ANS-C01 Multiple Select — 50 Questions

Question 1

Which THREE of the following are valid considerations when designing a multi-Region active-active application using AWS Global Accelerator?

Accepted Answer

You can assign different weights to endpoints in different Regions to control traffic distribution.. AWS Global Accelerator allows you to assign different weights to endpoints in different Regions, enabling granular control over traffic distribution for active-active architectures. This is achieved through endpoint group weights, where you can adjust the proportion of traffic sent to each Regional endpoint group, supporting scenarios like gradual rollouts or load balancing across Regions.

Answer

Global Accelerator supports sticky sessions (session affinity) based on client IP.

Answer

Global Accelerator provides a set of static IP addresses that are unique to each Region.

Question 2

Which THREE factors should be considered when designing a VPC for a multi-tier application that requires high availability and security? (Choose three.)

Accepted Answer

Provision subnets in at least two Availability Zones. Deploying subnets across at least two Availability Zones (AZs) ensures high availability by eliminating a single point of failure. If one AZ experiences an outage, the application can continue serving traffic from the other AZ. This is a foundational principle for building fault-tolerant architectures in AWS.

Answer

Assign public IP addresses to all instances for direct access

Answer

Use a single Availability Zone to reduce latency

Question 3

Which THREE AWS services can be used to improve the availability of a web application across multiple AWS Regions? (Choose 3.)

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator improves availability across multiple AWS Regions by using the AWS global network to route user traffic to the optimal regional endpoint based on health, latency, and geography. It provides static anycast IP addresses and automatically reroutes traffic to healthy endpoints during a regional failure, thereby enhancing fault tolerance and performance for global web applications.

Answer

VPC peering

Answer

AWS Direct Connect

Question 4

A company is designing a network architecture for a multi-account AWS environment using AWS Transit Gateway. They need to meet the following requirements: (1) Centralized inspection of traffic between VPCs using a firewall appliance. (2) Isolated development environments that cannot communicate with each other but can access the internet via a centralized NAT gateway. (3) Compliance with PCI DSS for production workloads, requiring encryption in transit between VPCs. Which TWO actions should they take?

Accepted Answer

Create a dedicated inspection VPC with a firewall appliance and attach it to the Transit Gateway. Use Transit Gateway route tables to route traffic from all VPCs through the inspection VPC.. It enables centralized traffic inspection by attaching a dedicated inspection VPC with a firewall appliance to the Transit Gateway and using separate route tables to force all inter-VPC traffic through that inspection VPC. This design meets the requirement for centralized inspection without requiring complex peering or VPN configurations.

Answer

Use VPC Peering for all inter-VPC communication

Answer

Use AWS Site-to-Site VPN between each VPC and a central VPN hub

Answer

Use AWS Client VPN to connect development VPCs to the production VPC

Question 5

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team observes that traffic between two VPCs (VPC A and VPC B) is not being forwarded correctly. The transit gateway route table is configured with static routes for the VPC CIDRs. Which THREE steps should the engineer take to troubleshoot this issue? (Choose THREE.)

Accepted Answer

Verify that the transit gateway route table contains the CIDR blocks of both VPCs.. The transit gateway route table must contain the CIDR blocks of both VPCs for traffic to be forwarded between them. Without these static routes, the transit gateway has no destination to route the traffic, causing it to be dropped. Verifying the route table entries ensures the necessary paths exist.

Answer

Check the Direct Connect virtual interface status.

Answer

Verify that the NAT Gateway in each VPC is properly configured.

Question 6

Which TWO statements about AWS Direct Connect are correct? (Select TWO.)

Accepted Answer

Direct Connect supports multiple virtual interfaces (VIFs) over a single connection. AWS Direct Connect allows you to create multiple virtual interfaces (VIFs) — including private VIFs, public VIFs, and transit VIFs — over a single physical Direct Connect connection. This enables you to segment traffic to different AWS services (e.g., VPCs via private VIF, public AWS endpoints via public VIF) without needing separate physical cables, leveraging 802.1Q VLAN tagging to isolate each VIF.

Answer

Direct Connect traffic is encrypted by default

Answer

Direct Connect is a managed VPN service

Answer

Direct Connect can be provisioned in minutes without any physical infrastructure

Question 7

Which TWO of the following are valid methods to connect an on-premises data center to a VPC in AWS? (Choose 2.)

Accepted Answer

AWS Direct Connect. AWS Direct Connect is a correct answer because it provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet for consistent latency and higher bandwidth. This service uses industry-standard 802.1Q VLANs to create virtual interfaces, enabling direct access to VPCs via private virtual interfaces (VIFs) or transit virtual interfaces for use with Transit Gateway.

Answer

VPC endpoint

Answer

Transit Gateway

Answer

VPC peering

Question 8

A company is designing a multi-region active-active application. They need to ensure that traffic is routed to the closest healthy region and that failover happens automatically. Which TWO services should be used together to achieve this?

Accepted Answer

AWS Global Accelerator with endpoint groups. AWS Global Accelerator (C) uses Anycast IPs to direct traffic to the closest healthy endpoint group, automatically rerouting traffic if a region becomes unhealthy. This provides fast regional failover and low-latency routing without DNS caching delays, making it ideal for active-active multi-region applications.

Answer

AWS Transit Gateway with inter-region peering

Answer

Amazon CloudFront with multiple origins

Answer

AWS Direct Connect with multiple locations

Question 9

Which TWO services can be used to centrally manage and monitor VPN connections across multiple AWS accounts? (Choose 2.)

Accepted Answer

AWS Network Manager. AWS Network Manager centrally manages and monitors VPN connections across multiple AWS accounts by providing a global view of your network topology, including on-premises and AWS resources. It integrates with Transit Gateway to monitor VPN tunnel status and performance metrics, enabling cross-account visibility via resource shares.

Answer

AWS CloudFormation

Answer

AWS Organizations

Answer

AWS Direct Connect Gateway

Question 10

A company has a VPC with CIDR 10.0.0.0/16 and two subnets: 10.0.1.0/24 (public) and 10.0.2.0/24 (private). The company wants to add a new subnet for a third tier. Which of the following are valid subnet CIDRs that can be added? (Select TWO.)

Accepted Answer

10.0.3.0/24. (10.0.3.0/24) is correct because it falls within the VPC CIDR 10.0.0.0/16 and does not overlap with the existing subnets (10.0.1.0/24 and 10.0.2.0/24). The /24 prefix length matches the existing subnet structure, and the third octet (3) is outside the range of the first two subnets, ensuring no IP address conflict.

Answer

10.0.1.128/25

Answer

10.1.0.0/16

Answer

10.0.2.64/26

Question 11

A company is designing a VPC with public and private subnets. The company needs to provide internet access to instances in the private subnets. Which TWO components are required? (Choose TWO.)

Accepted Answer

Internet Gateway attached to the VPC. An Internet Gateway (IGW) is required to provide a target in the VPC route tables for internet-bound traffic. For instances in private subnets, a NAT Gateway placed in a public subnet translates their private IP addresses to the public IP of the NAT Gateway, allowing outbound internet access while preventing unsolicited inbound connections. The private subnet's route table must point 0.0.0.0/0 to the NAT Gateway, and the public subnet's route table must point 0.0.0.0/0 to the IGW.

Answer

Transit Gateway

Answer

VPC Gateway Endpoint for S3

Answer

Virtual Private Gateway

Question 12

A company has a multi-account AWS environment using AWS Organizations. The network team wants to centralize VPC traffic inspection using a Transit Gateway and a firewall appliance in a central account. Which THREE steps are required to implement this design? (Choose THREE.)

Accepted Answer

Create a Transit Gateway in the central account and attach the central VPC.. A Transit Gateway (TGW) in the central account acts as the hub for VPC traffic inspection. Attaching the central VPC (which contains the firewall appliance) to the TGW allows all inter-VPC traffic to be routed through the central inspection VPC, enabling centralized traffic inspection without requiring VPC peering or per-spoke firewalls.

Answer

Create a VPC peering connection between each spoke VPC and the central VPC.

Answer

Deploy a firewall appliance in each spoke VPC.

Question 13

A company is designing a multi-region active-active application using Amazon Route 53 and Application Load Balancers (ALBs). The application must be highly available and route traffic to the closest healthy endpoint. Which TWO configurations should the company use? (Choose two.)

Accepted Answer

Configure Route 53 with latency-based routing. Latency-based routing (Option B) directs traffic to the AWS region that provides the lowest latency for each user, which aligns with the requirement to route to the closest healthy endpoint. Health checks (Option C) must be associated with each Route 53 record to mark endpoints as healthy or unhealthy, ensuring traffic is only sent to available ALBs. Together, these configurations enable an active-active multi-region design with automatic failover to the next-lowest-latency healthy region.

Answer

Configure Route 53 with failover routing

Answer

Configure Route 53 with weighted routing

Answer

Configure Route 53 with geoproximity routing

Question 14

A network engineer is troubleshooting an issue where an EC2 instance in a VPC cannot reach an S3 bucket via a gateway endpoint. The instance is in a private subnet with a route table that has a route for the S3 prefix list pointing to the gateway endpoint. Which TWO actions should the engineer take to diagnose the problem?

Accepted Answer

Verify that the route table for the subnet includes a route for the S3 prefix list (com.amazonaws.region.s3) with target type gateway endpoint.. The correct diagnostic steps are A (verify the route table has the S3 prefix list route to the gateway endpoint) and E (check the security group allows outbound HTTPS). The route table must include the prefix list route for the gateway endpoint to work, and the security group must permit HTTPS (443) outbound because S3 API calls use HTTPS. Option B is incorrect because gateway endpoints are used for S3, not interface endpoints (which are for other services). Option C is incorrect; although VPC Flow Logs can help analyze traffic after initial checks, they are not the first diagnostic step. Option D is incorrect because the instance does not need a public IP; gateway endpoints route traffic within the AWS network without leaving the VPC directly.

Answer

Ensure the VPC has an interface endpoint for S3.

Answer

Review VPC Flow Logs for the subnet to see if traffic is being dropped.

Answer

Confirm that the EC2 instance has a public IP address.

Question 15

A company is designing a network architecture for a multi-tier web application. The application includes a public-facing Application Load Balancer (ALB) in a public subnet, web servers in private subnets, and an Amazon RDS database in a private subnet. The company requires that the database is not directly accessible from the application servers except through specific ports, and that traffic between the web servers and the database is encrypted. Which TWO actions should the company take to meet these requirements? (Choose two.)

Accepted Answer

Enable SSL/TLS encryption for connections between the web servers and the RDS database. Enabling SSL/TLS encryption for connections between the web servers and the RDS database ensures that data in transit is encrypted, meeting the requirement for encrypted traffic. Option D is correct because configuring a security group on the RDS instance that allows inbound traffic from the web servers' security group on the database port provides a stateful, instance-level firewall rule that restricts direct access to only the web servers, without exposing the database to the public subnet or relying on IP-based rules.

Answer

Place the RDS database in a public subnet with a security group that allows only the web servers' IP addresses

Answer

Establish a VPC peering connection between the web servers' VPC and the RDS VPC

Answer

Use a network ACL to restrict inbound traffic to the RDS subnet to only the web server's IP range

Question 16

A company needs to log all network traffic to and from EC2 instances for security analysis. Which TWO services can capture this data? (Choose 2)

Accepted Answer

VPC Flow Logs. Options B and D are correct. VPC Flow Logs capture metadata (IP addresses, ports, protocols) about network traffic. Traffic Mirroring captures actual packet content for deep packet inspection. Option A (AWS Config) is incorrect because it records configuration changes, not network traffic. Option C (AWS CloudTrail) is incorrect because it logs API calls, not network traffic. Option E (Amazon CloudWatch Logs) is incorrect because it is for log storage and monitoring, not for capturing network traffic.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Question 17

A company has a VPC with a CIDR of 10.0.0.0/16. They have created a VPC peering connection with another VPC (CIDR 10.1.0.0/16). They want to enable DNS resolution between the VPCs. Which TWO actions must be taken?

Accepted Answer

Both VPCs must have the 'Enable DNS Resolution' attribute set to true in their VPC settings.. To enable DNS resolution across a VPC peering connection, two conditions must be met. First, both VPCs must have the 'Enable DNS Resolution' attribute set to true in their VPC settings, which requires both EnableDnsHostnames and EnableDnsSupport to be enabled (Option B). Second, the VPC peering connection itself must have DNS resolution enabled. This can be done by the accepter when accepting the peering connection or later by modifying the peering connection (Option D). Option A is incorrect because the requester does not accept the peering connection; the accepter does. Option C is not required for DNS resolution. Option E (route table entries) is necessary for connectivity but not specifically for DNS resolution.

Answer

The requester must accept the peering connection with the 'Enable DNS Resolution' option checked.

Answer

Ensure both VPCs are in the same AWS region.

Answer

The route tables must include a route for the peered VPC's CIDR.

Question 18

A company has a VPC with public and private subnets. They have a NAT gateway in a public subnet for outbound internet access from private instances. Which TWO of the following are required for the NAT gateway to function correctly?

Accepted Answer

A route in the public subnet's route table to an internet gateway. A NAT gateway must be placed in a public subnet and requires an Elastic IP address (E) to enable outbound internet traffic with a source IP that can be routed back. Additionally, the public subnet where the NAT gateway resides must have a route in its route table that points to an internet gateway (C) for the NAT gateway to reach the internet. Security groups are not attached to NAT gateways (they use security groups for attached instances, but NAT gateways themselves are not security group–aware). Network ACLs control traffic at the subnet level but are not a requirement specific to NAT gateway functionality; they can be configured as needed. Deploying the NAT gateway in a private subnet (A) would prevent it from accessing the internet because private subnets do not have direct routes to an internet gateway. Therefore, only options C and E are required.

Answer

The NAT gateway is deployed in a private subnet

Answer

A security group attached to the NAT gateway

Answer

A network ACL attached to the NAT gateway's subnet that allows inbound traffic from the internet

Question 19

A company is using AWS Direct Connect with a private VIF to connect to multiple VPCs in the same region. The company wants to use AWS Transit Gateway to simplify management. Which three components are required to achieve this? (Choose THREE.)

Accepted Answer

Direct Connect private virtual interface. Options A, B, and E are correct. A Direct Connect private virtual interface provides the physical connection from on-premises to AWS. AWS Transit Gateway serves as the central hub to interconnect multiple VPCs. A Direct Connect gateway is required to associate the Direct Connect virtual interface with the Transit Gateway, enabling connectivity to multiple VPCs in the same region. Options C and D are incorrect: VPC peering and Site-to-Site VPN are not required when using Transit Gateway with Direct Connect.

Answer

VPC peering connection

Answer

AWS Site-to-Site VPN connection

Question 20

A company is troubleshooting a slow network connection between two EC2 instances in the same VPC but different Availability Zones. Which TWO tools can be used to measure throughput and diagnose performance issues?

Accepted Answer

iperf. Options A and C are correct. iperf is a tool used to measure network throughput between two hosts. Traceroute diagnoses network path and latency, which can help identify performance bottlenecks. Options B, D, and E are incorrect: tcpdump captures packets but does not measure throughput; nslookup is a DNS lookup tool that does not measure network performance; ping measures latency but not throughput.

Answer

tcpdump

Answer

nslookup

Answer

ping