ANS-C01 Practice Test 9 — 10 Questions

Question 1

A company has deployed a transit gateway with multiple VPC attachments and VPN attachments. The network team notices that traffic between two VPCs is taking an unexpected path and experiencing high latency. Which tool should be used to trace the path and identify the specific transit gateway route table that is being used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

VPC Reachability Analyzer. VPC Reachability Analyzer performs connectivity and path analysis between sources and destinations, showing the route table decisions, including the specific transit gateway route table used. Option D is correct. Options A (CloudTrail), B (CloudWatch ServiceLens), and C (X-Ray) are not designed for path tracing.

Answer

AWS CloudTrail

Answer

Amazon CloudWatch ServiceLens

Answer

AWS X-Ray

Question 2

A company is using AWS Direct Connect with a private VIF to connect to multiple VPCs in the same region. The company wants to use AWS Transit Gateway to simplify management. Which three components are required to achieve this? (Choose THREE.)

Accepted Answer

Direct Connect private virtual interface. Options A, B, and E are correct. A Direct Connect private virtual interface provides the physical connection from on-premises to AWS. AWS Transit Gateway serves as the central hub to interconnect multiple VPCs. A Direct Connect gateway is required to associate the Direct Connect virtual interface with the Transit Gateway, enabling connectivity to multiple VPCs in the same region. Options C and D are incorrect: VPC peering and Site-to-Site VPN are not required when using Transit Gateway with Direct Connect.

Answer

VPC peering connection

Answer

AWS Site-to-Site VPN connection

Question 3

A company is using AWS Direct Connect to connect its on-premises network to AWS. The company wants to encrypt all traffic between its on-premises network and AWS. Which solution meets this requirement?

Accepted Answer

Use a private VIF and establish an IPsec VPN tunnel over the Direct Connect connection.. AWS Direct Connect does not natively encrypt traffic; it provides a private, dedicated network connection. To meet the encryption requirement, you can establish an IPsec VPN tunnel over the private VIF, which encrypts all traffic between the on-premises network and the VPC. This approach combines the low latency and reliability of Direct Connect with the security of IPsec encryption.

Answer

Use a public virtual interface (VIF) and route traffic through a NAT gateway.

Answer

Use a private virtual interface (VIF) and enable encryption on the Direct Connect connection.

Answer

Use a private VIF and enable TLS on all applications.

Question 4

A company has a VPC with multiple subnets. They want to centrally manage and inspect all traffic between subnets using a security appliance. Which AWS service should be used to achieve this?

Accepted Answer

Transit Gateway with a security appliance in a central VPC. Transit Gateway with a security appliance in a central VPC (Option D) is the correct approach because it allows centralized inspection of all traffic between subnets by routing traffic through a central inspection VPC where security appliances are deployed. Option A (VPC peering) is incorrect because it only provides direct connectivity between two VPCs and does not support centralized inspection. Option B (AWS Route 53 Resolver) is a DNS service and has no traffic inspection capability. Option C (AWS Network Firewall) is a managed firewall service, but it does not provide the multi-VPC architecture needed to centrally route traffic from multiple subnets/VPCs; Transit Gateway is required to route traffic to the firewall.

Answer

VPC peering

Answer

AWS Route 53 Resolver

Answer

AWS Network Firewall

Question 5

A company wants to monitor network traffic between its EC2 instances and determine which IP addresses are generating the most traffic. Which AWS service should be used to capture and analyze this traffic?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces in a VPC, enabling analysis of traffic patterns and identification of high-traffic IP addresses. AWS Trusted Advisor (Option A) provides best-practice checks, not traffic data. AWS CloudTrail (Option B) records API calls, not network traffic. AWS Config (Option C) tracks resource configuration changes.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

AWS Config

Question 6

A company has a Direct Connect connection with two private virtual interfaces (VIFs) to two different VPCs in the same AWS Region. The company wants to use AWS Transit Gateway to simplify connectivity between these VPCs and their on-premises network. Which steps are required to integrate the existing Direct Connect connection with Transit Gateway?

Accepted Answer

Create a Direct Connect gateway, associate the existing VIFs, and attach the Direct Connect gateway to the Transit Gateway.. AWS Direct Connect private VIFs cannot be attached directly to a Transit Gateway. Instead, you must create a Direct Connect Gateway, associate the existing private VIFs with it, and then attach the Direct Connect Gateway to the Transit Gateway. This architecture allows the Transit Gateway to route traffic between the on-premises network (via the Direct Connect connection) and the attached VPCs, while also enabling inter-VPC routing through the Transit Gateway.

Answer

Set up a VPN connection over the Direct Connect link and attach the VPN to the Transit Gateway.

Answer

Attach the existing private VIFs directly to the Transit Gateway.

Answer

Create a new private VIF on the Direct Connect connection and attach it to the Transit Gateway.

Question 7

A company is troubleshooting a slow network connection between two EC2 instances in the same VPC but different Availability Zones. Which TWO tools can be used to measure throughput and diagnose performance issues?

Accepted Answer

iperf. Options A and C are correct. iperf is a tool used to measure network throughput between two hosts. Traceroute diagnoses network path and latency, which can help identify performance bottlenecks. Options B, D, and E are incorrect: tcpdump captures packets but does not measure throughput; nslookup is a DNS lookup tool that does not measure network performance; ping measures latency but not throughput.

Answer

tcpdump

Answer

nslookup

Answer

ping

Question 8

A company is migrating on-premises workloads to AWS using AWS Direct Connect. The company has two Direct Connect connections from different providers for redundancy. Which configuration ensures seamless failover with automatic traffic rerouting?

Accepted Answer

Create two Direct Connect gateways, each attached to a separate Transit Gateway, and advertise the same prefixes via BGP.. Using two Direct Connect gateways, each attached to a separate Transit Gateway, with the same BGP prefixes advertised from both connections enables active-active or active-passive failover via BGP path selection (e.g., AS_PATH prepending or MED). This design ensures automatic traffic rerouting if one connection fails, as BGP withdraws the failed path and the remaining path takes over without manual intervention.

Answer

Use one Direct Connect connection as primary and the other as standby with static routes.

Answer

Connect both Direct Connect connections to the same Virtual Private Gateway (VGW) and enable BGP.

Answer

Use a VPN connection over the internet as a backup for the Direct Connect links.

Question 9

A company is using AWS Transit Gateway with multiple VPC attachments. They need to ensure that traffic between two specific VPCs is encrypted in transit. The VPCs are in the same AWS region. What is the SIMPLEST solution?

Accepted Answer

Create a VPN attachment on the Transit Gateway and route traffic through it. Creating a VPN attachment on the Transit Gateway and routing traffic through it provides encryption in transit between VPCs. The VPN attachment establishes an IPsec VPN tunnel over the AWS network, ensuring encryption. Option A is incorrect because Transit Gateway route tables do not provide encryption. Option B is incorrect because AWS PrivateLink is designed for accessing services, not for VPC-to-VPC encryption. Option D is incorrect because VPC peering does not encrypt traffic by default and is not the simplest solution.

Answer

Enable encryption on the Transit Gateway route tables

Answer

Use AWS PrivateLink to connect the VPCs

Answer

Use VPC peering instead of Transit Gateway and enable encryption

Question 10

A company has deployed a multi-VPC architecture with AWS Transit Gateway. The network team notices that traffic between two VPCs is intermittently dropped. Both VPCs are attached to the same transit gateway. Which action should the network engineer take to troubleshoot the issue?

Accepted Answer

Enable VPC Flow Logs on the subnets of the VPCs.. VPC Flow Logs capture IP traffic information at the network interface level, allowing engineers to analyze traffic patterns and identify dropped packets. Option A is incorrect because AWS Direct Connect is a dedicated network connection from on-premises to AWS, not between VPCs. Option B is incorrect because Transit Gateway Network Manager provides a visual representation of the network topology but does not provide packet-level details. Option C is incorrect because CloudWatch metrics for transit gateway attachments show aggregate metrics like bytes in/out but not individual packet drops.

Answer

Configure AWS Direct Connect to route traffic between the VPCs.

Answer

Use Transit Gateway Network Manager to view the network topology.

Answer

Enable CloudWatch metrics for the transit gateway attachments.