ANS-C01 Quick Quiz — 10 Questions

Question 1

A company has an application that requires fixed IP addresses for whitelisting by third-party partners. The application is hosted on an Application Load Balancer (ALB) in a VPC. Which solution provides static IP addresses for the ALB?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Place an AWS Global Accelerator in front of the ALB.. AWS Global Accelerator provides two static IP addresses that act as fixed entry points for traffic. By placing it in front of an Application Load Balancer (ALB), you can whitelist these static IPs with third-party partners while the ALB itself remains dynamic. Global Accelerator uses the AWS global network to route traffic to the ALB, preserving the ALB's native HTTP/HTTPS features.

Answer

Use Amazon CloudFront with the ALB as origin.

Answer

Assign an Elastic IP to the ALB.

Answer

Replace the ALB with a Network Load Balancer (NLB).

Question 2

A company has a VPC with a CIDR of 10.0.0.0/16. It has six subnets: three public (10.0.1.0/24, 10.0.2.0/24, 10.0.3.0/24) and three private (10.0.4.0/24, 10.0.5.0/24, 10.0.6.0/24). The company wants to launch an RDS instance in a private subnet. Which subnet should the RDS instance be placed in to maximize high availability and follow best practices?

Accepted Answer

Place the RDS instance in two private subnets that are in different Availability Zones.. Amazon RDS Multi-AZ deployments require the RDS instance to be placed in at least two subnets that reside in different Availability Zones (AZs) within the same VPC. This configuration enables synchronous standby replication across AZs, providing automatic failover and high availability. The subnets must be private to ensure the database is not directly exposed to the internet, aligning with security best practices.

Answer

Place the RDS instance in a public subnet and use security groups to restrict access.

Answer

Place the RDS instance in all three private subnets to maximize availability.

Answer

Place the RDS instance in a single private subnet with a large CIDR for future scaling.

Question 3

Which THREE of the following are valid considerations when designing a multi-Region active-active application using AWS Global Accelerator?

Accepted Answer

You can assign different weights to endpoints in different Regions to control traffic distribution.. AWS Global Accelerator allows you to assign different weights to endpoints in different Regions, enabling granular control over traffic distribution for active-active architectures. This is achieved through endpoint group weights, where you can adjust the proportion of traffic sent to each Regional endpoint group, supporting scenarios like gradual rollouts or load balancing across Regions.

Answer

Global Accelerator supports sticky sessions (session affinity) based on client IP.

Answer

Global Accelerator provides a set of static IP addresses that are unique to each Region.

Question 4

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They have two subnets: a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). They launch an EC2 instance in the private subnet that needs to download software updates from the internet. The company configures a NAT gateway in the public subnet and adds a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway. The NAT gateway is assigned an Elastic IP address. However, the EC2 instance cannot reach the internet. The security group for the EC2 instance allows all outbound traffic. What is the MOST likely cause?

Accepted Answer

The public subnet's route table does not have a route to an internet gateway.. The NAT gateway is in the public subnet, but the public subnet's route table must have a route to an internet gateway (0.0.0.0/0 -> IGW) for the NAT gateway to forward traffic to the internet. Without that route, the NAT gateway cannot communicate with the internet. Option A is incorrect because NAT gateways do not use security groups. Option B is incorrect because the NAT gateway has an Elastic IP and is properly allocated; the issue is not with the Elastic IP. Option D is incorrect because the private subnet's route table already has a route to the NAT gateway (0.0.0.0/0 -> NAT), which is correctly configured.

Answer

The NAT gateway is not associated with a security group that allows outbound traffic.

Answer

The NAT gateway's Elastic IP address is not properly allocated.

Answer

The private subnet's route table does not have a route to the NAT gateway.

Question 5

Which THREE factors should be considered when designing a VPC for a multi-tier application that requires high availability and security? (Choose three.)

Accepted Answer

Provision subnets in at least two Availability Zones. Deploying subnets across at least two Availability Zones (AZs) ensures high availability by eliminating a single point of failure. If one AZ experiences an outage, the application can continue serving traffic from the other AZ. This is a foundational principle for building fault-tolerant architectures in AWS.

Answer

Assign public IP addresses to all instances for direct access

Answer

Use a single Availability Zone to reduce latency

Question 6

A company wants to securely connect two VPCs in different AWS regions using AWS infrastructure. Which service should be used?

Accepted Answer

VPC peering. VPC peering is the correct service because it allows direct, private connectivity between two VPCs in different AWS regions using AWS's internal network, without traversing the public internet. It uses the existing AWS infrastructure to route traffic between the VPCs via private IP addresses, and it supports inter-region peering as of 2017, making it the simplest and most cost-effective solution for this specific requirement.

Answer

AWS Direct Connect

Answer

Internet Gateway

Answer

AWS Transit Gateway

Question 7

Which THREE AWS services can be used to improve the availability of a web application across multiple AWS Regions? (Choose 3.)

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator improves availability across multiple AWS Regions by using the AWS global network to route user traffic to the optimal regional endpoint based on health, latency, and geography. It provides static anycast IP addresses and automatically reroutes traffic to healthy endpoints during a regional failure, thereby enhancing fault tolerance and performance for global web applications.

Answer

VPC peering

Answer

AWS Direct Connect

Question 8

A network engineer is monitoring a Direct Connect connection. The exhibit shows CloudWatch metric data for the ConnectionState metric. The engineer sees that the average value is 0.0 for most of the day. What does this indicate?

Accepted Answer

The connection was down for most of the day.. The ConnectionState metric indicates the state of the Direct Connect connection, where 0 means down and 1 means up. An average value of 0.0 for most of the day indicates the connection was down. Therefore, option B is correct. Option A is incorrect because the metric shows a consistent value of 0, not fluctuating. Option C is incorrect because the data is complete and clearly shows the connection was down. Option D is incorrect because a value of 0 means the connection was not up and stable.

Answer

The connection was fluctuating between up and down.

Answer

The metric data is incomplete.

Answer

The connection was up and stable.

Question 9

A company is designing a multi-VPC architecture in the same region. The VPCs need to communicate with each other using private IP addresses. The company must minimize cost and operational overhead. Which solution should the company use?

Accepted Answer

Create VPC peering connections between each pair of VPCs.. VPC peering connections provide direct, private IP connectivity between VPCs using the AWS global network, with no bandwidth bottlenecks or single points of failure. It is the most cost-effective solution for a small number of VPCs (e.g., fewer than 10) as there are no hourly charges for the peering connection itself—only data transfer costs. This minimizes operational overhead compared to managing VPN tunnels or a Transit Gateway, as peering is a simple, one-to-one relationship that does not require additional appliances or complex routing policies.

Answer

Set up AWS Site-to-Site VPN connections between each VPC.

Answer

Use ClassicLink to connect the VPCs.

Answer

Create a Transit Gateway and attach all VPCs.

Question 10

A company has a VPC with an Application Load Balancer (ALB) in front of a fleet of EC2 instances. The security group for the EC2 instances must allow traffic only from the ALB. Which source should be specified in the security group inbound rule?

Accepted Answer

The ID of the ALB's security group. You can reference the ALB's security group ID as the source in the EC2 instances' security group inbound rule. This allows traffic from any network interface that is associated with the ALB's security group, regardless of the ALB's IP addresses or subnets. This is the recommended AWS best practice for controlling traffic between an ALB and its target instances, as it automatically adapts to changes in the ALB's underlying infrastructure.

Answer

The ALB's public IP address

Answer

The subnet CIDR block of the ALB's subnets

Answer

The VPC CIDR block