ANS-C01 Practice Questions

Question 1

A company wants to allow its employees to securely access internal applications hosted in a VPC without traversing the internet. The company also wants to be able to enforce security policies at the user level. Which AWS service should the company use?

Accepted Answer

AWS Client VPN. AWS Client VPN is a managed, cloud-based VPN service that allows employees to securely access internal applications hosted in a VPC from any location without traversing the internet. It uses OpenVPN-based client software and integrates with AWS Identity and Access Management (IAM) and Active Directory to enforce security policies at the user level, such as group-based access controls and multi-factor authentication.

Answer

Bastion host in a public subnet

Answer

AWS Direct Connect

Answer

AWS Site-to-Site VPN

Question 2

A company is setting up a Direct Connect connection between its on-premises data center and AWS. The company wants to use a single virtual interface (VIF) to access multiple VPCs in the same AWS Region. Which AWS service should be used to achieve this?

Accepted Answer

Direct Connect gateway. A Direct Connect gateway allows you to associate multiple Virtual Private Clouds (VPCs) in the same AWS Region with a single Direct Connect virtual interface (VIF). This is achieved by creating a Direct Connect gateway and attaching it to the VIF, then associating the desired VPCs with the gateway via virtual private gateways (VGWs) or transit gateways. This enables centralized, private connectivity from on-premises to multiple VPCs without needing separate VIFs per VPC.

Answer

VPC peering connection

Answer

AWS VPN CloudHub

Answer

Transit VPC

Question 3

Which TWO of the following are best practices for securing a VPC with AWS Network Firewall? (Choose two.)

Accepted Answer

Deploy firewall endpoints in at least two Availability Zones for high availability.. Option A is correct because AWS Network Firewall firewall endpoints are Availability Zone–scoped, so deploying endpoints in at least two AZs ensures high availability and prevents a single-AZ failure from taking down inspection. Option C is correct because stateful rule groups allow deep packet inspection and application-layer (Layer 7) filtering using Suricata-compatible rules, which is essential for detecting and blocking sophisticated threats. Option B is incorrect because stateless rules alone cannot perform application-layer inspection and are not a best practice for comprehensive security. Option D is incorrect because Network Firewall can inspect both inbound and outbound traffic, not just outbound. Option E is incorrect because the firewall should be deployed in a dedicated subnet (typically a firewall subnet) rather than the same subnet as workloads, to maintain proper traffic segmentation and routing.

Answer

Use only stateless rules to minimize processing overhead.

Answer

Use Network Firewall only for outbound traffic filtering.

Answer

Deploy the firewall in the same subnet as the workload for low latency.

Question 4

Which TWO of the following are valid methods to connect a VPC to an on-premises network? (Choose TWO.)

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN creates an encrypted tunnel over the public internet between a VPC and an on-premises network using IPsec. It is a fully managed, quick-to-deploy method that supports both static routes and BGP dynamic routing via the virtual private gateway.

Answer

VPC endpoints

Answer

AWS Transit Gateway

Answer

VPC peering

Question 5

Which THREE AWS services can be used to improve the availability of a web application across multiple AWS Regions? (Choose 3.)

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator improves availability across multiple AWS Regions by using the AWS global network to route user traffic to the optimal regional endpoint based on health, latency, and geography. It provides static anycast IP addresses and automatically reroutes traffic to healthy endpoints during a regional failure, thereby enhancing fault tolerance and performance for global web applications.

Answer

VPC peering

Answer

AWS Direct Connect

Question 6

A company uses AWS Direct Connect with a private VIF to connect to a VPC. The network team wants to monitor the bandwidth utilization of the Direct Connect connection in real time. Which AWS service should be used?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the AWS service that collects and displays Direct Connect metrics such as ConnectionBpsEgress, ConnectionBpsIngress, and VirtualInterfaceBpsEgress/Ingress, allowing real-time bandwidth utilization monitoring. These metrics are published automatically to CloudWatch under the AWS/DX namespace. CloudWatch dashboards and alarms can then be built on top of them.

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Answer

AWS Config

Question 7

Which THREE of the following are considerations when designing a multi-account VPC architecture using AWS Transit Gateway? (Choose 3.)

Accepted Answer

Transit Gateway can be integrated with Direct Connect Gateway. AWS Transit Gateway acts as a central hub for interconnecting VPCs and on-premises networks. It can be integrated with Direct Connect Gateway, allowing a single Direct Connect connection to reach multiple VPCs attached to the Transit Gateway, simplifying hybrid network design and reducing operational overhead.

Answer

Each VPC must have a unique route table

Answer

VPCs with overlapping CIDR blocks can be attached

Question 8

A company has a VPC with public and private subnets. An application running in a private subnet needs to access an S3 bucket to read and write data. The security team wants to ensure that traffic to S3 does not traverse the internet. Which solution should the team implement?

Accepted Answer

Create a gateway VPC endpoint for S3 and add a route to the endpoint in the private subnet route table.. A gateway VPC endpoint for S3 allows instances in a private subnet to access S3 privately using AWS's internal network, without traversing the internet. By adding a route to the endpoint's prefix list in the private subnet route table, traffic destined for S3 is directed through the endpoint, which uses AWS PrivateLink to provide highly available, redundant connectivity.

Answer

Establish a VPN connection to AWS and route S3 traffic through the VPN.

Answer

Configure a NAT gateway in the public subnet and update the private subnet route table with a default route pointing to the NAT gateway.

Answer

Attach an internet gateway to the VPC and add a route to the S3 prefix list in the private subnet route table.

Question 9

A company is deploying a critical application across multiple AWS accounts. The network team wants to simplify IP address management and ensure that VPCs in different accounts can communicate securely. The company has a centralized network account with a transit gateway. Which architecture should the company use?

Accepted Answer

Use AWS Resource Access Manager to share the transit gateway in the network account with other accounts and attach their VPCs.. AWS Resource Access Manager (RAM) allows you to share a transit gateway from a centralized network account with other AWS accounts, enabling VPCs in those accounts to attach to the shared transit gateway. This simplifies IP address management by providing a single hub for inter-VPC routing and avoids the complexity of managing multiple VPC peering connections. The transit gateway supports transitive routing, so VPCs in different accounts can communicate securely through the centralized gateway without needing direct peering.

Answer

Create VPC peering connections between each VPC in different accounts.

Answer

Configure VPC endpoints in each account to communicate through the network account.

Answer

Set up AWS Direct Connect between accounts and route through the network account.

Question 10

Refer to the exhibit. A flow log record shows ACCEPT for traffic from 10.0.1.5 to 10.0.2.10 on port 443. Which AWS service is most likely the destination?

Accepted Answer

Application Load Balancer. An Application Load Balancer (ALB) terminates HTTPS (port 443) connections and forwards traffic to targets. Flow logs showing ACCEPT for traffic to port 443 on an ALB's internal IP (10.0.2.10) are expected because the ALB listens on that port for incoming client connections. The ALB operates at Layer 7 and is the only listed service that natively accepts HTTPS traffic on port 443 within a VPC.

Answer

Amazon RDS instance

Answer

NAT Gateway

Answer

Amazon S3

Question 11

A company is designing a network for a multi-tier application. The web tier must be accessible from the internet, the application tier must be accessible only from the web tier, and the database tier must be accessible only from the application tier. Which architecture meets these requirements?

Accepted Answer

Place each tier in a separate subnet and use security groups to allow traffic between tiers. Security groups act as a stateful virtual firewall at the instance level, allowing you to specify inbound and outbound rules based on source/destination security group IDs. By placing each tier in a separate subnet and referencing the web tier's security group as the source for the application tier's inbound rule, and the application tier's security group as the source for the database tier's inbound rule, you achieve the required least-privilege access without exposing the application or database tiers to the internet.

Answer

Place each tier in a separate subnet and use network ACLs to allow traffic between tiers

Answer

Place all tiers in the same subnet and use security groups to control traffic

Answer

Place all tiers in a public subnet and use a NAT gateway for the application and database tiers

Question 12

Arrange the steps to configure an AWS Transit Gateway with attachments to multiple VPCs:

Accepted Answer

Step 1: Create the transit gateway. Step 2: Create transit gateway attachments to VPCs. Step 3: Associate attachments with a transit gateway route table. Step 4: Update VPC route tables to point to the transit gateway. Step 5: Test connectivity.. First create the transit gateway, then create attachments, associate them with a route table, update VPC routes, and test connectivity.

Answer

Step 1: Create transit gateway attachments to VPCs. Step 2: Create the transit gateway. Step 3: Update VPC route tables. Step 4: Associate attachments with a route table. Step 5: Test connectivity.

Answer

Step 1: Create the transit gateway. Step 2: Update VPC route tables. Step 3: Create transit gateway attachments. Step 4: Associate attachments with a route table. Step 5: Test connectivity.

Answer

Step 1: Create the transit gateway. Step 2: Create transit gateway attachments. Step 3: Update VPC route tables. Step 4: Associate attachments with a route table. Step 5: Test connectivity.

Question 13

A company's security team notices that a VPC flow log record shows an outbound connection from a private EC2 instance to an IP address in a restricted country. The security group allows outbound 0.0.0.0/0 for TCP 443. The network ACL allows outbound traffic to 0.0.0.0/0 on ephemeral ports. The company uses AWS Network Firewall with a firewall policy that has a stateful rule group that denies traffic to the restricted country. The flow log shows the traffic was accepted. What is the most likely cause?

Accepted Answer

The subnet's route table does not have a route that sends traffic to the AWS Network Firewall endpoint.. AWS Network Firewall's stateful rules are only evaluated for traffic that is routed through the firewall endpoint. If the subnet's route table does not include a route directing traffic to the firewall endpoint, the traffic bypasses the firewall entirely, allowing the outbound connection even though the firewall policy denies it. Option A is incorrect because VPC Flow Logs capture all accepted and rejected traffic after security group and NACL evaluation. Option C is incorrect because the network ACL allows outbound traffic on ephemeral ports, so inbound return traffic is permitted by the default ephemeral port rule. Option D is incorrect because the security group explicitly allows outbound HTTPS (TCP 443) to 0.0.0.0/0, which is permissive.

Answer

VPC Flow Logs are not capturing all traffic.

Answer

The network ACL inbound rule blocks the return traffic.

Answer

The security group outbound rule is not configured correctly.

Question 14

A company wants to block inbound SSH traffic to all EC2 instances in a VPC while allowing all other traffic. Which security group rule should be configured?

Accepted Answer

Remove any inbound rule that allows TCP port 22. Security groups are stateful and act as a virtual firewall. By default, all inbound traffic is denied unless explicitly allowed. Therefore, to block SSH traffic, you simply remove any inbound rule that permits TCP port 22. This is option B. Option A is incorrect because security groups do not support 'deny' rules; they only support allow rules. Option C is incorrect because the question specifically asks about security group configuration, not network ACLs. Option D is incorrect because outbound rules do not affect inbound traffic, and security groups are stateful, so blocking outbound SSH would not block incoming SSH connections.

Answer

Add an inbound rule to deny TCP port 22

Answer

Add an inbound deny rule for TCP port 22 to the network ACL

Answer

Add an outbound rule to deny TCP port 22

Question 15

A startup is launching a new web application on AWS and needs to design a highly available and secure network architecture. The application will run on EC2 instances in an Auto Scaling group across two Availability Zones in a single region. The application must be accessible from the internet over HTTPS. The company expects variable traffic and wants to reduce costs where possible. They also need to protect against common web exploits like SQL injection and cross-site scripting. Which combination of AWS services should be used for the network design?

Accepted Answer

Use an Application Load Balancer (ALB) in public subnets. Enable AWS WAF on the ALB. Place EC2 instances in private subnets with a NAT gateway for outbound traffic.. An Application Load Balancer (ALB) in public subnets can terminate HTTPS and distribute traffic to EC2 instances in private subnets, which enhances security by removing direct internet access from the instances. Enabling AWS WAF on the ALB protects against common web exploits like SQL injection and cross-site scripting. A NAT gateway in public subnets provides outbound internet access for instances in private subnets, which is cost-effective for variable traffic as it scales automatically and incurs charges only when used.

Answer

Use an Application Load Balancer (ALB) in private subnets. Enable AWS WAF on the ALB. Place EC2 instances in public subnets with a VPC endpoint for outbound traffic.

Answer

Use an Application Load Balancer (ALB) in public subnets. Use a VPC endpoint for outbound traffic. Place EC2 instances in public subnets with Elastic IPs.

Answer

Use a Network Load Balancer (NLB) in public subnets. Enable AWS Shield Advanced for DDoS protection. Place EC2 instances in private subnets with a NAT gateway for outbound traffic.

AWS Certified Advanced Networking Specialty ANS-C01 practice test

Three ways to study

Study ANS-C01 by domain

Study ANS-C01 by topic

Network Management and Operations practice questions

Network Security, Compliance and Governance practice questions

Network Design practice questions

Network Implementation practice questions

ANS-C01 fundamentals practice questions

ANS-C01 scenario practice questions

ANS-C01 troubleshooting practice questions

Top ANS-C01 questions

AWS Certified Advanced Networking Specialty ANS-C01 practice questions