ANS-C01 Timed Practice Test 3 — 10 Questions

Question 1

A company wants to audit all changes to security groups in their AWS account. They need to be notified whenever a security group rule is added, modified, or removed. They also want to see who made the change. Which solution should they implement?

10 minute time limit — choose an answer to begin.

Accepted Answer

Enable AWS CloudTrail and create a CloudWatch Events rule that triggers on EC2 SecurityGroup events, sending notifications via SNS.. AWS CloudTrail captures all API calls, including EC2 SecurityGroup-related actions (AuthorizeSecurityGroupIngress, RevokeSecurityGroupIngress, etc.), recording the identity of the caller. A CloudWatch Events rule can filter for these specific events and trigger an SNS notification, providing both the change details and the IAM user or role that made the change. This meets the audit and notification requirements precisely.

Answer

Use AWS Trusted Advisor to check for security group changes and send email alerts.

Answer

Use AWS Config to monitor security group changes and trigger a Lambda function to send notifications.

Answer

Enable VPC Flow Logs and analyze logs for changes to security group rules.

Question 2

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from an S3 bucket. The company wants to minimize data transfer costs and avoid traversing the internet. Which solution should be implemented?

Accepted Answer

Create a Gateway VPC Endpoint for S3. A Gateway VPC Endpoint for S3 allows EC2 instances in a private subnet to access S3 without traversing the internet, using AWS's internal network. This minimizes data transfer costs because Gateway Endpoints are free and traffic stays within the AWS backbone, avoiding NAT Gateway or internet gateway charges.

Answer

Use an Interface VPC Endpoint for S3

Answer

Use AWS Direct Connect

Answer

Set up a NAT Gateway in the public subnet and route traffic through it

Question 3

Which THREE of the following are required to configure a site-to-site VPN connection between an on-premises network and an Amazon VPC? (Select THREE.)

Accepted Answer

A customer gateway resource representing the on-premises VPN device.. A customer gateway resource is required because it represents the on-premises VPN device in AWS, providing the necessary configuration information such as the device's public IP address and BGP ASN (if dynamic routing is used) to establish the site-to-site VPN connection. Without this resource, AWS has no reference to the remote endpoint for the IPsec tunnels.

Answer

A public virtual interface.

Answer

An AWS Direct Connect connection.

Question 4

A company is using AWS Direct Connect to connect its on-premises data center to AWS. The network team wants to monitor the latency and packet loss on the Direct Connect virtual interfaces. Which AWS service should be used to measure these metrics?

Accepted Answer

AWS CloudWatch. AWS CloudWatch is the correct service because it provides built-in metrics for Direct Connect virtual interfaces, including 'VirtualInterfaceRxNoPacket' and 'VirtualInterfaceTxNoPacket' for packet loss, and you can derive latency by monitoring the 'VirtualInterfaceBpsEgress' and 'VirtualInterfaceBpsIngress' metrics with appropriate alarms. CloudWatch also supports custom metrics and logs that can be used to calculate round-trip time (RTT) by analyzing ping results or using AWS Direct Connect's native health checks. This allows the network team to set up dashboards and alarms for latency and packet loss directly from the Direct Connect metrics.

Answer

AWS Config

Answer

AWS X-Ray

Answer

AWS CloudTrail

Question 5

A company wants to connect its on-premises data center to a VPC using AWS Site-to-Site VPN. Which of the following is required to establish the VPN connection?

Accepted Answer

Virtual private gateway attached to the VPC and a customer gateway representing the on-premises router. To establish a Site-to-Site VPN, you need a virtual private gateway (VGW) or transit gateway on the AWS side, and a customer gateway (CGW) representing the on-premises router. Option C is correct. Option A is incorrect because a Direct Connect gateway is used for Direct Connect connections, not VPN. Option B is incorrect because an internet gateway is used for public internet traffic, not VPN. Option D is incorrect because a VPC endpoint is for private access to AWS services, not for establishing a VPN connection.

Answer

Direct Connect gateway associated with the VPC

Answer

Internet gateway attached to the VPC

Answer

VPC endpoint for the VPN service

Question 6

A company is using AWS Direct Connect to connect its on-premises network to AWS. The company wants to encrypt all traffic between its on-premises network and AWS. Which solution meets this requirement?

Accepted Answer

Use a private VIF and establish an IPsec VPN tunnel over the Direct Connect connection.. AWS Direct Connect does not natively encrypt traffic; it provides a private, dedicated network connection. To meet the encryption requirement, you can establish an IPsec VPN tunnel over the private VIF, which encrypts all traffic between the on-premises network and the VPC. This approach combines the low latency and reliability of Direct Connect with the security of IPsec encryption.

Answer

Use a public virtual interface (VIF) and route traffic through a NAT gateway.

Answer

Use a private virtual interface (VIF) and enable encryption on the Direct Connect connection.

Answer

Use a private VIF and enable TLS on all applications.

Question 7

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that no VPC in any account can have an internet gateway attached. Which option meets this requirement?

Accepted Answer

Apply a service control policy (SCP) that denies ec2:AttachInternetGateway at the root level.. A service control policy (SCP) applied at the root organizational unit (OU) level can deny the ec2:AttachInternetGateway action across all accounts in the organization. This centrally enforces the restriction. Option A is incorrect because IAM policies are applied per account and do not prevent the action if the user has permissions through other means. Option B is incorrect because security groups control traffic at the instance level, not internet gateway attachments. Option D is incorrect because network ACLs control traffic at the subnet level, not internet gateway attachments.

Answer

Create an IAM policy that denies ec2:AttachInternetGateway and attach it to each account's admin role.

Answer

Use security groups to block traffic from internet gateways.

Answer

Use network ACLs to block traffic from internet gateways.

Question 8

A company is deploying a global web application that will be accessed by users in North America, Europe, and Asia. The application runs on Amazon EC2 instances behind Application Load Balancers (ALBs) in three AWS Regions: us-east-1, eu-west-1, and ap-southeast-1. The company wants to provide a single global anycast IP address that routes users to the closest healthy endpoint based on latency, and must ensure that if an entire Region becomes unavailable, traffic is automatically redirected to the next closest Region. The solution must also support WebSocket connections. Which AWS service should the network engineer use to meet these requirements?

Accepted Answer

AWS Global Accelerator with a standard accelerator and endpoint groups in each Region.. AWS Global Accelerator provides static anycast IP addresses that act as a fixed entry point for global applications. It uses the AWS global network to route traffic to the optimal endpoint based on latency, and it performs health checks to automatically fail over to healthy endpoints in other Regions within seconds. It supports TCP and UDP, including WebSocket, making it the correct choice for this requirement.

Answer

AWS Transit Gateway with inter-Region peering and equal-cost multi-path routing.

Answer

Amazon CloudFront with a custom origin and Lambda@Edge for failover.

Answer

Amazon Route 53 with latency-based routing and health checks.

Question 9

A company has a VPC with multiple subnets across three Availability Zones. The company wants to deploy a Network Load Balancer (NLB) to distribute TCP traffic to a fleet of EC2 instances. The NLB must preserve the source IP address of the client. Which configuration is required?

Accepted Answer

Create the NLB with a TCP listener and register the EC2 instances as targets in a target group.. Network Load Balancers (NLBs) preserve the source IP address of clients by default when using a TCP listener. No additional configuration is required to enable this behavior; the NLB forwards packets with the original source IP intact. Therefore, simply creating the NLB with a TCP listener and registering EC2 instances as targets is sufficient.

Answer

Enable Proxy Protocol v2 on the NLB target group.

Answer

Enable cross-zone load balancing on the NLB.

Answer

Attach a security group to the NLB that allows inbound traffic from the client IP range.

Question 10

A company is migrating on-premises workloads to AWS using AWS Direct Connect. The company has two Direct Connect connections from different providers for redundancy. Which configuration ensures seamless failover with automatic traffic rerouting?

Accepted Answer

Create two Direct Connect gateways, each attached to a separate Transit Gateway, and advertise the same prefixes via BGP.. Using two Direct Connect gateways, each attached to a separate Transit Gateway, with the same BGP prefixes advertised from both connections enables active-active or active-passive failover via BGP path selection (e.g., AS_PATH prepending or MED). This design ensures automatic traffic rerouting if one connection fails, as BGP withdraws the failed path and the remaining path takes over without manual intervention.

Answer

Use one Direct Connect connection as primary and the other as standby with static routes.

Answer

Connect both Direct Connect connections to the same Virtual Private Gateway (VGW) and enable BGP.

Answer

Use a VPN connection over the internet as a backup for the Direct Connect links.