company is deploying a VPC with public and private subnets in two Availability Zones. They need to ensure that instances in private subnets can access the internet for software updates while remaining unreachable from the internet. Which solution meets these requirements?

Accepted Answer

Deploy a NAT Gateway in a public subnet and add a route to the NAT Gateway in the private subnet route tables.. A NAT Gateway deployed in a public subnet provides outbound-only internet access for instances in private subnets. The private subnet route table directs 0.0.0.0/0 traffic to the NAT Gateway, which translates the private IPs to the NAT Gateway's Elastic IP, allowing internet access while preventing any unsolicited inbound connections from the internet.

Answer

Attach an internet gateway to the private subnets and configure route tables.

Answer

Use a transit gateway to connect the VPC to the internet.

Answer

Establish a VPN connection to an on-premises network and route traffic through it.

Question 4

A company is deploying an application across multiple Availability Zones in a single AWS Region. The application requires that all traffic between EC2 instances in the same subnet be inspected by a network appliance. Which configuration should be used to meet this requirement?

Accepted Answer

Create a Gateway Load Balancer and configure the appliance as a target. A Gateway Load Balancer (GWLB) can inspect intra-subnet traffic between EC2 instances in the same subnet. Traffic between instances in the same subnet is Layer 2 and does not traverse route tables, so traditional routing methods cannot intercept it. GWLB uses Geneve encapsulation to transparently redirect traffic at the hypervisor level to the appliance targets without modifying the route table. The appliance must be configured to handle this encapsulation. Other options do not support inspection of same-subnet traffic.

Answer

Set up a VPC peering connection between the subnets

Answer

Use a Transit Gateway to route traffic through the appliance

Answer

Deploy AWS Network Firewall in the subnet

Question 5

A company is deploying a hybrid network architecture with an AWS Site-to-Site VPN connection between its on-premises network and a VPC. The on-premises network uses BGP to advertise routes to the VPN connection. After the VPN is established, the on-premises network cannot reach EC2 instances in the VPC. The VPC route table has a route for the on-premises CIDR block pointing to the VPN gateway. What is the most likely cause of this issue?

Accepted Answer

The on-premises network is advertising a default route (0.0.0.0/0) via BGP, which is overriding the VPC's local route.. When the on-premises network advertises a default route (0.0.0.0/0) via BGP over the VPN connection, the VPC propagates that route into its route tables (if route propagation is enabled). This default route can override the VPC's local route for the on-premises CIDR, causing traffic destined for the on-premises network to be sent back out the VPN gateway instead of being delivered locally, effectively breaking connectivity to EC2 instances.

Answer

The VPN connection is not using the correct pre-shared key.

Answer

The security group attached to the EC2 instances does not allow inbound traffic from the on-premises CIDR.

Answer

The VPC's network ACLs are blocking inbound traffic from the on-premises network.

Question 6

A company is designing a VPC architecture with a public subnet and a private subnet. They want to allow instances in the private subnet to download software updates from the internet. Which TWO options satisfy this requirement? (Choose TWO.)

Accepted Answer

Set up a NAT Gateway in a public subnet and add a default route in the private subnet route table pointing to the NAT Gateway.. A NAT Gateway in a public subnet provides outbound-only internet access to instances in a private subnet. By adding a default route (0.0.0.0/0) in the private subnet route table pointing to the NAT Gateway, traffic from private instances is source-NATed to the NAT Gateway's Elastic IP, allowing downloads while preventing inbound connections from the internet.

Answer

Configure a forward proxy in the private subnet and configure the instances to use it.

Answer

Create a VPC Gateway Endpoint for Amazon S3 and route traffic to it.

Answer

Attach an Internet Gateway to the private subnet and add a default route to it.

Question 7

A security engineer is designing a security group configuration for a web application that consists of an Application Load Balancer (ALB), Amazon EC2 instances in an Auto Scaling group, and an Amazon RDS database. Which TWO actions should the engineer take to follow security best practices? (Choose TWO.)

Accepted Answer

Configure the EC2 instance security group to allow inbound traffic on port 443 from the ALB security group.. Referencing the ALB security group as the source in the EC2 security group rule ensures that only traffic originating from the ALB (and not any other source) is allowed on port 443. This follows the security best practice of using security group references instead of IP ranges, providing a tighter, more dynamic access control that automatically scales with the ALB's elastic network interfaces.

Answer

Configure the RDS security group to allow inbound traffic on port 3306 from 0.0.0.0/0.

Answer

Configure the ALB security group to allow inbound traffic on port 443 from the security group of the EC2 instances.

Answer

Configure the ALB security group to allow inbound traffic on port 80 from the security group of the EC2 instances.

Question 8

Which TWO of the following are required to establish a BGP session over a Direct Connect private virtual interface? (Choose TWO.)

Accepted Answer

A VLAN ID. A VLAN ID is required because a Direct Connect private virtual interface operates over a single 802.1Q VLAN trunk. The VLAN ID uniquely identifies the virtual interface on the Direct Connect connection, allowing multiple virtual interfaces to share the same physical link. Without a VLAN ID, the Layer 2 encapsulation cannot be established, and the BGP session cannot form.

Answer

A public IP address for the BGP peer

Answer

A Direct Connect gateway

Answer

A VPN connection to the VPC

Question 9

A company has a VPC with public and private subnets. The public subnet contains a NAT gateway and a bastion host. The private subnet contains application servers. The company wants to ensure that the application servers can download patches from the internet. Which TWO steps should be taken to allow this while maintaining security? (Choose two.)

Accepted Answer

Allow outbound HTTPS (port 443) traffic from the application servers in the security group. The application servers need to initiate outbound HTTPS connections (port 443) to download patches from the internet. By allowing outbound HTTPS traffic in the security group associated with the application servers, you permit the necessary traffic while maintaining stateful filtering and restricting other outbound traffic. This is a security best practice that follows the principle of least privilege.

Answer

Modify the network ACL of the private subnet to allow all outbound traffic

Answer

Add a route in the public subnet route table that points 0.0.0.0/0 to the NAT gateway

Answer

Associate an Elastic IP address with the NAT gateway

Question 10

A company has a VPC with a CIDR block of 10.0.0.0/16. They have a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). They have an internet gateway attached to the public subnet. They deploy a web server on an EC2 instance in the public subnet and a database on an EC2 instance in the private subnet. The database should only be accessible from the web server. The company wants to secure the database by not assigning a public IP address to it. Which configuration will allow the web server to connect to the database?

Accepted Answer

Keep the database instance in the private subnet with no public IP, and configure the security group of the database to allow inbound traffic from the web server's security group on the database port. Security groups in AWS can reference other security groups as a source, allowing traffic from any instance associated with the source security group. By configuring the database's security group to allow inbound traffic on the database port from the web server's security group, the web server can connect to the database without the database needing a public IP address. This leverages AWS's built-in security group chaining, which works across subnets within the same VPC.

Answer

Create a VPC Peering connection between the public and private subnets

Answer

Assign a public IP address to the database instance and configure the security group to allow inbound traffic from the web server's public IP

Answer

Set up a VPN connection between the web server and the database

Question 11

A company is using an AWS Transit Gateway to connect multiple VPCs and on-premises networks via Direct Connect. The network team notices that traffic from an on-premises network (CIDR 172.16.0.0/12) to a VPC (CIDR 10.0.0.0/16) is being dropped. The transit gateway route table shows a static route for 10.0.0.0/16 pointing to the VPC attachment. The Direct Connect virtual interface (VIF) is associated with the transit gateway and the on-premises router is advertising 172.16.0.0/12 via BGP. What is the most likely cause of the traffic being dropped?

Accepted Answer

The transit gateway route table does not have a route for the on-premises CIDR (172.16.0.0/12) pointing to the Direct Connect attachment.. The transit gateway route table must contain a route for the on-premises CIDR (172.16.0.0/12) pointing to the Direct Connect attachment for return traffic to be forwarded correctly. Without this route, the transit gateway has no path for traffic destined to the on-premises network, causing it to be dropped. The static route for 10.0.0.0/16 only handles traffic toward the VPC, not the return direction.

Answer

The VPC has a route that points to the transit gateway for the on-premises CIDR, causing asymmetric routing.

Answer

The Direct Connect VIF is not configured with BFD.

Answer

The VPC route table does not have a route for the on-premises CIDR pointing to the transit gateway.

Question 12

A company has a VPC with an application load balancer (ALB) in public subnets and EC2 instances in private subnets. The EC2 instances must only accept traffic from the ALB. Which security group configuration achieves this?

Accepted Answer

Allow inbound traffic from the ALB's security group on the application port.. Referencing the ALB's security group as the source in the EC2 instances' inbound rule ensures that only traffic originating from the ALB is allowed. This leverages AWS security group referencing, which dynamically resolves to the private IP addresses of the ALB's elastic network interfaces (ENIs), providing a secure and scalable solution without exposing the instances to broader network ranges.

Answer

Allow inbound traffic from 0.0.0.0/0 on the application port.

Answer

Allow inbound traffic from the VPC CIDR on the application port.

Answer

Allow inbound traffic from the private subnet CIDR on the application port.

Question 13

A company is deploying a new application across multiple Availability Zones in a single region. The application requires low-latency communication between instances in different AZs. Which TWO design choices help achieve high availability and low latency? (Select TWO.)

Accepted Answer

Launch EC2 instances in at least two Availability Zones.. To achieve high availability and low-latency communication between instances in different Availability Zones, you should launch instances in at least two AZs (C) to avoid a single point of failure, and use an Application Load Balancer (E) to distribute traffic and perform health checks. A spread placement group (A) is not recommended for low latency; it spreads instances across distinct hardware, which can increase latency. Larger instance sizes (B) only increase capacity and do not improve availability or latency. A single NAT Gateway (D) introduces a single point of failure and does not affect inter-AZ latency.

Answer

Use a spread placement group for the instances.

Answer

Use larger instance sizes to handle traffic spikes.

Answer

Use a single NAT Gateway to provide internet access.

Question 14

Which THREE are benefits of using AWS Transit Gateway over VPC peering in a multi-VPC environment? (Select THREE.)

Accepted Answer

Centralized management of network policies. AWS Transit Gateway offers a hub-and-spoke architecture that provides three key benefits over VPC peering: (1) the ability to attach VPN connections and Direct Connect virtual interfaces, enabling hybrid connectivity; (2) centralized management of network policies such as routing, security, and access controls from a single point; and (3) transitive routing between all attached VPCs, eliminating the need for full mesh peering.

Answer

Higher bandwidth per connection

Answer

Simpler configuration for a few VPCs

Answer

Lower cost compared to VPC peering

Question 15

A company is using AWS Direct Connect with a private VIF to access their VPC. Users report intermittent connectivity issues. You check the Direct Connect console and see that the virtual interface state is 'down'. What is the MOST likely cause?

Accepted Answer

BGP session between the customer router and AWS is down.. A private VIF relies on a BGP session between the customer router and the AWS Direct Connect router to exchange routes and maintain the virtual interface state. When the BGP session goes down, the VIF state transitions to 'down' because no routing information is being exchanged, causing connectivity loss. This is the most direct and common cause of a VIF being in the 'down' state.

Answer

AWS Site-to-Site VPN is not established.

Answer

MACsec encryption is misconfigured on the customer router.

Answer

Jumbo frames are enabled on the VIF but not supported by the customer router.

Question 16

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download software patches from the internet. Which AWS service should be used to provide outbound internet access without allowing inbound traffic?

Accepted Answer

NAT gateway. A NAT gateway enables EC2 instances in a private subnet to initiate outbound IPv4 traffic to the internet (e.g., to download patches) while preventing any unsolicited inbound traffic from the internet. It resides in a public subnet with an Elastic IP and performs source network address translation (SNAT), replacing the private source IP with the gateway's public IP. This satisfies the requirement of outbound-only internet access without exposing the private instances to inbound connections.

Answer

Site-to-Site VPN connection

Answer

VPC endpoint

Answer

Internet gateway

Question 17

A company is designing a multi-region active-active application using Amazon Route 53 latency-based routing with health checks. The application is deployed in us-east-1 and eu-west-1. During a load test, users in South America experience high latency despite the Route 53 configuration. What is the most likely cause?

Accepted Answer

The health check for one region is failing, causing all traffic to be routed to the remaining healthy region.. Latency-based routing directs traffic to the region with the lowest latency for the user. If a health check fails, Route 53 treats that region as unhealthy and stops routing traffic to it, even if it would otherwise provide lower latency. In this scenario, users in South America likely experience high latency because the eu-west-1 region (which might have lower latency for them) is marked unhealthy, forcing all traffic to us-east-1, which is farther away.

Answer

The company should use geolocation routing instead of latency-based routing.

Answer

The latency records are not refreshed frequently enough, causing stale routing decisions.

Answer

The Route 53 health check is configured to use CloudWatch alarms, which introduced additional latency.

Question 18

Which THREE services can be used to detect and protect against DDoS attacks? (Choose THREE.)

Accepted Answer

AWS Firewall Manager. Options A, C, and D are correct. AWS Shield Advanced provides DDoS protection, AWS WAF filters web traffic, and AWS Firewall Manager centrally manages rules. Option B is wrong because AWS Config tracks configuration changes, not DDoS detection. Option E is wrong because VPC Flow Logs only log traffic.

Answer

AWS Config

Answer

VPC Flow Logs

Question 19

A company is experiencing intermittent connectivity issues between its on-premises network and AWS via a Direct Connect connection. The link is up, but packet loss is observed. Which test should the network engineer perform first to isolate the issue?

Accepted Answer

Run a traceroute with MTR. MTR (My TraceRoute) combines the functionality of traceroute and ping to provide per-hop latency and packet loss statistics. This allows the engineer to pinpoint whether the packet loss is occurring on the Direct Connect link itself, the customer gateway, or somewhere in the transit path, rather than just confirming end-to-end reachability.

Answer

Ping the virtual private gateway

Answer

Perform a DNS lookup

Answer

Run a speed test

Question 20

Match each AWS service or feature to its primary function in network architecture.

Accepted Answer

VPC: Isolated virtual network in AWS where you can launch resources. Correct matches: VPC is an isolated virtual network; Direct Connect is a dedicated physical connection; VPN is an encrypted internet-based connection; Route 53 is a DNS service. Common confusions include mixing Direct Connect with VPN and VPC with Direct Connect.

Answer

VPC: Dedicated physical connection from on-premises to AWS

Answer

Direct Connect: Encrypted connection over the internet to AWS