ANS-C01 Practice Test 9 — 10 Questions

Question 1

A company is deploying a multi-tier application in a VPC. The web tier is in public subnets, and the application tier is in private subnets. The application tier needs to communicate with an on-premises database via an AWS Direct Connect connection. The company wants to minimize latency and maximize throughput. Which design should they use?

Accepted Answer

Place the application tier instances in a private subnet in the same VPC as the web tier. Attach a virtual private gateway to the VPC and connect it to the on-premises network via a Direct Connect private virtual interface.. Option A is correct because a Direct Connect private virtual interface (VIF) connected to a virtual private gateway (VGW) provides a dedicated, low-latency, high-throughput connection from the VPC to on-premises. The application tier in the private subnet can route traffic directly to the on-premises database via the VGW without traversing the internet or a NAT device, minimizing latency and maximizing throughput.

Answer

Place the application tier in a private subnet and use a NAT Gateway to route traffic to the on-premises network.

Answer

Place the application tier in a separate VPC and peer it to the web tier VPC. Use a Direct Connect connection attached to the web tier VPC.

Answer

Place the application tier in a separate VPC and use a VPN connection over the internet to connect to on-premises.

Question 2

A company has a VPC with public and private subnets in three Availability Zones. They have an Application Load Balancer (ALB) in the public subnets and a fleet of EC2 instances in the private subnets. The ALB needs to send traffic to the instances on port 443. What is the most secure way to configure the security groups?

Accepted Answer

ALB SG: inbound from 0.0.0.0/0 on port 443. Instance SG: inbound from ALB SG on port 443.. Option C is correct because it follows the principle of least privilege by restricting the ALB security group to only allow inbound traffic on port 443 from the internet (0.0.0.0/0) and the instance security group to only allow inbound traffic on port 443 from the ALB security group. This ensures that only the ALB can communicate with the instances on the required port, preventing direct access from other sources and reducing the attack surface.

Answer

ALB SG: inbound from 0.0.0.0/0 on all ports. Instance SG: inbound from ALB SG on all ports.

Answer

ALB SG: inbound from 0.0.0.0/0 on port 443. Instance SG: inbound from 0.0.0.0/0 on port 443.

Answer

ALB SG: inbound from 0.0.0.0/0 on port 443. Instance SG: inbound from ALB SG on all ports.

Question 3

A company wants to monitor network traffic between two VPCs that are peered. Which AWS feature can capture IP traffic information for analysis?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including traffic between peered VPCs. They log metadata such as source/destination IPs, ports, protocols, and packet accept/reject decisions, which can be published to CloudWatch Logs or Amazon S3 for analysis. This makes them the correct choice for monitoring network traffic between two peered VPCs.

Answer

AWS X-Ray

Answer

AWS Config

Answer

AWS CloudTrail

Question 4

A company wants to monitor network traffic in their VPC for troubleshooting and security analysis. They need to capture IP traffic information, including source/destination IPs, ports, and protocol, but not the packet payload. Which AWS service should be used?

Accepted Answer

VPC Flow Logs.. VPC Flow Logs capture metadata about IP traffic in a VPC, including source/destination IPs, ports, protocol, and packet counts, but never the payload. This meets the requirement for troubleshooting and security analysis without the overhead or privacy concerns of full packet capture.

Answer

Amazon CloudWatch Logs.

Answer

AWS Network Firewall.

Answer

AWS Traffic Mirroring.

Question 5

A company is using AWS Transit Gateway to connect multiple VPCs and an on-premises network via AWS Direct Connect. They need to ensure that traffic between VPCs is inspected by a centralized security appliance. How should they design the routing?

Accepted Answer

Create a Transit Gateway with separate route tables. Attach each VPC and the Direct Connect virtual interface to the Transit Gateway. In the route tables, propagate routes and add static routes to send inter-VPC traffic to the security appliance VPC.. Option D is correct because AWS Transit Gateway supports separate route tables, allowing you to isolate traffic domains. By attaching each VPC and the Direct Connect virtual interface to the Transit Gateway, you can create a centralized inspection VPC. Static routes in the Transit Gateway route tables direct inter-VPC traffic to the security appliance VPC, ensuring all traffic between VPCs is inspected before reaching its destination.

Answer

Use Network ACLs on the subnets to restrict traffic and allow inspection.

Answer

Create VPC peering connections between all VPCs and route traffic through a security appliance in a central VPC.

Answer

Use security groups on the security appliance to inspect traffic.

Question 6

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group behind a Network Load Balancer (NLB). The application requires that all packets from a given client session are sent to the same target instance for the duration of the session. Which feature should be enabled on the NLB to meet this requirement?

Accepted Answer

Enable stickiness using the source IP address. Option C is correct because enabling stickiness using the source IP address on a Network Load Balancer (NLB) ensures that all packets from a given client IP are routed to the same target instance for the duration of the session. This is achieved by the NLB hashing the source IP address (and optionally port and protocol) to consistently select the same target, which meets the requirement for session persistence without relying on application-layer cookies.

Answer

Enable proxy protocol v2

Answer

Enable cross-zone load balancing

Answer

Configure health checks to mark targets as healthy

Question 7

A network administrator is troubleshooting connectivity to a web server in subnet with network ACL 'acl-12345678'. The web server is on port 443. The administrator finds that traffic from IP 10.0.1.5 is being denied. Why is the traffic being denied?

Accepted Answer

The network ACL rule 100 denies traffic from 10.0.0.0/8, which includes the IP 10.0.1.5.. Option C is correct because network ACLs are stateless and evaluated in ascending order by rule number. Rule 100 denies traffic from 10.0.0.0/8, which includes the source IP 10.0.1.5, so any traffic from that IP is denied regardless of later allow rules. Since network ACLs do not track connection state, the deny is applied immediately upon matching rule 100.

Answer

The subnet is not associated with this network ACL.

Answer

The security group attached to the web server is blocking the traffic.

Answer

The network ACL rule 100 allows traffic from 0.0.0.0/0, but rule 200 denies traffic from 10.0.0.0/8, and rule 200 is evaluated first.

Question 8

A company is designing a hybrid network architecture that connects multiple VPCs in different AWS regions to an on-premises data center. The company wants to minimize the number of VPN tunnels and reduce management overhead. Which AWS service should be used to simplify this design?

Accepted Answer

AWS Transit Gateway with VPN attachments. AWS Transit Gateway with VPN attachments is correct because it acts as a central hub that connects multiple VPCs across different AWS regions and an on-premises data center through a single VPN connection. This minimizes the number of VPN tunnels by eliminating the need for individual VPN connections between each VPC and the on-premises network, and reduces management overhead through a single point of configuration and routing.

Answer

AWS Direct Connect with multiple virtual interfaces

Answer

AWS VPN CloudHub

Answer

VPC peering between each VPC and the on-premises network

Question 9

A company is designing a hybrid network using AWS Direct Connect. They have a VPC with CIDR 10.0.0.0/16 and an on-premises network with CIDR 192.168.0.0/16. They want to establish a Direct Connect private virtual interface with a virtual private gateway. Which THREE steps are required to complete the connectivity? (Choose three.)

Accepted Answer

Create a virtual private gateway and attach it to the VPC.. Option B is correct because a virtual private gateway (VGW) is the required AWS-side endpoint for a Direct Connect private virtual interface (VIF) to terminate on a single VPC. The VGW must be created and attached to the VPC before the private VIF can be associated with it, enabling private connectivity between the on-premises network and the VPC.

Answer

Create a Transit Gateway and attach the VPC to it.

Answer

Create a customer gateway object in the AWS account.

Question 10

A company has a VPC with public and private subnets in three Availability Zones. They have EC2 instances in private subnets that need to download patches from the internet. The company requires that all outbound traffic to the internet is logged and inspected. Which solution meets these requirements with the highest availability?

Accepted Answer

Create a centralized egress VPC with a NAT Gateway in each AZ. Peer the application VPCs to the egress VPC and route 0.0.0.0/0 traffic through a firewall appliance in the egress VPC.. Option D is correct because it meets the requirements for logging and inspecting all outbound internet traffic by routing it through a centralized firewall appliance in an egress VPC, while also providing high availability through NAT Gateways deployed in each Availability Zone. This architecture ensures that traffic is inspected before reaching the internet, and the use of multiple NAT Gateways eliminates single points of failure, achieving the highest availability compared to single-instance or single-gateway solutions.

Answer

Launch a NAT instance in one public subnet and configure all private subnet route tables to send 0.0.0.0/0 to the NAT instance.

Answer

Place a single NAT Gateway in one public subnet and configure all private subnet route tables to send 0.0.0.0/0 to that NAT Gateway.

Answer

Attach an internet gateway to the VPC and add a route in the private subnet route tables to send 0.0.0.0/0 to the internet gateway.