ANS-C01 Mock Exam 89 — 25 Questions

Question 1

A company is designing a network for a critical application that requires low latency between EC2 instances. The instances are in the same AWS Region but different Availability Zones. Which configuration will provide the lowest latency?

Accepted Answer

Launch instances in the same placement group within a single Availability Zone. Option B is correct because placing EC2 instances within the same placement group in a single Availability Zone ensures they are in close physical proximity, often on the same rack or within the same cluster, which minimizes network hops and achieves the lowest possible latency (typically under 1 ms). This configuration is specifically designed for low-latency, high-throughput workloads like HPC or real-time data processing.

Answer

Use an Application Load Balancer to distribute traffic

Answer

Use Direct Connect to connect the VPCs

Answer

Use VPC peering to connect the VPCs

Question 2

A company is designing a VPC with both IPv4 and IPv6 CIDR blocks. The VPC must support internet-facing applications accessible via IPv6. Which resource must be configured as IPv6-enabled to allow internet traffic?

Accepted Answer

Internet Gateway. An Internet Gateway (IGW) is the only resource that supports both IPv4 and IPv6 traffic and provides a target in the VPC route table for IPv6 default routes (::/0) to enable direct internet access for IPv6-enabled resources. Unlike IPv4, which often requires NAT for private addressing, IPv6 globally unique addresses allow direct communication through the IGW without translation.

Answer

VPC Peering connection

Answer

NAT Gateway

Answer

Transit Gateway

Question 3

Refer to the exhibit. A network architect is reviewing an IAM policy for a junior engineer. What is the security concern with this policy?

Accepted Answer

The policy allows deletion of VPCs and subnets, which could lead to resource loss. Option B is correct because the IAM policy grants `ec2:DeleteVpc` and `ec2:DeleteSubnet` permissions, which allow the junior engineer to delete VPCs and subnets. This could lead to irreversible resource loss, including all associated resources like route tables, security groups, and network interfaces, disrupting network connectivity and services.

Answer

The policy does not include a condition to restrict the actions to specific VPCs

Answer

The policy allows creation of VPCs and subnets, which could cause resource exhaustion

Answer

The policy allows read-only actions that could expose sensitive network configurations

Question 4

A company is designing a VPC for a three-tier application (web, application, database). The database tier should not be accessible from the internet, but the web tier must be accessible. Which subnet design should the network engineer use?

Accepted Answer

Place web servers in public subnets with an internet gateway, and app and database servers in private subnets.. Option C is correct because it places the web servers in a public subnet with an Internet Gateway (IGW) to allow inbound HTTP/HTTPS traffic from the internet, while the application and database servers are placed in private subnets with no direct internet path. This design ensures the database tier is isolated from the internet, meeting the security requirement, while the web tier remains accessible. The application servers can communicate with the database via private IP addresses within the VPC, and outbound internet access for the private subnets (if needed) can be provided through a NAT Gateway in a public subnet.

Answer

Place web and app servers in public subnets, and database servers in private subnets.

Answer

Place all servers in private subnets and use a NAT Gateway for internet access.

Answer

Place all servers in public subnets and rely on security group rules to restrict access.

Question 5

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team notices that traffic between two VPCs is taking a suboptimal path through the on-premises network instead of staying within AWS. What is the MOST likely cause?

Accepted Answer

The Transit Gateway route tables do not have a route for the destination VPC CIDR, so traffic is sent to the on-premises network via a default route.. When a Transit Gateway route table lacks a specific route for the destination VPC CIDR, traffic destined for that VPC is evaluated against the remaining routes. If a default route (0.0.0.0/0) exists pointing to an on-premises network attachment (e.g., a VPN or Direct Connect), the traffic will be forwarded over that path, resulting in a suboptimal route that leaves AWS and re-enters through the on-premises network. This is the most likely cause because the Transit Gateway performs destination-based routing, and missing a specific VPC route forces fallback to the default route.

Answer

The subnet route tables in each VPC have a route pointing to the other VPC's CIDR via the Internet Gateway.

Answer

The VPCs are peered directly, bypassing the Transit Gateway.

Answer

Security groups are blocking traffic between the VPCs.

Question 6

A company is designing a hybrid network using AWS Direct Connect. The company wants to use the same Direct Connect connection to access both VPC resources and public AWS services (such as S3 and DynamoDB) from its on-premises network. Which THREE components are required to meet this goal? (Choose three.)

Accepted Answer

Private virtual interface (VIF). Option B is correct because a private virtual interface (VIF) is required to connect your on-premises network to a VPC via Direct Connect. However, to also access public AWS services like S3 and DynamoDB over the same Direct Connect connection, you need a public VIF (Option E) for public endpoint connectivity and a Direct Connect Gateway (Option C) to enable transitive routing between the private VIF and multiple VPCs or to simplify the architecture. Together, these three components allow a single Direct Connect connection to serve both private VPC resources and public AWS services.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN connection

Question 7

A company has a VPC with public and private subnets. The public subnet contains a NAT gateway and a bastion host. The private subnet contains application servers. The company wants to ensure that the application servers can download patches from the internet. Which TWO steps should be taken to allow this while maintaining security? (Choose two.)

Accepted Answer

Allow outbound HTTPS (port 443) traffic from the application servers in the security group. Option A is correct because the application servers need to initiate outbound HTTPS connections (port 443) to download patches from the internet. By allowing outbound HTTPS traffic in the security group associated with the application servers, you permit the necessary traffic while maintaining stateful filtering and restricting other outbound traffic. This is a security best practice that follows the principle of least privilege.

Answer

Modify the network ACL of the private subnet to allow all outbound traffic

Answer

Add a route in the public subnet route table that points 0.0.0.0/0 to the NAT gateway

Answer

Associate an Elastic IP address with the NAT gateway

Question 8

A company has a VPC with CIDR 10.0.0.0/16 and two subnets: 10.0.1.0/24 (public) and 10.0.2.0/24 (private). The company wants to add a new subnet for a third tier. Which of the following are valid subnet CIDRs that can be added? (Select TWO.)

Accepted Answer

10.0.3.0/24. Option B (10.0.3.0/24) is correct because it falls within the VPC CIDR 10.0.0.0/16 and does not overlap with the existing subnets (10.0.1.0/24 and 10.0.2.0/24). The /24 prefix length matches the existing subnet structure, and the third octet (3) is outside the range of the first two subnets, ensuring no IP address conflict.

Answer

10.0.1.128/25

Answer

10.1.0.0/16

Answer

10.0.2.64/26

Question 9

A company wants to ensure that traffic between two VPCs in the same region is encrypted and does not traverse the public internet. Which solution meets these requirements?

Accepted Answer

Configure VPC Peering between the two VPCs. VPC Peering (Option A) is correct because it establishes a direct, private network connection between two VPCs using AWS's internal infrastructure, ensuring traffic never traverses the public internet. All inter-VPC traffic over a VPC peering connection remains within the AWS global network, and encryption is inherently provided by the underlying physical layer security of AWS data centers, meeting both requirements without additional configuration.

Answer

Create VPC Endpoints in each VPC for the other VPC's CIDR

Answer

Use an AWS Transit Gateway to route traffic between the VPCs

Answer

Establish an AWS Site-to-Site VPN connection between the VPCs

Question 10

A company is designing a Direct Connect solution for high availability. Which of the following are best practices? (Select THREE.)

Accepted Answer

Provision two Direct Connect connections at different locations.. Provisioning two Direct Connect connections at different locations ensures physical diversity, which is a fundamental requirement for high availability. If one data center or fiber path fails, the other connection can continue to carry traffic, preventing a single point of failure. This aligns with the AWS Well-Architected Framework's recommendation for redundant network paths.

Answer

Use the same Direct Connect provider for both connections to simplify management.

Answer

Use a single Direct Connect connection with multiple virtual interfaces.

Question 11

A company is designing a VPC with IPv6. Which components are required to enable IPv6 communication between instances in the VPC and the internet? (Select TWO.)

Accepted Answer

A route in the subnet route table to ::/0 to the internet gateway. To enable IPv6 communication between instances in a VPC and the internet, you need an internet gateway (IGW) attached to the VPC, and a route in the subnet's route table that directs IPv6 traffic (destination ::/0) to that internet gateway. The IGW performs NAT for IPv6 (using eUI-64 addresses) and allows bidirectional traffic, so both components are required.

Answer

An egress-only internet gateway

Answer

A VPC peering connection to a VPC with internet access

Answer

A NAT Gateway

Question 12

A company is designing a VPC with public and private subnets. The company needs to provide internet access to instances in the private subnets. Which TWO components are required? (Choose TWO.)

Accepted Answer

Internet Gateway attached to the VPC. An Internet Gateway (IGW) is required to provide a target in the VPC route tables for internet-bound traffic. For instances in private subnets, a NAT Gateway placed in a public subnet translates their private IP addresses to the public IP of the NAT Gateway, allowing outbound internet access while preventing unsolicited inbound connections. The private subnet's route table must point 0.0.0.0/0 to the NAT Gateway, and the public subnet's route table must point 0.0.0.0/0 to the IGW.

Answer

Transit Gateway

Answer

VPC Gateway Endpoint for S3

Answer

Virtual Private Gateway

Question 13

A company is designing a network architecture for a multi-account AWS environment using AWS Transit Gateway. They need to meet the following requirements: (1) Centralized inspection of traffic between VPCs using a firewall appliance. (2) Isolated development environments that cannot communicate with each other but can access the internet via a centralized NAT gateway. (3) Compliance with PCI DSS for production workloads, requiring encryption in transit between VPCs. Which TWO actions should they take?

Accepted Answer

Create a dedicated inspection VPC with a firewall appliance and attach it to the Transit Gateway. Use Transit Gateway route tables to route traffic from all VPCs through the inspection VPC.. Option B is correct because it enables centralized traffic inspection by attaching a dedicated inspection VPC with a firewall appliance to the Transit Gateway and using separate route tables to force all inter-VPC traffic through that inspection VPC. This design meets the requirement for centralized inspection without requiring complex peering or VPN configurations.

Answer

Use VPC Peering for all inter-VPC communication

Answer

Use AWS Site-to-Site VPN between each VPC and a central VPN hub

Answer

Use AWS Client VPN to connect development VPCs to the production VPC

Question 14

A company has a multi-account AWS environment using AWS Organizations. The network team wants to centralize VPC traffic inspection using a Transit Gateway and a firewall appliance in a central account. Which THREE steps are required to implement this design? (Choose THREE.)

Accepted Answer

Create a Transit Gateway in the central account and attach the central VPC.. Option B is correct because a Transit Gateway (TGW) in the central account acts as the hub for VPC traffic inspection. Attaching the central VPC (which contains the firewall appliance) to the TGW allows all inter-VPC traffic to be routed through the central inspection VPC, enabling centralized traffic inspection without requiring VPC peering or per-spoke firewalls.

Answer

Create a VPC peering connection between each spoke VPC and the central VPC.

Answer

Deploy a firewall appliance in each spoke VPC.

Question 15

A company is designing a disaster recovery solution that requires replicating data from an on-premises database to an Amazon RDS instance in a different AWS region. The data transfer must be encrypted in transit and should not traverse the public internet. Which approach meets these requirements?

Accepted Answer

Establish an AWS Site-to-Site VPN over an AWS Direct Connect connection. Option B is correct because an AWS Site-to-Site VPN over an AWS Direct Connect connection provides encrypted IPsec tunnels for data in transit while keeping traffic entirely within the private network, avoiding the public internet. The Direct Connect private VIF establishes a dedicated private link to AWS, and the VPN overlay adds encryption, meeting both requirements for an on-premises to RDS cross-region replication scenario.

Answer

Use an AWS Direct Connect connection with public VIF

Answer

Establish an AWS Site-to-Site VPN over the internet

Answer

Use VPC Peering between the on-premises network and the RDS VPC

Question 16

A company wants to provide its employees with secure access to internal applications hosted in a VPC. The employees work remotely and use personal laptops. The solution must authenticate users against the company's existing identity provider (IdP) and must support both Windows and macOS clients. Which AWS service should be used?

Accepted Answer

AWS Client VPN. AWS Client VPN is a fully managed, cloud-based VPN solution that allows remote employees to securely access resources in a VPC using their personal laptops. It supports both Windows and macOS clients natively and can integrate with the company's existing identity provider (IdP) via SAML-based authentication, meeting all stated requirements.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

AWS Direct Connect

Question 17

Refer to the exhibit. An AWS administrator is troubleshooting an issue where an EC2 instance cannot access an S3 bucket using an instance profile. The instance profile is associated with an IAM role that has the above trust policy. The S3 bucket policy allows s3:GetObject only for the role's ARN. What is the most likely cause of the access failure?

Accepted Answer

The instance profile is not attached to the EC2 instance. The instance profile must be attached to the EC2 instance for the IAM role's credentials to be available to the instance. Without this attachment, the EC2 instance cannot assume the role or use its permissions to access the S3 bucket, even if the trust policy and bucket policy are correctly configured.

Answer

The VPC does not have an S3 VPC endpoint

Answer

The S3 bucket policy does not allow s3:ListBucket

Answer

The trust policy does not allow the S3 service to assume the role

Question 18

A company is designing a network for a real-time data analytics platform that ingests data from thousands of IoT devices. The devices send data via UDP to a UDP-based collector service running on EC2 instances. The collector service must be highly available and scalable. The data is then processed by a stream processing application. The company wants to minimize latency and jitter. Which TWO architectural choices should they make?

Accepted Answer

Use AWS Global Accelerator to provide a static anycast IP address and route traffic to the NLB endpoints. Option A is correct because AWS Global Accelerator provides static anycast IP addresses that route traffic over the AWS global network to the optimal NLB endpoint, reducing latency and jitter by avoiding public internet hops and using the AWS backbone. This is ideal for UDP-based real-time analytics where consistent performance is critical.

Answer

Use an Application Load Balancer (ALB) with a TCP listener and configure the collector to receive TCP

Answer

Use AWS Global Accelerator with EC2 instances as endpoints directly

Answer

Deploy an internet-facing NLB with Elastic IP addresses in each Availability Zone

Question 19

A company is designing a multi-region active-active application using Application Load Balancers (ALBs) behind AWS Global Accelerator. The application uses Aurora MySQL global database. Which design should be used to minimize cross-region latency for writes?

Accepted Answer

Deploy an ALB in each region with a Global Accelerator endpoint group containing both ALBs.. Option D is correct because deploying an ALB in each region and adding both to a Global Accelerator endpoint group enables active-active traffic distribution with optimal path routing via the AWS global network. Global Accelerator uses Anycast IPs to direct user traffic to the nearest healthy endpoint, minimizing latency. For writes to an Aurora MySQL global database, the primary region handles all write operations, but Global Accelerator ensures that write requests are routed to the primary region's ALB with the lowest possible latency from the client's location, while read traffic can be served locally from the secondary region's ALB.

Answer

Use Route 53 latency-based routing with a single ALB in the primary region.

Answer

Use Amazon CloudFront with origins in both regions and cache invalidation for writes.

Answer

Use Global Accelerator with a single ALB endpoint in one region and failover to the second region.

Question 20

A financial services company requires that all traffic between two VPCs in the same region be encrypted in transit. The VPCs are in separate AWS accounts and use non-overlapping CIDR blocks. Which solution meets the requirement with the least operational overhead?

Accepted Answer

Set up a VPC peering connection and configure VPN encryption using a virtual private gateway in each VPC.. Option A is correct because it combines a VPC peering connection (for private, low-latency connectivity between VPCs in the same region) with VPN encryption via a virtual private gateway in each VPC. This ensures all traffic between the VPCs is encrypted in transit, meeting the compliance requirement with minimal operational overhead, as it leverages existing AWS-managed VPN capabilities without requiring additional third-party appliances or complex routing.

Answer

Use VPC endpoints to connect the VPCs via AWS PrivateLink.

Answer

Attach both VPCs to an AWS Direct Connect connection.

Answer

Establish a VPC peering connection between the VPCs.