ANS-C01 Mock Exam 80 — 25 Questions

Question 1

A company is designing a highly available network architecture using AWS Direct Connect. They have two Direct Connect connections from different providers to two different AWS Direct Connect locations. They want to ensure that if one connection fails, traffic automatically fails over to the other. Which TWO steps should they take? (Select TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Advertise the same prefix over both Direct Connect connections.. Advertising the same prefix over both Direct Connect connections allows BGP to provide automatic failover. When one connection fails, BGP withdraws the route for that prefix, and traffic is redirected to the remaining connection. This leverages BGP's path selection and route propagation to achieve active/backup or active/active redundancy without manual intervention.

Answer

Use a different BGP AS number for each Direct Connect connection.

Answer

Use static routes instead of BGP for the Direct Connect connections.

Answer

Configure a single virtual interface for both connections.

Question 2

A company is deploying a VPC with public and private subnets in two Availability Zones. The public subnets host NAT gateways for outbound internet access from the private subnets. Which configuration ensures that EC2 instances in the private subnets can route traffic to the internet through the NAT gateways?

Accepted Answer

Add a route in the private subnet route table with destination 0.0.0.0/0 targeting the NAT gateway.. For EC2 instances in private subnets to reach the internet via a NAT gateway, the private subnet route table must include a default route (0.0.0.0/0) pointing to the NAT gateway as the next hop. The NAT gateway resides in a public subnet and translates the private IPs to its own Elastic IP, forwarding traffic to the internet gateway. Without this route, traffic from private instances has no path to the NAT gateway.

Answer

Add a route in the public subnet route table pointing to the internet gateway.

Answer

Attach an egress-only internet gateway to the private subnets.

Answer

Create a VPC peering connection between the VPC and the NAT gateway.

Question 3

A company is implementing a hybrid network using AWS Site-to-Site VPN. The on-premises firewall requires that the VPN tunnels use IKEv2 with pre-shared keys and that the tunnels are always active. Which VPN configuration should be used?

Accepted Answer

Two VPN tunnels in active/active mode with BGP. IKEv2 with pre-shared keys and always-active tunnels require both tunnels to be in active/active mode, which is achieved by using BGP to advertise the same routes over both tunnels. BGP enables dynamic routing and ensures both tunnels are used simultaneously, meeting the requirement for continuous active connectivity.

Answer

Two VPN tunnels in active/passive mode

Answer

Two VPN tunnels with static routing

Answer

One VPN tunnel with static routing

Question 4

A company has a Direct Connect connection with a private VIF to a VPC. They have set up a Transit Gateway and attached the VPC and the Direct Connect gateway. The on-premises network can reach some VPC resources but not others. The VPC has multiple subnets with different CIDR blocks. The on-premises router is advertising the same prefixes over BGP. What is the most likely cause of the partial connectivity?

Accepted Answer

The VPC route tables for the subnets that cannot be reached do not have a route to the Transit Gateway for the on-premises prefixes.. The most common cause of partial connectivity in this scenario is that the VPC route tables do not have routes pointing to the Transit Gateway for the on-premises prefixes. Even if the Transit Gateway has routes, the VPC subnets must send traffic to the Transit Gateway. Option A is correct. Option B is incorrect because if the Transit Gateway route table had incorrect propagation, it would affect all prefixes equally. Option C is incorrect because the on-premises router advertising the same prefixes would not cause partial connectivity. Option D is incorrect because the Direct Connect gateway association is fine if some traffic works.

Answer

The Direct Connect gateway association with the Transit Gateway is misconfigured.

Answer

The Transit Gateway route table does not have a static route or propagation for the on-premises prefixes.

Answer

The on-premises router is advertising different prefixes over BGP than expected.

Question 5

A media company is designing a network for a new AWS environment. They have a VPC with public and private subnets in three Availability Zones. In the private subnets, they run a fleet of Amazon EC2 instances that process video files from an Amazon S3 bucket. The S3 bucket is in the same region. The company wants to ensure that all traffic to S3 stays within the AWS network and does not traverse the internet. They also need to allow the EC2 instances to access the internet for software updates, but only through a centralized NAT gateway. Currently, there is one NAT gateway in AZ1. The network engineer has created a VPC endpoint for S3 (Gateway type) and associated it with the route tables for the private subnets. However, the EC2 instances in AZ2 and AZ3 cannot reach the NAT gateway for internet access. What is the most likely cause?

Accepted Answer

The NAT gateway is only available in the AZ where it is deployed. The most likely cause is that the NAT gateway is only available in the AZ where it is deployed because the private subnets in AZ2 and AZ3 likely do not have a default route pointing to the NAT gateway. A NAT gateway is created in a specific AZ, and while it can be accessed from other AZs using cross-AZ routing, the route tables for those subnets must be explicitly configured with a 0.0.0.0/0 route to the NAT gateway. The S3 Gateway Endpoint adds a specific route for S3 traffic, which does not override the default route; therefore, adding the endpoint does not affect internet access. Option A is incorrect because the endpoint route is more specific for S3, not a default route. Options B and D are false because Gateway Endpoints are regional and do not require per-AZ creation, and NAT gateways can be used cross-AZ with proper routing.

Answer

The route table for private subnets now has a more specific route for S3 that overrides the default route to the NAT gateway

Answer

The VPC endpoint needs to be created in each Availability Zone

Answer

The S3 VPC endpoint is only accessible from the AZ where it was created

Question 6

A network engineer created a VPC endpoint for the service shown in the exhibit. The endpoint is in the 'available' state, but instances in the VPC cannot resolve the private DNS name 'example.com'. What is the most likely cause?

Accepted Answer

The endpoint does not have 'Private DNS names enabled'. The private DNS name is only resolved via Route 53 private hosted zone if 'Private DNS names enabled' is set. The exhibit shows the service has a PrivateDnsName, but the endpoint must have 'Private DNS names enabled' for resolution to work.

Answer

The VPC does not have a Route 53 private hosted zone for example.com

Answer

The VPC does not have an internet gateway

Answer

The security group for the endpoint is blocking DNS traffic

Question 7

Which TWO of the following are valid methods to connect a VPC to an on-premises network? (Choose TWO.)

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN creates an encrypted tunnel over the public internet between a VPC and an on-premises network using IPsec. It is a fully managed, quick-to-deploy method that supports both static routes and BGP dynamic routing via the virtual private gateway.

Answer

VPC endpoints

Answer

AWS Transit Gateway

Answer

VPC peering

Question 8

Which TWO scenarios are best suited for using AWS Transit Gateway over VPC peering? (Select TWO.)

Accepted Answer

Connecting hundreds of VPCs across multiple accounts. AWS Transit Gateway is designed to act as a central hub for connecting multiple VPCs and on-premises networks, simplifying management and reducing the number of connections. Option C is correct because Transit Gateway can scale to connect hundreds of VPCs across multiple accounts using a hub-and-spoke model, whereas VPC peering would require a full mesh of point-to-point connections, which becomes unmanageable and hits the hard limit of 125 peering connections per VPC. Option D is correct because Transit Gateway natively integrates with AWS Direct Connect via a Direct Connect Gateway, allowing a single Transit Gateway to route traffic from multiple VPCs to on-premises without needing individual VPN tunnels or complex routing configurations.

Answer

Connecting VPCs in different AWS accounts

Answer

Connecting a single VPC to an on-premises network

Answer

Connecting two VPCs in the same account and region

Question 9

A company has a VPC with a CIDR of 10.0.0.0/16. They have two subnets: 10.0.1.0/24 (public) and 10.0.2.0/24 (private). They launch a NAT Gateway in the public subnet and add a route in the private subnet route table: destination 0.0.0.0/0, target nat-gateway-id. An EC2 instance in the private subnet can ping an external server, but cannot connect to it via SSH. The security group allows outbound SSH (port 22), and the NACL allows outbound ephemeral ports. What is the likely cause?

Accepted Answer

The external server's firewall is blocking traffic from the NAT Gateway's Elastic IP address.. The NAT Gateway translates the private instance's source IP to its own Elastic IP address for outbound traffic. SSH connections require bidirectional communication: the external server must send SYN-ACK packets back to the source IP. If the external server's firewall blocks traffic from the NAT Gateway's Elastic IP, the TCP handshake fails, preventing SSH while ICMP (ping) may still work because ICMP echo requests and replies are stateless and often allowed by default.

Answer

The NACL on the private subnet is blocking outbound ephemeral ports.

Answer

The route table in the private subnet does not have a route to the NAT Gateway.

Answer

The NAT Gateway is not configured to allow SSH traffic.

Question 10

Refer to the exhibit. A VPN connection is established between an on-premises network (10.0.0.0/16) and an AWS VPC (172.16.0.0/16). The on-premises network can ping the VPC's private IP addresses, but the VPC cannot ping the on-premises network's IP addresses. The VPC route table has a route to 10.0.0.0/16 pointing to the VGW. What is the MOST likely cause?

Accepted Answer

The on-premises network does not have a route to the VPC CIDR (172.16.0.0/16) pointing to the customer gateway. The on-premises network can ping the VPC because the VPC route table has a route to 10.0.0.0/16 pointing to the virtual private gateway (VGW), so return traffic from the VPC is correctly forwarded. However, the VPC cannot ping the on-premises network because the on-premises router lacks a route back to the VPC CIDR (172.16.0.0/16) pointing to the customer gateway (CGW). Without this return route, traffic from the VPC reaches the on-premises network, but the on-premises router drops the response packets as it does not know how to reach 172.16.0.0/16.

Answer

The VPN tunnels are not both in UP state

Answer

The VPN acceleration is disabled, causing high latency

Answer

The VPN connection is configured with static routes only and BGP is not used

Question 11

A security team wants to block traffic from a specific IP address (203.0.113.5) from reaching an EC2 instance. The instance is in a public subnet with a security group that allows all traffic from the internet. A network ACL is associated with the subnet. The team adds a DENY rule for the IP in the network ACL. However, traffic from that IP still reaches the instance. What is the most likely reason?

Accepted Answer

The network ACL has an ALLOW rule with a lower rule number that matches the IP, so the DENY rule is never evaluated.. Network ACLs are stateless and evaluated in order by rule number, from lowest to highest. If an ALLOW rule with a lower rule number (e.g., 100) matches the source IP 203.0.113.5 before the DENY rule (e.g., 200) is reached, the ALLOW rule will be applied and the traffic permitted. The DENY rule is never evaluated because the first matching rule determines the action.

Answer

The security group allows traffic from the IP, overriding the network ACL.

Answer

The network ACL is applied to the wrong subnet.

Answer

The internet gateway is ignoring the network ACL.

Question 12

A network engineer has created a VPC endpoint for a VPC endpoint service. The endpoint is 'available' but the application cannot connect to the service using the private DNS name. The engineer checks the Route 53 private hosted zone and finds that no record exists for the endpoint. What is the most likely cause?

Accepted Answer

The 'PrivateDnsEnabled' flag is set to false on the VPC endpoint. When the 'PrivateDnsEnabled' flag is set to false on a VPC endpoint, AWS does not automatically create a Route 53 private hosted zone for the endpoint, so the private DNS name does not resolve. This is the most likely cause given that no DNS record exists. Option D is correct. Options A, B, and C could cause connectivity issues but would not prevent the DNS record from being created.

Answer

The VPC endpoint service is not accepting connections

Answer

The VPC endpoint policy is blocking connectivity

Answer

The security group for the endpoint does not allow inbound traffic

Question 13

A company is deploying a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB), a fleet of EC2 instances in an Auto Scaling group across three Availability Zones, and an Amazon RDS for MySQL database. The ALB has a target group that routes traffic to the EC2 instances on TCP port 8080. The security group for the EC2 instances allows inbound traffic from the ALB's security group on port 8080. Users report intermittent connectivity issues to the application. A network engineer reviews the VPC Flow Logs and notices that traffic from the ALB to the EC2 instances is being recorded as 'REJECT' for some requests. What is the most likely cause of this issue?

Accepted Answer

The network ACL associated with the EC2 instances' subnet does not have an outbound rule to allow traffic from the EC2 instances to the ALB on ephemeral ports.. The network ACL (NACL) is stateless and must have explicit outbound rules to allow return traffic from the EC2 instances back to the ALB on ephemeral ports. Since the ALB initiates connections to the EC2 instances on TCP port 8080, the return traffic from the EC2 instances uses ephemeral ports (typically 1024-65535) destined for the ALB's source port. Without an outbound rule in the subnet's NACL allowing this traffic, the NACL will reject the response packets, causing intermittent REJECT entries in VPC Flow Logs.

Answer

The ALB's security group is blocking inbound traffic from the EC2 instances on the response path.

Answer

The ALB's target group health check is misconfigured, causing the ALB to mark instances as unhealthy and stop sending traffic.

Answer

The security group on the EC2 instances is stateful and automatically allows return traffic; the issue cannot be security group related.

Question 14

A network engineer is setting up a Direct Connect connection from an on-premises data center to AWS. The connection uses a private VIF to connect to a VPC via a Direct Connect gateway. The on-premises network is advertising a BGP prefix 10.0.0.0/16, which overlaps with the VPC CIDR 10.0.0.0/16. What is the expected behavior?

Accepted Answer

The BGP session will be established, but the overlapping prefix will be ignored and not programmed into the VPC route tables.. When a BGP prefix advertised over a Direct Connect private VIF overlaps with the VPC CIDR, the BGP session establishes successfully, but AWS ignores the overlapping prefix and does not install it into the VPC route tables. This is because AWS always prefers the local VPC route over any propagated BGP route for the same prefix, preventing traffic destined for the VPC from being blackholed or misrouted to on-premises.

Answer

The VPC will automatically reassign a new CIDR to avoid the conflict.

Answer

The BGP session will fail to establish due to the prefix conflict.

Answer

The on-premises prefix will take precedence and override the VPC route.

Question 15

A company is designing a Direct Connect solution with two connections to provide high availability. The company has two customer routers, each connected to a separate AWS Direct Connect location. The company uses BGP to advertise the same prefixes from both routers. What is the correct way to configure the BGP attributes to ensure that traffic uses both connections actively?

Accepted Answer

Advertise the same AS path length from both routers.. Advertising the same AS path length from both routers ensures that AWS Direct Connect routers see both paths as equally preferred under the BGP path selection process (which considers AS path length before MED, local preference, and IGP metric). With equal AS path length, traffic will be load-balanced across both Direct Connect connections, actively using both links for inbound traffic from AWS to the customer network.

Answer

Use AS path prepending on both routers to make the paths equally long.

Answer

Set a higher local preference on the primary router and lower on the secondary.

Answer

Advertise a shorter AS path on the primary router and a longer AS path on the secondary router.

Question 16

A company is implementing a hybrid network using AWS Direct Connect. They have a virtual private gateway (VGW) attached to their VPC and a Direct Connect gateway (DXGW) with a private virtual interface (VIF) to their on-premises router. They have established a BGP session between the on-premises router and the VGW. The on-premises network can reach EC2 instances in the VPC, but the VPC instances cannot reach on-premises resources. What is the most likely cause?

Accepted Answer

The VPC route tables lack a route for the on-premises CIDR pointing to the virtual private gateway. For instances in a VPC to reach on-premises resources over Direct Connect, the VPC route tables must have a route for the on-premises CIDR that points to the virtual private gateway (VGW). Without this route, traffic from the VPC to the on-premises network will not be forwarded to the VGW, even though the BGP session is established and the on-premises side can reach the VPC. Option A is incorrect because the VGW is attached to the VPC (otherwise on-premises could not reach EC2 instances). Option B is incorrect because a VPC endpoint for S3 does not cause routing conflicts for on-premises traffic. Option D is incorrect because the BGP session is established and the on-premises CIDR is being advertised (otherwise on-premises could not reach the VPC).

Answer

The virtual private gateway is not attached to the VPC

Answer

The VPC has a VPC endpoint for S3 that is causing a routing conflict

Answer

The BGP session is not advertising the on-premises CIDR to the VGW

Question 17

A company is designing a hybrid network with AWS Direct Connect and a VPN backup. They have two on-premises sites connected via MPLS. They want to ensure that if the Direct Connect fails, traffic automatically fails over to the VPN without manual intervention. Which routing configuration should they use?

Accepted Answer

Use BGP and set a higher local preference for routes learned via Direct Connect, and enable BGP graceful shutdown on the Direct Connect router. Using BGP with a higher local preference for routes learned via Direct Connect ensures that the Direct Connect path is preferred over the VPN backup. If the Direct Connect fails, the BGP session goes down, the routes are withdrawn, and traffic automatically fails over to the VPN without manual intervention. BGP graceful shutdown is not required for failover but can be used to gracefully drain traffic before maintenance.

Answer

Configure static routes with equal cost pointing to Direct Connect and VPN

Answer

Use BGP and advertise the same prefixes with a lower MED on the VPN connection

Answer

Create a VPC peering connection between the VPC and on-premises network

Question 18

Which THREE of the following are considerations when designing a multi-account VPC architecture using AWS Transit Gateway? (Choose 3.)

Accepted Answer

Transit Gateway can be integrated with Direct Connect Gateway. AWS Transit Gateway acts as a central hub for interconnecting VPCs and on-premises networks. It can be integrated with Direct Connect Gateway, allowing a single Direct Connect connection to reach multiple VPCs attached to the Transit Gateway, simplifying hybrid network design and reducing operational overhead.

Answer

Each VPC must have a unique route table

Answer

VPCs with overlapping CIDR blocks can be attached

Question 19

A company has multiple VPCs connected via a Transit Gateway. Each VPC has its own CIDR block. The company wants to isolate network traffic between specific VPCs. What is the most scalable way to achieve this?

Accepted Answer

Create separate Transit Gateway route tables and associate VPC attachments to the appropriate route tables.. Transit Gateway route tables allow you to isolate traffic between VPCs by controlling which VPC attachments can communicate with each other. By associating each VPC attachment with a specific route table and configuring route propagation appropriately, you can enforce isolation without additional appliances or complex routing. This approach scales seamlessly as you add more VPCs, because you simply create new route tables and associate attachments as needed.

Answer

Deploy AWS Network Firewall in each VPC.

Answer

Use Security Groups in each VPC to filter traffic.

Answer

Use VPC Peering connections and modify route tables.

Question 20

A company has a Direct Connect connection with a private VIF to a VPC. They also have a site-to-site VPN as a backup. The on-premises network advertises the same prefix via BGP over both connections. The company wants to prefer the Direct Connect path. What configuration achieves this?

Accepted Answer

Configure the Direct Connect BGP session with a higher local preference (e.g., 200) than the VPN BGP session.. Local preference is a BGP attribute used to influence outbound traffic from the local AS. By setting a higher local preference (e.g., 200) on the Direct Connect BGP session, the router will prefer that path over the VPN session (default local preference 100) for the same prefix. This ensures traffic from the VPC to on-premises uses Direct Connect as the primary path.

Answer

Set the Multi-Exit Discriminator (MED) on the VPN advertisement to a lower value.

Answer

Prepend the AS path on the Direct Connect advertisement to make it longer.

Answer

Configure the VPN BGP session with a higher local preference than the Direct Connect session.