ANS-C01 Mock Exam 80 — 25 Questions

Question 1

A network engineer analyzes a VPC Flow Log entry showing an ACCEPT for a TCP connection from 203.0.113.50 (internet) to 10.0.1.5 on port 443. The security group for the instance allows inbound HTTPS only from 10.0.0.0/16, and the NACL for the subnet has the rules shown. Why was the traffic accepted?

Accepted Answer

The flow log entry represents outbound traffic from the instance (source 10.0.1.5:443 to destination 203.0.113.50:38000). The security group's default outbound rule allows all traffic, and the NACL outbound (not shown) also allows it, resulting in ACCEPT.. The VPC Flow Log entry shows an ACCEPT for traffic from 203.0.113.50:38000 to 10.0.1.5:443. Because flow logs record connection state, this entry actually represents the return traffic of an outbound connection initiated by the instance (10.0.1.5) to the internet host on port 443. The security group's default outbound rule allows all traffic, and the NACL outbound rules (not shown) also permit it, so the return ACCEPT is valid.

Answer

The NACL inbound rule #120 allows HTTPS from 10.0.0.0/16, but the source is 203.0.113.50, so it should be denied.

Answer

The NACL inbound rule #100 allows HTTP from anywhere, and the traffic is HTTP.

Answer

The security group allows inbound HTTPS from 10.0.0.0/16, but the flow log source is 203.0.113.50, so it should be denied. The ACCEPT must be an error.

Question 2

A company is deploying a VPC with public and private subnets in two Availability Zones. They need to ensure that instances in private subnets can access the internet for software updates while remaining unreachable from the internet. Which solution meets these requirements?

Accepted Answer

Deploy a NAT Gateway in a public subnet and add a route to the NAT Gateway in the private subnet route tables.. Option B is correct because a NAT Gateway deployed in a public subnet provides outbound-only internet access for instances in private subnets. The private subnet route table directs 0.0.0.0/0 traffic to the NAT Gateway, which translates the private IPs to the NAT Gateway's Elastic IP, allowing internet access while preventing any unsolicited inbound connections from the internet.

Answer

Attach an internet gateway to the private subnets and configure route tables.

Answer

Use a transit gateway to connect the VPC to the internet.

Answer

Establish a VPN connection to an on-premises network and route traffic through it.

Question 3

A company has a VPC with a CIDR of 10.0.0.0/16 and has enabled VPC Flow Logs to capture all traffic. The logs show that an EC2 instance (10.0.1.10) is sending outbound traffic to an external IP (203.0.113.50) on port 443, but the traffic is being rejected. The instance's security group allows outbound HTTPS to 0.0.0.0/0, and the subnet's NACL allows outbound traffic on port 443. The VPC has an internet gateway attached, and the route table directs 0.0.0.0/0 to the internet gateway. What is the most likely cause of the rejection?

Accepted Answer

The NACL inbound rules are blocking the return traffic.. The outbound traffic from the EC2 instance is allowed by the security group and NACL outbound rules, but the return traffic (responses from 203.0.113.50:443 back to 10.0.1.10) must also be permitted by the subnet's NACL inbound rules. Since the NACL is stateless, it requires explicit inbound rules for ephemeral ports (typically 1024-65535) to allow the return traffic. If those inbound rules are missing, the return packets are dropped, causing the outbound traffic to appear as rejected in VPC Flow Logs.

Answer

The security group does not allow inbound HTTPS traffic.

Answer

The internet gateway is not attached to the VPC.

Answer

The route table does not have a route to the internet gateway.

Question 4

A network engineer is analyzing VPC Flow Logs for a VPC with CIDR 10.0.0.0/16. The exhibit shows a sample log entry. The engineer notices that traffic from 10.0.1.10 to 10.0.2.10 on port 443 is being accepted. However, the application team reports that the connection is failing. What is the most likely reason for the disconnect?

Accepted Answer

The application layer is failing to establish a proper connection.. The VPC Flow Logs show that traffic from 10.0.1.10 to 10.0.2.10 on port 443 is being accepted (ACCEPT record), which indicates that the network layer (security groups, network ACLs, and routing) is permitting the traffic. Since the application team reports the connection is failing, the issue must be at a higher layer, specifically the application layer (e.g., TLS handshake failure, certificate mismatch, or the application not listening on port 443). Flow logs capture only network-layer metadata (IP, port, protocol, action) and cannot detect application-layer errors.

Answer

The security groups are blocking the traffic.

Answer

The route tables are incorrectly configured, causing packet loss.

Answer

The flow logs are misconfigured and not capturing all traffic.

Question 5

Refer to the exhibit. A network engineer is analyzing VPC Flow Logs to troubleshoot connectivity issues. The engineer notices that traffic from 10.0.1.5 to 192.168.1.1 on port 80 is logged as ACCEPT, but the application team reports that the web request failed. What is the most likely cause?

Accepted Answer

The destination host 192.168.1.1 is not reachable or does not have a route back to the source.. The VPC Flow Logs record the state of the TCP handshake from the perspective of the network path, but they do not confirm that the destination host successfully processed the request or that a return path exists. If 192.168.1.1 has no route back to 10.0.1.5, the initial SYN-ACK will never reach the source, causing the application to time out even though the forward traffic was accepted by the network ACL and security group.

Answer

The VPC Flow Logs are not capturing all packets due to sampling.

Answer

The network ACL is returning an ICMP unreachable message that is not logged.

Answer

The security group on the ENI is blocking outbound traffic to 192.168.1.1.

Question 6

A company has a VPC with public and private subnets. The public subnet has a NAT Gateway. The private subnet instances need to access an S3 bucket in the same region. Which THREE steps should the network engineer take to ensure the most cost-effective and secure access without traversing the internet?

Accepted Answer

Create a VPC Gateway Endpoint for S3.. Option A is correct because a VPC Gateway Endpoint for S3 provides private, cost-effective access to S3 without traversing the internet or requiring a NAT Gateway. It uses AWS's internal network and route table entries to direct S3 traffic through the endpoint, avoiding data transfer costs and improving security.

Answer

Create a VPC Interface Endpoint for S3.

Answer

Create a NAT Gateway in the public subnet.

Question 7

A company has a Direct Connect connection with multiple virtual interfaces (VIFs). The network team notices that traffic to a specific VPC is intermittently failing. The team suspects an issue with BGP routing. Which THREE steps should the team take to troubleshoot the BGP session? (Choose THREE.)

Accepted Answer

View the BGP route advertisements received by the on-premises router from AWS.. Option A is correct because viewing the BGP route advertisements received by the on-premises router from AWS directly reveals whether the expected prefixes are being advertised. If the routes are missing or incorrect, the VPC traffic will fail intermittently, making this a primary troubleshooting step for BGP routing issues.

Answer

Check the Direct Connect endpoint health in the AWS Management Console.

Answer

Examine VPC Flow Logs for dropped packets on the virtual interface.

Question 8

A company has a security group that allows inbound SSH (port 22) from 0.0.0.0/0. A security engineer discovers that an EC2 instance was compromised via SSH. The engineer needs to identify which IAM user created the overly permissive security group rule. Which AWS service or feature should the engineer use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API calls made within the AWS environment, including the AuthorizeSecurityGroupIngress API call that created the overly permissive security group rule. By searching CloudTrail logs for this specific API event, the engineer can identify the IAM user, source IP, and timestamp of the rule creation. VPC Flow Logs, AWS Config, and GuardDuty do not capture IAM user identity for API-level changes.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon GuardDuty

Question 9

A company is designing a network security architecture for a multi-account environment using AWS Transit Gateway. The company requires that all traffic between VPCs must be inspected by a centralized security appliance in a shared services VPC. The security appliance must receive traffic for both directions (ingress and egress). Which THREE components are required to achieve this? (Choose THREE.)

Accepted Answer

A shared services VPC containing the security appliances.. Option A is correct because the shared services VPC hosts the centralized security appliances (e.g., firewalls, intrusion detection systems) that must inspect all inter-VPC traffic. This VPC acts as a hub for traffic inspection, ensuring that both ingress and egress traffic flows through the appliances before reaching its destination.

Answer

VPC peering connections between each spoke VPC and the shared services VPC.

Answer

NAT gateways in each spoke VPC for outbound traffic.

Question 10

A company has a VPC with public and private subnets. The security team wants to implement a web application firewall to protect against common web exploits. Which TWO AWS services can be used together to achieve this?

Accepted Answer

Application Load Balancer (ALB). Option A is correct because an Application Load Balancer (ALB) operates at Layer 7 and can be associated with AWS WAF to inspect HTTP/HTTPS traffic for common web exploits. AWS WAF provides a managed rule set that blocks SQL injection, cross-site scripting (XSS), and other OWASP Top 10 threats. Together, they form a web application firewall (WAF) solution that protects resources in the VPC's private subnets.

Answer

Network Load Balancer (NLB)

Answer

NAT Gateway

Answer

Amazon CloudFront

Question 11

A company has a VPC with public and private subnets. An application running in a private subnet needs to access an S3 bucket to read and write data. The security team wants to ensure that traffic to S3 does not traverse the internet. Which solution should the team implement?

Accepted Answer

Create a gateway VPC endpoint for S3 and add a route to the endpoint in the private subnet route table.. A gateway VPC endpoint for S3 allows instances in a private subnet to access S3 privately using AWS's internal network, without traversing the internet. By adding a route to the endpoint's prefix list in the private subnet route table, traffic destined for S3 is directed through the endpoint, which uses AWS PrivateLink to provide highly available, redundant connectivity.

Answer

Establish a VPN connection to AWS and route S3 traffic through the VPN.

Answer

Configure a NAT gateway in the public subnet and update the private subnet route table with a default route pointing to the NAT gateway.

Answer

Attach an internet gateway to the VPC and add a route to the S3 prefix list in the private subnet route table.

Question 12

An IAM policy is attached to a user. What is the effect when the user attempts to launch an EC2 instance of type m5.large?

Accepted Answer

The action is denied because the instance type does not equal t2.micro.. Option D is correct because the IAM policy explicitly allows the `ec2:RunInstances` action only when the condition `ec2:InstanceType` equals `t2.micro`. Since the user is attempting to launch an `m5.large` instance, the condition is not satisfied, and the default implicit deny applies, resulting in the action being denied.

Answer

The action is allowed because the policy allows t2.micro instances.

Answer

The action is allowed because there is no explicit allow for RunInstances.

Answer

The action is denied because the condition is not met.

Question 13

A company attaches the above bucket policy to an S3 bucket. A user from the IP range 203.0.113.0/24 makes a request over HTTPS (TLS) to download an object from the bucket. Will the request succeed?

Accepted Answer

Yes, because the request uses HTTPS and comes from the allowed IP range.. Option D is correct because the bucket policy includes an Allow statement that grants s3:GetObject access to requests coming from the IP range 203.0.113.0/24 over HTTPS (using the aws:SecureTransport condition). The Deny statement only denies requests that do not use HTTPS (i.e., aws:SecureTransport equals false), so a request from the allowed IP range using TLS is not affected by the Deny and is permitted by the Allow statement.

Answer

Yes, but only if the request also includes a valid AWS signature.

Answer

No, because the Allow statement is overridden by the Deny statement.

Answer

No, because the Deny statement denies all requests regardless of the condition.

Question 14

A network engineer is troubleshooting a connectivity issue between two VPCs (VPC-A and VPC-B) that are connected via a VPC peering connection. The engineer has verified that the route tables in both VPCs have the appropriate routes. However, instances in VPC-A cannot ping instances in VPC-B. Which TWO actions should the engineer take to resolve this issue? (Choose two.)

Accepted Answer

Verify that the network ACLs in VPC-B allow inbound ICMP traffic from VPC-A.. Option C is correct because network ACLs are stateless firewalls that control inbound and outbound traffic at the subnet level. Even if the route tables are correctly configured, a network ACL in VPC-B that denies inbound ICMP traffic from VPC-A's CIDR will block ping requests. Option D is correct because security groups are stateful and must explicitly allow inbound ICMP traffic from VPC-A's CIDR; without this rule, the instances in VPC-B will drop the ping requests.

Answer

Add a route in VPC-A's route table pointing to the VPC peering connection for the CIDR of VPC-B.

Answer

Enable DNS resolution for the VPC peering connection.

Answer

Configure a transit gateway to route traffic between the two VPCs.

Question 15

A company has deployed a centralized NAT gateway in a VPC and uses VPC Flow Logs to monitor traffic. The network team notices that traffic from an EC2 instance in a private subnet to the internet is not being logged in the flow logs. The flow logs are configured at the VPC level with the 'ALL' format. What is the most likely cause of this issue?

Accepted Answer

Flow logs must be created specifically for the NAT gateway's elastic network interface to capture its traffic.. VPC Flow Logs capture traffic at the elastic network interface (ENI) level. A centralized NAT gateway has its own ENI in the public subnet, and traffic from private instances is routed through that ENI when it reaches the internet. To log that traffic, flow logs must be created specifically for the NAT gateway's ENI, not just at the VPC level, because VPC-level flow logs capture traffic for ENIs within that VPC but do not inherently capture traffic passing through the NAT gateway's ENI unless that ENI is explicitly targeted.

Answer

The EC2 instance is using a different VPC than the one where flow logs are configured.

Answer

The flow log format is set to 'ALL' which excludes NAT gateway traffic.

Answer

The flow logs are configured to capture only rejected traffic by default.

Question 16

A company is migrating its on-premises data center to AWS. The network team needs to establish connectivity between the on-premises network and multiple VPCs in a single AWS Region. The company has a Direct Connect connection and wants to minimize latency and cost while maximizing bandwidth utilization. Which solution meets these requirements?

Accepted Answer

Use a Direct Connect gateway and associate it with the VPCs.. A Direct Connect gateway allows a single Direct Connect connection to connect to multiple VPCs in the same or different AWS Regions, minimizing latency by using a private, dedicated network path and reducing cost by eliminating the need for separate virtual interfaces or VPN tunnels per VPC. It also maximizes bandwidth utilization by aggregating traffic from multiple VPCs over the same Direct Connect link.

Answer

Provision a separate Direct Connect virtual interface for each VPC.

Answer

Create a VPN connection over the Direct Connect link to each VPC.

Answer

Use VPC peering between the on-premises network and each VPC.

Question 17

A company is deploying a new application in a VPC. The application consists of EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The ALB must only receive traffic from the company's on-premises network via an AWS Site-to-Site VPN. Which THREE steps should the network engineer take to meet this requirement?

Accepted Answer

Place the ALB in a public subnet.. Option B is correct because an Application Load Balancer (ALB) must be placed in a public subnet to be reachable from an on-premises network via an AWS Site-to-Site VPN. The VPN connection terminates on a virtual private gateway or transit gateway, which routes traffic to the VPC, but the ALB itself needs a public subnet with a route to the internet gateway (or virtual private gateway) to accept inbound traffic from the VPN. Without a public subnet, the ALB cannot receive traffic from outside the VPC, including VPN traffic.

Answer

Place the ALB in a private subnet and use a Transit Gateway.

Answer

Create a NAT gateway in the public subnet for outbound traffic.

Question 18

A company has a VPC with a CIDR of 10.0.0.0/16. They need to connect to two on-premises data centers, each with overlapping CIDR blocks (192.168.0.0/16). The company wants to use AWS Site-to-Site VPN with dynamic routing (BGP). Which design allows the VPC to reach both data centers without route conflicts?

Accepted Answer

Create two separate virtual private gateways, each in a different VPC, and use VPC peering. Alternatively, use a transit gateway with separate VPN attachments and BGP communities to tag routes.. Option C is correct because overlapping CIDR blocks cannot be advertised to the same virtual private gateway (VPG) without causing route conflicts. By using a transit gateway with separate VPN attachments, each data center's routes are isolated in separate route tables, and BGP communities can be used to tag and differentiate routes. This design allows the VPC to reach both data centers by leveraging the transit gateway's ability to manage overlapping prefixes through separate route tables and path selection.

Answer

Create two VPN connections to a single virtual private gateway and advertise the same CIDR from both data centers. Use BGP AS_PATH prepending to influence routing.

Answer

Create a single VPN connection with two tunnels to the same virtual private gateway. Use different BGP ASNs for each data center.

Answer

Create two VPN connections to the same virtual private gateway. Use static routes with different metric values.

Question 19

A network engineer has configured an AWS Site-to-Site VPN connection between a VPC and an on-premises network. The engineer checks the VPN status and sees the output above. What is the MOST likely cause of Tunnel2 being down?

Accepted Answer

The IPsec encryption or integrity algorithms do not match between the AWS VPN endpoint and the on-premises device.. Tunnel2 is down while Tunnel1 is up, indicating a per-tunnel configuration mismatch. The most common cause is a mismatch in IPsec security parameters (encryption, integrity, or DH group) between the AWS VPN endpoint and the on-premises device for that specific tunnel. AWS uses separate pre-shared keys and IPsec settings per tunnel, so a mismatch in algorithms would affect only the misconfigured tunnel.

Answer

The BGP ASN on the on-premises device is misconfigured.

Answer

The route tables in the VPC do not have a route to the on-premises network.

Answer

The IKE pre-shared key used for Tunnel2 is incorrect.

Question 20

A network engineer is designing a hybrid network architecture that connects an on-premises data center to AWS using AWS Direct Connect. The company requires high availability and wants to minimize operational overhead. The on-premises network uses BGP to advertise routes to AWS. Which design meets these requirements?

Accepted Answer

Provision two Direct Connect connections to two different Direct Connect locations, each with a private VIF to the same VPC. Use BGP over the VIFs.. Option A is correct because provisioning two Direct Connect connections to two different Direct Connect locations ensures physical and path diversity, eliminating single points of failure. Using BGP over the private VIFs allows dynamic route advertisement and automatic failover, meeting high availability requirements while minimizing operational overhead through managed BGP sessions.

Answer

Provision one Direct Connect connection with a private VIF and a site-to-site VPN connection as a backup.

Answer

Provision one Direct Connect connection with two virtual interfaces (VIFs) to the same AWS device.

Answer

Provision two Direct Connect connections to the same Direct Connect location, both with private VIFs to the same VPC.

ANS-C01 Mock Exam 80 — 25 Questions

Exhibit

ANS-C01 Mock Exam 80 — 25 Questions

Exhibit