ANS-C01 Mock Exam 79 — 25 Questions

Question 1

A company is designing a network security architecture for a multi-tier application. The web tier must be accessible from the internet, but the application and database tiers must not. Which TWO design choices meet these requirements? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a security group on the web tier to allow HTTP/HTTPS from 0.0.0.0/0, and security groups on the app and database tiers that only allow traffic from the web tier security group.. The correct answers are C and E. Option C uses security groups to control traffic between tiers: the web tier security group allows HTTP/HTTPS from 0.0.0.0/0, and the app and database tier security groups only allow traffic from the web tier security group. This ensures that the application and database tiers are not directly accessible from the internet. Option E places the web tier in a public subnet with an internet gateway in its route table, so it can receive inbound traffic from the internet. The app and database tiers are placed in private subnets without a direct route to the internet gateway, so they cannot be accessed from the internet. Option A is incorrect because a VPC Gateway Endpoint is used for private connectivity to AWS services like S3 or DynamoDB, not for internet access. Option B is incorrect because a NAT gateway provides outbound internet access for private subnets, not inbound internet access to the web tier. Option D is incorrect because placing all tiers in a public subnet exposes the application and database tiers to the internet, even with restrictive security groups, because they would still have a route to the internet gateway.

Answer

Use a VPC Gateway Endpoint for the web tier to access the internet.

Answer

Use a NAT gateway in a public subnet to provide internet access to the app and database tiers for updates.

Answer

Place all tiers in a public subnet with a security group that restricts access to the app and database tiers.

Question 2

A company is designing a network for a critical application that requires low latency and high throughput between EC2 instances in the same AWS Region. Which network design should the company use?

Accepted Answer

Launch the instances in a Cluster Placement Group.. A Cluster Placement Group is the correct choice because it provides the lowest possible latency and highest throughput between EC2 instances by placing them in a single Availability Zone with non-blocking, high-bandwidth networking. This design is ideal for tightly coupled, high-performance computing (HPC) or latency-sensitive applications that require consistent, low-latency communication within the same AWS Region.

Answer

Launch the instances in a Spread Placement Group.

Answer

Launch the instances as larger instance types with enhanced networking.

Answer

Launch the instances in different Availability Zones.

Question 3

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to an on-premises network with CIDR 10.0.0.0/8. The company wants to use AWS Site-to-Site VPN. What configuration change is required to avoid routing conflicts?

Accepted Answer

Change the VPC CIDR to a non-overlapping range, such as 172.16.0.0/16.. The VPC CIDR 10.0.0.0/16 is a subset of the on-premises CIDR 10.0.0.0/8. AWS Site-to-Site VPN cannot route traffic correctly when the VPC and on-premises networks have overlapping IP ranges because the VPN connection relies on distinct destination prefixes. The only way to eliminate the conflict is to change the VPC CIDR to a non-overlapping range, such as 172.16.0.0/16, ensuring no IP address overlap between the two networks.

Answer

Create a more specific route in the VPC route table for the on-premises CIDR.

Answer

Enable route propagation on the VPC route tables.

Answer

Use a VPN connection with static routes instead of BGP.

Question 4

Which THREE of the following are considerations when designing a VPC with multiple Availability Zones for high availability? (Choose THREE.)

Accepted Answer

Use an Application Load Balancer to distribute traffic across instances in different Availability Zones.. An Application Load Balancer (ALB) distributes incoming traffic across multiple targets, such as EC2 instances, in different Availability Zones (AZs). By registering instances from multiple AZs with the ALB, you ensure that if one AZ becomes unavailable, the ALB can route traffic to healthy instances in another AZ, thereby maintaining high availability. This aligns with the AWS Well-Architected Framework's recommendation to deploy workloads across multiple AZs and use a load balancer to handle failover.

Answer

Create a single public subnet that spans all Availability Zones.

Answer

Use a single NAT gateway in one Availability Zone to reduce cost.

Question 5

A company is designing a multi-tier application in a VPC. The web tier must be accessible from the internet, while the application tier must only be accessible from the web tier. The database tier must be isolated from all other tiers except the application tier. Which TWO network architectures meet these requirements? (Choose TWO.)

Accepted Answer

Use a public subnet for an Application Load Balancer and private subnets for web, app, and database tiers. Use security groups to restrict traffic between tiers.. It places the Application Load Balancer in a public subnet to receive internet traffic, while the web, app, and database tiers reside in private subnets. Security groups are used to restrict traffic flows: the ALB security group allows inbound HTTP/HTTPS from the internet, the web tier security group allows inbound only from the ALB, the app tier security group allows inbound only from the web tier, and the database tier security group allows inbound only from the app tier. This ensures the application tier is only accessible from the web tier, and the database tier is isolated except from the application tier.

Answer

Use a single public subnet for all tiers and control access with security groups.

Answer

Use private subnets for all tiers and a NAT gateway for internet access from the web tier. Use security groups to control traffic.

Answer

Use a VPN connection from the on-premises network to access all tiers.

Question 6

A security team needs to block outbound traffic from an EC2 instance to known malicious IP addresses while allowing all other outbound traffic. Which THREE steps should be taken? (Choose three.)

Accepted Answer

Update the VPC route table to send traffic for the malicious IPs to a network firewall appliance.. The correct approach to block outbound traffic to known malicious IPs involves a combination of routing and stateful firewall inspection. Option B is correct because updating the VPC route table to send traffic for the malicious IPs to a network firewall appliance (e.g., AWS Network Firewall) enables centralized inspection and blocking. Option C is correct because deploying AWS Network Firewall provides stateful, application-layer inspection that can handle allow/deny rules for specific IPs. Option D is correct because a firewall rule within AWS Network Firewall can explicitly deny traffic to the malicious IPs. Option A is incorrect because network ACLs are stateless and require individual rules for each IP, making them impractical for dynamic blocklists. Option E is incorrect because security groups support only allow rules, not explicit deny; they cannot block specific IPs outbound.

Answer

Configure network ACLs to deny outbound traffic to the malicious IPs.

Answer

Modify the security group for the EC2 instance to deny outbound traffic to the malicious IPs.

Question 7

A company is setting up a new VPC with both IPv4 and IPv6 support. They need to ensure that instances in a private subnet can access the Internet for software updates. Which combination of resources is required?

Accepted Answer

NAT gateway and egress-only internet gateway. For IPv6 traffic, an egress-only internet gateway allows outbound-only internet access from private subnets, while a NAT gateway provides similar functionality for IPv4 traffic. Together, they enable instances in a private subnet to initiate outbound connections to the internet for software updates without allowing inbound connections from the internet.

Answer

VPC endpoint and internet gateway

Answer

NAT instance and internet gateway

Answer

Internet gateway and NAT gateway

Question 8

A company is deploying a VPC with public and private subnets in two Availability Zones. The public subnets are used for NAT gateways and an Application Load Balancer (ALB). The private subnets host EC2 instances running a web application. What is the most cost-effective and highly available configuration for internet access from the private instances?

Accepted Answer

Deploy a NAT gateway in each public subnet and configure private route tables with a default route to the NAT gateway in the same AZ.. Deploying a NAT gateway in each public subnet (one per Availability Zone) ensures that private instances in each AZ can route outbound traffic through a NAT gateway in the same AZ, providing both high availability (no single point of failure) and cost efficiency (no cross-AZ data transfer charges). This configuration uses the default route (0.0.0.0/0) in the private route tables pointing to the NAT gateway in the same AZ, which avoids the per-GB data transfer costs that would occur if traffic crossed AZs to reach a single NAT gateway.

Answer

Create a single NAT gateway in one public subnet and route all private traffic to it.

Answer

Attach an internet gateway to the VPC and add a default route to it in the private subnets.

Answer

Launch a NAT instance in each public subnet and configure the private route tables.

Question 9

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16 and needs to add IPv6 support for its public-facing web application. The application must be accessible via both IPv4 and IPv6. The VPC already has an Internet Gateway attached. What is the correct set of steps to enable IPv6?

Accepted Answer

Associate an Amazon-provided IPv6 CIDR block to the VPC, add a route for ::/0 to the Internet Gateway, and allocate IPv6 addresses to the subnets.. To enable IPv6 in a VPC, you must associate an Amazon-provided IPv6 CIDR block (a /56 block by default), add a route for the IPv6 default route (::/0) to the Internet Gateway, and allocate IPv6 addresses to the subnets. The Internet Gateway already supports IPv6 traffic natively, so no additional gateway is required for public-facing IPv6 access.

Answer

Assign a custom IPv6 CIDR block from your own range to the VPC and add a route to the Internet Gateway.

Answer

Associate an IPv6 CIDR block, create an Egress-Only Internet Gateway, and route ::/0 to it.

Answer

Associate a /64 IPv6 CIDR block to the VPC, add a route for ::/0 to the Internet Gateway, and assign IPv6 addresses to instances.

Question 10

A company is implementing a multi-region active-active application. They want to route users to the nearest healthy endpoint using DNS. Which AWS service should be used?

Accepted Answer

Amazon Route 53 latency-based routing. Amazon Route 53 latency-based routing directs traffic based on the lowest network latency between the user and the endpoint, making it ideal for routing users to the nearest healthy endpoint in a multi-region active-active setup. It continuously monitors endpoint health via health checks and only routes to healthy endpoints, ensuring high availability and performance.

Answer

Elastic Load Balancer (ELB)

Answer

Amazon CloudFront

Answer

AWS Global Accelerator

Question 11

Which THREE of the following are considerations when designing a Direct Connect implementation for high availability? (Choose three.)

Accepted Answer

Use BGP to advertise the same prefixes over both connections.. Using BGP to advertise the same prefixes over both Direct Connect connections enables active-active or active-passive load balancing and automatic failover. BGP’s route selection and AS_PATH prepending allow you to control traffic flow, ensuring that if one connection fails, the other continues to advertise the same prefixes, maintaining connectivity without manual intervention.

Answer

Use a single connection with high bandwidth.

Answer

Configure static routes to the on-premises network.

Question 12

A financial services company must ensure that all traffic between its on-premises data center and VPC is encrypted in transit and does not traverse the public internet. The company has an AWS Direct Connect connection. Which solution meets these requirements?

Accepted Answer

Use a private virtual interface (VIF) over the Direct Connect connection and establish an IPsec VPN tunnel over the private VIF. A private virtual interface (VIF) provides private, non-internet-routed connectivity between the on-premises data center and the VPC over AWS Direct Connect. However, Direct Connect itself does not natively encrypt traffic; by establishing an IPsec VPN tunnel over the private VIF, you add end-to-end encryption (e.g., using AES-256) while keeping all traffic off the public internet, meeting both requirements.

Answer

Use a private virtual interface (VIF) and rely on Direct Connect encryption

Answer

Use a public virtual interface (VIF) over the Direct Connect connection and configure an IPsec VPN tunnel over it

Answer

Use a transit virtual interface (VIF) over the Direct Connect connection and attach it to a transit gateway

Question 13

A company needs to provide internet access to a VPC that has both public and private subnets. They have already created an Internet Gateway and attached it to the VPC. What else must be configured for instances in the public subnet to be reachable from the internet?

Accepted Answer

Add a route to the public subnet's route table pointing 0.0.0.0/0 to the Internet Gateway.. For instances in a public subnet to be reachable from the internet, the subnet's route table must include a default route (0.0.0.0/0) pointing to the Internet Gateway (IGW). The IGW itself is a horizontally scaled, redundant component that provides a target for internet-bound traffic, but without the route, traffic from the internet cannot reach the instances. This route enables bidirectional communication: the IGW performs NAT for instances with public IPs, translating their private IPs to the associated Elastic IP or public IP.

Answer

Launch a NAT Gateway in the public subnet.

Answer

Attach the VPC to an AWS Transit Gateway.

Answer

Establish a VPN connection to the Internet Gateway.

Question 14

A company uses AWS Transit Gateway to connect multiple VPCs. The network team notices that traffic between two VPCs is taking a suboptimal path through a third VPC. What is the most likely cause?

Accepted Answer

Incorrect route table associations and propagations in the Transit Gateway.. Incorrect route table associations and propagations in the Transit Gateway cause traffic between two VPCs to take a suboptimal path through a third VPC. The Transit Gateway uses route tables to determine the next hop for traffic; if the route table for the source VPC does not have a direct route to the destination VPC but instead has a route pointing to the third VPC (e.g., via a VPN attachment or a transit VPC attachment), traffic will be forwarded through that third VPC. This is a common misconfiguration when route propagation is not properly set up or when static routes are incorrectly prioritized.

Answer

Security groups are blocking the direct path, forcing traffic through a third VPC.

Answer

BGP is not configured between the VPCs, so traffic defaults through a transit VPC.

Answer

ECMP routing is enabled, causing traffic to be load-balanced across multiple paths.

Question 15

Which THREE of the following are valid methods to connect a VPC to an on-premises network?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is a valid method to connect a VPC to an on-premises network because it provides a dedicated, private, high-bandwidth physical connection from your on-premises data center to AWS, bypassing the public internet. This connection uses industry-standard 802.1Q VLANs to create virtual interfaces (VIFs) that directly access VPCs or AWS services, offering consistent network performance and reduced latency compared to internet-based connections.

Answer

VPC Peering

Answer

VPC Endpoint

Question 16

A company is designing a network for a three-tier web application. The web tier must be accessible from the internet, the application tier must only be accessible from the web tier, and the database tier must only be accessible from the application tier. Which VPC design meets these requirements with the highest security?

Accepted Answer

Create public subnets for web tier and private subnets for app and database tiers. Use security groups to allow traffic from web to app and app to database.. It uses separate public subnets for the web tier (with an Internet Gateway for inbound traffic) and private subnets for the application and database tiers, which have no direct route to the internet. Security groups act as stateful virtual firewalls at the instance level, allowing you to precisely control traffic flows: the web tier security group allows inbound HTTP/HTTPS from the internet, the application tier security group allows inbound traffic only from the web tier security group, and the database tier security group allows inbound traffic only from the application tier security group. This layered approach enforces least-privilege access and minimizes the attack surface.

Answer

Create a single public subnet and use security groups to restrict traffic between instances.

Answer

Place all instances in public subnets but assign private IP addresses only.

Answer

Use network ACLs on subnets to restrict traffic instead of security groups.

Question 17

A company wants to deploy a web application on EC2 instances behind an Application Load Balancer (ALB). The application must support sticky sessions (session affinity). What configuration is required on the ALB?

Accepted Answer

Enable stickiness on the target group and specify a cookie duration. Sticky sessions (session affinity) are enabled at the target group level on an Application Load Balancer. By enabling stickiness and specifying a cookie duration, the ALB generates a session cookie (AWSALB) that binds a client's session to a specific target for the duration, ensuring subsequent requests from the same client are routed to the same EC2 instance.

Answer

Use path-based routing

Answer

Configure health checks on the target group

Answer

Enable proxy protocol v2

Question 18

A company has a VPN connection between an on-premises network and AWS using two tunnels for redundancy. The BGP sessions are established, but traffic is only flowing through one tunnel. The engineer wants to ensure both tunnels are actively used. What should be configured?

Accepted Answer

Advertise the same BGP prefixes over both tunnels from the on-premises router.. When both tunnels advertise the same BGP prefixes, the AWS VPN endpoint will see equal-cost paths and load-balance traffic across both tunnels using ECMP (Equal-Cost Multi-Path) routing. This ensures active-active utilization of both tunnels, which is the standard design for AWS VPN redundancy.

Answer

Enable load balancing on the VPN connection in the AWS console.

Answer

Configure static routes for the second tunnel.

Answer

Assign different BGP ASNs to each tunnel.

Question 19

A company is migrating a legacy application that requires static IP addresses for its clients' firewall whitelisting. The application will be hosted on EC2 instances behind a Network Load Balancer (NLB) in a private subnet. Which approach should the company use to provide static IP addresses for outbound traffic?

Accepted Answer

Deploy a NAT Gateway in a public subnet with an Elastic IP. A NAT Gateway in a public subnet with an Elastic IP provides a static source IP address for outbound traffic from private subnets. Since the EC2 instances are in a private subnet behind an NLB, they cannot directly reach the internet; the NAT Gateway translates their private IPs to the Elastic IP, which clients can whitelist. This ensures consistent outbound IPs without exposing the instances to inbound traffic.

Answer

Assign Elastic IPs to the EC2 instances

Answer

Use an internet-facing NLB with Elastic IPs

Answer

Use a VPC endpoint for the application

Question 20

Which TWO of the following are requirements for establishing an AWS Direct Connect private virtual interface? (Choose two.)

Accepted Answer

A BGP session between the customer router and the AWS device.. A BGP session between the customer router and the AWS device is a fundamental requirement for establishing a private virtual interface. The private VIF uses BGP to exchange routing information (typically a /30 or /31 subnet) between the on-premises network and the VPC, enabling dynamic route advertisement and failover. Without this BGP session, the VIF cannot be activated or used for traffic.

Answer

Jumbo frames support (MTU 9001).

Answer

A public IP address for the VIF.

Answer

A public BGP ASN.