ANS-C01 Multiple Select — 50 Questions

Question 1

Which TWO of the following are best practices for securing a VPC with AWS Network Firewall? (Choose two.)

Accepted Answer

Deploy firewall endpoints in at least two Availability Zones for high availability.. Option A is correct because AWS Network Firewall firewall endpoints are Availability Zone–scoped, so deploying endpoints in at least two AZs ensures high availability and prevents a single-AZ failure from taking down inspection. Option C is correct because stateful rule groups allow deep packet inspection and application-layer (Layer 7) filtering using Suricata-compatible rules, which is essential for detecting and blocking sophisticated threats. Option B is incorrect because stateless rules alone cannot perform application-layer inspection and are not a best practice for comprehensive security. Option D is incorrect because Network Firewall can inspect both inbound and outbound traffic, not just outbound. Option E is incorrect because the firewall should be deployed in a dedicated subnet (typically a firewall subnet) rather than the same subnet as workloads, to maintain proper traffic segmentation and routing.

Answer

Use only stateless rules to minimize processing overhead.

Answer

Use Network Firewall only for outbound traffic filtering.

Answer

Deploy the firewall in the same subnet as the workload for low latency.

Question 2

Which TWO of the following are valid methods to connect a VPC to an on-premises network? (Choose TWO.)

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN creates an encrypted tunnel over the public internet between a VPC and an on-premises network using IPsec. It is a fully managed, quick-to-deploy method that supports both static routes and BGP dynamic routing via the virtual private gateway.

Answer

VPC endpoints

Answer

AWS Transit Gateway

Answer

VPC peering

Question 3

Which THREE AWS services can be used to improve the availability of a web application across multiple AWS Regions? (Choose 3.)

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator improves availability across multiple AWS Regions by using the AWS global network to route user traffic to the optimal regional endpoint based on health, latency, and geography. It provides static anycast IP addresses and automatically reroutes traffic to healthy endpoints during a regional failure, thereby enhancing fault tolerance and performance for global web applications.

Answer

VPC peering

Answer

AWS Direct Connect

Question 4

Which THREE of the following are considerations when designing a multi-account VPC architecture using AWS Transit Gateway? (Choose 3.)

Accepted Answer

Transit Gateway can be integrated with Direct Connect Gateway. AWS Transit Gateway acts as a central hub for interconnecting VPCs and on-premises networks. It can be integrated with Direct Connect Gateway, allowing a single Direct Connect connection to reach multiple VPCs attached to the Transit Gateway, simplifying hybrid network design and reducing operational overhead.

Answer

Each VPC must have a unique route table

Answer

VPCs with overlapping CIDR blocks can be attached

Question 5

Which THREE of the following are required to configure a site-to-site VPN connection between an on-premises network and an Amazon VPC? (Select THREE.)

Accepted Answer

A customer gateway resource representing the on-premises VPN device.. A customer gateway resource is required because it represents the on-premises VPN device in AWS, providing the necessary configuration information such as the device's public IP address and BGP ASN (if dynamic routing is used) to establish the site-to-site VPN connection. Without this resource, AWS has no reference to the remote endpoint for the IPsec tunnels.

Answer

A public virtual interface.

Answer

An AWS Direct Connect connection.

Question 6

A company is planning to connect its on-premises data center to AWS using AWS Direct Connect. The company requires high availability and wants to ensure that if one Direct Connect connection fails, traffic automatically fails over to another. Which THREE design elements should be included?

Accepted Answer

Provision two Direct Connect connections at different AWS Direct Connect locations.. Option A is correct because provisioning two Direct Connect connections at different AWS Direct Connect locations provides physical path diversity, so a failure at one location or its equipment does not take down all connectivity, which is required for high availability. Option D is correct because Direct Connect uses BGP to exchange routes between the on-premises routers and AWS; BGP is what enables dynamic routing and automatic failover when a connection or path becomes unavailable. Option E is correct because advertising the same BGP prefixes from both on-premises routers ensures AWS has redundant paths to the same networks and can fail over to the alternate connection when one path is withdrawn or fails. Option B is not appropriate because a single customer router is a single point of failure, defeating the high-availability goal even if it connects to two locations. Option C is not one of the three required design elements here because a VPN backup is a separate hybrid connectivity option, not a Direct Connect high-availability design element, and the scenario specifically asks for failover between Direct Connect connections.

Answer

Use a single customer router with multiple connections to both Direct Connect locations.

Answer

Configure a VPN connection as a backup to Direct Connect.

Question 7

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. It needs to connect to two other VPCs: VPC B (10.1.0.0/16) and VPC C (10.2.0.0/16). The company wants to use AWS Transit Gateway. Which THREE configurations are required to enable full mesh connectivity between all three VPCs?

Accepted Answer

Associate each VPC attachment with the Transit Gateway route table.. Associating each VPC attachment with the Transit Gateway route table is necessary for the Transit Gateway to know which attachments can communicate. Without this association, the Transit Gateway would not forward traffic between the VPCs, even if routes are present in the route table.

Answer

Create separate Transit Gateway route tables for each VPC to isolate traffic.

Answer

Create a VPN attachment to each VPC for encrypted communication.

Question 8

Which TWO actions can be taken to reduce the attack surface of a VPC's public subnets? (Choose 2.)

Accepted Answer

Place web servers in private subnets and use a load balancer in a public subnet. Placing web servers in private subnets and using a load balancer in a public subnet reduces the attack surface by ensuring that the web servers have no direct internet-facing IP addresses. The load balancer acts as a single point of ingress, allowing security groups to tightly control traffic from the load balancer to the web servers, while the public subnet only exposes the load balancer's endpoints. This architecture follows AWS best practices for a multi-tier application, minimizing the number of resources directly accessible from the internet.

Answer

Allow all inbound traffic from the internet to the public subnets

Answer

Use a single subnet for all application tiers

Answer

Disable ICMP traffic on the network ACL

Question 9

A company wants to inspect traffic between VPCs in the same region using a third-party security appliance. Which THREE components are needed? (Choose 3)

Accepted Answer

AWS Transit Gateway. Option C (AWS Transit Gateway) is correct because it acts as a regional hub that connects multiple VPCs and can route inter-VPC traffic through a central inspection point, which is exactly what is needed to steer traffic to a third-party security appliance. Option E (a dedicated inspection VPC for the security appliance) is correct because the appliance must live in its own VPC so that Transit Gateway attachments and route tables can force traffic through it before reaching the destination VPC. Option D (route tables in the inspection VPC directing traffic through the appliance) is correct because without route table entries pointing to the appliance's ENI as the next hop, traffic would bypass inspection; the inspection VPC's route tables are what enforce the traffic flow through the security appliance. Option A (VPC Peering connections between all VPCs) is not needed and would actually bypass the central inspection design, since peering creates direct VPC-to-VPC paths. Option B (NAT Gateways in each VPC) is unrelated to traffic inspection; NAT Gateways only provide outbound internet access for private subnets and do not route or inspect inter-VPC traffic.

Answer

VPC Peering connections between all VPCs

Answer

NAT Gateways in each VPC

Question 10

Which THREE of the following are benefits of using AWS Transit Gateway over VPC peering for inter-VPC connectivity? (Choose three.)

Accepted Answer

Transitive routing between all attached VPCs. Option A is correct because AWS Transit Gateway acts as a regional hub that provides transitive routing, so any attached VPC can reach any other attached VPC through the gateway without needing a full mesh of individual peering connections. Option C is correct because Transit Gateway natively supports attachments for AWS Direct Connect gateways and Site-to-Site VPN, allowing centralized hybrid connectivity to on-premises networks, whereas VPC peering cannot extend to on-premises by itself. Option E is correct because Transit Gateway centralizes connectivity management, letting you attach many VPCs and on-premises links to a single gateway and control routing with a single set of route tables, instead of managing numerous point-to-point peering relationships. Option B is not correct because Transit Gateway adds an extra hop through a central hub, so it does not inherently provide lower latency than direct VPC peering. Option D is not correct because Transit Gateway charges per attachment and per GB of data processed, so it typically costs more than VPC peering, which has no hourly attachment charge.

Answer

Lower latency than VPC peering

Answer

No additional cost compared to VPC peering

Question 11

A company is using AWS Direct Connect to connect its on-premises network to a VPC via a private virtual interface (VIF) attached to a virtual private gateway (VGW). The company wants to add redundant connectivity using a second Direct Connect connection from a different provider. The network team proposes using a Direct Connect gateway (DXGW) with two private VIFs from different connections, each attached to the DXGW. The DXGW will be associated with the VGW. Which THREE steps are required to complete this configuration? (Choose three.)

Accepted Answer

Associate both private virtual interfaces with the same Direct Connect gateway.. Option B is correct because a Direct Connect gateway can aggregate multiple private VIFs from different Direct Connect connections, so both private VIFs must be associated with the same DXGW to provide redundant paths into the same VPC. Option C is correct because the DXGW must be associated with the virtual private gateway (VGW) attached to the VPC, which allows the DXGW to advertise and route traffic to that VPC over the private VIFs. Option D is correct because the on-premises network must advertise its prefixes over both BGP sessions (one per private VIF) so that AWS can learn the routes and use both connections for active-active load sharing or failover. Option A is not required because, with a DXGW associated to a VGW, the VPC route tables point to the virtual private gateway, not directly to the Direct Connect gateway. Option E is incorrect because a single VGW can be associated with the DXGW; separate VGWs per connection are not needed and would not provide the intended redundant attachment to the same VPC.

Answer

Add routes to the VPC subnets' route tables pointing to the Direct Connect gateway.

Answer

Create a separate virtual private gateway for each Direct Connect connection.

Question 12

Which THREE of the following are considerations when designing a VPC with multiple Availability Zones for high availability? (Choose THREE.)

Accepted Answer

Use an Application Load Balancer to distribute traffic across instances in different Availability Zones.. An Application Load Balancer (ALB) distributes incoming traffic across multiple targets, such as EC2 instances, in different Availability Zones (AZs). By registering instances from multiple AZs with the ALB, you ensure that if one AZ becomes unavailable, the ALB can route traffic to healthy instances in another AZ, thereby maintaining high availability. This aligns with the AWS Well-Architected Framework's recommendation to deploy workloads across multiple AZs and use a load balancer to handle failover.

Answer

Create a single public subnet that spans all Availability Zones.

Answer

Use a single NAT gateway in one Availability Zone to reduce cost.

Question 13

A company has a VPC with a CIDR of 10.0.0.0/16. It creates a subnet 10.0.1.0/24 in us-east-1a and launches an EC2 instance with a private IP 10.0.1.10. The instance needs to send traffic to an on-premises server at 192.168.1.50 over a Direct Connect private VIF. The VPC has a virtual private gateway attached and a route table associated with the subnet. Which TWO entries must exist in the route table for the traffic to succeed?

Accepted Answer

Destination: 10.0.0.0/16, Target: local. For traffic from an EC2 instance in a VPC to an on-premises server over a Direct Connect private VIF, the route table must include two entries: a local route for the VPC CIDR (10.0.0.0/16) which is automatically added and enables communication within the VPC (Option C), and a specific route to the on-premises network (192.168.1.0/24) pointing to the virtual private gateway (vgw-xxxxxxxx) so that traffic destined for 192.168.1.50 is directed over the Direct Connect (Option D). No other entries are required; the local route already covers all subnets, and there is no need for a default route to the internet.

Answer

Destination: 0.0.0.0/0, Target: igw-xxxxxxxx

Answer

Destination: 0.0.0.0/0, Target: nat-xxxxxxxx

Answer

Destination: 10.0.1.0/29, Target: local

Question 14

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to an on-premises network with CIDR 172.16.0.0/12. They are using an AWS Transit Gateway with a VPN attachment to the on-premises network. The transit gateway route table has a static route for 172.16.0.0/12 pointing to the VPN attachment. Which THREE of the following are necessary for traffic to flow from the VPC to on-premises?

Accepted Answer

The VPC route tables include a route for 172.16.0.0/12 pointing to the transit gateway. Option B is correct because the VPC must have a Transit Gateway attachment (a VPC attachment) before any traffic can be sent to or received from the transit gateway; without this attachment, the TGW cannot route packets into the VPC. Option A is correct because the VPC's route tables must contain a route for 172.16.0.0/12 targeting the transit gateway; otherwise instances in the VPC have no path toward the on-premises CIDR. Option C is correct because the transit gateway route table must have a route for 172.16.0.0/12 pointing to the VPN attachment, which is exactly the static route described in the scenario and is required for the TGW to forward traffic to the VPN. Option D is not required because the scenario already states a static route exists on the TGW, so BGP advertisement from the on-premises router is unnecessary for the TGW to know the route. Option E is not required because the VPN can use static routing; dynamic BGP is optional and not mandated by the scenario.

Answer

The on-premises router is advertising the 172.16.0.0/12 route over BGP

Answer

The VPN tunnel is configured with dynamic BGP routing

Question 15

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They have subnets in three Availability Zones. They need to add IPv6 connectivity to the VPC and allow instances in private subnets to initiate outbound IPv6 connections to the internet, but not allow inbound connections from the internet. Which TWO actions must be taken?

Accepted Answer

Create an egress-only internet gateway and add a route for ::/0 to it in the private subnet route tables.. Option C is correct because before any IPv6 addressing or routing can exist in the VPC, you must associate an Amazon-provided or BYOIP IPv6 CIDR block with the VPC (and then assign IPv6 CIDR blocks to the subnets), which is the prerequisite for IPv6 connectivity. Option A is correct because an egress-only internet gateway is the AWS component purpose-built for IPv6-only outbound access: it is stateful and allows instances to initiate outbound IPv6 traffic to the internet while preventing the internet from initiating inbound IPv6 connections, and a ::/0 route in the private subnet route table pointing to that egress-only internet gateway enables the outbound path. Option B is not correct because an internet gateway provides bidirectional IPv6 connectivity, so routing ::/0 to it would allow inbound internet-initiated connections, violating the requirement. Option D is not correct because a NAT gateway only translates IPv4 traffic and does not provide IPv6 connectivity. Option E is not correct because security groups are stateful and, by default, allow all outbound traffic; a security group rule is not the mechanism that enables or restricts internet-initiated inbound IPv6 connectivity, and it is not a required action to add IPv6 egress.

Answer

Create an internet gateway and add a route for ::/0 to it in the private subnet route tables.

Answer

Create a NAT gateway in a public subnet.

Answer

Configure a security group that allows outbound IPv6 traffic.

Question 16

A company wants to encrypt all data in transit between its on-premises data center and AWS. Which two services or features can provide encryption for data in transit?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN (C) is correct because it creates IPsec tunnels over the public internet between the on-premises customer gateway and an AWS virtual private gateway or transit gateway, encrypting all traffic in transit with IPsec. AWS Direct Connect with MACsec (E) is correct because MACsec (IEEE 802.1AE) provides layer-2 encryption on the dedicated Direct Connect link between the customer's router and the AWS Direct Connect endpoint, protecting data in transit. AWS PrivateLink (A) is not correct here because it privately connects VPCs and services over the AWS backbone without providing encryption of the traffic itself. VPC peering (B) is not correct because it only routes traffic privately between VPCs and does not encrypt it. AWS Transit Gateway (D) is not correct because it is a network transit hub for connecting VPCs and on-premises networks, not an encryption mechanism.

Answer

AWS PrivateLink

Answer

VPC peering

Answer

AWS Transit Gateway

Question 17

A company is designing a multi-region active-active application using Amazon Route 53 and Application Load Balancers (ALBs). The application must be highly available and route traffic to the closest healthy endpoint. Which TWO configurations should the company use? (Choose two.)

Accepted Answer

Configure Route 53 with latency-based routing. Latency-based routing (B) is correct because it directs users to the AWS Region that provides the lowest latency, which matches the requirement to route traffic to the closest healthy endpoint in a multi-region active-active design. Associating health checks with each Route 53 record (C) is correct because health checks let Route 53 remove unhealthy regional endpoints from DNS responses, ensuring traffic only goes to healthy ALBs and supporting high availability. Failover routing (A) is not appropriate here because it is designed for active-passive configurations with a primary and secondary endpoint, not active-active closest-endpoint routing. Weighted routing (D) distributes traffic by assigned proportions and does not inherently select the lowest-latency or closest healthy endpoint. Geoproximity routing (E) routes based on geographic location and bias, not actual measured latency, so it does not meet the closest healthy endpoint requirement.

Answer

Configure Route 53 with failover routing

Answer

Configure Route 53 with weighted routing

Answer

Configure Route 53 with geoproximity routing

Question 18

Which TWO actions should be taken to secure an EC2 instance that is used as a bastion host? (Choose 2)

Accepted Answer

Use a security group that only allows necessary inbound ports. A bastion host should only expose necessary inbound ports (typically TCP 22 for SSH) to minimize the attack surface. By using a security group that restricts inbound traffic to only required ports, you enforce the principle of least privilege at the network layer, preventing unauthorized access to other services that might be running on the instance.

Answer

Use HTTPS instead of SSH for administration

Answer

Place the bastion host in a private subnet

Answer

Allow all inbound traffic on port 22 in the network ACL

Question 19

A company needs to log all network traffic to and from EC2 instances for security analysis. Which TWO services can capture this data? (Choose 2)

Accepted Answer

VPC Flow Logs. VPC Flow Logs (B) is correct because it captures IP traffic metadata (source/destination IP, ports, protocol, packets, bytes, accept/reject) for traffic to and from network interfaces in a VPC, including EC2 instances, and publishes it to CloudWatch Logs or S3 for security analysis. Traffic Mirroring (D) is correct because it copies the actual packet payloads from an EC2 instance's elastic network interface to a target (another ENI or Network Load Balancer) for deep inspection and analysis, providing full content capture that Flow Logs cannot. AWS Config (A) only records resource configuration changes and compliance state, not network traffic. AWS CloudTrail (C) logs AWS API activity and management events, not packet-level network traffic. Amazon CloudWatch Logs (E) is merely a log storage/analysis destination, not a service that itself captures VPC or EC2 network traffic.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Question 20

A company is deploying an AWS Client VPN endpoint to provide remote access to its VPC resources. The company wants to allow clients to access resources in multiple subnets within the VPC. Which TWO configurations are necessary?

Accepted Answer

Associate the Client VPN endpoint with subnets in the VPC.. Associating the Client VPN endpoint with subnets in the VPC is required to establish the network connectivity between the VPN clients and the VPC. The Client VPN endpoint uses elastic network interfaces in the associated subnets to route traffic from clients into the VPC. Without this association, the endpoint cannot forward traffic to VPC resources.

Answer

Configure route tables in the VPC to direct traffic to the Client VPN endpoint.

Answer

Attach the VPC to a transit gateway.

Answer

Configure security groups on the target subnets.