ANS-C01 Hard Questions — 25 Difficult Questions

Question 1

Which THREE of the following are valid considerations when designing a multi-Region active-active application using AWS Global Accelerator?

Accepted Answer

You can assign different weights to endpoints in different Regions to control traffic distribution.. AWS Global Accelerator allows you to assign different weights to endpoints in different Regions, enabling granular control over traffic distribution for active-active architectures. This is achieved through endpoint group weights, where you can adjust the proportion of traffic sent to each Regional endpoint group, supporting scenarios like gradual rollouts or load balancing across Regions.

Answer

Global Accelerator supports sticky sessions (session affinity) based on client IP.

Answer

Global Accelerator provides a set of static IP addresses that are unique to each Region.

Question 2

Which THREE factors should be considered when designing a VPC for a multi-tier application that requires high availability and security? (Choose three.)

Accepted Answer

Provision subnets in at least two Availability Zones. Deploying subnets across at least two Availability Zones (AZs) ensures high availability by eliminating a single point of failure. If one AZ experiences an outage, the application can continue serving traffic from the other AZ. This is a foundational principle for building fault-tolerant architectures in AWS.

Answer

Assign public IP addresses to all instances for direct access

Answer

Use a single Availability Zone to reduce latency

Question 3

A company has deployed an application in a VPC with public and private subnets. The application uses an Amazon RDS for MySQL database in a private subnet. To meet security requirements, the database must not be accessible from the internet. The application team needs to connect to the database for maintenance using SSH over a bastion host. Which architecture is the most secure?

Accepted Answer

Bastion host in a public subnet with a security group allowing SSH from the corporate IP range, and database security group allowing MySQL from the bastion host's security group. The most secure architecture because it restricts SSH access to the bastion host from only the corporate IP range, and the database security group allows MySQL (port 3306) traffic solely from the bastion host's security group. This ensures the database is never directly exposed to the internet and only accepts connections from the bastion, which itself is locked down to authorized corporate IPs. The use of security group referencing (instead of IP-based rules) provides dynamic, scalable access control that automatically applies to any instances with the bastion's security group.

Answer

Bastion host in a public subnet with the same security group as the database, allowing SSH from the corporate IP range and MySQL from the bastion

Answer

Bastion host in a public subnet with a security group allowing SSH from 0.0.0.0/0, and database security group allowing MySQL from the bastion host's security group

Answer

Connect to the database directly using a Site-to-Site VPN without a bastion host

Question 4

A company is designing a network architecture for a critical application that requires high availability and low latency. The application will be deployed on EC2 instances in an Auto Scaling group across three Availability Zones in a single region. The instances will communicate with an Amazon RDS database. Which configuration will provide the MOST resilient and performant network connectivity?

Accepted Answer

Create an RDS Multi-AZ cluster with one writer and two reader instances in different AZs, and use the cluster endpoint for writes and reader endpoint for reads.. A Multi-AZ cluster with one writer and two reader instances provides both high availability and low latency. The cluster endpoint automatically routes write traffic to the primary instance, while the reader endpoint distributes read traffic across the reader instances in different Availability Zones, reducing latency and improving resilience. This architecture ensures that if one Availability Zone fails, the database remains available without manual intervention, meeting the critical application's requirements.

Answer

Launch a single RDS instance in a public subnet and use Route 53 latency-based routing to direct traffic.

Answer

Use a Network Load Balancer in front of the RDS instance to distribute connections across Availability Zones.

Answer

Place the RDS instance in a single Availability Zone and use a read replica in another AZ for failover.

Question 5

A security engineer created the above S3 bucket policy to grant public read access to objects in the 'confidential/' prefix. However, users report that they receive 'Access Denied' errors when trying to access objects that have the tag 'classification: public'. What is the most likely cause?

Accepted Answer

The objects in the 'confidential/' prefix do not have the required tag 'classification: public'.. The bucket policy includes a condition that requires the object to have the tag 'classification: public' (using s3:ExistingObjectTag). If the objects in the 'confidential/' prefix do not have this tag, the condition fails and access is denied, even though the prefix matches. The policy explicitly grants public read access only to objects that satisfy both the prefix and the tag condition.

Answer

The bucket policy does not grant access to objects owned by other AWS accounts.

Answer

The 's3:GetObjectVersion' action is not allowed because the bucket is not versioned.

Answer

The condition should use 'StringLike' instead of 'StringEquals' for tag matching.

Question 6

A company is designing a network architecture for a multi-account AWS environment using AWS Transit Gateway. They need to meet the following requirements: (1) Centralized inspection of traffic between VPCs using a firewall appliance. (2) Isolated development environments that cannot communicate with each other but can access the internet via a centralized NAT gateway. (3) Compliance with PCI DSS for production workloads, requiring encryption in transit between VPCs. Which TWO actions should they take?

Accepted Answer

Create a dedicated inspection VPC with a firewall appliance and attach it to the Transit Gateway. Use Transit Gateway route tables to route traffic from all VPCs through the inspection VPC.. It enables centralized traffic inspection by attaching a dedicated inspection VPC with a firewall appliance to the Transit Gateway and using separate route tables to force all inter-VPC traffic through that inspection VPC. This design meets the requirement for centralized inspection without requiring complex peering or VPN configurations.

Answer

Use VPC Peering for all inter-VPC communication

Answer

Use AWS Site-to-Site VPN between each VPC and a central VPN hub

Answer

Use AWS Client VPN to connect development VPCs to the production VPC

Question 7

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team observes that traffic between two VPCs (VPC A and VPC B) is not being forwarded correctly. The transit gateway route table is configured with static routes for the VPC CIDRs. Which THREE steps should the engineer take to troubleshoot this issue? (Choose THREE.)

Accepted Answer

Verify that the transit gateway route table contains the CIDR blocks of both VPCs.. The transit gateway route table must contain the CIDR blocks of both VPCs for traffic to be forwarded between them. Without these static routes, the transit gateway has no destination to route the traffic, causing it to be dropped. Verifying the route table entries ensures the necessary paths exist.

Answer

Check the Direct Connect virtual interface status.

Answer

Verify that the NAT Gateway in each VPC is properly configured.

Question 8

A network engineer has created a gateway VPC endpoint for S3 as shown in the exhibit. The endpoint is associated with route table rtb-12345678. An EC2 instance in a subnet that uses route table rtb-12345678 tries to download an object from my-bucket. The request fails with an access denied error. Which change should the engineer make to resolve the issue?

Accepted Answer

Add a route in route table rtb-12345678 that sends traffic to the S3 service via the VPC endpoint.. The endpoint policy requires the aws:SourceVpc condition to match the VPC ID, but the condition key is misspelled or the value is incorrect? Actually, the condition is correct. However, the error is likely because the route table does not have a route to the endpoint. Gateway endpoints require a route in the associated route table that points to the endpoint. Option A is wrong because the endpoint policy already allows s3:GetObject. Option B is wrong because the endpoint is already associated with the route table. Option C is wrong because the bucket policy is not shown; but the issue is likely the route. Option D is correct: add a route to the S3 service in route table rtb-12345678.

Answer

Associate the endpoint with a different route table.

Answer

Add a bucket policy to my-bucket that allows access from the VPC endpoint.

Answer

Modify the endpoint policy to allow all S3 actions.

Question 9

A company has a multi-VPC architecture with VPCs in the same region. They need to ensure that traffic between VPCs never traverses the public internet and is encrypted in transit. Which solution meets these requirements with the lowest operational overhead?

Accepted Answer

Use AWS PrivateLink to connect VPCs via Network Load Balancers.. AWS PrivateLink allows you to connect VPCs privately using VPC endpoints and Network Load Balancers. Traffic stays within the AWS network and never traverses the public internet. When the application uses TLS/HTTPS, the traffic is encrypted end-to-end. This solution has low operational overhead because PrivateLink is fully managed and requires no VPN tunnels or third-party appliances.

Answer

Use AWS Transit Gateway with IPsec VPN attachments between VPCs.

Answer

Use VPC peering connections between all VPCs.

Answer

Use AWS Transit Gateway with VPC attachments and enable multicast.

Question 10

A company is migrating a legacy on-premises application to AWS. The application requires multicast traffic between instances within a VPC. The network engineer must design a solution that supports multicast without modifying the application. Which AWS service or feature should be used?

Accepted Answer

AWS Transit Gateway with multicast domain.. AWS Transit Gateway supports multicast through the creation of a multicast domain, which allows multicast traffic to flow between instances in different subnets within the same VPC or across attached VPCs without modifying the application. This is the only native AWS service that provides multicast forwarding, making it the correct choice for this requirement.

Answer

VPC peering connections between all instance subnets.

Answer

Application Load Balancer with UDP listener.

Answer

AWS Site-to-Site VPN connections with multicast routing enabled.

Question 11

A network engineer is troubleshooting a VPN connection between an on-premises network (172.16.0.0/16) and an AWS VPC (10.0.0.0/16). The VPN status is 'available' but traffic is not passing. The engineer runs the command shown in the exhibit. What is the most likely cause of the issue?

Accepted Answer

The VPC route table does not have a route for 172.16.0.0/16 pointing to the virtual private gateway.. The VPN status is 'available', which indicates that the VPN tunnels are established and the BGP sessions (if configured) are up. However, traffic still fails because the VPC route table lacks a route for the on-premises CIDR (172.16.0.0/16) pointing to the virtual private gateway (VGW). Without this route, the VPC does not know to send traffic destined for the on-premises network through the VPN connection, even though the tunnels themselves are operational.

Answer

The VPN tunnels are not in 'UP' state.

Answer

The tunnel inside CIDRs overlap with the VPC CIDR.

Answer

The BGP session is not established.

Question 12

A company has a VPC with CIDR 10.0.0.0/16 and two subnets: 10.0.1.0/24 (public) and 10.0.2.0/24 (private). The company wants to add a new subnet for a third tier. Which of the following are valid subnet CIDRs that can be added? (Select TWO.)

Accepted Answer

10.0.3.0/24. (10.0.3.0/24) is correct because it falls within the VPC CIDR 10.0.0.0/16 and does not overlap with the existing subnets (10.0.1.0/24 and 10.0.2.0/24). The /24 prefix length matches the existing subnet structure, and the third octet (3) is outside the range of the first two subnets, ensuring no IP address conflict.

Answer

10.0.1.128/25

Answer

10.1.0.0/16

Answer

10.0.2.64/26

Question 13

A company has a VPC with a CIDR of 10.0.0.0/16 and uses AWS Direct Connect with a private VIF to connect to on-premises. The on-premises network uses 10.0.0.0/8. The company wants to access an AWS service (e.g., S3) privately from the VPC without using public endpoints. Which solution avoids IP overlap and meets the requirement?

Accepted Answer

Create a VPC endpoint for S3 (Gateway type) and use it from the VPC.. A Gateway VPC Endpoint for S3 allows private access to S3 from within the VPC without traversing the internet or requiring public IPs. It avoids IP overlap because the endpoint uses prefix lists and route table entries within the VPC's 10.0.0.0/16 range, and does not involve the on-premises 10.0.0.0/8 network. The Direct Connect private VIF is not used for S3 traffic, so the overlapping CIDR is irrelevant.

Answer

Create a NAT gateway in a public subnet and route S3 traffic through it.

Answer

Use a public virtual interface and access S3 via public endpoints.

Answer

Add a route in the VPC route table pointing to the Direct Connect virtual interface for the S3 prefix list.

Question 14

A company is designing a network architecture for a critical application that requires sub-millisecond latency between EC2 instances in the same placement group. The instances will be launched in a single Availability Zone in us-east-1. Which combination of features should be used to achieve the lowest latency?

Accepted Answer

Launch instances in a cluster placement group with Elastic Fabric Adapter (EFA) enabled.. Elastic Fabric Adapter (EFA) provides OS-bypass capabilities that enable HPC and machine learning workloads to achieve sub-millisecond latency by bypassing the operating system kernel for inter-instance communication. Combined with a cluster placement group, which ensures instances are in close physical proximity within a single Availability Zone, this configuration delivers the lowest possible latency for tightly coupled applications.

Answer

Launch instances in a cluster placement group with Enhanced Networking (ENA) enabled.

Answer

Launch instances in a spread placement group with SR-IOV enabled.

Answer

Launch instances in a spread placement group with Enhanced Networking (ENA) enabled.

Question 15

A company is running a latency-sensitive application in a VPC with a public subnet and a private subnet. The application in the private subnet needs to access an Amazon S3 bucket in the same region. The company wants to minimize latency and avoid using a NAT gateway. Which solution meets these requirements?

Accepted Answer

Create a VPC Gateway Endpoint for Amazon S3 and update the route table for the private subnet. A VPC Gateway Endpoint for Amazon S3 allows instances in a private subnet to access S3 without traversing the internet or requiring a NAT gateway. This minimizes latency by routing traffic over the AWS internal network, and it avoids the cost and complexity of NAT devices. The route table for the private subnet must be updated with a route pointing to the gateway endpoint for the S3 prefix list.

Answer

Use S3 Transfer Acceleration and access the bucket via the public endpoint

Answer

Attach an Internet Gateway to the VPC and route the private subnet traffic through a NAT instance

Answer

Set up a NAT gateway in the public subnet and route traffic to the S3 bucket through it

Question 16

A company has created a VPC Interface Endpoint for Amazon ECR (Docker registry API) as shown in the exhibit. However, an EC2 instance in the same VPC is unable to authenticate with the ECR registry using the private DNS name. What is the most likely cause?

Accepted Answer

Private DNS is not enabled for the endpoint. The most likely cause is that Private DNS is not enabled for the VPC Interface Endpoint. When Private DNS is enabled, the endpoint automatically associates a Route 53 private hosted zone with the VPC, allowing the default private DNS name (e.g., *.dkr.ecr.us-east-1.amazonaws.com) to resolve to the endpoint's elastic network interface IP addresses. Without this, the EC2 instance will resolve the private DNS name to the public IP of the ECR service, bypassing the endpoint and failing authentication due to network path issues.

Answer

The endpoint service name is incorrect; it should be com.amazonaws.us-east-1.ecr.api

Answer

The endpoint is not in the 'available' state

Answer

The endpoint type should be Gateway, not Interface

Question 17

A network engineer is setting up a cross-account Route 53 Resolver rule association. The engineer creates the above resource-based policy on a resolver rule in account 111111111111. The engineer then tries to associate the rule from account 222222222222 but receives an access denied error. What is the MOST likely reason for the failure?

Accepted Answer

The policy's Principal is set to account 111111111111 instead of account 222222222222.. The resource-based policy on the Route 53 Resolver rule must specify the consuming account (222222222222) as the Principal to authorize cross-account association. Since the policy incorrectly sets the Principal to the owning account (111111111111), the request from account 222222222222 lacks the required permissions, resulting in an access denied error.

Answer

The policy does not allow the 'route53resolver:AssociateResolverRule' action.

Answer

The policy does not include the 'route53resolver:DisassociateResolverRule' action.

Answer

The resolver rule is not shared with account 222222222222.

Question 18

A company has a multi-account AWS environment using AWS Organizations. The network team wants to centralize VPC traffic inspection using a Transit Gateway and a firewall appliance in a central account. Which THREE steps are required to implement this design? (Choose THREE.)

Accepted Answer

Create a Transit Gateway in the central account and attach the central VPC.. A Transit Gateway (TGW) in the central account acts as the hub for VPC traffic inspection. Attaching the central VPC (which contains the firewall appliance) to the TGW allows all inter-VPC traffic to be routed through the central inspection VPC, enabling centralized traffic inspection without requiring VPC peering or per-spoke firewalls.

Answer

Create a VPC peering connection between each spoke VPC and the central VPC.

Answer

Deploy a firewall appliance in each spoke VPC.

Question 19

A company is migrating its on-premises data center to AWS. As part of the migration, they need to establish connectivity between their on-premises network (10.0.0.0/8) and multiple VPCs in a single region. They are using AWS Transit Gateway with a Direct Connect gateway. They have two Direct Connect connections, each with a private virtual interface (VIF) to the Direct Connect gateway. The on-premises routers are configured with BGP and are advertising 10.0.0.0/8. The Transit Gateway has three VPC attachments: VPC1 (10.1.0.0/16), VPC2 (10.2.0.0/16), and VPC3 (10.3.0.0/16). All VPC attachments are in the same Transit Gateway route table, which also includes the Direct Connect gateway attachment. Initially, all VPCs can communicate with on-premises. After a maintenance window, the network team adds a new on-premises subnet (10.4.0.0/16) and updates the BGP advertisement to include 10.4.0.0/16. However, after the change, instances in VPC3 can no longer reach on-premises resources in any subnet, while VPC1 and VPC2 can still communicate with all on-premises subnets including the new one. The network engineer checks the Transit Gateway route table and sees that the route for 10.0.0.0/8 is present, pointing to the Direct Connect gateway attachment. What is the MOST likely cause of the issue?

Accepted Answer

The VPC3 subnet route tables have a static route for 10.0.0.0/8 that points to a non-existent or unavailable target. The issue is specific to VPC3. Since the route table has a route for 10.0.0.0/8, all VPCs should be able to reach on-premises. However, if VPC3 has a more specific route that conflicts, it might cause issues. But the most common cause is that the VPC3 route table (in the VPC itself) might have a local route or a VPN route that is more specific and overriding the Transit Gateway route. Alternatively, the Transit Gateway route table might have a specific route for VPC3 that is misconfigured. However, the description says the Transit Gateway route table has the correct route. The issue could be that VPC3's subnet route tables have a route for the on-premises CIDR pointing to a different target (like a VPN connection) that is now inactive or incorrect. But the question says after adding the new subnet, VPC3 lost connectivity entirely. Perhaps the BGP update caused a route flap or a prefix limit was exceeded on the Direct Connect gateway, but that would affect all VPCs. Since only VPC3 is affected, it's likely a VPC-specific issue. The most plausible is that the VPC3's route tables have a static route for the on-premises CIDR that was manually added and is now incorrect or conflicting. However, the best answer among the options is that the Transit Gateway route table has a blackhole route for 10.4.0.0/16, but that wouldn't affect all on-premises subnets. Let's think: The Direct Connect gateway might have a prefix limit that was exceeded when adding 10.4.0.0/16, causing the BGP session to drop, but that would affect all VPCs. The most likely single-VPC issue is that VPC3's route tables have a route for the on-premises CIDR pointing to an incorrect attachment, like a peering connection or VPN that is not working. But the options given might include such a scenario. I'll go with: The VPC3 route tables have a static route for 10.0.0.0/8 pointing to a network interface that no longer exists.

Answer

The BGP advertisement for 10.4.0.0/16 exceeded the allowed prefix limit on the Direct Connect gateway

Answer

The Direct Connect gateway is not propagating routes to the Transit Gateway for VPC3

Answer

The Transit Gateway route table has a route for 10.4.0.0/16 that is blackholed

Question 20

A company has a Direct Connect connection with a private VIF and a public VIF. The private VIF is used to access VPC resources, and the public VIF is used to access AWS public services. Recently, the company enabled AWS Global Accelerator for its application. The network team notices that traffic to the application via Global Accelerator is not using the Direct Connect connection but is going over the internet. What should the team do to ensure traffic uses the Direct Connect public VIF?

Accepted Answer

Configure a VPN connection over the Direct Connect public VIF to route Global Accelerator traffic. Global Accelerator uses static anycast IP addresses that are not directly reachable over a Direct Connect public VIF. The public VIF provides access to AWS public services via the Direct Connect connection, but Global Accelerator IPs are not advertised over the BGP session. To route on-premises traffic to Global Accelerator through Direct Connect, you must establish a VPN connection over the public VIF. This VPN tunnel encapsulates the traffic and sends it over the Direct Connect link, ensuring it does not traverse the public internet. Option B is incorrect because you cannot advertise Global Accelerator IPs from your on-premises router; they are owned and advertised by AWS. Option C is incorrect because a Direct Connect gateway is used for private VIFs and does not integrate with Global Accelerator. Option D is incorrect because a private VIF is for accessing VPC resources, not public services like Global Accelerator.

Answer

Advertise the Global Accelerator IP addresses on the on-premises router to route traffic via the public VIF

Answer

Attach a Direct Connect gateway to the Global Accelerator

Answer

Create a private VIF for Global Accelerator traffic