ANS-C01 Mock Exam 82 — 25 Questions

Question 1

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to add a new CIDR block 10.1.0.0/16 to accommodate more subnets. The VPC already has multiple subnets and route tables. What is the impact of adding this secondary CIDR?

Accepted Answer

Existing subnets and route tables remain unchanged; new subnets can be created in the new CIDR.. Adding a secondary CIDR block to an existing VPC is a non-disruptive operation. The existing subnets and route tables remain completely unchanged because the secondary CIDR is an additional IP address space, not a modification of the existing one. New subnets can be created within the new CIDR block, and you must explicitly associate them with route tables as needed.

Answer

The secondary CIDR will be automatically advertised to all route tables.

Answer

The VPC will experience a brief outage while the new CIDR is being associated.

Answer

Existing subnets will automatically be extended to include IPs from the new CIDR.

Question 2

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance is behind a NAT Gateway in the public subnet. The download is failing. Which configuration should the network engineer check FIRST?

Accepted Answer

The route table associated with the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway.. Option D is correct because for an EC2 instance in a private subnet to reach the internet via a NAT Gateway, the private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway. Without this route, traffic from the instance destined for the internet has no path to the NAT Gateway, causing the download to fail.

Answer

The network ACL for the private subnet allows inbound HTTP/HTTPS traffic.

Answer

The EC2 instance has a public IP address assigned.

Answer

The Internet Gateway is attached to the private subnet.

Question 3

A company is deploying a multi-tier application in a VPC. The web servers must be accessible from the internet, while the application servers must only be accessible from the web servers. Which architecture meets these requirements?

Accepted Answer

Web servers in public subnets with an Internet Gateway; application servers in private subnets with a route to the NAT Gateway.. Option D is correct because it places web servers in public subnets with an Internet Gateway (IGW) for direct internet access, while application servers reside in private subnets that lack a direct route to the IGW. The private subnets have a route to a NAT Gateway, allowing the application servers to initiate outbound internet connections (e.g., for updates) without being reachable from the internet. Security Groups on the application servers can further restrict inbound traffic to only the web servers' security group, ensuring the application tier is isolated.

Answer

All servers in private subnets; use a load balancer in a public subnet.

Answer

Web servers in private subnets; application servers in public subnets with an Internet Gateway.

Answer

All servers in public subnets; use Security Groups to restrict access.

Question 4

A company has a VPC with public and private subnets in three Availability Zones. The company hosts a web application on Amazon EC2 instances in the private subnets. The instances need to download security patches from the internet but must not be directly accessible from the internet. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Deploy a NAT gateway in each public subnet and configure the private subnet route tables to point to the respective NAT gateway.. Option D is correct because a NAT gateway is a fully managed AWS service that provides outbound internet connectivity for instances in private subnets while preventing inbound internet access. Deploying a NAT gateway in each public subnet across three Availability Zones ensures high availability and fault tolerance, and configuring private subnet route tables with a default route (0.0.0.0/0) pointing to the respective NAT gateway meets the requirement with minimal operational overhead, as AWS handles patching and scaling.

Answer

Deploy a NAT instance in a public subnet and configure the private subnet route tables to point to the NAT instance.

Answer

Attach an internet gateway to the VPC and add a default route to the internet gateway in the private subnet route tables.

Answer

Create a VPC endpoint for Amazon S3 and configure the instances to use the endpoint.

Question 5

A solutions architect needs to design a VPC with both IPv4 and IPv6 support. The VPC will have public and private subnets. Resources in private subnets need outbound IPv6 access to the internet. Which combination of resources should be used?

Accepted Answer

Internet gateway for public subnets and egress-only internet gateway for private subnets. Option D is correct because an egress-only internet gateway (EIGW) is the AWS-managed service designed specifically to provide outbound-only IPv6 access from private subnets to the internet, while an internet gateway (IGW) handles both inbound and outbound IPv4/IPv6 traffic for public subnets. Unlike a NAT gateway, which only supports IPv4, the EIGW works with IPv6 and prevents any inbound IPv6 connections from the internet, meeting the requirement for outbound-only IPv6 access.

Answer

Internet gateway for public subnets and VPC gateway endpoints for private subnets

Answer

Internet gateway for public subnets and NAT gateway for private subnets

Answer

Internet gateway for both public and private subnets using route tables

Question 6

An application running on EC2 instances in a private subnet needs to download patches from the internet. The VPC has an internet gateway and public subnets. Which resource should be used to provide outbound internet access to the instances?

Accepted Answer

NAT gateway in a public subnet. A NAT gateway in a public subnet provides outbound-only internet access to instances in private subnets by translating their private IP addresses to the NAT gateway's Elastic IP address. This allows the EC2 instances to download patches from the internet while preventing any unsolicited inbound connections from the internet, which is the standard design for secure outbound internet access in a VPC.

Answer

VPC gateway endpoint for S3

Answer

AWS Site-to-Site VPN connection

Answer

Internet gateway in the private subnet

Question 7

A company needs to connect its on-premises data center to AWS with a dedicated, private network connection that provides consistent performance. Which AWS service should they use?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet. This ensures consistent, low-latency performance and can reduce bandwidth costs for high-volume data transfer, making it the ideal choice for the stated requirement.

Answer

Internet Gateway

Answer

VPC Endpoint

Answer

Site-to-Site VPN

Question 8

Which TWO of the following are valid options for implementing network segmentation in a VPC?

Accepted Answer

Security Groups. Security Groups (A) are stateful virtual firewalls that operate at the instance level (ENI), allowing you to control inbound and outbound traffic based on rules. They are a valid mechanism for network segmentation because you can assign different Security Groups to different instances or groups of instances to isolate traffic between tiers (e.g., web, app, database). Subnets (B) provide network segmentation at the VPC subnet level by dividing the VPC's IP address range into smaller segments, each associated with a specific Availability Zone and route table, enabling logical separation of resources.

Answer

Route Tables

Answer

NAT Gateway

Answer

Internet Gateway

Question 9

Refer to the exhibit. A flow log record shows ACCEPT for traffic from 10.0.1.5 to 10.0.2.10 on port 443. Which AWS service is most likely the destination?

Accepted Answer

Application Load Balancer. An Application Load Balancer (ALB) terminates HTTPS (port 443) connections and forwards traffic to targets. Flow logs showing ACCEPT for traffic to port 443 on an ALB's internal IP (10.0.2.10) are expected because the ALB listens on that port for incoming client connections. The ALB operates at Layer 7 and is the only listed service that natively accepts HTTPS traffic on port 443 within a VPC.

Answer

Amazon RDS instance

Answer

NAT Gateway

Answer

Amazon S3

Question 10

A company has deployed a web application across multiple AWS Regions using Application Load Balancers (ALBs) and EC2 instances. They want to use AWS Global Accelerator to improve performance and provide a fixed entry point. The Global Accelerator is configured with endpoints pointing to the ALBs. However, users are experiencing intermittent failures. What is the most likely cause?

Accepted Answer

Client IP address preservation is enabled on the Global Accelerator for cross-Region endpoints.. When client IP address preservation is enabled on Global Accelerator for cross-Region endpoints, the accelerator preserves the original client IP address in the packets sent to the Application Load Balancers. However, ALBs are layer-7 load balancers that require traffic to originate from the Global Accelerator's static IP addresses, not the client's IP, for proper routing and health check responses. This mismatch causes the ALBs to reject or mishandle traffic, leading to intermittent failures.

Answer

Global Accelerator does not support multiple endpoints in different Regions.

Answer

The ALBs are not configured with health checks.

Answer

The Global Accelerator is not configured for IPv6 traffic.

Question 11

A company is using AWS Transit Gateway to interconnect multiple VPCs and on-premises networks. The network team notices that traffic between two VPCs is taking an unexpected path. Which AWS service should be used to analyze the packet-level traffic flow and identify the path?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet/byte counts) at the network interface level, enabling analysis of packet-level traffic flow paths through AWS Transit Gateway. By enabling flow logs on the Transit Gateway attachment or VPC subnets, you can trace the actual path traffic takes between VPCs, including whether it traverses the Transit Gateway or an unexpected route.

Answer

AWS CloudTrail

Answer

AWS X-Ray

Answer

AWS Config

Question 12

Which THREE are best practices for designing a highly available AWS Direct Connect connection? (Choose 3.)

Accepted Answer

Use multiple Direct Connect connections to different AWS Direct Connect locations. Option B is correct because using multiple Direct Connect connections to different AWS Direct Connect locations provides geographic redundancy. If one location experiences an outage, traffic can fail over to the other location, ensuring high availability. This aligns with AWS best practices for resilient hybrid networking.

Answer

Use a single Direct Connect connection with redundant virtual interfaces

Answer

Use a single large Direct Connect connection instead of multiple smaller ones

Question 13

Which TWO actions can be taken to reduce the attack surface of a VPC's public subnets? (Choose 2.)

Accepted Answer

Place web servers in private subnets and use a load balancer in a public subnet. Option B is correct because placing web servers in private subnets and using a load balancer in a public subnet reduces the attack surface by ensuring that the web servers have no direct internet-facing IP addresses. The load balancer acts as a single point of ingress, allowing security groups to tightly control traffic from the load balancer to the web servers, while the public subnet only exposes the load balancer's endpoints. This architecture follows AWS best practices for a multi-tier application, minimizing the number of resources directly accessible from the internet.

Answer

Allow all inbound traffic from the internet to the public subnets

Answer

Use a single subnet for all application tiers

Answer

Disable ICMP traffic on the network ACL

Question 14

Which TWO actions should be taken to secure an EC2 instance that is used as a bastion host? (Choose 2)

Accepted Answer

Use a security group that only allows necessary inbound ports. Option A is correct because a bastion host should only expose necessary inbound ports (typically TCP 22 for SSH) to minimize the attack surface. By using a security group that restricts inbound traffic to only required ports, you enforce the principle of least privilege at the network layer, preventing unauthorized access to other services that might be running on the instance.

Answer

Use HTTPS instead of SSH for administration

Answer

Place the bastion host in a private subnet

Answer

Allow all inbound traffic on port 22 in the network ACL

Question 15

A company is deploying a web application on EC2 instances behind an ALB. The application must be accessible only over HTTPS. Which security group rule should be added to the ALB security group?

Accepted Answer

Inbound: TCP port 443 from 0.0.0.0/0. The ALB must terminate HTTPS traffic, which requires an inbound rule allowing TCP port 443 (HTTPS) from 0.0.0.0/0. This ensures clients can establish encrypted TLS connections to the load balancer, as the application is only accessible over HTTPS.

Answer

Inbound: TCP port 22 from 0.0.0.0/0

Answer

Inbound: TCP port 3306 from 0.0.0.0/0

Answer

Inbound: TCP port 80 from 0.0.0.0/0

Question 16

A company is designing a global network with multiple VPCs connected via AWS Transit Gateway. The company wants to route traffic between VPCs through a centralized inspection VPC that hosts firewalls. Which configurations are required? (Choose THREE.)

Accepted Answer

Configure a default route (0.0.0.0/0) in the Transit Gateway route table pointing to the inspection VPC attachment.. Option A is correct because configuring a default route (0.0.0.0/0) in the Transit Gateway route table pointing to the inspection VPC attachment forces all inter-VPC traffic that does not match a more specific route to be sent to the inspection VPC for firewall inspection. This is a common pattern for centralized inspection, where the inspection VPC acts as a next hop for all traffic between VPCs.

Answer

Create VPC endpoints for the inspection services.

Answer

Establish VPC peering connections between each VPC and the inspection VPC.

Question 17

A company is designing a multi-region architecture with an Application Load Balancer (ALB) in each region. They want to route users to the nearest healthy ALB using latency-based routing. Which AWS service should be used?

Accepted Answer

Amazon Route 53 latency-based routing. Amazon Route 53 latency-based routing directs user traffic to the AWS region with the lowest network latency for the end user, based on latency measurements between the user and each region's resources. This matches the requirement to route users to the nearest healthy ALB, as Route 53 can evaluate health checks on the ALBs and only route to healthy endpoints.

Answer

Amazon CloudWatch

Answer

VPC Traffic Mirroring

Answer

AWS Global Accelerator

Question 18

A network engineer is troubleshooting a VPN connection that is not passing traffic. The tunnel status shows as 'UP'. Which THREE steps should the engineer take to diagnose the issue?

Accepted Answer

Ensure that the security groups for instances allow inbound traffic from the on-premises network. Option A is correct because security groups act as a virtual firewall for instances, controlling inbound and outbound traffic at the instance level. Even if the VPN tunnel is up, traffic will be dropped if the security group does not explicitly allow inbound traffic from the on-premises network's IP range. This is a common misconfiguration that prevents traffic flow despite a healthy tunnel.

Answer

Check the IKE and IPSEC settings on the customer gateway

Answer

Check the internet gateway route table for the VPC

Question 19

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. The company wants to add a second VPC in the same AWS Region using the same Direct Connect connection. Which solution meets the requirements with the least operational effort?

Accepted Answer

Create a Direct Connect gateway and associate both VPCs, then associate the private VIF with the Direct Connect gateway. A Direct Connect gateway allows a single private virtual interface (VIF) to connect to multiple VPCs in the same AWS Region, eliminating the need for multiple VIFs or complex routing. By associating both VPCs with the Direct Connect gateway and attaching the private VIF to it, you achieve the goal with minimal operational overhead, as the gateway handles the routing between the on-premises network and the VPCs.

Answer

Set up a VPN connection over the Direct Connect for the second VPC

Answer

Create a transit virtual interface and attach it to a transit gateway, then attach both VPCs

Answer

Create a second private virtual interface for the second VPC

Question 20

A company has multiple VPCs across different AWS Regions and wants to enable communication between them using AWS's global network backbone. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Use AWS Transit Gateway with inter-Region peering.. AWS Transit Gateway with inter-Region peering is correct because it allows you to connect multiple VPCs across different AWS Regions using AWS's global network backbone, providing a hub-and-spoke architecture that scales easily. This solution minimizes operational overhead by centralizing routing and eliminating the need to manage individual connections between each VPC, as Transit Gateway automatically handles route propagation and traffic distribution across peered transit gateways.

Answer

Set up AWS Direct Connect connections to each VPC.

Answer

Create VPC peering connections between each pair of VPCs.

Answer

Use AWS Site-to-Site VPN between VPCs.