ANS-C01 Mock Exam 82 — 25 Questions

Question 1

A company has a VPC with an AWS Site-to-Site VPN connection to their on-premises network. The VPN uses dynamic routing with BGP. The on-premises network is advertising a specific route to the VPC. However, instances in the VPC cannot reach the on-premises network. The VPN tunnels are up and BGP sessions are established. What should the engineer check?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Route propagation is enabled on the VPC route tables.. Even if BGP routes are received, they must be propagated to the route tables. If route propagation is not enabled, the routes are not added. Option A is incorrect; static routes are not necessary for dynamic routing. Option B is incorrect because the VPN connection routes are already configured. Option D is incorrect because the tunnels are up, so the configuration is likely correct.

Answer

The tunnel options include the correct encryption algorithms.

Answer

The on-premises router is advertising the route with the correct ASN.

Answer

The VPN connection's static routes are configured for the on-premises CIDR.

Question 2

A network engineer is designing a highly available VPN connection between an on-premises network and AWS. The on-premises network has two internet connections from different ISPs. Which AWS VPN configuration should be used to provide the highest availability?

Accepted Answer

Create two customer gateways, each with a VPN tunnel to the virtual private gateway.. Using two customer gateways with two VPN tunnels each provides redundancy at both the device and ISP level. Option A is wrong because a single VPN tunnel is not redundant. Option C is wrong because a single customer gateway with two tunnels only provides ISP redundancy. Option D is wrong because Direct Connect is not a VPN.

Answer

Create a single VPN tunnel from one customer gateway to the virtual private gateway.

Answer

Create one customer gateway with two VPN tunnels, each using different internet connections.

Answer

Use AWS Direct Connect instead of VPN for higher availability.

Question 3

A company has a VPC with multiple subnets. The network engineer wants to monitor network traffic between two specific EC2 instances in different subnets. Which THREE methods can be used to capture and analyze this traffic?

Accepted Answer

Enable VPC Flow Logs for the subnets containing the instances.. VPC Flow Logs capture metadata, Traffic Mirroring captures full packets, and AWS Network Firewall can inspect traffic. VPC Peering is for connectivity, not monitoring.

Answer

Use AWS CloudTrail to log network traffic.

Answer

Create a VPC peering connection between the two subnets' VPCs.

Question 4

A global e-commerce company is migrating to AWS and plans to use a hub-and-spoke topology with AWS Transit Gateway. The network team wants to ensure high availability for the connection between the hub VPC and the on-premises data center using AWS Direct Connect with multiple virtual interfaces (VIFs). They need to be able to fail over quickly with minimal packet loss. Which design should meet these requirements?

Accepted Answer

Provision two Direct Connect connections, each with multiple private VIFs, and attach them to the same transit gateway. Use BFD to detect failures and rely on ECMP routing across the VIFs.. It provides true high availability and fast failover by using two separate Direct Connect connections, each with multiple private VIFs, attached to the same transit gateway. BFD (Bidirectional Forwarding Detection) enables sub-second failure detection, and ECMP (Equal-Cost Multi-Path) routing across the VIFs allows active-active load balancing, minimizing packet loss during failover. This design eliminates single points of failure and meets the requirement for rapid convergence with minimal disruption.

Answer

Provision one Direct Connect connection with a single private VIF, and enable BFD on the VIF to detect failures quickly.

Answer

Provision one Direct Connect connection with two private VIFs, and use a second Direct Connect connection as backup with a single VIF. Configure route tables to prefer the primary.

Answer

Provision two Direct Connect connections, each with a single private VIF, and use AWS Site-to-Site VPN as a backup for each.

Question 5

A company is planning to connect its on-premises data center to AWS using AWS Direct Connect. The company requires high availability and wants to ensure that if one Direct Connect connection fails, traffic automatically fails over to another. Which THREE design elements should be included?

Accepted Answer

Provision two Direct Connect connections at different AWS Direct Connect locations.. Provisioning two Direct Connect connections at different AWS Direct Connect locations ensures physical diversity. If one location fails, the other connection remains available, providing high availability. This design eliminates a single point of failure at the network edge.

Answer

Use a single customer router with multiple connections to both Direct Connect locations.

Answer

Configure a VPN connection as a backup to Direct Connect.

Question 6

An organization has a requirement that all cross-account access to Amazon S3 buckets must be logged and monitored. The security team has enabled AWS CloudTrail and S3 server access logs. However, they notice that some cross-account access attempts are not being logged. Which additional step should be taken to ensure all cross-account access is logged?

Accepted Answer

Enable CloudTrail data events for S3 buckets to capture object-level API operations.. CloudTrail logs management events by default, but not data events. S3 server access logs capture object-level operations but require proper configuration. Option A is wrong because CloudWatch Logs is for log storage, not for enabling logging. Option B is wrong because enabling default encryption does not affect logging. Option D is wrong because S3 Object Lock is for compliance, not logging.

Answer

Create a CloudWatch Logs subscription filter to capture all S3 access logs.

Answer

Enable default encryption on all S3 buckets.

Answer

Enable S3 Object Lock on all buckets to prevent deletion of logs.

Question 7

Which TWO of the following are valid ways to encrypt data in transit between an on-premises data center and an Amazon VPC? (Choose two.)

Accepted Answer

Use AWS Site-to-Site VPN.. Options A and C are correct. AWS Site-to-Site VPN creates an IPSec tunnel, encrypting all traffic. AWS Direct Connect can be combined with a VPN over the connection to encrypt traffic. Option B is incorrect because Direct Connect alone does not provide encryption. Option D is incorrect because VPC peering does not encrypt traffic. Option E is incorrect because internet gateway does not encrypt traffic.

Answer

Use AWS Direct Connect without any additional encryption.

Answer

Use VPC peering.

Answer

Use an internet gateway with a security group.

Question 8

A company needs to connect its on-premises network to a VPC using AWS Direct Connect. The company wants to use a single Direct Connect connection to connect to multiple VPCs in the same region. Which configuration should be used?

Accepted Answer

Create a Direct Connect Gateway and associate it with multiple VPCs. A Direct Connect Gateway allows a single Direct Connect connection (via a private virtual interface) to be associated with multiple VPCs in the same region (or across regions). The Direct Connect Gateway acts as a hub, enabling transitive routing between the on-premises network and all associated VPCs without needing separate private VIFs per VPC.

Answer

Create a private VIF for each VPC

Answer

Use a VPN connection to extend the Direct Connect to other VPCs

Answer

Use a Transit Gateway to connect the Direct Connect to multiple VPCs

Question 9

A company manages multiple VPCs connected via a transit gateway. Each VPC has a VPN connection to an on-premises data center. The network team wants to monitor the bandwidth utilization on each VPN connection. Which approach is the most efficient?

Accepted Answer

Use Amazon CloudWatch metrics for the VPN tunnels.. CloudWatch metrics for VPN tunnels provide bandwidth utilization. Option B is wrong because VPC Flow Logs are for packet-level logs, not metrics. Option C is wrong because AWS Config tracks configuration. Option D is wrong because Transit Gateway Network Manager provides topology, not bandwidth metrics.

Answer

Enable VPC Flow Logs on each VPC and aggregate them in CloudWatch Logs Insights.

Answer

Use Transit Gateway Network Manager to view VPN bandwidth.

Answer

Use AWS Config rules to monitor VPN bandwidth changes.

Question 10

A company's security team is investigating a potential data exfiltration incident. They notice that an EC2 instance in a private subnet is making HTTPS connections to an unknown external IP address. The instance's security group only allows outbound HTTPS to a specific set of IPs. What is the MOST likely cause of the traffic?

Accepted Answer

The instance is routing traffic through a NAT Gateway that has a route to the internet. A NAT Gateway in a public subnet can allow outbound traffic to any destination, bypassing security group restrictions if the security group allows traffic to the NAT Gateway. Option B is wrong because security groups are stateful; outbound rules apply regardless. Option C is wrong because an Internet Gateway is not in a private subnet. Option D is wrong because a VPC Endpoint is for AWS services, not external IPs.

Answer

The instance is using a VPC Endpoint to connect to the external IP

Answer

The security group outbound rules are being overridden by a Network ACL

Answer

The instance has a public IP address and is using an Internet Gateway directly

Question 11

A company has a VPC with public and private subnets. They have an EC2 instance in a private subnet that needs to access the internet for software updates. Which solution provides internet access while keeping the instance private?

Accepted Answer

Create a NAT gateway in a public subnet, and update the private subnet's route table to point 0.0.0.0/0 to the NAT gateway.. A NAT gateway in a public subnet allows instances in private subnets to initiate outbound internet traffic while preventing inbound traffic from the internet. Option B is correct. Option A (internet gateway) would expose the instance to inbound traffic if assigned a public IP. Option C (VPC peering) does not provide internet access. Option D (VPC endpoint) only provides access to specific AWS services, not general internet.

Answer

Attach an internet gateway to the VPC and assign a public IP to the EC2 instance.

Answer

Use an AWS PrivateLink VPC endpoint for the software update service.

Answer

Set up a VPC peering connection with another VPC that has internet access.

Question 12

A security engineer is troubleshooting connectivity issues. An EC2 instance cannot access the internet. The instance is in a private subnet with a route table that has a default route (0.0.0.0/0) pointing to a NAT gateway. The NAT gateway is in a public subnet with an Elastic IP. The security group allows all outbound traffic. What is the most likely cause?

Accepted Answer

The network ACL in the public subnet is blocking inbound traffic to the NAT gateway. The network ACL in the public subnet must allow inbound traffic from the internet to the NAT gateway's Elastic IP. Option B is wrong because the route table in the private subnet is correct. Option C is wrong because the NAT gateway's security group is not a thing; it uses security groups for instances. Option D is wrong because the internet gateway is required and assumed attached.

Answer

The NAT gateway does not have a security group allowing outbound traffic

Answer

The internet gateway is not attached to the VPC

Answer

The route table in the private subnet has no route to the NAT gateway

Question 13

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team needs to block a specific IP address range that has been launching DDoS attacks. The solution must be implemented at the network edge, before traffic reaches the ALB. What should the security team do?

Accepted Answer

Create an AWS WAF web ACL with an IP set rule that blocks the IP range and attach it to the ALB.. AWS WAF web ACL attached to the ALB can filter traffic based on IP addresses. Option B is correct because WAF is deployed at the edge (ALB or CloudFront) and can block IP sets. Option A is wrong because security groups are stateful but work at the instance level, not at the edge. Option C is wrong because NACLs are applied at the subnet level, but ALB is in a subnet, so traffic reaches the ALB first; NACL is stateless and less suitable for layer 7 filtering. Option D is wrong because CloudFront with WAF is also edge, but the question says 'before traffic reaches the ALB' and ALB is already in place; adding CloudFront changes the architecture.

Answer

Update the security group for the ALB to deny traffic from the IP range.

Answer

Add a network ACL rule on the ALB's subnet to deny inbound traffic from the IP range.

Answer

Deploy Amazon CloudFront in front of the ALB and use AWS WAF to block the IP range at CloudFront.

Question 14

A company has a VPC with public and private subnets. They use a NAT Gateway in the public subnet to allow instances in the private subnet to access the internet. The security team wants to ensure that all outbound traffic from the private subnet is logged and inspected. Which THREE services should they use together to achieve this? (Choose THREE.)

Accepted Answer

VPC Flow Logs

Answer

AWS Direct Connect

Answer

AWS Transit Gateway

Question 15

A company uses AWS Direct Connect to connect their on-premises network to AWS. They have a VPC with a virtual private gateway (VGW) and a private VIF attached to it. They recently added a second Direct Connect connection for redundancy. Both connections are active and advertised via BGP. The on-premises network uses BGP with the same AS number. After configuration, they notice that traffic is not load-balanced as expected; instead, all traffic flows through one connection. What is the most likely cause?

Accepted Answer

The on-premises router is configured with a higher local preference for one of the BGP sessions, causing it to prefer that path.

Answer

The on-premises router has a static route pointing to the primary connection, overriding BGP learned routes.

Answer

Both Direct Connect connections are in the same AWS region and use the same VGW, so traffic cannot be load-balanced.

Answer

The Direct Connect connections are using different VLANs, causing asymmetric routing.

Question 16

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company wants to use a single NAT Gateway for all private subnets to reduce costs, but the NAT Gateway is in a single Availability Zone (AZ). The network architect is concerned about single points of failure. Which design best addresses high availability while still using the minimum number of NAT Gateways?

Accepted Answer

Deploy one NAT Gateway in each AZ that contains private subnets, and update the route tables accordingly.. Deploying one NAT Gateway per Availability Zone (AZ) that contains private subnets ensures that if an AZ fails, the private subnets in other AZs still have internet access via their local NAT Gateway. This design provides high availability while using the minimum number of NAT Gateways necessary to cover all AZs with private subnets, avoiding a single point of failure without over-provisioning.

Answer

Deploy a single NAT Gateway in one AZ and use a VPN to an on-premises internet gateway as backup.

Answer

Use a NAT instance in an Auto Scaling group across multiple AZs instead of a NAT Gateway.

Answer

Create a second VPC with a NAT Gateway and peer the VPCs to share the NAT Gateway.

Question 17

A company has a VPC with multiple subnets and an AWS Transit Gateway. They have a requirement to inspect traffic between subnets using a third-party firewall appliance that is deployed in a centralized inspection VPC. The firewall appliance must process all traffic between the VPC subnets, including traffic between subnets in the same Availability Zone. Which routing configuration achieves this?

Accepted Answer

None of the options are correct.. None of the provided routing configurations can achieve this requirement because the local route for the VPC CIDR in any VPC route table cannot be overridden. Therefore, intra-VPC traffic will always use the local route and will not be sent to the Transit Gateway. To inspect traffic between subnets within the same VPC, alternative architectures such as a Gateway Load Balancer or a Transit Gateway with VPC peering between different VPCs must be used.

Answer

Create a VPC route table that routes all traffic (0.0.0.0/0) to the Transit Gateway.

Answer

Create a VPC route table that routes the VPC CIDR to the Transit Gateway and associate it with each subnet.

Answer

Use the main route table and add a route for the VPC CIDR to the Transit Gateway.

Question 18

A company uses AWS Organizations with SCPs to restrict access. The security team needs to prevent users in the 'Developers' OU from disabling AWS Config or modifying its rules. Which SCP effect should be used?

Accepted Answer

Deny. A Deny effect explicitly blocks the action, overriding any Allow. Option A is wrong because Allow would not prevent the action. Option C is wrong because SCPs don't have a Block effect. Option D is wrong because NotAction is a condition element, not an effect.

Answer

Block

Answer

Allow

Answer

NotAction

Question 19

A company is using AWS Client VPN for remote access. They want to ensure that only clients with a valid client certificate can connect, and that traffic is routed through a centralized inspection VPC. The VPN endpoint is configured with mutual authentication using server and client certificates. The route table in the VPN VPC has a default route pointing to an AWS Network Firewall endpoint in the inspection VPC. Users report that they can connect to the VPN but cannot access any internal resources. The network engineer checks the Client VPN endpoint configuration and confirms that the authorization rules allow access to the internal CIDR (10.0.0.0/8). What is the most likely cause?

Accepted Answer

The route table in the VPN VPC has a default route (0.0.0.0/0) pointing to the Network Firewall, but the Network Firewall's route table needs a route back to the VPN VPC for the client CIDR, which is missing.

Answer

The client certificate is not associated with the same CA as the server certificate, causing TLS handshake failure.

Answer

The subnet route table in the VPN VPC does not have a route for the client CIDR (assigned by the VPN) pointing to the VPN endpoint's network interface.

Answer

The AWS Network Firewall in the inspection VPC is blocking traffic from the VPN client CIDR because it does not have a rule allowing it.

Question 20

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They need to ensure that traffic between VPCs is inspected by a security appliance in a centralized inspection VPC. How should they configure the Transit Gateway route tables?

Accepted Answer

Associate all VPCs with a single route table that has a default route pointing to the inspection VPC attachment, and enable route propagation from the inspection VPC. Using separate route tables for each VPC with a blackhole route pointing to the inspection VPC is not standard; the correct approach is to have a shared route table that propagates routes and uses a static route to the inspection VPC. Option D is correct: associate all VPCs with a single route table that has a default route pointing to the inspection VPC's attachment, and enable route propagation from the inspection VPC. Option A is wrong because it does not force traffic through the inspection VPC. Option B is wrong because it only inspects traffic from one VPC. Option C is wrong because a blackhole route drops traffic.

Answer

Create a route table for the inspection VPC and add blackhole routes for all other VPCs

Answer

Use one route table with all VPC attachments and enable route propagation for all attachments

Answer

Create separate route tables for each VPC and add a static route to the inspection VPC