ANS-C01 Mock Exam 87 — 25 Questions

Question 1

A company has an application that requires fixed IP addresses for whitelisting by third-party partners. The application is hosted on an Application Load Balancer (ALB) in a VPC. Which solution provides static IP addresses for the ALB?

Accepted Answer

Place an AWS Global Accelerator in front of the ALB.. AWS Global Accelerator provides two static IP addresses that act as fixed entry points for traffic. By placing it in front of an Application Load Balancer (ALB), you can whitelist these static IPs with third-party partners while the ALB itself remains dynamic. Global Accelerator uses the AWS global network to route traffic to the ALB, preserving the ALB's native HTTP/HTTPS features.

Answer

Use Amazon CloudFront with the ALB as origin.

Answer

Assign an Elastic IP to the ALB.

Answer

Replace the ALB with a Network Load Balancer (NLB).

Question 2

Which TWO AWS services can be used to provide inbound internet connectivity to resources in a VPC? (Select TWO.)

Accepted Answer

Internet Gateway. An Internet Gateway (IGW) is a horizontally scaled, redundant VPC component that provides a target in VPC route tables for internet-routable traffic and performs network address translation (NAT) for instances with public IPs. It enables inbound internet connectivity by allowing traffic from the internet to reach resources in the VPC, provided the resources have public IPs and the route table directs 0.0.0.0/0 traffic to the IGW.

Answer

VPC Endpoint

Answer

Amazon CloudFront

Answer

NAT Gateway

Question 3

A company has an Amazon Route 53 private hosted zone associated with a VPC. The company wants to resolve custom domain names for resources within that VPC. Which configuration is required for EC2 instances in the VPC to resolve these private hosted zone records?

Accepted Answer

Ensure that the VPC has the enableDnsHostnames and enableDnsSupport attributes set to true. Option C is correct because for EC2 instances in a VPC to resolve records in a Route 53 private hosted zone, the VPC must have both the `enableDnsHostnames` and `enableDnsSupport` attributes set to `true`. These settings enable the VPC's built-in DNS resolver (the Amazon-provided DNS server at the VPC's base CIDR +2 address) to query the private hosted zone and return the custom domain names to instances. Without these attributes, the VPC DNS resolver cannot perform resolution for private hosted zones, even if the zone is associated with the VPC.

Answer

Configure a Route 53 Resolver inbound endpoint in the VPC

Answer

Create a Route 53 Resolver outbound endpoint in the VPC

Answer

Establish a VPC peering connection with the Route 53 hosted zone

Question 4

A company designs a multi-account AWS environment using AWS Organizations. The networking team wants a centralized inspection VPC for traffic between VPCs and on-premises. Which architecture ensures that all inter-VPC traffic passes through the inspection VPC?

Accepted Answer

AWS Transit Gateway with centralized routing to the inspection VPC.. Option C is correct because AWS Transit Gateway enables centralized routing by attaching all VPCs and the on-premises network to a single transit gateway, then configuring route tables to force all inter-VPC traffic through a dedicated inspection VPC appliance (e.g., firewall or NGFW). This ensures traffic flows via the inspection VPC without requiring full-mesh peering or per-VPC firewalls.

Answer

VPC peering between all VPCs and the inspection VPC.

Answer

AWS Network Firewall deployed in each VPC.

Answer

AWS Direct Connect Gateway with virtual interfaces.

Question 5

A company is running a latency-sensitive application in a VPC with a public subnet and a private subnet. The application in the private subnet needs to access an Amazon S3 bucket in the same region. The company wants to minimize latency and avoid using a NAT gateway. Which solution meets these requirements?

Accepted Answer

Create a VPC Gateway Endpoint for Amazon S3 and update the route table for the private subnet. A VPC Gateway Endpoint for Amazon S3 allows instances in a private subnet to access S3 without traversing the internet or requiring a NAT gateway. This minimizes latency by routing traffic over the AWS internal network, and it avoids the cost and complexity of NAT devices. The route table for the private subnet must be updated with a route pointing to the gateway endpoint for the S3 prefix list.

Answer

Use S3 Transfer Acceleration and access the bucket via the public endpoint

Answer

Attach an Internet Gateway to the VPC and route the private subnet traffic through a NAT instance

Answer

Set up a NAT gateway in the public subnet and route traffic to the S3 bucket through it

Question 6

A company is deploying a critical application across three AWS Regions using an active-active architecture with Amazon Route 53 latency-based routing. Each region has an Application Load Balancer (ALB) as the endpoint. The application health checks are configured to check the /health endpoint every 10 seconds. During a regional failure, some users experience timeouts while others are redirected correctly. What is the most likely cause?

Accepted Answer

Route 53 health checkers take multiple intervals to detect failure, and timeouts occur before failover completes.. Route 53 health checkers operate from multiple global locations and evaluate the /health endpoint every 10 seconds. However, to declare an endpoint unhealthy, Route 53 requires a configurable number of consecutive failures (default is 3), meaning it can take 30 seconds or more before the DNS record is updated to remove the failed region. During this detection window, some users whose DNS queries are answered by Route 53 before the failure is fully propagated may receive the IP of the failing ALB, leading to timeouts, while others who query after the failover complete successfully.

Answer

The ALB health check is misconfigured and returns a non-200 status code during normal operation.

Answer

The TTL on the Route 53 record is set too low, causing stale DNS responses.

Answer

Users have cached DNS records from the failed region, and Route 53 does not return healthy endpoints.

Question 7

A company wants to enable communication between two VPCs (VPC A and VPC B) in the same AWS account and region. They want to use private IP addresses and avoid using the internet. Which THREE options can achieve this?

Accepted Answer

VPC peering connection. VPC peering connection (Option A) allows direct, private IP connectivity between two VPCs using the AWS global network, with no internet gateway or VPN required. Traffic stays within AWS's internal infrastructure, meeting the requirement for private IP addresses and avoiding the internet.

Answer

Internet gateway attached to both VPCs

Answer

NAT gateway in each VPC

Question 8

A company is designing a highly available architecture for a web application using an Application Load Balancer (ALB) across multiple Availability Zones. The application requires that user sessions are maintained (sticky sessions) and that the ALB can offload SSL/TLS termination. Which configuration should they use?

Accepted Answer

Create an Application Load Balancer with a target group that has stickiness enabled and an HTTPS listener that terminates SSL.. Option D is correct because an Application Load Balancer (ALB) natively supports both sticky sessions (via a generated cookie or application-based cookie) and SSL/TLS termination at the HTTPS listener. This allows the ALB to decrypt traffic before forwarding it to targets over HTTP, reducing backend processing overhead while maintaining session affinity across multiple Availability Zones for high availability.

Answer

Create a Network Load Balancer with a target group that has stickiness enabled and an SSL listener.

Answer

Launch EC2 instances as reverse proxy servers in front of the application servers, configure SSL on the reverse proxy, and use an Application Load Balancer to distribute traffic to the reverse proxies.

Answer

Create a Classic Load Balancer with sticky sessions and SSL termination.

Question 9

A company has a VPC with a CIDR of 10.0.0.0/16. They have two subnets: subnet A (10.0.1.0/24) and subnet B (10.0.2.0/24). They launch an EC2 instance in subnet A and another in subnet B. The security groups for both instances allow all traffic from the other instance's private IP. However, the instances cannot communicate. What is the most likely cause?

Accepted Answer

The network ACLs are blocking the traffic. The most likely cause is that the network ACLs (NACLs) are blocking the traffic. Security groups are stateful and allow return traffic automatically, but NACLs are stateless and require explicit inbound and outbound rules for both directions. By default, custom NACLs deny all traffic, so even though the security groups permit communication, the NACLs on subnets A and B must allow the traffic. The correct answer is B.

Answer

The instances are in different Availability Zones

Answer

The security groups are stateful and block return traffic

Answer

The route tables do not have a local route

Question 10

A company has a VPC with multiple subnets across two Availability Zones. They are designing a highly available web application using an Application Load Balancer (ALB) and EC2 instances in an Auto Scaling group. Which of the following is the most resilient and cost-effective design for the network layer?

Accepted Answer

Deploy a single ALB with subnets in two AZs and enable cross-zone load balancing.. Option C is correct because deploying a single Application Load Balancer (ALB) with subnets in two Availability Zones (AZs) and enabling cross-zone load balancing provides high availability and fault tolerance at the network layer. The ALB automatically distributes incoming traffic across healthy targets in all enabled AZs, eliminating the need for multiple load balancers and reducing costs while maintaining resilience. This design leverages the ALB's native ability to handle AZ failures by routing traffic only to healthy AZs, making it both resilient and cost-effective.

Answer

Deploy a Network Load Balancer (NLB) in each AZ and associate them with a single ALB.

Answer

Deploy an ALB in one AZ and EC2 instances in the same AZ.

Answer

Deploy an ALB in each AZ and use Route 53 weighted routing.

Question 11

A company is designing a network for a multi-account architecture using AWS Resource Access Manager (RAM) to share VPC subnets across accounts. They want to ensure that instances in shared subnets can communicate with instances in the owner's VPC using private IP addresses. What is required?

Accepted Answer

No additional networking configuration is required; the shared subnet is part of the same VPC.. When you share a subnet using AWS Resource Access Manager (RAM), the shared subnet is part of the owner's VPC. Instances launched into that shared subnet reside in the same VPC as the owner's instances, so they can communicate using private IP addresses by default, with no additional networking configuration required. This is because VPC subnets are a logical subdivision of the VPC's CIDR block, and all instances within the same VPC can route to each other via the VPC's internal router.

Answer

Establish a VPC peering connection between the owner and participant accounts.

Answer

Configure a VPC endpoint for Amazon EC2 to allow cross-account private communication.

Answer

Create a transit gateway and attach both VPCs to it.

Question 12

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They need to ensure that traffic between VPCs in different regions is encrypted. Which solution should be used?

Accepted Answer

Use AWS Transit Gateway inter-region peering with a VPN attachment between the transit gateways.. Option B is correct because AWS Transit Gateway inter-region peering provides encrypted transit between VPCs in different regions by establishing a VPN attachment between the transit gateways. This leverages IPsec VPN tunnels to encrypt traffic as it traverses the AWS global network, meeting the requirement for cross-region encryption without routing through on-premises infrastructure.

Answer

Use a Site-to-Site VPN from each VPC to the on-premises network and route traffic through the corporate network.

Answer

Use VPC Peering connections between the VPCs, which encrypts traffic automatically.

Answer

Use AWS PrivateLink to connect the VPCs across regions.

Question 13

A company is designing a hybrid network with AWS Direct Connect and AWS Site-to-Site VPN as backup. The primary Direct Connect connection uses a private VIF to a VPC. If the Direct Connect fails, traffic should automatically fail over to the VPN connection. What is the MOST reliable way to achieve this failover?

Accepted Answer

Use BGP on both connections and prepend AS paths on the Direct Connect routes to make them less preferred.. Option C is correct because using BGP on both connections allows you to influence route selection via AS path prepending. By prepending the AS path on the Direct Connect routes, you make them appear less preferred compared to the VPN routes, ensuring that under normal conditions traffic uses Direct Connect. When Direct Connect fails, the BGP session drops, the routes are withdrawn, and traffic automatically fails over to the VPN without any manual intervention or reliance on static metrics.

Answer

Use BGP on Direct Connect and static routes on the VPN connection, with a higher metric for the VPN static route.

Answer

Configure static routes on the customer gateway device with a lower metric for the Direct Connect interface.

Answer

Use BGP on both connections and set a lower local preference on the Direct Connect routes.

Question 14

A company has a VPC with CIDR 10.0.0.0/16 and needs to connect to an on-premises network with CIDR 10.0.0.0/8. They plan to use AWS Direct Connect with a private virtual interface. What should they do to resolve the overlapping CIDR conflict?

Accepted Answer

Change the VPC CIDR to a non-overlapping range, such as 172.16.0.0/16, and re-create the VPC with the new CIDR.. Option C is correct because AWS does not support network address translation (NAT) for overlapping CIDRs on a Direct Connect private virtual interface. The only way to resolve the conflict is to change the VPC CIDR to a non-overlapping range (e.g., 172.16.0.0/16) and recreate the VPC, as the VPC CIDR cannot be modified after creation. This ensures that routes between the VPC and on-premises network do not conflict.

Answer

Create a VPN connection with dynamic routing and use BGP to advertise the VPC CIDR.

Answer

Create a VPC peering connection between the VPC and the on-premises network.

Answer

Use a NAT Gateway in the VPC to translate the on-premises IP addresses.

Question 15

A company is designing a hybrid network using AWS Direct Connect and AWS Site-to-Site VPN as backup. They want to ensure that traffic from on-premises to AWS uses Direct Connect when available and fails over to VPN automatically. Which BGP configuration should be used?

Accepted Answer

Prepend AS path on the VPN connection to make it less preferred.. Option B is correct because prepending the AS path on the VPN connection increases the AS path length, making the VPN route less preferred compared to the Direct Connect route. BGP selects the path with the shortest AS path length by default, so the Direct Connect path will be chosen as the primary path. When Direct Connect fails, the VPN route becomes the only available path and traffic automatically fails over.

Answer

Set a higher BGP local preference on the VPN connection.

Answer

Use the same BGP attributes for both connections and let ECMP handle load balancing.

Answer

Set a higher Multi-Exit Discriminator (MED) on the Direct Connect connection.

Question 16

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. It needs to connect to an on-premises data center over AWS Direct Connect. The on-premises network uses the 10.0.0.0/8 address space. The company cannot change the on-premises addressing. Which solution will allow connectivity without overlapping IP addresses?

Accepted Answer

Assign IPv6 CIDR to the existing VPC, use IPv6 for all resources, and connect over Direct Connect using IPv6.. Option C is correct because assigning an IPv6 CIDR to the existing VPC and using IPv6 for all resources avoids the IPv4 address overlap with the on-premises 10.0.0.0/8 network. AWS Direct Connect supports both IPv4 and IPv6 traffic, so you can establish a BGP session over IPv6 and route IPv6 traffic between the VPC and on-premises, completely bypassing the conflicting IPv4 address space.

Answer

Use VPC peering between the existing VPC and a new VPC with a non-overlapping CIDR, then route traffic through the new VPC.

Answer

Create a new VPC with a non-overlapping CIDR such as 172.16.0.0/16 and migrate resources.

Answer

Use AWS Transit Gateway with a Network Address Translation (NAT) attachment to translate the VPC CIDR.

Question 17

A company has created a VPC Interface Endpoint for Amazon ECR (Docker registry API) as shown in the exhibit. However, an EC2 instance in the same VPC is unable to authenticate with the ECR registry using the private DNS name. What is the most likely cause?

Accepted Answer

Private DNS is not enabled for the endpoint. The most likely cause is that Private DNS is not enabled for the VPC Interface Endpoint. When Private DNS is enabled, the endpoint automatically associates a Route 53 private hosted zone with the VPC, allowing the default private DNS name (e.g., *.dkr.ecr.us-east-1.amazonaws.com) to resolve to the endpoint's elastic network interface IP addresses. Without this, the EC2 instance will resolve the private DNS name to the public IP of the ECR service, bypassing the endpoint and failing authentication due to network path issues.

Answer

The endpoint service name is incorrect; it should be com.amazonaws.us-east-1.ecr.api

Answer

The endpoint is not in the 'available' state

Answer

The endpoint type should be Gateway, not Interface

Question 18

A company is designing a network for a multi-account AWS environment using AWS Organizations. They need to centralize network management and enable VPC connectivity across accounts. Which THREE services should they consider? (Choose THREE.)

Accepted Answer

AWS Resource Access Manager. AWS Resource Access Manager (RAM) is correct because it enables you to share centrally managed resources, such as Transit Gateways and VPC subnets, across multiple AWS accounts within an AWS Organization. This eliminates the need to create duplicate resources in each account and allows for centralized network management without requiring cross-account IAM roles or complex peering configurations.

Answer

VPC Peering

Answer

AWS Direct Connect

Question 19

A company is planning to connect multiple VPCs in different AWS accounts using AWS Transit Gateway. The VPCs must be able to communicate with each other, but the company wants to centralize egress traffic to the internet through a single VPC that has a NAT gateway. Which configuration meets these requirements?

Accepted Answer

Attach all VPCs to a Transit Gateway, create a central egress VPC with a NAT gateway, and configure Transit Gateway route tables to send default traffic to the central VPC.. Option A is correct because AWS Transit Gateway allows you to attach multiple VPCs from different accounts and centrally manage routing. By configuring the Transit Gateway route tables to send default traffic (0.0.0.0/0) to a central egress VPC that contains a NAT gateway, all other VPCs can route internet-bound traffic through that single NAT gateway, centralizing egress while maintaining inter-VPC communication.

Answer

Use AWS Site-to-Site VPN to connect the VPCs and route traffic through a central VPN endpoint.

Answer

Use VPC peering to connect all VPCs and configure a NAT gateway in one VPC.

Answer

Attach each VPC to a Transit Gateway and configure a NAT gateway in each VPC.

Question 20

A solutions architect needs to design a highly available web application that uses an Application Load Balancer (ALB) and spans multiple Availability Zones (AZs) in a single region. The application must be able to handle a sudden increase in traffic without manual intervention. Which feature should the architect enable on the ALB to meet this requirement?

Accepted Answer

Enable cross-zone load balancing. Cross-zone load balancing distributes incoming traffic evenly across all registered targets in all enabled Availability Zones, rather than sending traffic only to targets in the same AZ as the load balancer node. This ensures that if one AZ receives more traffic than another, the ALB can still balance the load across all healthy instances, allowing the application to handle sudden traffic spikes without manual scaling intervention.

Answer

Enable connection draining

Answer

Enable sticky sessions

Answer

Enable deletion protection