ANS-C01 Mock Exam 83 — 25 Questions

Question 1

A company has a VPC with public and private subnets. The security team wants to block all outbound traffic to the internet from the private subnets except for traffic to an AWS service like Amazon S3. Which configuration should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a VPC endpoint for Amazon S3 and add a route to the endpoint in the private subnet route table.. A VPC endpoint for S3 allows private subnet instances to access S3 without going through an internet gateway. A NAT gateway would allow all internet traffic, not just S3. A proxy server would allow all traffic unless configured to restrict. Internet gateway alone does not provide granular control.

Answer

Attach an internet gateway to the VPC and add a route to the internet gateway in the private subnet route table.

Answer

Place a proxy server in the private subnet and configure all instances to use it.

Answer

Configure a NAT gateway in the public subnet and update the route table to send 0.0.0.0/0 traffic to the NAT gateway.

Question 2

A large e-commerce company is redesigning its global network architecture. They have three VPCs in us-east-1: production (10.0.0.0/16), staging (10.1.0.0/16), and development (10.2.0.0/16). They also have two VPCs in eu-west-1: production (10.10.0.0/16) and staging (10.11.0.0/16). All VPCs are connected via a Transit Gateway with inter-region peering. The company wants to allow the staging VPCs in both regions to communicate with each other for data replication, but no other cross-region traffic should be allowed. Additionally, the production VPC in us-east-1 must be able to send traffic to the production VPC in eu-west-1 for a disaster recovery pilot. The security team has configured Network ACLs and security groups appropriately. However, after implementation, the staging VPCs can communicate, but the production VPCs cannot. A network engineer checks the Transit Gateway route tables and finds that both production VPC attachments are associated with the same route table, which has a static route for the 10.0.0.0/16 and 10.10.0.0/16 prefixes. What is the MOST likely reason for the failure?

Accepted Answer

The production VPCs are attached to the same Transit Gateway route table, causing asymmetric routing. Transit Gateway route tables propagate routes from VPC attachments. If both production VPCs are in the same route table, the routes for their CIDRs will be propagated. However, if there is a propagated route for the local VPC, it may override the static route or cause a conflict. The issue is likely that the static routes are being ignored because a more specific or conflicting propagated route exists, or the route table lacks a route for the remote production CIDR if the attachment is not associated correctly. Actually, the most common issue is that the production VPC attachments are in the same route table, but the static route for the remote production CIDR might be pointing to the VPC attachment itself, causing a loop. But the key point: Transit Gateway route tables do not allow overlapping CIDRs. Since both production VPCs have overlapping CIDRs (10.0.0.0/16 and 10.10.0.0/16 are different), that's not the issue. The issue is likely that the route table has a static route for the remote production CIDR, but the propagation from the local production VPC attachment might be creating a route that is not correct. The best answer is that the production VPC attachments need to be in separate route tables to avoid conflicting routes.

Answer

The security groups in the production VPCs are blocking the traffic

Answer

The production VPCs have overlapping CIDR ranges, causing a routing conflict

Answer

The Transit Gateway route table for the production VPCs does not have a route for the remote production CIDR

Question 3

A company has a VPC with multiple subnets. The network ACL for a subnet is configured to deny all inbound traffic. A security group attached to an EC2 instance in that subnet allows SSH from a specific IP range. Will SSH traffic from that IP range reach the instance?

Accepted Answer

No, because the network ACL denies all inbound traffic.. Network ACLs are stateless and deny all inbound traffic, so even though the security group allows SSH, the network ACL will block the traffic before it reaches the instance. Option A is wrong because security groups are stateful but are evaluated after network ACLs. Option C is wrong because the network ACL operates at the subnet level. Option D is wrong because the order does not matter for stateless ACLs.

Answer

Yes, because the security group allows SSH.

Answer

Yes, because the security group overrides the network ACL.

Answer

It depends on the rule number order in the network ACL.

Question 4

A company has a VPC with public and private subnets. The security team wants to block all outbound traffic to the internet from the private subnets except for traffic to an AWS service like Amazon S3. Which configuration should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

NAT gateway in a public subnet.. A NAT gateway allows instances in private subnets to initiate outbound traffic to the internet. Option B is wrong because Internet Gateway alone does not provide NAT; it requires public IPs. Option C is wrong because VPN does not provide direct internet access. Option D is wrong because VPC endpoint is for accessing AWS services.

Answer

Internet gateway attached to the VPC.

Answer

VPC Gateway Endpoint for Amazon S3.

Answer

Site-to-Site VPN connection.

Question 5

A company uses AWS Organizations and has multiple VPCs in different accounts. They want to centrally manage network firewall rules for all VPCs using a single firewall policy. Which AWS service should they use?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager allows you to centrally manage firewall rules across accounts and VPCs. Option B is wrong because Network Firewall is a per-VPC service. Option C is wrong because Shield is for DDoS. Option D is wrong because WAF is for web ACLs, not network firewalls.

Answer

AWS WAF

Answer

AWS Network Firewall

Answer

AWS Shield Advanced

Question 6

A security team needs to log all rejected traffic to an internet-facing Network Load Balancer (NLB) for compliance. Which configuration should they use?

Accepted Answer

Enable access logs on the NLB. NLB access logs capture information about rejected traffic when enabled. Option A is wrong because VPC Flow Logs do not capture traffic that is rejected by the NLB itself before reaching the target. Option B is wrong because CloudTrail logs API calls, not network traffic. Option C is wrong because ALB is a different load balancer type and does not apply to NLB.

Answer

Enable VPC Flow Logs on the NLB subnets

Answer

Enable AWS CloudTrail for the NLB

Answer

Enable access logs on an Application Load Balancer in front of the NLB

Question 7

A company has an AWS Direct Connect connection with a private VIF to a VPC. The VPC has multiple subnets across two Availability Zones. The company wants to use the Direct Connect connection as the primary path for all traffic from on-premises to the VPC, and use a Site-to-Site VPN as a backup. The on-premises router is configured to advertise a default route via BGP over the Direct Connect, and the VPN also advertises a default route. Which configuration ensures that the Direct Connect path is preferred over the VPN?

Accepted Answer

Configure AS_PATH prepending on the VPN BGP advertisements from the on-premises router to make the VPN path longer.. AS_PATH prepending increases the AS path length for routes advertised over the VPN, making them less preferred compared to the Direct Connect routes when both paths advertise a default route. BGP selects the path with the shortest AS_PATH length when all other attributes are equal, so prepending on the VPN ensures Direct Connect is the primary path.

Answer

Disable route propagation from the VPN in the VPC route tables to ensure Direct Connect routes take precedence.

Answer

Set a higher local preference on the Direct Connect BGP session on the on-premises router.

Answer

Decrease the Multi-Exit Discriminator (MED) value on the Direct Connect BGP advertisements from AWS.

Question 8

A company has a VPC with a VPN connection to an on-premises data center. They want to ensure that traffic between the VPC and on-premises is encrypted and authenticated. Which two components are required to establish the VPN tunnel?

Accepted Answer

Virtual Private Gateway and Customer Gateway. A Virtual Private Gateway (VPG) is the AWS-side endpoint, and a Customer Gateway (CGW) represents the on-premises router. Option A (Internet Gateway) is for internet traffic. Option C (Direct Connect) is a different service. Option D (Transit Gateway) is optional.

Answer

AWS Direct Connect and Direct Connect Gateway

Answer

Internet Gateway and NAT Gateway

Answer

Transit Gateway and VPN Attachment

Question 9

A company wants to block inbound traffic from a specific IP address range (203.0.113.0/24) at the VPC level using AWS WAF. Which resource should the AWS WAF web ACL be associated with?

Accepted Answer

Application Load Balancer. AWS WAF can be associated with an Application Load Balancer to filter HTTP/HTTPS traffic. Option B is wrong because NLB does not support AWS WAF. Option C is wrong because VPC peering does not have a web ACL. Option D is wrong because a security group is used for stateful filtering, but AWS WAF is a separate service for web traffic.

Answer

Network Load Balancer

Answer

VPC peering connection

Answer

Security group

Question 10

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. They need to connect their on-premises data center to AWS using AWS Direct Connect. The data center uses RFC 1918 addresses from the 10.0.0.0/8 range, overlapping with the VPC CIDR. The company cannot change the on-premises IP addresses. Which design allows connectivity without IP conflicts?

Accepted Answer

Deploy a Private NAT Gateway in the VPC and configure routes to send on-premises traffic through it. A Private NAT Gateway in the VPC allows the on-premises network to reach the VPC by translating overlapping IP addresses. Since the on-premises network uses the same 10.0.0.0/8 range as the VPC's 10.0.0.0/16 CIDR, traffic from the data center to the VPC must be source NATed to a non-overlapping IP range. The Private NAT Gateway performs this translation, enabling bidirectional communication without IP conflicts.

Answer

Configure Direct Connect Gateway with network address translation

Answer

Use AWS Transit Gateway with route table separation

Answer

Set up VPC Peering between the VPC and on-premises network over Direct Connect

Question 11

A company is designing a hybrid network using AWS Direct Connect. The company wants to use the same Direct Connect connection to access both VPC resources and public AWS services (such as S3 and DynamoDB) from its on-premises network. Which THREE components are required to meet this goal? (Choose three.)

Accepted Answer

Private virtual interface (VIF). A private virtual interface (VIF) is required to connect your on-premises network to a VPC via Direct Connect. However, to also access public AWS services like S3 and DynamoDB over the same Direct Connect connection, you need a public VIF (Option E) for public endpoint connectivity and a Direct Connect Gateway (Option C) to enable transitive routing between the private VIF and multiple VPCs or to simplify the architecture. Together, these three components allow a single Direct Connect connection to serve both private VPC resources and public AWS services.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN connection

Question 12

A company is designing a multi-VPC architecture with AWS Transit Gateway. The security requirements include: (1) all inter-VPC traffic must be inspected by a central firewall, (2) traffic to the internet must egress through a centralized egress VPC, and (3) traffic to on-premises via Direct Connect must go through the same inspection firewall. Which THREE components are required to meet these requirements?

Accepted Answer

AWS Network Firewall in an inspection VPC. The correct components are B, C, and E. Option B (AWS Network Firewall in an inspection VPC) provides the central firewall to inspect inter-VPC traffic. Option C (Virtual Private Gateway (VGW) attachment to the inspection VPC) enables on-premises Direct Connect traffic to be routed through the inspection VPC and firewall. Option E (AWS Transit Gateway with multiple route tables) allows segmentation of traffic and ensures that inter-VPC traffic and traffic to/from on-premises is routed through the inspection VPC. Option A (VPC peering connections between all VPCs) is not needed because Transit Gateway provides the connectivity. Option D (NAT gateways in each VPC) is not required because internet egress is centralized through an egress VPC, not through individual NAT gateways.

Answer

VPC peering connections between all VPCs

Answer

NAT gateways in each VPC

Question 13

A company is designing a network for a critical application that requires low latency between EC2 instances. The instances are in the same AWS Region but different Availability Zones. Which configuration will provide the lowest latency?

Accepted Answer

Launch instances in the same placement group within a single Availability Zone. Placing EC2 instances within the same placement group in a single Availability Zone ensures they are in close physical proximity, often on the same rack or within the same cluster, which minimizes network hops and achieves the lowest possible latency (typically under 1 ms). This configuration is specifically designed for low-latency, high-throughput workloads like HPC or real-time data processing.

Answer

Use an Application Load Balancer to distribute traffic

Answer

Use Direct Connect to connect the VPCs

Answer

Use VPC peering to connect the VPCs

Question 14

A network engineer examines the route table above. The VPC has a CIDR of 10.0.0.0/16. There is a VPC peering connection (pcx-...) to a VPC with CIDR 192.168.0.0/16. However, instances in this route table's subnet cannot communicate with the peered VPC. What is the most likely cause?

Accepted Answer

The security group or network ACL in the source subnet is blocking traffic.. The route table shown includes a route for the peered VPC (192.168.0.0/16 via pcx-...), and the route table is associated with the subnet (implied by the question stating 'this route table's subnet'). Since routing is in place, the most likely remaining cause is that a security group (stateful, blocking inbound/outbound traffic) or a network ACL (stateless, blocking inbound/outbound traffic) is filtering the traffic between the subnets. Security groups and network ACLs operate at the instance and subnet level respectively, and misconfigured rules can prevent communication even when routes are correct.

Answer

The route table is not associated with the subnet.

Answer

The VPC peering connection is in 'pending-acceptance' state.

Answer

The route to the peered VPC is missing from the route table.

Question 15

Match each AWS networking feature to its use case for hybrid connectivity.

Accepted Answer

AWS Transit Gateway: Central hub to interconnect VPCs and on-premises networks.. Correct matches: Direct Connect = dedicated private connection; Site-to-Site VPN = encrypted internet tunnel; Transit Gateway = central hub. Common confusions include swapping the encryption and dedicated nature of Direct Connect and VPN.

Answer

AWS Direct Connect: Encrypted connection over the internet to connect on-premises to AWS.

Answer

AWS Site-to-Site VPN: Dedicated private connection from on-premises to AWS.

Question 16

A company has a VPC with multiple subnets. They want to ensure that all outbound traffic from EC2 instances in the VPC goes through a centralized NAT device for inspection. They have deployed a NAT instance in a public subnet and configured the route tables for private subnets to point to the NAT instance. However, traffic is not being routed through the NAT instance. What is the most likely cause?

Accepted Answer

The source/destination check is enabled on the NAT instance.. The source/destination check is a security feature on EC2 instances that prevents them from forwarding traffic unless the instance is the source or destination of the packet. Since a NAT instance must forward traffic that it did not originate (e.g., from private instances to the internet), this check must be disabled. When enabled, the NAT instance drops packets that are not addressed to itself, breaking the routing of outbound traffic through it.

Answer

The NAT instance does not have a public IP address.

Answer

The route table for the private subnets does not have a default route (0.0.0.0/0) pointing to the NAT instance.

Answer

The security group of the NAT instance blocks outbound traffic.

Question 17

Refer to the exhibit. A network engineer is analyzing VPC Flow Logs to troubleshoot connectivity issues. The engineer notices that traffic from 10.0.1.5 to 192.168.1.1 on port 80 is logged as ACCEPT, but the application team reports that the web request failed. What is the most likely cause?

Accepted Answer

The destination host 192.168.1.1 is not reachable or does not have a route back to the source.. The VPC Flow Logs record the state of the TCP handshake from the perspective of the network path, but they do not confirm that the destination host successfully processed the request or that a return path exists. If 192.168.1.1 has no route back to 10.0.1.5, the initial SYN-ACK will never reach the source, causing the application to time out even though the forward traffic was accepted by the network ACL and security group.

Answer

The VPC Flow Logs are not capturing all packets due to sampling.

Answer

The network ACL is returning an ICMP unreachable message that is not logged.

Answer

The security group on the ENI is blocking outbound traffic to 192.168.1.1.

Question 18

Refer to the exhibit. A network engineer runs the above command and sees this network ACL configuration. The subnet associated with this ACL contains an EC2 instance that is failing to receive inbound HTTP traffic (TCP 80) from the internet. What is the MOST likely cause?

Accepted Answer

The inbound deny rule for TCP (port range) blocks all TCP traffic. The inbound deny rule (Rule 100) for TCP (Protocol 6) from 0.0.0.0/0 denies all TCP traffic, including HTTP on port 80. Network ACLs evaluate rules in ascending order, so this deny rule is evaluated before any allow rules. Even though Rule 200 allows all traffic, the deny rule takes precedence because it comes first. Therefore, inbound HTTP traffic from the internet is blocked. Option A is incorrect because the subnet association does not affect the rule order; the deny rule applies to the subnet. Option C is incorrect because the outbound rule allows all traffic, so return traffic is not the issue. Option D is incorrect because the allow rule is wide enough (all traffic), but it is evaluated after the deny rule.

Answer

The inbound deny rule is associated with the wrong subnet

Answer

The outbound rule does not allow return traffic

Answer

The inbound allow rule is not wide enough

Question 19

A global company is designing a multi-region architecture with VPCs in us-east-1, eu-west-1, and ap-southeast-1. They are using AWS Transit Gateway with inter-region peering between all three regions. The company also has on-premises data centers in the US and Europe connected via Direct Connect to the Transit Gateways in us-east-1 and eu-west-1 respectively. The on-premises networks use BGP to advertise their CIDRs (10.0.0.0/8 for US, 172.16.0.0/12 for Europe). The Transit Gateway route tables are configured to propagate routes from all attachments. The company needs all VPCs and on-premises networks to be able to communicate with each other. After configuration, the VPC in ap-southeast-1 can communicate with the VPCs in us-east-1 and eu-west-1, but cannot communicate with either on-premises network. The VPCs in us-east-1 and eu-west-1 can communicate with all on-premises networks. What is the MOST likely cause of this issue?

Accepted Answer

The inter-region peering attachments in ap-southeast-1 do not have route propagation enabled. The on-premises CIDRs are advertised via Direct Connect into the Transit Gateways in us-east-1 and eu-west-1. Those Transit Gateways propagate the routes to the inter-region peering attachments. However, the Transit Gateway in ap-southeast-1 needs to have routes for the on-premises CIDRs pointing to the inter-region peering attachments. This is typically done by enabling route propagation from the inter-region peering attachment. If the route propagation is not enabled, the routes will not be added automatically. The engineer likely assumed propagation works automatically, but it must be explicitly enabled for each attachment. Since the VPCs in us-east-1 and eu-west-1 can reach on-premises, the local Direct Connect routes are fine. The issue is that the ap-southeast-1 Transit Gateway route table does not have routes for the on-premises CIDRs via the peering attachments.

Answer

The VPC in ap-southeast-1 has a security group that blocks traffic from on-premises IP ranges

Answer

The on-premises networks are not advertising their CIDRs to the ap-southeast-1 region

Answer

The Direct Connect gateways are not attached to the Transit Gateways in us-east-1 and eu-west-1

Question 20

A network administrator is troubleshooting connectivity to a web server in subnet with network ACL 'acl-12345678'. The web server is on port 443. The administrator finds that traffic from IP 10.0.1.5 is being denied. Why is the traffic being denied?

Accepted Answer

The network ACL rule 100 denies traffic from 10.0.0.0/8, which includes the IP 10.0.1.5.. Network ACLs are stateless and evaluated in ascending order by rule number. Rule 100 denies traffic from 10.0.0.0/8, which includes the source IP 10.0.1.5, so any traffic from that IP is denied regardless of later allow rules. Since network ACLs do not track connection state, the deny is applied immediately upon matching rule 100.

Answer

The subnet is not associated with this network ACL.

Answer

The security group attached to the web server is blocking the traffic.

Answer

The network ACL rule 100 allows traffic from 0.0.0.0/0, but rule 200 denies traffic from 10.0.0.0/8, and rule 200 is evaluated first.