ANS-C01 Mock Exam 92 — 25 Questions

Question 1

A company is migrating its on-premises data center to AWS. As part of the migration, they need to establish connectivity between their on-premises network (10.0.0.0/8) and multiple VPCs in a single region. They are using AWS Transit Gateway with a Direct Connect gateway. They have two Direct Connect connections, each with a private virtual interface (VIF) to the Direct Connect gateway. The on-premises routers are configured with BGP and are advertising 10.0.0.0/8. The Transit Gateway has three VPC attachments: VPC1 (10.1.0.0/16), VPC2 (10.2.0.0/16), and VPC3 (10.3.0.0/16). All VPC attachments are in the same Transit Gateway route table, which also includes the Direct Connect gateway attachment. Initially, all VPCs can communicate with on-premises. After a maintenance window, the network team adds a new on-premises subnet (10.4.0.0/16) and updates the BGP advertisement to include 10.4.0.0/16. However, after the change, instances in VPC3 can no longer reach on-premises resources in any subnet, while VPC1 and VPC2 can still communicate with all on-premises subnets including the new one. The network engineer checks the Transit Gateway route table and sees that the route for 10.0.0.0/8 is present, pointing to the Direct Connect gateway attachment. What is the MOST likely cause of the issue?

Accepted Answer

The VPC3 subnet route tables have a static route for 10.0.0.0/8 that points to a non-existent or unavailable target. The issue is specific to VPC3. Since the route table has a route for 10.0.0.0/8, all VPCs should be able to reach on-premises. However, if VPC3 has a more specific route that conflicts, it might cause issues. But the most common cause is that the VPC3 route table (in the VPC itself) might have a local route or a VPN route that is more specific and overriding the Transit Gateway route. Alternatively, the Transit Gateway route table might have a specific route for VPC3 that is misconfigured. However, the description says the Transit Gateway route table has the correct route. The issue could be that VPC3's subnet route tables have a route for the on-premises CIDR pointing to a different target (like a VPN connection) that is now inactive or incorrect. But the question says after adding the new subnet, VPC3 lost connectivity entirely. Perhaps the BGP update caused a route flap or a prefix limit was exceeded on the Direct Connect gateway, but that would affect all VPCs. Since only VPC3 is affected, it's likely a VPC-specific issue. The most plausible is that the VPC3's route tables have a static route for the on-premises CIDR that was manually added and is now incorrect or conflicting. However, the best answer among the options is that the Transit Gateway route table has a blackhole route for 10.4.0.0/16, but that wouldn't affect all on-premises subnets. Let's think: The Direct Connect gateway might have a prefix limit that was exceeded when adding 10.4.0.0/16, causing the BGP session to drop, but that would affect all VPCs. The most likely single-VPC issue is that VPC3's route tables have a route for the on-premises CIDR pointing to an incorrect attachment, like a peering connection or VPN that is not working. But the options given might include such a scenario. I'll go with: The VPC3 route tables have a static route for 10.0.0.0/8 pointing to a network interface that no longer exists.

Answer

The BGP advertisement for 10.4.0.0/16 exceeded the allowed prefix limit on the Direct Connect gateway

Answer

The Direct Connect gateway is not propagating routes to the Transit Gateway for VPC3

Answer

The Transit Gateway route table has a route for 10.4.0.0/16 that is blackholed

Question 2

A company is deploying a new application on AWS and needs a highly available architecture across two Availability Zones (AZs) in a single region. The application consists of an Application Load Balancer (ALB) in front of a fleet of EC2 instances running in an Auto Scaling group, and an Amazon RDS for MySQL database with Multi-AZ deployment. The company requires that the application remain available even if an entire AZ fails. The network team has designed the VPC with two public subnets and two private subnets, each in a different AZ. The ALB is internet-facing and placed in the public subnets. The EC2 instances are in the private subnets. The RDS instance is also in the private subnets. The route tables are configured with a default route via an Internet Gateway for public subnets and via a NAT Gateway for private subnets. What change is MOST likely needed to ensure the architecture can survive an AZ failure?

Accepted Answer

Create a NAT Gateway in each Availability Zone. To survive an AZ failure, each AZ must have its own NAT Gateway to provide outbound internet access for instances in that AZ. If a single NAT Gateway is used (e.g., in one AZ), and that AZ fails, instances in the other AZ lose internet connectivity. Similarly, a single NAT Gateway would be a single point of failure. Therefore, the architecture should include a NAT Gateway in each AZ. The ALB and RDS Multi-AZ already provide AZ resilience. So the missing component is a NAT Gateway per AZ.

Answer

Add a second Internet Gateway in the other AZ

Answer

Use a Network Load Balancer instead of an Application Load Balancer

Answer

Configure the Auto Scaling group to launch instances in both AZs

Question 3

A media company is designing a global streaming platform using AWS. They have a primary workload in us-east-1 (VPC A, 10.0.0.0/16) and a secondary workload in eu-west-1 (VPC B, 10.1.0.0/16). They need to replicate data between these VPCs with low latency and high throughput, and also allow their on-premises data center (10.2.0.0/16) in us-east-2 to communicate with both VPCs. The on-premises network is connected to AWS via two Direct Connect connections terminating in us-east-1 and eu-west-1. The company uses a Transit Gateway in each region, with inter-region peering between the Transit Gateways. The on-premises network has BGP advertisements for 10.2.0.0/16. The routing is set up such that the on-premises network can reach both VPCs via the Direct Connect connections. However, the VPCs cannot reach each other's CIDRs. The network engineer checks the Transit Gateway route tables and sees that the inter-region peering attachment is associated with the appropriate route tables, and static routes for the remote VPC CIDRs are present. What is the MOST likely cause of the problem?

Accepted Answer

The static routes for the remote VPC CIDRs are pointing to the Direct Connect attachment instead of the inter-region peering attachment. In a Transit Gateway inter-region peering, you need to add static routes in both directions to point to the peering attachment. The engineer confirmed static routes are present, so that might not be the issue. However, a common misconfiguration is that the on-premises network's route propagation via Direct Connect may be causing the Transit Gateway to prefer the on-premises path (which may not have connectivity between regions) over the inter-region peering. But the VPCs cannot reach each other's CIDRs, so the issue is likely that the route tables for the VPC attachments do not have the routes for the remote VPC CIDRs pointing to the inter-region peering attachment. Alternatively, the inter-region peering attachment might not be in the correct route table. The most likely issue is that the Transit Gateway route tables for the VPCs do not include routes for the remote VPC CIDRs via the peering attachment. Since the engineer says they are present, the issue might be that the propagation from the Direct Connect attachment is overriding the static route with a less preferred route or causing a conflict. Actually, the most common problem is that the static routes for the inter-region CIDRs are pointing to the wrong attachment (e.g., the Direct Connect attachment instead of the peering attachment).

Answer

The inter-region peering attachment is not in the same route table as the VPC attachments

Answer

The VPC CIDRs overlap with each other

Answer

The on-premises network is advertising a default route that is being preferred

Question 4

A company is designing a network architecture for a two-tier web application. The web tier runs on EC2 instances behind an Application Load Balancer (ALB) in public subnets. The application tier runs on EC2 instances in private subnets. The application tier needs to access an Amazon RDS for PostgreSQL database in the same private subnets. The company requires that all traffic between the ALB and web tier, as well as between web tier and application tier, remain within the AWS network and not traverse the internet. The current design uses an Internet Gateway (IGW) for public subnet internet access and a NAT Gateway for private subnet outbound internet access. The web tier instances have a default route to the IGW, and the application tier instances have a default route to the NAT Gateway. The security groups are configured correctly. However, the application tier cannot connect to the RDS database. What is the MOST likely cause?

Accepted Answer

The application tier instances are using the RDS public DNS name instead of the private DNS name. The RDS database is in private subnets. The application tier instances are also in private subnets. They should be able to communicate within the same VPC via private IP addresses. The issue is not about internet access. The most likely cause is that the application tier instances are trying to connect to the RDS endpoint using the public DNS name, which resolves to a public IP, and the traffic is being routed to the NAT Gateway, which blocks inbound traffic from the internet (the RDS public endpoint). The application tier should use the private DNS name or the private IP address of the RDS instance. Alternatively, the security group might be misconfigured, but the question says security groups are correct. The most common mistake is using the public endpoint.

Answer

The RDS database is in a different VPC

Answer

The ALB is not configured to forward traffic to the web tier

Answer

The NAT Gateway is not configured with the correct route to the RDS subnet

Question 5

A global company is designing a multi-region architecture with VPCs in us-east-1, eu-west-1, and ap-southeast-1. They are using AWS Transit Gateway with inter-region peering between all three regions. The company also has on-premises data centers in the US and Europe connected via Direct Connect to the Transit Gateways in us-east-1 and eu-west-1 respectively. The on-premises networks use BGP to advertise their CIDRs (10.0.0.0/8 for US, 172.16.0.0/12 for Europe). The Transit Gateway route tables are configured to propagate routes from all attachments. The company needs all VPCs and on-premises networks to be able to communicate with each other. After configuration, the VPC in ap-southeast-1 can communicate with the VPCs in us-east-1 and eu-west-1, but cannot communicate with either on-premises network. The VPCs in us-east-1 and eu-west-1 can communicate with all on-premises networks. What is the MOST likely cause of this issue?

Accepted Answer

The inter-region peering attachments in ap-southeast-1 do not have route propagation enabled. The on-premises CIDRs are advertised via Direct Connect into the Transit Gateways in us-east-1 and eu-west-1. Those Transit Gateways propagate the routes to the inter-region peering attachments. However, the Transit Gateway in ap-southeast-1 needs to have routes for the on-premises CIDRs pointing to the inter-region peering attachments. This is typically done by enabling route propagation from the inter-region peering attachment. If the route propagation is not enabled, the routes will not be added automatically. The engineer likely assumed propagation works automatically, but it must be explicitly enabled for each attachment. Since the VPCs in us-east-1 and eu-west-1 can reach on-premises, the local Direct Connect routes are fine. The issue is that the ap-southeast-1 Transit Gateway route table does not have routes for the on-premises CIDRs via the peering attachments.

Answer

The VPC in ap-southeast-1 has a security group that blocks traffic from on-premises IP ranges

Answer

The on-premises networks are not advertising their CIDRs to the ap-southeast-1 region

Answer

The Direct Connect gateways are not attached to the Transit Gateways in us-east-1 and eu-west-1

Question 6

A company has a VPC with CIDR 10.0.0.0/16. They have a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). They have a Network Load Balancer (NLB) in the public subnet, and EC2 instances in the private subnet. The NLB has a target group pointing to the EC2 instances. The security group for the EC2 instances allows traffic from the NLB's private IP addresses on port 80. The network ACL for the private subnet allows inbound traffic on port 80 from the public subnet CIDR and outbound ephemeral ports to 0.0.0.0/0. However, clients connecting to the NLB experience intermittent timeouts. The network engineer checks the NLB logs and sees that connections are established but occasionally drop. The engineer also notices that the EC2 instances have a default route to a NAT Gateway in the public subnet. What is the most likely cause of the intermittent timeouts?

Accepted Answer

The EC2 instances have a default route to the NAT Gateway, causing asymmetric routing.. Option A is correct. When the NLB uses client IP preservation (default), the target instance receives traffic with the client's source IP. The target then sends the response back to the client IP. But the target's default route points to the NAT Gateway, so the response goes to the NAT Gateway instead of directly back to the NLB. The NAT Gateway then sends the response to the internet, but the client expects the response from the NLB's IP, causing asymmetry and potential drops. Option B is wrong because health checks are independent. Option C is wrong because disabling cross-zone load balancing does not cause timeouts. Option D is wrong because the NLB does not have security groups.

Answer

Cross-zone load balancing is disabled on the NLB.

Answer

The NLB health checks are failing, causing targets to be removed.

Answer

The security group for the NLB is blocking inbound traffic.

Question 7

A company has a multi-tier application deployed in a VPC. The web tier consists of an internet-facing Application Load Balancer (ALB) in public subnets, and EC2 instances in private subnets. The application tier runs on EC2 instances in separate private subnets, and the database tier uses an Amazon RDS for MySQL instance in private subnets. The application tier needs to connect to the database on port 3306. The security group for the RDS instance (sg-database) has an inbound rule allowing TCP 3306 from the security group of the application tier (sg-app). The application tier instances can connect to the database, but the web tier instances cannot. The web tier instances should not have direct database access. What is the most likely reason for the web tier's inability to connect to the database?

Accepted Answer

The security group of the RDS instance does not have an inbound rule allowing traffic from the web tier's security group.. The security group rule on sg-database allows traffic from sg-app. Since the web tier instances are in a different security group, they are not allowed. Option A is wrong because the rule is from sg-app, not from the web tier's security group. Option B is wrong because NACLs are stateless and if they were blocking, the application tier would also be affected. Option C is wrong because the database is in a private subnet and does not need a NAT Gateway. Option D is wrong because the route table is not relevant for security group rules.

Answer

The network ACL for the database subnet is blocking inbound traffic from the web tier subnets.

Answer

The RDS instance is in a public subnet and requires a NAT Gateway for communication.

Answer

The route table for the web tier subnets does not have a route to the database subnets.

Question 8

A company has a VPC with a CIDR of 10.0.0.0/16. They have two Availability Zones, each with a public subnet (10.0.1.0/24 and 10.0.2.0/24) and a private subnet (10.0.3.0/24 and 10.0.4.0/24). They have an internet-facing ALB in the public subnets and EC2 instances in the private subnets. The EC2 instances need to download updates from the internet. They deploy a NAT Gateway in each public subnet and add routes in the private subnet route tables pointing to the respective NAT Gateway in the same AZ. However, the EC2 instances in AZ2 cannot access the internet, while those in AZ1 can. What is the most likely cause?

Accepted Answer

The NAT Gateway in AZ2 does not have an Elastic IP address assigned.. The NAT Gateway in AZ2 may be in a different public subnet than the one the private subnet route points to, or the NAT Gateway may not have an associated Elastic IP. Option A is wrong because cross-AZ routing is possible but not the issue. Option B is wrong because the route is to the specific NAT Gateway in the same AZ. Option D is wrong because the issue is specific to one AZ, not a global issue.

Answer

The security group of the EC2 instances in AZ2 is blocking outbound traffic.

Answer

The private subnet in AZ2 is routing traffic to the NAT Gateway in AZ1, which is in a different Availability Zone and incurs cross-AZ charges but should still work.

Answer

The route table for the private subnet in AZ2 is missing a route to the NAT Gateway.

Question 9

A company uses AWS Global Accelerator to improve performance for a web application hosted on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The Global Accelerator has an endpoint group in the us-east-1 Region with the ALB as an endpoint. Users in Asia report high latency. The company creates a new endpoint group in ap-southeast-1 and adds the same ALB (which is still in us-east-1). However, users in Asia still experience high latency. What should the network engineer do to reduce latency for Asian users?

Accepted Answer

Add an additional ALB in ap-southeast-1 and add it as an endpoint in the ap-southeast-1 endpoint group. Global Accelerator uses anycast IPs and routes traffic to the nearest endpoint group. But if the ALB is only in us-east-1, traffic from Asia will still go to us-east-1. To reduce latency, the company needs to deploy the application in ap-southeast-1 and add a local ALB as an endpoint. Options A and C do not address the physical distance. Option D is incorrect because Global Accelerator endpoints can be ALBs, but cross-Region ALB is not supported (endpoint group and endpoint must be in same Region).

Answer

Change the endpoint in ap-southeast-1 to use the same ALB but with a cross-Region VPC peering

Answer

Configure Global Accelerator to use weighted routing to direct more traffic to ap-southeast-1

Answer

Use Lambda@Edge to cache content at CloudFront edge locations in Asia

Question 10

A media company runs a latency-sensitive streaming application on Amazon EC2 instances in a VPC. The application sends UDP traffic to multiple on-premises destinations via an AWS Transit Gateway with a VPN attachment. Users report occasional freezing. Network monitoring shows no packet loss on the VPN tunnel, but the application logs show out-of-order packets and high jitter. The company uses a single VPN tunnel with BGP dynamic routing over the public internet. The on-premises router has a 50ms latency to the AWS endpoint. The application requires low jitter and in-order delivery. What should a network engineer do to resolve the issue?

Accepted Answer

Replace the VPN attachment with an AWS Direct Connect private VIF to provide a consistent path. UDP traffic over a single VPN tunnel over the internet can experience jitter and reordering due to variable network conditions. Using AWS Direct Connect provides a consistent, low-latency path that eliminates internet variability. Option A (multiple VPN tunnels) may not resolve jitter inherent to internet transit. Option B (TCP instead of UDP) changes application protocol, not a network solution. Option D (enable jumbo frames) does not address jitter.

Answer

Add a second VPN tunnel to the same Transit Gateway to load balance traffic

Answer

Enable jumbo frames on the VPN tunnel to reduce packet overhead

Answer

Change the application to use TCP instead of UDP

Question 11

A company has a Direct Connect connection with a private virtual interface (VIF) attached to a Virtual Private Gateway (VGW) that is associated with a single VPC (10.0.0.0/16). The on-premises network uses BGP to exchange routes. The company has recently acquired another company and needs to connect to their VPC (172.16.0.0/16) in the same region. They want to use the existing Direct Connect connection to access both VPCs. The network engineer creates a Transit Gateway, attaches both VPCs, and creates a transit virtual interface (VIF) to the Transit Gateway. The engineer also deletes the private VIF. However, after the change, on-premises users cannot reach either VPC. What should the engineer do to restore connectivity?

Accepted Answer

Configure BGP on the on-premises router to peer with the Transit Gateway over the transit VIF.. Option D is correct because the on-premises router must be configured to establish BGP peering with the Transit Gateway over the transit VIF. Option A is incorrect because a new VPN connection is unnecessary. Option B is incorrect because the VPCs are already attached. Option C is incorrect because route propagation must be enabled in the TGW route tables.

Answer

Attach the VPCs to the Transit Gateway with different route tables.

Answer

Create a new private VIF to each VPC.

Answer

Enable route propagation on the Transit Gateway route tables.

Question 12

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to connect two separate branch offices using AWS Client VPN. Each branch office has a different subnet: Branch A uses 10.0.1.0/24 and Branch B uses 10.0.2.0/24. The Client VPN endpoint is configured with a CIDR range of 10.0.3.0/24. The route table for the VPC has the local route and routes to the Client VPN endpoint. Users from both branches can connect to the VPN but cannot communicate with each other. What is the most likely reason?

Accepted Answer

The branch subnets 10.0.1.0/24 and 10.0.2.0/24 are part of the VPC CIDR, so the VPC routes traffic locally instead of via the VPN. Branch subnets overlap with the VPC CIDR, causing routing conflicts. The VPC sees 10.0.1.0/24 and 10.0.2.0/24 as local, thus traffic destined to those addresses is routed locally within the VPC, not to the VPN. Options B and C are not relevant to inter-branch communication. Option D would not cause the issue because branch subnets are within the VPC CIDR.

Answer

The route tables in the branch subnets do not have routes to the Client VPN endpoint

Answer

The Client VPN endpoint is configured with a CIDR that overlaps with the branch subnets

Answer

The security group for the Client VPN endpoint does not allow inbound traffic from branch subnets

Question 13

A large enterprise uses AWS Organizations with multiple accounts. The central networking account hosts a Transit Gateway with attachments from VPCs in various accounts. The enterprise uses AWS Resource Access Manager (RAM) to share the Transit Gateway with other accounts. A network engineer in a spoke account creates a VPC and attaches it to the shared Transit Gateway. The attachment shows 'available' state. However, traffic from the spoke VPC to other attached VPCs fails. The spoke VPC route table has a route to the Transit Gateway for 0.0.0.0/0. The Transit Gateway route table has routes for the spoke VPC CIDR and other VPC CIDRs. What is the most likely cause?

Accepted Answer

The Transit Gateway owner has not accepted the VPC attachment. When a Transit Gateway is shared via RAM, the owner account must accept the attachment request. The attachment shows 'available' but not 'associated'? Actually, for shared TGW, the owner account needs to accept the attachment. The attachment state 'available' means it's ready but not yet associated with a TGW route table in the owner's account. The owner must associate it. Option B is wrong because the TGW route table has routes. Option C is wrong because the spoke route table has a route. Option D is wrong because no cross-account roles are needed for attachment.

Answer

The spoke account does not have an IAM role to access the Transit Gateway

Answer

The spoke VPC route table does not have routes to the other VPC CIDRs

Answer

The Transit Gateway route table does not propagate routes from the spoke VPC attachment

Question 14

A company has a VPC with a public subnet hosting a web server. They want to make the web server accessible over the internet. The web server has a public IP address. The public subnet route table has a default route (0.0.0.0/0) to an internet gateway. The security group for the web server allows inbound HTTP (port 80) from 0.0.0.0/0. However, external users cannot access the web server. What is the most likely cause?

Accepted Answer

The internet gateway is not attached to the VPC. The internet gateway must be attached to the VPC. If it is not attached, traffic cannot flow. Option B (NACL) could be blocking but default NACL allows all traffic. Option C (web server not listening) is possible but less likely than IGW attachment. Option D (route table) is already correct.

Answer

The web server is not listening on port 80

Answer

The route table for the public subnet does not have a route to the internet gateway

Answer

The network ACL for the public subnet is blocking inbound HTTP traffic

Question 15

A company uses AWS Direct Connect with a private VIF to connect to a VPC. The VPC has a virtual private gateway (VGW). The on-premises network uses BGP to exchange routes with the VGW. The company wants to route traffic from the VPC to an on-premises subnet 192.168.1.0/24. The on-premises router advertises 192.168.1.0/24 over BGP. However, instances in the VPC cannot reach that subnet. The VPC route table has the local route and a route to the VGW for 0.0.0.0/0. What is the most likely cause?

Accepted Answer

The 192.168.1.0/24 subnet overlaps with the VPC CIDR, causing the local route to take precedence. The VPC route table does not have a specific route for 192.168.1.0/24 pointing to the VGW. The default route (0.0.0.0/0) goes to the VGW, but if the on-premises subnet is part of the VPC CIDR (e.g., if VPC CIDR is 192.168.0.0/16), then the local route takes precedence and traffic never goes to VGW. Since the subnet is 192.168.1.0/24, it could be within a VPC CIDR like 192.168.0.0/16. The local route would match and traffic stays in VPC. Option B is wrong because allowed prefixes are configured in Direct Connect Gateway, not VPC route table. Option C is wrong because if the subnet is within VPC CIDR, propagation doesn't help. Option D is wrong because the route is advertised.

Answer

BGP route propagation is disabled on the VPC route table

Answer

The VPC route table does not have a specific route for 192.168.1.0/24 pointing to the virtual private gateway

Answer

The Direct Connect virtual interface does not have the allowed prefixes configured

Question 16

A company has a VPC with public and private subnets across two Availability Zones. They have a Network Load Balancer (NLB) in the public subnets. The NLB has a target group of EC2 instances in the private subnets. The NLB is configured with TLS listeners and uses a certificate from AWS Certificate Manager (ACM). Clients connect to the NLB over the internet. Some clients report connection timeouts. The NLB access logs show that the connections are established but then hang. The target instances are healthy. The security groups for the instances allow inbound TCP/443 from the NLB's private IPs. What is the most likely cause?

Accepted Answer

The target group is configured with protocol TLS instead of TCP. NLB with TLS termination requires that the target group uses TCP protocol (not TLS) because NLB terminates TLS and forwards plain TCP to targets. If the target group is configured with TLS protocol, the NLB will attempt to initiate a TLS handshake with the targets, which may fail if targets are not expecting TLS (or if certificates mismatch). This can cause connections to hang. Option B (cross-zone load balancing) would not cause hang. Option C (idle timeout) would cause disconnects, not hang. Option D (security group) is correct as described.

Answer

Cross-zone load balancing is disabled, causing uneven distribution

Answer

The security group for the NLB is blocking traffic from clients

Answer

The NLB idle timeout is set too low

Question 17

A company has a VPC with IPv4 and IPv6 CIDRs. They have a public subnet with an internet gateway and a private subnet with a NAT gateway. EC2 instances in the private subnet need to download updates from the internet. The instances have IPv6 addresses. The private subnet route table has a default route (::/0) pointing to an egress-only internet gateway. However, instances cannot reach IPv6 internet destinations. The egress-only internet gateway is attached to the VPC and in 'available' state. What is the most likely cause?

Accepted Answer

The instances do not have an IPv6 address assigned. Egress-only internet gateway is for outbound-only IPv6 traffic. It requires a route in the subnet route table. The route is present. However, egress-only internet gateway does not support IPv6 traffic that originates from the private subnet if the instances have public IPv6 addresses? Actually, egress-only internet gateway works for instances with IPv6 addresses. The issue might be that the instances have IPv6 addresses but the route table for the private subnet does not have a route to the egress-only internet gateway. But the question says it does. Another common issue: the egress-only internet gateway must be the target of the default IPv6 route. The most likely cause is that the route table for the public subnet (not private) does not have a route to the internet gateway for IPv6, but that's for public subnet. For private subnet, egress-only internet gateway is correct. But instances may need to have IPv6 addresses assigned. Option B (NAT gateway) is for IPv4 only. Option C (security group) is not likely. Option D (auto-assign IPv6) might be disabled.

Answer

The security group for the instances is blocking outbound IPv6 traffic

Answer

The NAT gateway does not support IPv6

Answer

The egress-only internet gateway is not attached to the VPC

Question 18

A company has a VPC with a CIDR of 10.0.0.0/16. They have an Application Load Balancer (ALB) in public subnets and EC2 instances in private subnets. The ALB is configured to route traffic to the instances. Users can reach the ALB, but the ALB returns 502 Bad Gateway errors. The target group health checks are failing. The instances are running a web server on port 80. The security group for the instances allows inbound traffic from the ALB's security group on port 80. The network ACL for the private subnets allows inbound traffic on port 80 from the public subnet CIDR (10.0.1.0/24). What is the most likely cause of the health check failures?

Accepted Answer

The network ACL for the private subnets is stateless and is blocking the return traffic from the instances to the ALB. Option B is correct because the health checks originate from the ALB's private IPs, which are in the public subnet CIDR 10.0.1.0/24, but the network ACL must allow inbound traffic from the ALB's security group source? Actually, the NACL allows from the public subnet CIDR, which should include the ALB's IPs. However, the NACL is stateless and must also allow outbound traffic from the instance's subnet to the ALB. The issue is likely that the NACL is blocking the return traffic. Option A is wrong because the security group allows the traffic. Option C is wrong because the NACL allows inbound on port 80 from the public subnet. Option D is wrong because the target group port is correct.

Answer

The network ACL for the private subnets does not allow inbound traffic on port 80 from the ALB's subnet

Answer

The security group for the instances does not allow inbound traffic from the ALB

Answer

The target group is configured with the wrong port

Question 19

A financial services company is migrating its on-premises data center to AWS. The company has a three-tier application that consists of web servers, application servers, and a database. The application servers must communicate with the database using a private IP address. The database is hosted on an Amazon RDS for MySQL instance in a private subnet. The application servers are in a public subnet. The company has a security requirement that all traffic between the application servers and the database must be encrypted in transit. The network engineer has created a security group for the RDS instance that allows inbound traffic on port 3306 from the security group of the application servers. The engineer has also enabled encryption at rest for the RDS instance. During a security audit, it is discovered that traffic between the application servers and the database is not encrypted. The application team confirms that the application is configured to connect to the database using standard MySQL client library without any SSL/TLS options. The network engineer must ensure that all traffic between the application servers and the database is encrypted without modifying the application code. What should the network engineer do?

Accepted Answer

Deploy a Network Load Balancer (NLB) with a TLS listener in front of the RDS instance. Configure the NLB to terminate TLS from the application servers and forward traffic to the RDS instance using TLS.. Option B is correct because using a Network Load Balancer (NLB) with TLS termination between the application servers and the RDS instance allows offloading the SSL/TLS encryption from the application. The NLB can be configured with a TLS listener that terminates the client's TLS connection and then re-encrypts traffic to the RDS instance using TLS. This requires the RDS instance to have SSL/TLS enabled. Option A is incorrect because the application does not support TLS, so enabling SSL on RDS alone will not encrypt traffic if the client does not request it. Option C is incorrect because a VPN connection between subnets is unnecessarily complex and still requires the application to use TLS. Option D is incorrect because creating a new security group does not enforce encryption at the transport layer.

Answer

Create an AWS Site-to-Site VPN connection between the application servers' subnet and the database subnet to encrypt all traffic.

Answer

Enable the 'require_secure_transport' parameter in the RDS parameter group and set it to ON.

Answer

Modify the security group for the RDS instance to only allow traffic from the application servers' security group on port 3306 with the 'tls' protocol.

Question 20

A company uses AWS PrivateLink to access a SaaS application hosted in another AWS account. The SaaS provider has created a VPC endpoint service in their account. The consumer has created a VPC endpoint in their VPC. The consumer's VPC has a route table with a local route and a route to a NAT gateway. The VPC endpoint is associated with a security group that allows inbound HTTPS from the consumer's VPC CIDR. The consumer's EC2 instances can resolve the DNS name of the endpoint but cannot connect to the SaaS service. What is the most likely cause?

Accepted Answer

The VPC endpoint security group does not allow inbound HTTPS from the consumer's EC2 instances. For PrivateLink, the consumer's VPC endpoint should be associated with a security group that allows outbound traffic to the endpoint service. The security group for the endpoint controls inbound traffic to the endpoint from the consumer's instances. But the issue is that instances can resolve DNS but cannot connect. The most likely cause is that the endpoint's security group does not allow inbound HTTPS from the instances. Option B (NAT gateway) is irrelevant because PrivateLink uses private IPs. Option C (route table) is wrong because the endpoint uses local routing via the endpoint's network interfaces. Option D (availability) is wrong because DNS resolution works.

Answer

The consumer's route table routes traffic to the endpoint via the NAT gateway

Answer

The VPC endpoint service is not available in the consumer's Availability Zone

Answer

The consumer's route table does not have a route to the VPC endpoint