ANS-C01 Practice Test 9 — 10 Questions

Question 1

A company is setting up a new AWS Direct Connect connection. They have provisioned a 1 Gbps dedicated connection. They need to create a private virtual interface (VIF) to connect to their VPC. The VIF has been created and is in the 'available' state, but the BGP session is not coming up. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The BGP authentication key does not match between the customer router and AWS.. The most likely cause is a BGP authentication key mismatch. When the BGP session fails to establish but the virtual interface is in the 'available' state, it indicates the Layer 2 (VLAN) and Layer 1 (physical) connectivity are working. BGP authentication uses MD5 (per RFC 2385), and if the pre-shared key configured on the customer router does not exactly match the key specified in the AWS Direct Connect console for the private VIF, the TCP MD5 signature will fail, preventing the BGP session from coming up.

Answer

The BGP hold timer is set too high on the customer router.

Answer

The VLAN ID assigned to the VIF is already in use on another VIF.

Answer

The Direct Connect interface is in the 'down' state.

Question 2

A company has a VPC with multiple subnets. They have an AWS Network Firewall deployed in a firewall subnet. They want to inspect all outbound traffic from the VPC to the internet. Currently, the VPC route table has a default route (0.0.0.0/0) pointing to an internet gateway. What routing change is required to route outbound traffic through the firewall?

Accepted Answer

Add a route in the subnet route tables that sends 0.0.0.0/0 traffic to the Network Firewall endpoint's elastic network interface.. To route traffic through AWS Network Firewall, you must add a route in the subnet route tables that sends 0.0.0.0/0 traffic to the firewall endpoint's elastic network interface (ENI). This forces outbound traffic to be inspected by the firewall before reaching the internet gateway. Option A is incorrect because a VPC Gateway Endpoint is used for private access to AWS services, not for routing traffic through a firewall. Option B is incorrect because a NAT gateway provides outbound connectivity but does not inspect traffic; adding another hop to the firewall would be redundant and not supported. Option D is incorrect because a transit gateway is used to connect multiple VPCs or on-premises networks, not to route traffic through a single firewall.

Answer

Create a VPC Gateway Endpoint for the firewall service.

Answer

Add a NAT gateway in a public subnet and route 0.0.0.0/0 to the NAT gateway, then point the NAT gateway to the firewall.

Answer

Add a transit gateway and attach the VPC and the internet gateway to it, then route traffic through the firewall.

Question 3

A company is deploying a latency-sensitive application across multiple AWS Regions. They want to use the AWS global network to route traffic to the nearest edge location for fast content delivery. Which service should they use?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator uses the AWS global network to direct traffic to the nearest edge location via Anycast IP addresses, then routes it over the AWS backbone to the optimal regional endpoint. This minimizes latency and jitter for latency-sensitive applications by avoiding the public internet and providing static IP addresses for traffic management.

Answer

Amazon Route 53

Answer

AWS Direct Connect

Answer

Amazon CloudFront

Question 4

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The company wants to centralize network security by inspecting all traffic between VPCs and between VPCs and on-premises. Which architecture should be used?

Accepted Answer

Attach all VPCs to a Transit Gateway and use route tables to send traffic through a firewall appliance in one VPC.. AWS Transit Gateway supports centralized routing through a shared services VPC. By attaching all VPCs and VPN connections to the Transit Gateway and configuring route tables to point default or inter-VPC routes to a network firewall appliance (e.g., a third-party firewall or AWS Network Firewall) in a dedicated inspection VPC, all traffic between VPCs and between VPCs and on-premises can be forced through the firewall for inspection. This architecture leverages Transit Gateway route tables and blackhole routes to enforce traffic steering without requiring complex peering or VPN meshes.

Answer

Use VPN connections between all VPCs and on-premises.

Answer

Use VPC peering between all VPCs and configure security groups.

Answer

Use Network Load Balancer to distribute traffic across VPCs.

Question 5

A company is deploying a VPC with public and private subnets in two Availability Zones. The workloads in the private subnets need to access the internet for software updates. What is the MOST secure way to provide this internet access?

Accepted Answer

Deploy a NAT gateway in a public subnet and update the private subnets' route table to point default traffic to the NAT gateway.. A NAT gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing any unsolicited inbound traffic from the internet. This is the most secure and AWS-recommended method because it uses Source Network Address Translation (SNAT) to mask private IPs behind the NAT gateway's Elastic IP, and it requires only a route table update in the private subnets to direct default traffic (0.0.0.0/0) to the NAT gateway.

Answer

Set up a VPN connection to an on-premises network with internet access.

Answer

Use a transit gateway with a VPC attachment and route internet traffic through a centralized inspection VPC.

Answer

Attach an internet gateway to the VPC and route the private subnets' traffic to it.

Question 6

A large e-commerce company operates a multi-tier application across multiple AWS accounts. The web tier is in a VPC (10.0.0.0/16) in Account A, and the application tier is in a separate VPC (10.1.0.0/16) in Account B. Both VPCs are connected via a VPC peering connection. The application tier uses an NLB to distribute traffic to EC2 instances in private subnets. The web tier sends traffic to the NLB's private IP address. Recently, the company migrated the application tier to use AWS PrivateLink instead of the VPC peering connection, creating a VPC endpoint service in Account B and an interface VPC endpoint in Account A. After the migration, the web tier cannot connect to the application tier. The security groups and NACLs allow the traffic. Which of the following is the MOST likely cause of the connectivity issue?

Accepted Answer

The web tier instances are using the private IP address of the Network Load Balancer instead of the VPC endpoint DNS name or private IP addresses.. After migrating from VPC peering to AWS PrivateLink, the web tier instances must use the VPC endpoint's DNS name or its private IP addresses to connect to the application tier. The VPC endpoint provides a different set of IP addresses (from the subnet in Account A) than the NLB's private IP, which remains in Account B. Since the web tier continues to send traffic to the NLB's private IP, the packets are not routed through the VPC endpoint, causing connectivity failure because the VPC peering connection is no longer available.

Answer

The route tables in Account A's VPC do not have a route to the VPC endpoint service in Account B.

Answer

The VPC endpoint in Account A requires an Internet Gateway (IGW) to route traffic to the VPC endpoint service in Account B.

Answer

The Network Load Balancer in Account B is not configured to support TCP traffic.

Question 7

A company is running a two-tier application with a web tier and a database tier. The web tier must be accessible from the internet, but the database tier should only be accessible from the web tier. Which architecture should they use?

Accepted Answer

Web tier in public subnet, database tier in private subnet with a security group allowing only web tier.. The correct architecture places the web tier in a public subnet with an internet gateway for inbound traffic, and the database tier in a private subnet with a security group that only allows inbound traffic from the web tier's security group. This ensures the database is not directly reachable from the internet, adhering to the principle of least privilege and defense in depth. The security group acts as a stateful virtual firewall, allowing you to reference the web tier's security group as the source, which automatically adapts to any changes in the web tier's IP addresses.

Answer

Both tiers in public subnets with security groups restricting database access.

Answer

Both tiers in private subnets with a NAT Gateway for internet access.

Answer

Web tier in private subnet, database tier in public subnet with a security group.

Question 8

A company is deploying a public-facing web application on EC2 instances behind an Application Load Balancer. The ALB is configured to terminate HTTPS using a certificate from AWS Certificate Manager. What additional step is required to ensure the ALB can validate the certificate?

Accepted Answer

Ensure the certificate is in the same AWS region as the ALB.. For an Application Load Balancer to terminate HTTPS using a certificate from AWS Certificate Manager (ACM), the certificate must be in the same AWS region as the ALB. ACM certificates are region-specific resources; the ALB can only reference certificates that are stored in the same region where the ALB is deployed. This is a fundamental constraint of ACM integration with regional services like ALB.

Answer

Attach the certificate to an Amazon CloudFront distribution.

Answer

Create a DNS record to validate domain ownership.

Answer

Import the certificate into AWS Certificate Manager Private Certificate Authority.

Question 9

A company has a VPC with an AWS Site-to-Site VPN connection to their on-premises network. The VPN uses dynamic routing with BGP. The on-premises network is advertising a specific route to the VPC. However, instances in the VPC cannot reach the on-premises network. The VPN tunnels are up and BGP sessions are established. What should the engineer check?

Accepted Answer

Route propagation is enabled on the VPC route tables.. With dynamic routing over an AWS Site-to-Site VPN, BGP-learned routes are not automatically installed into VPC route tables. Route propagation must be explicitly enabled on each route table that needs to reach the on-premises network via the virtual private gateway (VGW). Even though the tunnels are up and BGP sessions are established, without route propagation enabled, the VPC route tables have no entry pointing the on-premises CIDR to the VGW, so instances cannot reach on-premises hosts.

Answer

The tunnel options include the correct encryption algorithms.

Answer

The on-premises router is advertising the route with the correct ASN.

Answer

The VPN connection's static routes are configured for the on-premises CIDR.

Question 10

A security engineer is designing a network security architecture for a multi-account AWS environment using AWS Organizations. The company requires that all VPC flow logs be delivered to a central S3 bucket in the security account. The security engineer has created a bucket policy that grants the necessary permissions. However, flow logs from member accounts are failing to be delivered. What is the most likely cause?

Accepted Answer

The bucket policy does not include a condition that restricts access to the flow log delivery service using aws:SourceArn or aws:SourceAccount.. The VPC Flow Logs delivery service uses a service-linked role to write to the destination S3 bucket. Without a condition in the bucket policy that restricts access using `aws:SourceArn` or `aws:SourceAccount`, the policy is vulnerable to the confused deputy problem, where a different AWS service or account could potentially write to the bucket. The missing condition causes the delivery to fail because the service cannot verify that the request originated from the expected source.

Answer

The member accounts have not created an IAM role with permissions to write to the central bucket.

Answer

The bucket policy does not grant write access to the member accounts' root user.

Answer

The central S3 bucket has not been configured with ACLs enabled.