Courseiva
← ANS-C01
Full test
Network Design →easyMultiple ChoiceObjective-mapped

ANS-C01 Network Design Practice Question

A company wants to provide its employees with secure access to internal applications hosted in a VPC. The employees work remotely and use personal laptops. The solution must authenticate users against the company's existing identity provider (IdP) and must support both Windows and macOS clients. Which AWS service should be used?

⚠ Common exam trap

Watch out — candidates often confuse Site-to-Site VPN (which connects networks) with Client VPN (which connects individual users), leading them to select AWS Site-to-Site VPN despite the requirement for remote employee access from personal laptops.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

AWS Client VPN

AWS Client VPN is a fully managed, cloud-based VPN solution that allows remote employees to securely access resources in a VPC using their personal laptops. It supports both Windows and macOS clients natively and can integrate with the company's existing identity provider (IdP) via SAML-based authentication, meeting all stated requirements.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    AWS Transit Gateway

    Why it's wrong here

    Incorrect; Transit Gateway is for interconnecting networks.

  • ✗

    AWS Site-to-Site VPN

    Why it's wrong here

    Incorrect; Site-to-Site VPN is for network-to-network connections.

  • ✗

    AWS Direct Connect

    Why it's wrong here

    Incorrect; Direct Connect is a physical connection, not for remote clients.

  • ✓

    AWS Client VPN

    Why this is correct

    Correct; AWS Client VPN provides remote access with user authentication.

About these practice questions

Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

2 more ways this is tested on ANS-C01

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A company wants to provide its employees with access to a set of internal web applications hosted in a VPC. The applications are accessed via an internet-facing ALB. Security requirements mandate that employees connect only from the corporate network (on-premises) and not from the public internet. Which solution meets these requirements?

easy
  • A.Make the ALB internal and use a NAT gateway to provide internet access.
  • ✓ B.Set up an AWS Client VPN endpoint in the VPC and make the ALB internal. Employees connect via the VPN.
  • C.Deploy a CloudFront distribution with an origin access identity pointing to the ALB.
  • D.Keep the ALB internet-facing but restrict access using a security group that allows only the corporate public IP range.

Why B: Making the ALB internal ensures it is only reachable from within the VPC, and using an AWS Client VPN endpoint provides a secure, authenticated tunnel from the corporate network. This enforces the requirement that employees connect only from on-premises, as traffic must traverse the VPN and cannot originate from the public internet.

Variation 2. A company wants to provide its employees with secure access to internal applications running on AWS without using a VPN. Which AWS service can be used?

easy
  • A.AWS Site-to-Site VPN
  • B.AWS Transit Gateway
  • ✓ C.AWS Client VPN
  • D.AWS Direct Connect

Why C: AWS Client VPN is a managed, cloud-based VPN solution that allows employees to securely access AWS resources and internal applications from their devices using OpenVPN or IKEv2 protocols, without requiring a traditional site-to-site VPN or dedicated hardware. It provides per-user authentication via Active Directory, SAML, or mutual authentication, making it ideal for remote user access to internal applications without a VPN appliance on-premises.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.