ANS-C01 Hard Questions — 25 Difficult Questions

Question 1

Refer to the exhibit. A subnet is created in VPC vpc-abcde but no explicit route table association is set. What is the default route for internet-bound traffic from this subnet?

Accepted Answer

Traffic goes through the NAT Gateway nat-67890.. When a subnet is created in a VPC without an explicit route table association, it is implicitly associated with the VPC's main route table. The main route table in this scenario includes a default route (0.0.0.0/0) pointing to NAT Gateway nat-67890, so internet-bound traffic from this subnet is directed through the NAT Gateway. This allows instances in private subnets to initiate outbound internet connections while preventing inbound traffic from the internet.

Answer

Traffic is dropped because no explicit association is set.

Answer

Traffic goes through the Internet Gateway.

Answer

Traffic is dropped because no Internet Gateway is present.

Question 2

A company has a Direct Connect connection with multiple virtual interfaces (VIFs). They notice that traffic from on-premises to a VPC is being dropped. The VPC is associated with a private VIF. The on-premises router has a BGP route to the VPC's CIDR. The VPC's route table has a route to the virtual private gateway. What is the MOST likely cause of the dropped traffic?

Accepted Answer

The VPC route table does not have a route pointing to the virtual private gateway for the on-premises CIDR. For return traffic from on-premises to reach the VPC, the VPC route table must contain a route for the on-premises CIDR pointing to the virtual private gateway. The question states the VPC route table only has a route to the VGW (presumably for the VPC CIDR or a default), but not specifically for the on-premises CIDR, so packets arriving at the VPC have no matching route and are dropped.

Answer

The MTU size on the Direct Connect connection is too small

Answer

The BGP session is not established

Answer

The allowed prefixes on the virtual private gateway do not include the on-premises CIDR

Question 3

Which TWO of the following are best practices for securing a VPC with AWS Network Firewall? (Choose two.)

Accepted Answer

Deploy firewall endpoints in at least two Availability Zones for high availability.. Option A is correct because AWS Network Firewall firewall endpoints are Availability Zone–scoped, so deploying endpoints in at least two AZs ensures high availability and prevents a single-AZ failure from taking down inspection. Option C is correct because stateful rule groups allow deep packet inspection and application-layer (Layer 7) filtering using Suricata-compatible rules, which is essential for detecting and blocking sophisticated threats. Option B is incorrect because stateless rules alone cannot perform application-layer inspection and are not a best practice for comprehensive security. Option D is incorrect because Network Firewall can inspect both inbound and outbound traffic, not just outbound. Option E is incorrect because the firewall should be deployed in a dedicated subnet (typically a firewall subnet) rather than the same subnet as workloads, to maintain proper traffic segmentation and routing.

Answer

Use only stateless rules to minimize processing overhead.

Answer

Use Network Firewall only for outbound traffic filtering.

Answer

Deploy the firewall in the same subnet as the workload for low latency.

Question 4

Which THREE of the following are considerations when designing a multi-account VPC architecture using AWS Transit Gateway? (Choose 3.)

Accepted Answer

Transit Gateway can be integrated with Direct Connect Gateway. AWS Transit Gateway acts as a central hub for interconnecting VPCs and on-premises networks. It can be integrated with Direct Connect Gateway, allowing a single Direct Connect connection to reach multiple VPCs attached to the Transit Gateway, simplifying hybrid network design and reducing operational overhead.

Answer

Each VPC must have a unique route table

Answer

VPCs with overlapping CIDR blocks can be attached

Question 5

A network engineer is troubleshooting connectivity issues between two VPCs that are peered. The VPCs are in the same region but different accounts. The engineer verifies that the route tables and security group rules are correctly configured. However, instances in VPC A cannot ping instances in VPC B. What is the most likely cause?

Accepted Answer

The route tables in VPC A point to a VPN gateway instead of the VPC peering connection. For VPC peering to work, both VPCs' route tables must have explicit routes pointing to the peering connection (pcx-xxxx) for the peer's CIDR. If VPC A's route table points to a VPN gateway instead of the peering connection, traffic destined for VPC B is sent to the VPN instead of the peering link, breaking connectivity even though security groups and NACLs are correct. This is the most likely cause given the scenario.

Answer

Network ACLs are not configured to allow inbound ICMP

Answer

Security groups are stateful and block return traffic

Answer

The VPC peering connection is in the 'failed' state

Question 6

A company is deploying a critical application across multiple AWS accounts. The network team wants to simplify IP address management and ensure that VPCs in different accounts can communicate securely. The company has a centralized network account with a transit gateway. Which architecture should the company use?

Accepted Answer

Use AWS Resource Access Manager to share the transit gateway in the network account with other accounts and attach their VPCs.. AWS Resource Access Manager (RAM) allows you to share a transit gateway from a centralized network account with other AWS accounts, enabling VPCs in those accounts to attach to the shared transit gateway. This simplifies IP address management by providing a single hub for inter-VPC routing and avoids the complexity of managing multiple VPC peering connections. The transit gateway supports transitive routing, so VPCs in different accounts can communicate securely through the centralized gateway without needing direct peering.

Answer

Create VPC peering connections between each VPC in different accounts.

Answer

Configure VPC endpoints in each account to communicate through the network account.

Answer

Set up AWS Direct Connect between accounts and route through the network account.

Question 7

A company has a multi-VPC architecture with VPCs in the same region. They need to ensure that traffic between VPCs never traverses the public internet and is encrypted in transit. Which solution meets these requirements with the lowest operational overhead?

Accepted Answer

Use AWS PrivateLink to connect VPCs via Network Load Balancers.. AWS PrivateLink allows you to connect VPCs privately using VPC endpoints and Network Load Balancers. Traffic stays within the AWS network and never traverses the public internet. When the application uses TLS/HTTPS, the traffic is encrypted end-to-end. This solution has low operational overhead because PrivateLink is fully managed and requires no VPN tunnels or third-party appliances.

Answer

Use AWS Transit Gateway with IPsec VPN attachments between VPCs.

Answer

Use VPC peering connections between all VPCs.

Answer

Use AWS Transit Gateway with VPC attachments and enable multicast.

Question 8

A company has a VPC with a CIDR of 10.0.0.0/16 and uses AWS Direct Connect with a private VIF to connect to on-premises. The on-premises network uses 10.0.0.0/8. The company wants to access an AWS service (e.g., S3) privately from the VPC without using public endpoints. Which solution avoids IP overlap and meets the requirement?

Accepted Answer

Create a VPC endpoint for S3 (Gateway type) and use it from the VPC.. A Gateway VPC Endpoint for S3 allows private access to S3 from within the VPC without traversing the internet or requiring public IPs. It avoids IP overlap because the endpoint uses prefix lists and route table entries within the VPC's 10.0.0.0/16 range, and does not involve the on-premises 10.0.0.0/8 network. The Direct Connect private VIF is not used for S3 traffic, so the overlapping CIDR is irrelevant.

Answer

Create a NAT gateway in a public subnet and route S3 traffic through it.

Answer

Use a public virtual interface and access S3 via public endpoints.

Answer

Add a route in the VPC route table pointing to the Direct Connect virtual interface for the S3 prefix list.

Question 9

A company has created a VPC Interface Endpoint for Amazon ECR (Docker registry API) as shown in the exhibit. However, an EC2 instance in the same VPC is unable to authenticate with the ECR registry using the private DNS name. What is the most likely cause?

Accepted Answer

Private DNS is not enabled for the endpoint. The most likely cause is that Private DNS is not enabled for the VPC Interface Endpoint. When Private DNS is enabled, the endpoint automatically associates a Route 53 private hosted zone with the VPC, allowing the default private DNS name (e.g., *.dkr.ecr.us-east-1.amazonaws.com) to resolve to the endpoint's elastic network interface IP addresses. Without this, the EC2 instance will resolve the private DNS name to the public IP of the ECR service, bypassing the endpoint and failing authentication due to network path issues.

Answer

The endpoint service name is incorrect; it should be com.amazonaws.us-east-1.ecr.api

Answer

The endpoint is not in the 'available' state

Answer

The endpoint type should be Gateway, not Interface

Question 10

A company's security team notices that a VPC flow log record shows an outbound connection from a private EC2 instance to an IP address in a restricted country. The security group allows outbound 0.0.0.0/0 for TCP 443. The network ACL allows outbound traffic to 0.0.0.0/0 on ephemeral ports. The company uses AWS Network Firewall with a firewall policy that has a stateful rule group that denies traffic to the restricted country. The flow log shows the traffic was accepted. What is the most likely cause?

Accepted Answer

The subnet's route table does not have a route that sends traffic to the AWS Network Firewall endpoint.. AWS Network Firewall's stateful rules are only evaluated for traffic that is routed through the firewall endpoint. If the subnet's route table does not include a route directing traffic to the firewall endpoint, the traffic bypasses the firewall entirely, allowing the outbound connection even though the firewall policy denies it. Option A is incorrect because VPC Flow Logs capture all accepted and rejected traffic after security group and NACL evaluation. Option C is incorrect because the network ACL allows outbound traffic on ephemeral ports, so inbound return traffic is permitted by the default ephemeral port rule. Option D is incorrect because the security group explicitly allows outbound HTTPS (TCP 443) to 0.0.0.0/0, which is permissive.

Answer

VPC Flow Logs are not capturing all traffic.

Answer

The network ACL inbound rule blocks the return traffic.

Answer

The security group outbound rule is not configured correctly.

Question 11

A company has multiple AWS accounts under AWS Organizations. The security team wants to centrally log all network traffic that is denied by security group rules across all accounts. Which approach meets this requirement with the least operational overhead?

Accepted Answer

Enable VPC Flow Logs with organization-level aggregation and publish to a central S3 bucket. VPC Flow Logs can capture rejected traffic, and publishing to a central S3 bucket using Organization-level aggregation simplifies management. Option D is correct because it uses VPC Flow Logs with organization-level aggregation. Option A is wrong because AWS Config does not log network traffic. Option B is wrong because it requires per-account setup. Option C is wrong because CloudTrail does not capture network flows.

Answer

Enable AWS Config rules for security group changes and send logs to a central account

Answer

Create VPC Flow Logs in each account and publish to a central S3 bucket

Answer

Use AWS CloudTrail to log all API calls and filter for security group events

Question 12

A company is designing a hybrid network with AWS Direct Connect. They have multiple VPCs in the same Region and want to use a single Direct Connect connection to access all VPCs. Which AWS resource should be used?

Accepted Answer

Direct Connect Gateway. A Direct Connect Gateway allows you to associate up to 10 Virtual Private Gateways (VGWs) or Transit Gateways in the same or different AWS accounts, enabling a single Direct Connect connection to reach multiple VPCs in the same Region. This is the correct resource because it acts as a hub that terminates the Direct Connect virtual interfaces (VIFs) and propagates routes to the associated VPCs via their VGWs or Transit Gateways.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

Virtual Private Gateway

Question 13

A company has a VPC with multiple subnets across three Availability Zones. They are deploying an NFS file system using Amazon EFS. They need high availability and low latency from all subnets. Which EFS deployment option meets these requirements?

Accepted Answer

Use EFS Standard storage class with Multi-AZ and create mount targets in each Availability Zone.. The EFS Standard storage class provides Multi-AZ durability and availability, and creating mount targets in each Availability Zone ensures that EC2 instances in any subnet can connect to EFS with low latency by using a mount target in the same AZ. This architecture avoids cross-AZ data transfer charges and minimizes latency, meeting both high availability and low latency requirements.

Answer

Use EFS One Zone storage class with a single mount target in the same Availability Zone as the application.

Answer

Use EFS Standard storage class with Multi-AZ and create a single mount target in one Availability Zone.

Answer

Use EFS One Zone storage class and create mount targets in each Availability Zone.

Question 14

A company is using AWS Client VPN for remote access. Users can authenticate and establish a VPN connection, but they cannot access resources in the VPC. The Client VPN endpoint is associated with a subnet in the VPC. The security group for the Client VPN endpoint allows all traffic. What is the most likely cause?

Accepted Answer

There is no authorization rule to allow access to the VPC CIDR.. AWS Client VPN requires authorization rules to permit access to the VPC CIDR. Without an authorization rule, even if authentication and connection succeed, the client cannot access VPC resources. The security group allowing all traffic is irrelevant because the authorization rule is a separate access control layer. Therefore, the missing authorization rule is the most likely cause.

Answer

The Client VPN endpoint is not associated with the correct subnet.

Answer

The route table for the subnet does not have a route to the Client VPN endpoint.

Answer

The Client VPN endpoint's server certificate is expired.

Question 15

Which THREE of the following are required to configure a site-to-site VPN connection between an on-premises network and an Amazon VPC? (Select THREE.)

Accepted Answer

A customer gateway resource representing the on-premises VPN device.. A customer gateway resource is required because it represents the on-premises VPN device in AWS, providing the necessary configuration information such as the device's public IP address and BGP ASN (if dynamic routing is used) to establish the site-to-site VPN connection. Without this resource, AWS has no reference to the remote endpoint for the IPsec tunnels.

Answer

A public virtual interface.

Answer

An AWS Direct Connect connection.

Question 16

A company is deploying a global web application that will be accessed by users in North America, Europe, and Asia. The application runs on Amazon EC2 instances behind Application Load Balancers (ALBs) in three AWS Regions: us-east-1, eu-west-1, and ap-southeast-1. The company wants to provide a single global anycast IP address that routes users to the closest healthy endpoint based on latency, and must ensure that if an entire Region becomes unavailable, traffic is automatically redirected to the next closest Region. The solution must also support WebSocket connections. Which AWS service should the network engineer use to meet these requirements?

Accepted Answer

AWS Global Accelerator with a standard accelerator and endpoint groups in each Region.. AWS Global Accelerator provides static anycast IP addresses that act as a fixed entry point for global applications. It uses the AWS global network to route traffic to the optimal endpoint based on latency, and it performs health checks to automatically fail over to healthy endpoints in other Regions within seconds. It supports TCP and UDP, including WebSocket, making it the correct choice for this requirement.

Answer

AWS Transit Gateway with inter-Region peering and equal-cost multi-path routing.

Answer

Amazon CloudFront with a custom origin and Lambda@Edge for failover.

Answer

Amazon Route 53 with latency-based routing and health checks.

Question 17

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. It needs to connect to two other VPCs: VPC B (10.1.0.0/16) and VPC C (10.2.0.0/16). The company wants to use AWS Transit Gateway. Which THREE configurations are required to enable full mesh connectivity between all three VPCs?

Accepted Answer

Associate each VPC attachment with the Transit Gateway route table.. Associating each VPC attachment with the Transit Gateway route table is necessary for the Transit Gateway to know which attachments can communicate. Without this association, the Transit Gateway would not forward traffic between the VPCs, even if routes are present in the route table.

Answer

Create separate Transit Gateway route tables for each VPC to isolate traffic.

Answer

Create a VPN attachment to each VPC for encrypted communication.

Question 18

A company has a Direct Connect connection with a private VIF to a VPC. They want to extend this connectivity to multiple VPCs in the same region without creating additional VIFs. Which solution should they implement?

Accepted Answer

Use a Direct Connect Gateway and attach the VPCs. A Direct Connect Gateway (DX Gateway) is a managed service that allows you to associate a single private virtual interface (VIF) with up to 10 VPCs in the same AWS Region (or across Regions with inter-region peering). This enables the company to extend their existing Direct Connect connection to multiple VPCs without provisioning additional VIFs, simplifying management and reducing costs.

Answer

Provision additional private VIFs for each VPC

Answer

Use VPC peering between the VPCs

Answer

Use a Transit VPC with VPN connections

Question 19

A company is designing a multi-account AWS environment using AWS Organizations. They want to restrict the use of certain instance types across all accounts. Which approach should they use to enforce this policy?

Accepted Answer

Create a service control policy (SCP) that denies the ec2:RunInstances action for noncompliant instance types and attach it to the root organizational unit.. Service control policies (SCPs) in AWS Organizations are the correct mechanism to enforce permission guardrails across multiple accounts. An SCP attached to the root organizational unit applies to all member accounts and can deny the ec2:RunInstances action for specific instance types, ensuring centralized, preventive control. SCPs do not grant permissions; they only limit the maximum available permissions.

Answer

Create an IAM policy that denies the ec2:RunInstances action for noncompliant instance types and attach it to each IAM user.

Answer

Set up AWS Config rules to detect noncompliant instances and trigger an AWS Lambda function to terminate them.

Answer

Use AWS CloudTrail to monitor ec2:RunInstances events and send alerts.

Question 20

A company is using AWS Direct Connect to connect its on-premises data center to AWS. The company has a single hosted virtual interface (VIF) with a private VIF to a VPC. The network team notices that traffic from on-premises to AWS is asymmetric—some packets go through the Direct Connect while others use a VPN backup. The team wants all traffic to use Direct Connect when available. What should they do?

Accepted Answer

Advertise more specific prefixes (e.g., /24) over Direct Connect and less specific (e.g., /16) over VPN.. BGP route selection prefers more specific prefixes (longest prefix match) over less specific ones. By advertising a more specific prefix (e.g., /24) over Direct Connect and a less specific prefix (e.g., /16) over the VPN, the on-premises router will prefer the Direct Connect path for the more specific route, ensuring all traffic uses Direct Connect when available. This leverages BGP's prefix-length-based path selection without requiring removal of the VPN backup.

Answer

Disable AS_PATH prepending on the Direct Connect BGP session.

Answer

Convert the private VIF to a public VIF.

Answer

Remove the VPN connection to force all traffic through Direct Connect.