ANS-C01 Mock Exam 85 — 25 Questions

Question 1

A company is designing a multi-region architecture with an Application Load Balancer (ALB) in us-east-1 and a Network Load Balancer (NLB) in eu-west-1. They need to route traffic from the ALB to the NLB using a fixed IP address. Which AWS service should be used to provide a static IP for the NLB and enable cross-region load balancing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator provides two static anycast IP addresses that serve as a fixed entry point for traffic. It can route traffic from the ALB in us-east-1 to the NLB in eu-west-1 by using an endpoint group that includes the NLB's IP address, enabling cross-region load balancing with a static IP. This allows the ALB to forward traffic to the Global Accelerator's static IP, which then optimally routes to the NLB in the other region.

Answer

AWS WAF

Answer

Amazon CloudFront

Answer

AWS Transit Gateway

Question 2

A company is designing a network security architecture for a multi-account environment using AWS Transit Gateway. The company requires that all traffic between VPCs must be inspected by a centralized security appliance in a shared services VPC. The security appliance must receive traffic for both directions (ingress and egress). Which THREE components are required to achieve this? (Choose THREE.)

Accepted Answer

A shared services VPC containing the security appliances.. The shared services VPC hosts the centralized security appliances (e.g., firewalls, intrusion detection systems) that must inspect all inter-VPC traffic. This VPC acts as a hub for traffic inspection, ensuring that both ingress and egress traffic flows through the appliances before reaching its destination.

Answer

VPC peering connections between each spoke VPC and the shared services VPC.

Answer

NAT gateways in each spoke VPC for outbound traffic.

Question 3

A network engineer has configured an AWS Site-to-Site VPN connection between a VPC and an on-premises network. The engineer checks the VPN status and sees the output above. What is the MOST likely cause of Tunnel2 being down?

Accepted Answer

The IPsec encryption or integrity algorithms do not match between the AWS VPN endpoint and the on-premises device.. Tunnel2 is down while Tunnel1 is up, indicating a per-tunnel configuration mismatch. The most common cause is a mismatch in IPsec security parameters (encryption, integrity, or DH group) between the AWS VPN endpoint and the on-premises device for that specific tunnel. AWS uses separate pre-shared keys and IPsec settings per tunnel, so a mismatch in algorithms would affect only the misconfigured tunnel.

Answer

The BGP ASN on the on-premises device is misconfigured.

Answer

The route tables in the VPC do not have a route to the on-premises network.

Answer

The IKE pre-shared key used for Tunnel2 is incorrect.

Question 4

A security team requires that all traffic between Amazon EC2 instances in different subnets of a VPC be logged. Which AWS service should be used to capture and log the traffic?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces and can be published to Amazon CloudWatch Logs or Amazon S3. This allows logging of all traffic between EC2 instances in different subnets. Option B is incorrect because AWS CloudTrail logs API calls and actions taken on AWS resources, not network traffic. Option C is incorrect because VPC Traffic Mirroring copies traffic for deep packet inspection and analysis, but it is not a logging service; it is used for traffic monitoring and security analysis. Option D is incorrect because AWS Config tracks resource configuration changes and evaluates compliance, not network traffic.

Answer

AWS CloudTrail

Answer

VPC Traffic Mirroring

Answer

AWS Config

Question 5

A company has a Direct Connect connection with a single private virtual interface (VIF) to a virtual private gateway (VGW) attached to a VPC. The VPC CIDR is 10.0.0.0/16. The on-premises CIDR is 172.16.0.0/12. The BGP session is established, and the on-premises router is advertising the 172.16.0.0/12 route to the VGW. The VGW is configured to propagate routes to the VPC route tables. However, instances in the VPC cannot reach on-premises resources. The VPC route table shows a propagated route for 172.16.0.0/12 with a target of the VGW. What is the most likely issue?

Accepted Answer

The on-premises router does not have a route to the VPC CIDR via the Direct Connect interface. The on-premises router must also have a route back to the VPC CIDR via the Direct Connect interface for traffic to flow bidirectionally. Option A is wrong because security groups are stateful, so outbound traffic is automatically allowed. Option B is wrong because the VPC route table does contain the propagated route for 172.16.0.0/12. Option D is wrong because the BGP session is established and the VGW does not need to advertise the VPC CIDR for outbound traffic; the problem is the lack of a return route on the on-premises router.

Answer

The security groups for the VPC instances do not allow outbound traffic to the on-premises network

Answer

The VPC route table does not have a route for the on-premises CIDR

Answer

The BGP session is not advertising the VPC CIDR to the on-premises router

Question 6

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The application must be accessible only from a specific AWS Client VPN endpoint. The security team has configured the ALB security group to allow inbound traffic from the Client VPN CIDR range, but users report that they can still access the application from outside the VPN. What is the MOST likely cause of this issue?

Accepted Answer

The ALB security group is not set as the source for inbound traffic; instead, traffic reaches the ALB directly from the internet.. The ALB security group is configured to allow inbound traffic from the Client VPN CIDR range, but if the ALB itself is internet-facing (i.e., it has public IP addresses and is deployed in public subnets), traffic can bypass the security group rules if the security group is not actually applied to the ALB's network interfaces. The most likely cause is that the ALB security group is not set as the source for inbound traffic; instead, traffic reaches the ALB directly from the internet, meaning the security group rules are not being enforced on the ALB's listener. This allows users outside the VPN to access the application because the ALB accepts traffic from any source unless the security group explicitly restricts it.

Answer

The network ACL is stateless and requires separate inbound and outbound rules for return traffic.

Answer

The subnet's network ACL allows inbound HTTP/HTTPS traffic from 0.0.0.0/0.

Answer

The EC2 instances' security group allows inbound traffic from 0.0.0.0/0.

Question 7

A company is designing a network for a VPC with a CIDR of 10.0.0.0/16. The VPC has three private subnets in three different Availability Zones. The company needs to provide internet access to instances in the private subnets for software updates. The architecture must be highly available and cost-effective. Which TWO actions should the network engineer take?

Accepted Answer

Configure each private subnet's route table to route 0.0.0.0/0 to the NAT Gateway in the same Availability Zone.. Configuring each private subnet's route table to route 0.0.0.0/0 to the NAT Gateway in the same Availability Zone ensures that traffic from instances in that subnet uses a NAT Gateway that is in the same AZ, avoiding cross-AZ data transfer costs and maintaining high availability. Option C is correct because deploying a NAT Gateway in each Availability Zone provides redundancy; if one AZ fails, the other NAT Gateways continue to provide internet access, meeting the high availability requirement while remaining cost-effective compared to using NAT instances with Auto Scaling.

Answer

Use a NAT instance in an Auto Scaling group.

Answer

Use a single route table for all private subnets and route to one NAT Gateway.

Answer

Deploy a single NAT Gateway in one Availability Zone.

Question 8

Which TWO options are valid methods to connect multiple VPCs together in a hub-and-spoke topology? (Select TWO.)

Accepted Answer

VPC peering. VPC peering (A) is a valid method because it establishes a direct, one-to-one network connection between two VPCs using the AWS global backbone, enabling private IPv4 or IPv6 communication without gateways or VPNs. AWS Transit Gateway (E) is valid because it acts as a central hub that connects multiple VPCs and on-premises networks through a single, scalable gateway, simplifying the hub-and-spoke topology management.

Answer

AWS Direct Connect

Answer

VPC Endpoints

Answer

AWS Site-to-Site VPN

Question 9

A company is troubleshooting connectivity between two VPCs (VPC-A and VPC-B) that are peered together. Both VPCs are in the same region. VPC-A has a CIDR of 10.0.0.0/16 and VPC-B has a CIDR of 10.0.0.0/16. The peering connection is established and the route tables are updated. However, EC2 instances in VPC-A cannot ping EC2 instances in VPC-B. What is the most likely cause?

Accepted Answer

The VPCs have overlapping CIDR blocks.. VPC peering requires non-overlapping CIDR blocks because the VPCs must have unique IP address spaces for routing to work correctly. Since both VPC-A and VPC-B use the same CIDR 10.0.0.0/16, the route tables cannot distinguish between the two VPCs, causing traffic to be misrouted or dropped. This is the most likely cause of the ping failure, as overlapping CIDRs prevent proper destination-based routing in the VPC peering connection.

Answer

The route tables do not have routes to the private IP addresses of the instances.

Answer

The security groups in VPC-B do not allow inbound ICMP traffic from VPC-A.

Answer

The VPCs are in different regions and peering does not work across regions.

Question 10

A company is designing a hybrid network connecting on-premises data centers to AWS via AWS Direct Connect. The company requires high availability with multiple connections. Which design ensures that a failure of a single Direct Connect location does not impact connectivity?

Accepted Answer

Provision two Direct Connect connections at two different Direct Connect locations.. Deploying two Direct Connect connections at two different Direct Connect locations ensures that a single location failure (e.g., power outage, fiber cut, or facility issue) does not affect connectivity. This design provides geographic redundancy, meeting the high availability requirement by eliminating a single point of failure at the Direct Connect location level.

Answer

Provision a single Direct Connect connection with a large bandwidth.

Answer

Provision two Direct Connect connections at the same AWS Direct Connect location.

Answer

Provision one Direct Connect connection and one AWS Site-to-Site VPN as backup.

Question 11

A global company is designing a multi-region architecture with an Active-Passive setup. They want to use Amazon Route 53 to route traffic to the active region and fail over to the passive region during an outage. They need to ensure that the failover is automatic based on health checks. Which routing policy should they use?

Accepted Answer

Failover routing policy. The Failover routing policy in Amazon Route 53 is specifically designed for active-passive configurations. It allows you to designate one record as primary (active) and another as secondary (passive), and Route 53 automatically routes traffic to the secondary record only when the health check associated with the primary record fails. This meets the requirement for automatic failover based on health checks without manual intervention.

Answer

Weighted routing policy

Answer

Latency routing policy

Answer

Geolocation routing policy

Question 12

A company wants to provide secure access to an S3 bucket from a VPC without using an internet gateway or NAT device. Which AWS feature should be used?

Accepted Answer

VPC endpoint (Gateway type) for S3. A VPC endpoint (Gateway type) for S3 allows instances within a VPC to access S3 buckets privately using the AWS network, without requiring an internet gateway or NAT device. This is achieved by adding an endpoint route in the VPC route table that directs S3 traffic through the AWS backbone, ensuring data never traverses the public internet.

Answer

Internet gateway

Answer

NAT gateway

Answer

AWS Site-to-Site VPN connection

Question 13

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises router is advertising a default route (0.0.0.0/0) via BGP. The VPC has an internet gateway attached, and the route table has a default route to the internet gateway. The network team notices that traffic from on-premises to the internet is not working as expected. What is the most likely cause?

Accepted Answer

The on-premises router is advertising a default route, causing a routing conflict.. The on-premises router advertising a default route (0.0.0.0/0) via BGP over the private VIF causes a routing conflict because the VPC route table already has a default route pointing to the internet gateway. When traffic from on-premises destined for the internet enters the VPC, it matches the more specific BGP-learned default route and is forwarded back toward the on-premises router (or black-holed), rather than being sent to the internet gateway. This creates a routing loop or asymmetric routing, breaking internet connectivity from on-premises.

Answer

The BGP session is not established.

Answer

The VPC route table does not have a route to the internet gateway for the on-premises traffic.

Answer

The private VIF is associated with the wrong VLAN.

Question 14

A company uses AWS Direct Connect with a private virtual interface (VIF) to connect its on-premises network to its VPC. The on-premises network team reports that they can ping the private IP address of an EC2 instance in the VPC, but cannot establish a TCP connection to a web server running on that instance. The network security group allows inbound TCP port 80 from the on-premises CIDR. What should the network engineer check next?

Accepted Answer

Check the operating system firewall and web server configuration on the EC2 instance.. The instance's OS firewall or web server configuration may be blocking the TCP connection, even though ping works (ICMP may be allowed). Option A is wrong because ping works, indicating routing and NACL are fine. Option C is wrong because the BGP session status is unrelated to connectivity to the instance. Option D is wrong because the NACL is stateless and would affect ping as well, so routing is fine.

Answer

Review the network ACL associated with the subnet to ensure it allows inbound TCP 80.

Answer

Check the BGP session status on the Direct Connect virtual interface.

Answer

Verify the route table on the VPC has a route back to the on-premises network.

Question 15

A company has a VPC with public and private subnets. The private subnets need internet access for updates, but must not be directly reachable from the internet. Which AWS service should be used?

Accepted Answer

NAT gateway. A NAT gateway enables instances in a private subnet to initiate outbound IPv4 traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet. It resides in a public subnet with an Elastic IP and uses the internet gateway for outbound traffic, but it does not allow inbound traffic to reach the private instances directly.

Answer

Internet gateway

Answer

VPN connection

Answer

VPC endpoint

Question 16

A security engineer needs to ensure that all internet-bound traffic from a VPC is inspected by a third-party firewall appliance before reaching the internet. The firewall is deployed in a separate VPC. Which AWS service should the engineer use to route traffic from the source VPC to the firewall VPC?

Accepted Answer

AWS Transit Gateway with a route table that points the default route (0.0.0.0/0) to the firewall VPC attachment.. AWS Transit Gateway enables transitive routing between VPCs. By creating a route table in the Transit Gateway with a default route (0.0.0.0/0) pointing to the firewall VPC attachment, all internet-bound traffic from the source VPC is forwarded to the firewall for inspection before reaching the internet. Option B (VPC Gateway Endpoint) is incorrect because Gateway Endpoints are used for privately accessing AWS services (like S3 or DynamoDB) from a VPC, not for routing traffic to a third-party firewall. Option C (AWS PrivateLink) is incorrect because PrivateLink allows you to access services hosted in other VPCs via Network Load Balancers and ENIs, but it does not provide transitive routing for internet-bound traffic. Option D (VPC Peering) is incorrect because VPC peering connections do not support transitive routing; you cannot route traffic from one VPC through a peered VPC to another destination.

Answer

VPC Gateway Endpoint for the firewall service.

Answer

AWS PrivateLink to connect to the firewall service in the other VPC.

Answer

VPC Peering connection between the two VPCs with a route table entry that sends internet traffic to the peering connection.

Question 17

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group behind a Network Load Balancer (NLB). The application requires that all packets from a given client session are sent to the same target instance for the duration of the session. Which feature should be enabled on the NLB to meet this requirement?

Accepted Answer

Enable stickiness using the source IP address. Enabling stickiness using the source IP address on a Network Load Balancer (NLB) ensures that all packets from a given client IP are routed to the same target instance for the duration of the session. This is achieved by the NLB hashing the source IP address (and optionally port and protocol) to consistently select the same target, which meets the requirement for session persistence without relying on application-layer cookies.

Answer

Enable proxy protocol v2

Answer

Enable cross-zone load balancing

Answer

Configure health checks to mark targets as healthy

Question 18

A network engineer is troubleshooting connectivity between a VPC (10.0.0.0/16) and a peered VPC (10.1.0.0/16). The route table shown is associated with subnet-aaa. An EC2 instance in subnet-aaa cannot reach an instance in the peered VPC. What is the issue?

Accepted Answer

The VPC peering connection is not in the 'active' state. A VPC peering connection must be in the 'active' state for traffic to flow between the VPCs. If the peering connection is in any other state (e.g., 'pending-acceptance', 'expired', 'failed', or 'deleted'), the route to the peered VPC's CIDR will be considered a black hole, and the EC2 instance in subnet-aaa will be unable to reach the instance in the peered VPC. The route table shown includes a route for 10.1.0.0/16 pointing to the peering connection, but the connection's state must be verified as 'active' for the route to be effective.

Answer

The route to the peered VPC's CIDR is missing

Answer

The route table does not have a route to an Internet Gateway

Answer

The route table is not associated with the correct subnet

Question 19

A company is setting up a cross-account VPC peering connection between VPC A (account 1) and VPC B (account 2). The security team wants to ensure that only specific TCP ports are allowed between the VPCs. They have configured the route tables and the VPC peering connection is active. Which additional configuration is required to enforce the port restriction?

Accepted Answer

Update the security groups in both VPCs to allow inbound traffic only on the required ports from the peered VPC's CIDR or security group.. Security groups can reference security groups from peered VPCs across accounts when the VPC peering connection is active, allowing fine-grained control over specific TCP ports at the instance level. Option A is incorrect because modifying network ACLs is possible but they are stateless and apply at the subnet level, not instance level; also, network ACLs cannot reference security groups from peered VPCs. Option B is incorrect because network ACLs are stateless, not stateful; security groups are stateful. Option D is incorrect because route tables control the path of traffic, not port-level filtering; they cannot deny traffic based on ports.

Answer

Modify the network ACLs in both VPCs to allow inbound traffic only on the required ports.

Answer

Use network ACLs with stateful filtering to allow only the required ports.

Answer

Configure the route tables to deny traffic on all ports except the allowed ones.

Question 20

A company is using AWS Direct Connect to connect their on-premises network to AWS. They need to ensure that traffic from a specific on-premises subnet can only access a specific VPC subnet. Which two components must be configured? (Choose two.)

Accepted Answer

Route tables with specific routes. To restrict traffic from a specific on-premises subnet to a specific VPC subnet using AWS Direct Connect, you need two components. First, a private virtual interface (VIF) is required because it provides connectivity to VPCs (as opposed to public or transit VIFs). Second, route tables with specific routes must be configured on both the on-premises router and the VPC route tables to ensure that traffic is directed to the correct destination subnet. Option B (Route tables with specific routes) and Option D (Private virtual interface) are correct. Option A (VPN connection) is not needed because Direct Connect itself provides the private connectivity. Option C (Public virtual interface) is incorrect as it is used for accessing public AWS endpoints, not VPC subnets. Option E (Transit virtual interface) is used for connecting to multiple VPCs via a transit gateway, not for a single VPC subnet.

Answer

VPN connection

Answer

Public virtual interface (VIF)

Answer

Transit virtual interface (VIF)