ANS-C01 Mock Exam 86 — 25 Questions

Question 1

A company is migrating its on-premises data center to AWS. The migration requires connectivity between the on-premises network and a VPC. The company needs a connection that supports multiple VLANs for separate environments (development, test, production) and provides consistent performance. The company also wants to avoid using the public internet. Which AWS service should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct choice because it provides a dedicated, private network connection from on-premises to AWS, bypassing the public internet for consistent performance. It supports multiple VLANs (802.1Q) via Virtual LANs (VLANs) on a single Direct Connect circuit, allowing separate logical networks for development, test, and production environments. This meets the requirements for private connectivity, multi-VLAN support, and predictable performance.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

AWS Client VPN

Question 2

A security engineer runs tcpdump on an EC2 instance (10.0.1.5) and sees the output above. The instance is in a private subnet with a security group that allows inbound HTTPS from 0.0.0.0/0. The instance is behind a Network Load Balancer (NLB) that has a public IP. The engineer is unable to establish an HTTPS connection from the internet. What is the most likely cause?

Accepted Answer

The NLB's target group health checks are failing, causing the NLB to consider the instance unhealthy.. The tcpdump output shows the NLB's health check traffic (SYN packets from the NLB's private IPs) reaching the instance, but the engineer cannot establish an HTTPS connection from the internet. If the target group health checks are failing, the NLB marks the instance as unhealthy and stops forwarding traffic to it, which would prevent any internet HTTPS connections from reaching the instance. This is the most likely cause because the security group allows inbound HTTPS from 0.0.0.0/0, and the NLB does not preserve source IP by default, so the security group is not blocking traffic from the internet.

Answer

The NLB is not preserving the source IP, so the security group is blocking the traffic.

Answer

The instance's operating system firewall is blocking the connection.

Answer

The security group is blocking inbound traffic from the NLB.

Question 3

A company wants to centrally manage and enforce security rules for all VPCs in a multi-account environment. Which AWS service should be used?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager is the correct choice because it provides centralized management of firewall rules across multiple accounts and VPCs in an AWS Organization. It allows you to enforce a common set of security policies, such as AWS WAF rules, AWS Shield Advanced protections, and VPC security group rules, ensuring consistent governance across all VPCs in the multi-account environment.

Answer

Amazon GuardDuty

Answer

AWS Shield

Answer

AWS WAF

Question 4

A company is designing a hybrid network with multiple AWS Direct Connect connections to multiple on-premises data centers. They want to maximize availability and use all available bandwidth. They have two Direct Connect connections terminated at two different Direct Connect locations. They plan to use a single Virtual Private Gateway (VGW) for each VPC. Which configuration should be used to meet these requirements?

Accepted Answer

Create a Direct Connect Gateway. Attach both Direct Connect connections to the Direct Connect Gateway. Associate the Direct Connect Gateway with the VGW. Configure the on-premises routers to use BGP with equal-cost multipath (ECMP).. It uses a Direct Connect Gateway to aggregate multiple Direct Connect connections into a single logical endpoint, allowing both connections to be associated with a single VGW. By configuring BGP with ECMP on the on-premises routers, traffic is load-balanced across both connections, maximizing bandwidth utilization while providing high availability through redundant paths.

Answer

Create two VGWs and attach each to a separate Direct Connect connection. Use a Transit Gateway to connect the VGWs to the VPC.

Answer

Create two Virtual Private Gateways, one for each Direct Connect connection. Attach each VGW to the VPC. Configure BGP on both connections for active-active.

Answer

Create a single virtual interface and associate it with both Direct Connect connections. Attach the virtual interface to the VGW.

Question 5

A company is deploying a global application behind an Application Load Balancer (ALB) in AWS. They want to use AWS Global Accelerator to improve performance by directing traffic to the nearest healthy endpoint. Which configuration is required to achieve this?

Accepted Answer

Create an accelerator with an endpoint group that includes the ALB as an endpoint. AWS Global Accelerator uses endpoint groups to direct traffic to the nearest healthy endpoint. By creating an accelerator with an endpoint group that includes the ALB as an endpoint, Global Accelerator can route user traffic over the AWS global network to the optimal ALB based on latency and health, improving performance for global users.

Answer

Configure Route 53 health checks for the ALB and associate them with Global Accelerator

Answer

Configure a CloudFront distribution with the ALB as an origin and enable Global Accelerator

Answer

Create a Route 53 latency-based routing record set pointing to the ALB

Question 6

A company has a VPC with multiple subnets. An EC2 instance in a private subnet needs to access an S3 bucket. Which AWS service should be used to allow this access without traversing the internet?

Accepted Answer

VPC Gateway Endpoint for S3. A VPC Gateway Endpoint for S3 allows EC2 instances in a private subnet to access S3 buckets without traversing the internet by using AWS's internal network. It uses prefix lists and route table entries to direct S3 traffic through the endpoint, which is horizontally scaled and highly available. This avoids the need for a NAT gateway or internet gateway, keeping traffic within the AWS backbone.

Answer

Transit Gateway

Answer

NAT gateway

Answer

Internet gateway

Question 7

A company has a VPC with public and private subnets. The public subnet has a NAT Gateway. The private subnet instances need to access an S3 bucket in the same region. Which THREE steps should the network engineer take to ensure the most cost-effective and secure access without traversing the internet?

Accepted Answer

Create a VPC Gateway Endpoint for S3.. A VPC Gateway Endpoint for S3 provides private, cost-effective access to S3 without traversing the internet or requiring a NAT Gateway. It uses AWS's internal network and route table entries to direct S3 traffic through the endpoint, avoiding data transfer costs and improving security.

Answer

Create a VPC Interface Endpoint for S3.

Answer

Create a NAT Gateway in the public subnet.

Question 8

A network engineer needs to monitor network traffic in a VPC. Which TWO AWS services can capture and analyze VPC flow logs?

Accepted Answer

Amazon S3. Amazon S3 is a correct destination for VPC Flow Logs because you can publish flow log data directly to an S3 bucket, where it can be stored, queried with Amazon Athena, or processed by other analytics tools. Amazon CloudWatch Logs is also a correct destination, allowing you to publish flow logs to a log group for real-time monitoring, metric filters, and integration with CloudWatch alarms or third-party solutions via subscription filters.

Answer

Amazon GuardDuty

Answer

VPC Traffic Mirroring

Answer

AWS Config

Question 9

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to add a new CIDR block 10.1.0.0/16 to accommodate more subnets. The VPC already has multiple subnets and route tables. What is the impact of adding this secondary CIDR?

Accepted Answer

Existing subnets and route tables remain unchanged; new subnets can be created in the new CIDR.. Adding a secondary CIDR block to an existing VPC is a non-disruptive operation. The existing subnets and route tables remain completely unchanged because the secondary CIDR is an additional IP address space, not a modification of the existing one. New subnets can be created within the new CIDR block, and you must explicitly associate them with route tables as needed.

Answer

The secondary CIDR will be automatically advertised to all route tables.

Answer

The VPC will experience a brief outage while the new CIDR is being associated.

Answer

Existing subnets will automatically be extended to include IPs from the new CIDR.

Question 10

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to connect to the internet for patching. The security team wants to minimize the attack surface. Which solution should be used?

Accepted Answer

Create a NAT Gateway in the public subnet and update route tables. A NAT Gateway in the public subnet allows the EC2 instance in the private subnet to initiate outbound connections to the internet for patching while preventing unsolicited inbound traffic, thus minimizing the attack surface. Option A is incorrect because a proxy server adds unnecessary complexity and overhead compared to a managed NAT Gateway, and it still requires careful configuration to minimize attack surface. Option B is incorrect because an Internet Gateway cannot be attached directly to a private subnet; it is attached to the VPC and requires a public subnet for route propagation. Option D is incorrect because a VPN connection is designed for hybrid connectivity to on-premises networks, not for general internet access from a VPC.

Answer

Set up a proxy server in the public subnet

Answer

Attach an Internet Gateway to the private subnet

Answer

Use a VPN connection to the on-premises network

Question 11

A company has a VPC with multiple subnets spanning three Availability Zones. They have deployed an Application Load Balancer (ALB) in the VPC and need to ensure high availability and scalability for a web application. Which of the following are design considerations for implementing the ALB in this environment? (Choose THREE.)

Accepted Answer

Enable the ALB in at least two Availability Zones to provide high availability.. AWS requires an Application Load Balancer to be enabled in at least two Availability Zones to achieve high availability. If one AZ fails, the ALB can continue routing traffic to healthy targets in the remaining AZs, ensuring fault tolerance and compliance with the ALB's regional service model.

Answer

Configure the ALB to use subnets that span multiple Availability Zones.

Answer

Use VPC peering to connect the ALB to subnets in other VPCs.

Question 12

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company wants to minimize data transfer costs and avoid exposing the private instance to inbound traffic from the internet. Which solution meets these requirements?

Accepted Answer

Create a VPC Gateway Endpoint for Amazon S3 and ensure the patches are hosted in S3. Route private subnet traffic to the endpoint.. A VPC Gateway Endpoint for Amazon S3 provides private connectivity to S3 without traversing the internet, eliminating data transfer costs and avoiding exposure to inbound traffic. Option D is incorrect because assigning a public IP and using an internet gateway would expose the instance to inbound traffic. Option B (NAT gateway) and Option C (NAT instance) incur data transfer costs and are not required when the patches are in S3 and can be accessed via a gateway endpoint.

Answer

Attach an internet gateway to the VPC and route the private subnet's default route to a NAT gateway in the public subnet.

Answer

Launch a NAT instance in the public subnet and route the private subnet's default route to it.

Answer

Attach an internet gateway to the VPC and assign a public IP to the EC2 instance.

Question 13

A company has a VPC with public and private subnets. They launch an Application Load Balancer (ALB) in the public subnets and targets in private subnets. Security requirements dictate that the targets should only accept traffic from the ALB. Which security group configuration meets this requirement?

Accepted Answer

Set the target security group inbound rule to allow HTTP from the ALB security group ID.. Referencing the ALB security group by ID in the target security group inbound rule allows traffic only from that specific security group, ensuring that only the ALB can reach the targets. This is a best practice for securing traffic between an ALB and its targets. Option A is incorrect because allowing HTTP from 0.0.0.0/0 would permit traffic from any source, not just the ALB. Option C is incorrect because the ALB's traffic originates from its elastic network interfaces (ENIs), which are associated with the ALB security group, not a fixed public IP. Option D is incorrect because allowing traffic from the entire VPC CIDR would permit any resource in the VPC to reach the targets, not just the ALB.

Answer

Set the target security group inbound rule to allow HTTP from 0.0.0.0/0.

Answer

Set the target security group inbound rule to allow HTTP from the ALB's public IP address.

Answer

Set the target security group inbound rule to allow HTTP from the VPC CIDR.

Question 14

A network engineer is troubleshooting connectivity issues. The route table shows a blackhole route for 10.0.0.0/8 pointing to a VPC endpoint (vpce-12345678). What is the most likely cause of the blackhole state?

Accepted Answer

The VPC endpoint (vpce-12345678) has been deleted.. A blackhole route in a VPC route table indicates that the target for the route (in this case, a VPC endpoint) is not in a valid state. When a VPC endpoint (vpce-12345678) is deleted, all routes pointing to it become blackhole routes because the target no longer exists. This causes traffic destined for 10.0.0.0/8 to be dropped silently.

Answer

The VPC CIDR 10.0.0.0/16 is overlapping with the endpoint route.

Answer

The route table does not have a route to the internet.

Answer

The internet gateway is not attached to the VPC.

Question 15

A company has an AWS Direct Connect connection with a private VIF to a VPC. They notice that traffic from the on-premises network to the VPC is being routed through the internet instead of the Direct Connect. The VPC route table has a route pointing to the virtual private gateway for the on-premises CIDR. What is the most likely cause?

Accepted Answer

The on-premises router is not advertising the prefix via BGP over the Direct Connect. If the on-premises router is not advertising the prefix via BGP over the Direct Connect, the VPC will not have a route to the on-premises network through the Direct Connect, causing traffic to go over the internet. Option A is incorrect because if the virtual private gateway were not attached, the VPC would have no route to the on-premises network at all. Option B is incorrect because security groups do not affect routing decisions; they filter traffic at the instance level. Option C is incorrect because a more specific route would still use the virtual private gateway, not the internet.

Answer

The virtual private gateway is not attached to the VPC

Answer

The security group on the VPC resources blocks the traffic

Answer

The on-premises CIDR is more specific than the VPC route table entry

Question 16

A company wants to securely connect their on-premises data center to AWS using a site-to-site VPN. They have multiple branch offices that also need to connect to AWS. Which AWS service should they use to simplify the management of multiple VPN connections?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway (C) acts as a central hub that interconnects VPCs and on-premises networks, allowing you to manage multiple site-to-site VPN connections and branch office attachments through a single gateway. This simplifies routing and reduces operational overhead compared to managing individual VPN connections between each branch and each VPC.

Answer

VPC Peering

Answer

AWS Direct Connect

Answer

VPN CloudHub

Question 17

A company is deploying a multi-tier web application across multiple AWS accounts. They want to centralize network security by using a shared services VPC with a Transit Gateway. All application VPCs will be attached to the Transit Gateway. The security team needs to inspect and filter traffic between application VPCs. Which solution should be used to meet this requirement?

Accepted Answer

Deploy a Transit Gateway and attach a central inspection VPC with a firewall appliance. Configure route tables to send inter-VPC traffic through the inspection VPC.. A Transit Gateway with a central inspection VPC allows you to route all inter-VPC traffic through a firewall appliance for inspection. By configuring route tables on the Transit Gateway, you can force traffic between application VPCs to traverse the inspection VPC, enabling centralized security filtering without requiring point-to-point peering or per-VPC rules.

Answer

Create VPC Peering connections between each pair of application VPCs and apply security groups to the peer connections.

Answer

Use security groups in each application VPC to control traffic between VPCs.

Answer

Use network ACLs in each application VPC to filter traffic between VPCs.

Question 18

A company has a VPC with public and private subnets. They have a web server in the public subnet that needs to make API calls to Amazon S3. The web server has a public IP. What is the MOST secure way to allow the web server to access S3 without traversing the internet?

Accepted Answer

Create a Gateway VPC Endpoint for S3 and add a route in the public subnet's route table to S3 via the endpoint. A Gateway VPC Endpoint for S3 allows resources within a VPC to access S3 over the AWS private network without traversing the internet. By adding a route in the public subnet's route table pointing to the endpoint, the web server can reach S3 privately, even though it has a public IP. This is the most secure option because traffic stays within the AWS backbone and does not require an internet gateway, NAT, or proxy.

Answer

Place a forward proxy server in the public subnet and configure the web server to use it for S3

Answer

Create an Interface VPC Endpoint for S3 in the public subnet

Answer

Set up a NAT Gateway in the same subnet and route S3 traffic through it

Question 19

A company is designing a hybrid network architecture that connects its on-premises data center to AWS via AWS Direct Connect. The on-premises network uses BGP to advertise routes to AWS. The company wants to ensure that if the Direct Connect connection fails, traffic automatically fails over to a VPN connection. Which configuration ensures this failover behavior?

Accepted Answer

Advertise the on-premises prefixes over Direct Connect with a lower MED value than over the VPN.. BGP uses the Multi-Exit Discriminator (MED) value to influence inbound path selection, where a lower MED is preferred. By advertising on-premises prefixes over Direct Connect with a lower MED than over the VPN, AWS will prefer the Direct Connect path under normal conditions. If the Direct Connect fails, the routes are withdrawn, and the VPN routes (with higher MED) become active, providing automatic failover.

Answer

Advertise the on-premises prefixes over Direct Connect with a higher AS path prepend than over the VPN.

Answer

Advertise the on-premises prefixes over Direct Connect with a specific BGP community to influence path selection.

Answer

Advertise the on-premises prefixes over Direct Connect with a higher local preference than over the VPN.

Question 20

A company has a VPC with CIDR 10.0.0.0/16 and needs to connect to an on-premises network using AWS Direct Connect. The on-premises CIDR is 10.1.0.0/16. To enable communication between the VPC and on-premises, which component must be configured?

Accepted Answer

Attach a Virtual Private Gateway to the VPC and update route tables. To connect a VPC to an on-premises network over AWS Direct Connect, you must attach a Virtual Private Gateway (VGW) to the VPC. The VGW serves as the VPN concentrator on the AWS side, terminating the Direct Connect virtual interface (VIF) and enabling BGP peering for route exchange. You then update the VPC route tables to point the on-premises CIDR (10.1.0.0/16) to the VGW, allowing traffic to flow between the VPC and the on-premises network.

Answer

Attach an Internet Gateway to the VPC and configure a NAT gateway

Answer

Create a VPC peering connection between the VPC and the on-premises network

Answer

Create a Transit Gateway and attach the VPC and Direct Connect