ANS-C01 Mock Exam 89 — 25 Questions

Question 1

A company has multiple AWS accounts and wants to centralize VPC flow logs for analysis. The flow logs are published to Amazon S3 in each account. A central account needs to access these logs. Which solution meets the requirements with the least operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use S3 bucket policies in each account to grant the central account access. Using S3 bucket policies with cross-account permissions allows the central account to access the flow logs directly from the S3 buckets in each account without additional infrastructure. Option A is incorrect because AWS Glue jobs would add unnecessary operational overhead for copying data. Option B is incorrect because AWS Transit Gateway handles network traffic routing, not S3 access. Option C is incorrect because VPC peering provides network connectivity between VPCs but does not grant access to S3 buckets; S3 access is managed via IAM and bucket policies.

Answer

Set up AWS Glue jobs to copy logs to a central S3 bucket

Answer

Use AWS Transit Gateway to centralize network traffic and capture logs

Answer

Use VPC peering to connect the accounts and access the S3 buckets directly

Question 2

A company is designing a multi-region active-active architecture for a web application using Application Load Balancers (ALBs) and AWS Global Accelerator. The application must provide low-latency access to users worldwide and automatically route traffic to healthy endpoints. Which design should be used?

Accepted Answer

Deploy Global Accelerator with endpoints in each region (ALBs) and configure health checks to route traffic to healthy endpoints.. Global Accelerator uses the AWS global network and Anycast IPs to direct traffic to the nearest healthy endpoint, providing low-latency access and automatic failover across regions. By configuring ALBs as endpoints in each region with health checks, Global Accelerator ensures traffic is routed only to healthy endpoints, meeting the active-active multi-region requirement.

Answer

Use Amazon CloudFront with multiple origins pointing to ALBs in each region and configure origin failover.

Answer

Use Amazon Route 53 latency-based routing with health checks to route traffic to ALBs in each region.

Answer

Deploy a single ALB with multiple target groups across regions using cross-zone load balancing.

Question 3

A company wants to allow an EC2 instance in a private subnet to download files from an S3 bucket without traversing the internet. Which AWS service should be used?

Accepted Answer

Create a VPC Gateway Endpoint for S3.. A VPC Gateway Endpoint for S3 allows instances in a private subnet to access S3 without traversing the internet by routing traffic through AWS's internal network. It uses prefix lists and route table entries to direct S3 traffic to the endpoint, avoiding the need for NAT gateways or internet gateways.

Answer

Establish an AWS Direct Connect connection to the VPC.

Answer

Attach an internet gateway and route through a NAT gateway.

Answer

Create a VPC Interface Endpoint for S3.

Question 4

A company has a VPC with a CIDR of 10.0.0.0/16 and has enabled VPC Flow Logs to capture all traffic. The logs show that an EC2 instance (10.0.1.10) is sending outbound traffic to an external IP (203.0.113.50) on port 443, but the traffic is being rejected. The instance's security group allows outbound HTTPS to 0.0.0.0/0, and the subnet's NACL allows outbound traffic on port 443. The VPC has an internet gateway attached, and the route table directs 0.0.0.0/0 to the internet gateway. What is the most likely cause of the rejection?

Accepted Answer

The NACL inbound rules are blocking the return traffic.. The outbound traffic from the EC2 instance is allowed by the security group and NACL outbound rules, but the return traffic (responses from 203.0.113.50:443 back to 10.0.1.10) must also be permitted by the subnet's NACL inbound rules. Since the NACL is stateless, it requires explicit inbound rules for ephemeral ports (typically 1024-65535) to allow the return traffic. If those inbound rules are missing, the return packets are dropped, causing the outbound traffic to appear as rejected in VPC Flow Logs.

Answer

The security group does not allow inbound HTTPS traffic.

Answer

The internet gateway is not attached to the VPC.

Answer

The route table does not have a route to the internet gateway.

Question 5

A company has a VPC with public and private subnets. The private subnets use a NAT gateway for outbound internet access. The security team notices that some EC2 instances in the private subnets are able to reach the internet, but others are not. All instances have the same security group and are in the same private subnet. What is the most likely cause?

Accepted Answer

The NAT gateway's security group is blocking traffic from some instances.. The most likely cause is that the NAT gateway's security group (attached to its elastic network interface) is blocking traffic from some instances. Although all EC2 instances are in the same private subnet and have the same security group, the NAT gateway's own security group can be configured to allow outbound traffic only from specific source IPs or security groups. If the NAT gateway's security group only permits traffic from certain instances' private IPs (or security groups) within the subnet, it would allow some instances to reach the internet while blocking others. Option A is incorrect because a missing route would affect all instances in that subnet equally. Option B is incorrect because a network ACL applies to the entire subnet and would block all instances. Option D is incorrect because the internet gateway is attached to the VPC, not directly to private subnets, and its absence would prevent all internet access.

Answer

The route table associated with the private subnet is missing a default route to the NAT gateway.

Answer

The network ACL is blocking outbound traffic on ephemeral ports.

Answer

The internet gateway is not attached to the VPC.

Question 6

A company is deploying a new application in a VPC with public and private subnets. The application servers in the private subnets need to access the internet to download patches. Which configuration meets this requirement without allowing inbound internet traffic?

Accepted Answer

Create a NAT gateway in a public subnet and add a route to the NAT gateway from the private subnets' route tables.. A NAT gateway in a public subnet allows instances in private subnets to initiate outbound connections to the internet (e.g., for patch downloads) while preventing unsolicited inbound traffic from the internet. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT gateway's elastic network interface. This is the standard AWS pattern for outbound-only internet access from private subnets.

Answer

Attach an internet gateway to the private subnets and configure route tables accordingly.

Answer

Establish a site-to-site VPN connection to an on-premises internet gateway.

Answer

Configure a VPC endpoint for the internet in the private subnets.

Question 7

A company is deploying a web application across multiple AWS Regions using an Application Load Balancer (ALB) in each Region. The company wants to use AWS Global Accelerator to provide a static IP address and accelerate traffic. The application requires that client IP addresses be preserved in the backend logs. Which configuration should the network engineer use?

Accepted Answer

Use Network Load Balancers as endpoints in Global Accelerator.. AWS Global Accelerator preserves the client IP address when using a Network Load Balancer (NLB) as an endpoint. Global Accelerator uses the Proxy Protocol v2 to pass the original client IP to the NLB, which then forwards it to the backend targets. This meets the requirement for client IP preservation in backend logs.

Answer

Use VPC endpoints and AWS PrivateLink to route traffic through the Global Accelerator.

Answer

Use Amazon CloudFront in front of the ALBs with origin protocol policy set to HTTPS.

Answer

Use Application Load Balancers as endpoints and enable X-Forwarded-For header logging.

Question 8

A company has a VPC with public and private subnets in three Availability Zones. They want to provide outbound internet access to instances in private subnets while preventing inbound traffic from the internet. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Create a NAT Gateway in a public subnet and add a default route in the private subnet route table pointing to the NAT Gateway.. A NAT Gateway is a fully managed AWS service that provides outbound internet access for instances in private subnets while blocking unsolicited inbound connections. By placing the NAT Gateway in a public subnet and adding a default route (0.0.0.0/0) in the private subnet route table pointing to the NAT Gateway, traffic from private instances is source NATed to the NAT Gateway's Elastic IP, ensuring inbound traffic from the internet cannot reach the private instances. This solution offers the least operational overhead as AWS handles scaling, patching, and availability, unlike a self-managed NAT instance.

Answer

Deploy a NAT instance in a public subnet and configure the private subnet route table to point to it.

Answer

Attach an Internet Gateway to the VPC and add a default route to it in the private subnet route table.

Answer

Create a VPC Gateway Endpoint for Amazon S3 and route outbound traffic through it.

Question 9

A company has deployed a centralized NAT gateway in a VPC and uses VPC Flow Logs to monitor traffic. The network team notices that traffic from an EC2 instance in a private subnet to the internet is not being logged in the flow logs. The flow logs are configured at the VPC level with the 'ALL' format. What is the most likely cause of this issue?

Accepted Answer

Flow logs must be created specifically for the NAT gateway's elastic network interface to capture its traffic.. VPC Flow Logs capture traffic at the elastic network interface (ENI) level. A centralized NAT gateway has its own ENI in the public subnet, and traffic from private instances is routed through that ENI when it reaches the internet. To log that traffic, flow logs must be created specifically for the NAT gateway's ENI, not just at the VPC level, because VPC-level flow logs capture traffic for ENIs within that VPC but do not inherently capture traffic passing through the NAT gateway's ENI unless that ENI is explicitly targeted.

Answer

The EC2 instance is using a different VPC than the one where flow logs are configured.

Answer

The flow log format is set to 'ALL' which excludes NAT gateway traffic.

Answer

The flow logs are configured to capture only rejected traffic by default.

Question 10

A company has an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The ALB is configured with a target group that has a health check path of /health. Some instances are failing health checks and being marked unhealthy, but the application logs show the instances are healthy. What is the most likely cause?

Accepted Answer

The security group for the instances does not allow inbound traffic from the ALB's security group on the health check port. The most likely cause is that the security group for the EC2 instances does not allow inbound traffic from the ALB's security group on the health check port. ALB health checks originate from the ALB's private IP addresses, and if the instance security group lacks an inbound rule permitting traffic from the ALB's security group (or its CIDR) on the health check port, the health check requests are dropped, causing the target to be marked unhealthy even though the application itself is running fine.

Answer

The health check path is incorrect

Answer

The target group's slow start duration is too long

Answer

The ALB's stickiness is preventing health checks

Question 11

A company uses AWS Organizations with SCPs to restrict access to services. The security team needs to ensure that no IAM role can be created without an approved custom trust policy. Which SCP should be attached to the root OU to enforce this requirement?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:CreateRole","Resource":"*","Condition":{"StringNotEquals":{"aws:RequestTag/Approved":"true"}}}]}. It uses a Deny effect with a condition that only blocks IAM role creation when the request does not include a tag with key 'Approved' set to 'true'. This enforces that every new IAM role must have an approved custom trust policy by requiring the tag as a proxy for approval, while still allowing role creation when the tag is present. The SCP is attached to the root OU to apply globally across all accounts in the organization.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:CreateRole","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:CreateRole","Resource":"arn:aws:iam::*:role/*","Condition":{"StringNotLike":{"iam:RoleName":"approved-*"}}}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:PassRole","Resource":"*"}]}

Question 12

A company is using AWS Transit Gateway to interconnect multiple VPCs and on-premises networks. The network team notices that traffic between two VPCs is taking an unexpected path. Which AWS service should be used to analyze the packet-level traffic flow and identify the path?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet/byte counts) at the network interface level, enabling analysis of packet-level traffic flow paths through AWS Transit Gateway. By enabling flow logs on the Transit Gateway attachment or VPC subnets, you can trace the actual path traffic takes between VPCs, including whether it traverses the Transit Gateway or an unexpected route.

Answer

AWS CloudTrail

Answer

AWS X-Ray

Answer

AWS Config

Question 13

A company has a Direct Connect connection with a private VIF to a VPC. The company also has a Site-to-Site VPN connection to the same VPC as a backup. During a failover test, traffic from on-premises to the VPC continues to use the Direct Connect even after it is intentionally failed. The BGP timers are set to default values. What is the most likely cause?

Accepted Answer

The BGP session with the Direct Connect router is still established because the physical link is up, but the link is not forwarding traffic.. The Direct Connect physical link is still up, so the BGP session remains established even though the link is not forwarding traffic. With default BGP timers (keepalive 60s, hold 180s), the session does not time out, so the VPC continues to receive the Direct Connect route and prefers it over the VPN backup. A failover requires either the BGP session to go down or the route to be withdrawn, neither of which occurs when only the data plane fails.

Answer

The Direct Connect route is more specific than the VPN route.

Answer

The VPN BGP route has a longer AS path than the Direct Connect route.

Answer

The VPN route has a lower local preference than the Direct Connect route.

Question 14

A company is deploying a multi-tier application in a VPC. The web servers must be accessible from the internet, while the application servers must only be accessible from the web servers. Which architecture meets these requirements?

Accepted Answer

Web servers in public subnets with an Internet Gateway; application servers in private subnets with a route to the NAT Gateway.. It places web servers in public subnets with an Internet Gateway (IGW) for direct internet access, while application servers reside in private subnets that lack a direct route to the IGW. The private subnets have a route to a NAT Gateway, allowing the application servers to initiate outbound internet connections (e.g., for updates) without being reachable from the internet. Security Groups on the application servers can further restrict inbound traffic to only the web servers' security group, ensuring the application tier is isolated.

Answer

All servers in private subnets; use a load balancer in a public subnet.

Answer

Web servers in private subnets; application servers in public subnets with an Internet Gateway.

Answer

All servers in public subnets; use Security Groups to restrict access.

Question 15

A company is designing a disaster recovery solution that requires replicating data from an on-premises database to an Amazon RDS instance in a different AWS region. The data transfer must be encrypted in transit and should not traverse the public internet. Which approach meets these requirements?

Accepted Answer

Establish an AWS Site-to-Site VPN over an AWS Direct Connect connection. An AWS Site-to-Site VPN over an AWS Direct Connect connection provides encrypted IPsec tunnels for data in transit while keeping traffic entirely within the private network, avoiding the public internet. The Direct Connect private VIF establishes a dedicated private link to AWS, and the VPN overlay adds encryption, meeting both requirements for an on-premises to RDS cross-region replication scenario.

Answer

Use an AWS Direct Connect connection with public VIF

Answer

Establish an AWS Site-to-Site VPN over the internet

Answer

Use VPC Peering between the on-premises network and the RDS VPC

Question 16

A company is designing a network for a highly available application across multiple AWS regions. The application requires low-latency communication between regions and uses IP addresses that cannot change. Which AWS service should be used to connect the VPCs in different regions?

Accepted Answer

VPC Peering. VPC Peering is the correct choice because it establishes a direct, private network connection between two VPCs in different AWS regions using AWS's global backbone, enabling low-latency communication without requiring public internet traversal. It supports inter-region peering (since 2017) and allows the use of private IP addresses that remain unchanged, satisfying the requirement for fixed IPs.

Answer

AWS Direct Connect

Answer

VPC Endpoints

Answer

Internet Gateway

Question 17

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16 and needs to connect to an on-premises network via AWS Direct Connect. The on-premises network uses 10.0.0.0/16. Which solution allows connectivity without IP overlap?

Accepted Answer

Create a new VPC with a non-overlapping CIDR, connect both VPCs via Transit Gateway, and use NAT on the Transit Gateway attachment to the on-premises network.. When both the VPC and on-premises network use the same 10.0.0.0/16 CIDR, direct connectivity is impossible due to overlapping IP ranges. By creating a new VPC with a non-overlapping CIDR, connecting both VPCs via Transit Gateway, and applying NAT on the Transit Gateway attachment to the on-premises network, traffic from the original VPC can be source-NATed to the new VPC's range before being forwarded to on-premises, resolving the overlap. This allows the on-premises network to receive traffic with unique IPs, avoiding routing conflicts.

Answer

Establish a VPC peering connection between the VPC and on-premises network.

Answer

Use AWS Direct Connect with a private VIF and static routes to route traffic.

Answer

Deploy a NAT instance in the VPC to translate on-premises IPs.

Question 18

A company is deploying a multi-tier web application on AWS. The web tier runs on EC2 instances behind an Application Load Balancer (ALB), and the application tier runs on EC2 instances that connect to an RDS MySQL Multi-AZ DB instance. The application tier must be isolated from the internet and only accessible from the web tier. Which network implementation meets these requirements with the LEAST administrative overhead?

Accepted Answer

Place the web tier in a public subnet and the application tier in a private subnet, and configure security groups to allow inbound traffic to the application tier only from the web tier's security group.. Placing the web tier in a public subnet and the application tier in a private subnet, then using a security group rule that references the web tier's security group as the source, provides a stateful, application-layer firewall that allows traffic only from the web tier to the application tier. This design isolates the application tier from the internet while requiring no additional infrastructure like NAT gateways or VPC peering, minimizing administrative overhead. The security group reference automatically scales with the web tier's instances, eliminating the need to manage IP addresses.

Answer

Create two VPCs: one for the web tier with a public subnet, and one for the application tier with a private subnet, and connect them using VPC peering.

Answer

Place the web tier in a public subnet and the application tier in a private subnet with a NAT gateway for outbound access, and use security groups to allow traffic from the web tier.

Answer

Place both tiers in the same public subnet, and use a network ACL to restrict traffic from the web tier to the application tier.

Question 19

A company runs a web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB) across multiple Availability Zones. The application uses a MySQL database on an RDS instance in a private subnet. Security compliance requires that all traffic between the ALB and EC2 instances must be encrypted. The security team finds that the ALB currently sends traffic to the EC2 instances using HTTP on port 80. The EC2 security group allows inbound HTTP traffic from the ALB security group. The team needs to implement encryption with minimal changes and without disrupting the application. Which solution meets these requirements?

Accepted Answer

Modify the ALB listener to use HTTPS on port 443. Create a new target group with protocol HTTPS on port 443. Install a valid SSL/TLS certificate on each EC2 instance. Update the EC2 security group to allow inbound HTTPS from the ALB security group.. It directly modifies the existing ALB to use an HTTPS listener on port 443, creates a new target group with HTTPS on port 443, and requires installing a valid SSL/TLS certificate on each EC2 instance. This ensures all traffic between the ALB and EC2 instances is encrypted with TLS, meeting the security requirement with minimal changes and no disruption to the application. The EC2 security group update to allow inbound HTTPS from the ALB security group completes the configuration.

Answer

Set up an AWS Client VPN endpoint and have the ALB send traffic through the VPN to the EC2 instances.

Answer

Deploy an internal ALB in front of the EC2 instances and configure it with an HTTPS listener. Route traffic from the public ALB to the internal ALB.

Answer

Replace the ALB with a Network Load Balancer (NLB) and use TLS listeners to the EC2 instances.

Question 20

A company is designing a multi-region architecture using AWS Direct Connect. Which TWO of the following are valid configurations for connecting to multiple regions? (Select TWO.)

Accepted Answer

Set up separate Direct Connect connections in each region. Each AWS Direct Connect connection is physically provisioned at a specific Direct Connect location and terminates in a single AWS region. To connect to multiple regions, you must establish separate Direct Connect connections in each target region. Option E is correct because a Direct Connect Gateway allows you to associate Virtual Private Clouds (VPCs) from different regions to a single private virtual interface (VIF), enabling inter-region connectivity over the Direct Connect connection.

Answer

Use a single Direct Connect connection to connect to all regions

Answer

Use a Transit Gateway to connect to multiple regions

Answer

Use a single private VIF associated with multiple regions