Courseiva

AWS Certified Advanced Networking Specialty ANS-C01 (ANS-C01) — Questions 676–750

1621 questions total · 22pages · All types, answers revealed

Take a mock examExam hub
Page 9

Page 10 of 22

Page 11
676
MCQmedium

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network uses BGP to advertise the 10.0.0.0/8 prefix to AWS. The VPC has a route table that includes a route to the Virtual Private Gateway for 10.0.0.0/8. On-premises hosts can ping EC2 instances in the VPC, but EC2 instances cannot ping on-premises hosts. The VPC has an Internet Gateway and a NAT Gateway. The EC2 instances are in private subnets with routes to the NAT Gateway for 0.0.0.0/0. What is the most likely cause?

A.The Direct Connect virtual interface is configured for public VIF instead of private VIF.
B.The EC2 instances' security group outbound rules are blocking ICMP.
C.The VPC route table has a more specific local route (10.0.0.0/16) that overrides the route to the VGW for part of the on-premises CIDR.
D.The on-premises router is not advertising the 10.0.0.0/8 route to AWS.
AnswerC

Because the VPC uses 10.0.0.0/16, any on-premises IP within that range is considered local and not forwarded to the VGW.

Why this answer

For EC2 instances to reach on-premises hosts, the VPC route table must have a route for the on-premises CIDR pointing to the Virtual Private Gateway. The engineer has that route. However, the on-premises hosts are in the 10.0.0.0/8 range, and the VPC also uses 10.0.0.0/16.

The issue is that the VPC route table has a local route for 10.0.0.0/16, which is more specific than the 10.0.0.0/8 route to the VGW. Traffic from EC2 to on-premises hosts within the 10.0.0.0/16 range will be routed locally within the VPC, not through the VGW. The on-premises hosts must be in a different CIDR than the VPC's CIDR, or the VPC must use a different CIDR.

Since the VPC uses 10.0.0.0/16, any on-premises host with an IP in that range will be considered local and won't go through the VGW. The solution is to ensure the VPC CIDR does not overlap with the on-premises CIDR.

Full explanation →
677
MCQeasy

A company uses AWS Client VPN to provide remote access to its VPC. Users report slow connection speeds. The CloudWatch metrics show high packet loss on the VPN connections. What is the most likely cause?

A.The client certificate has expired.
B.The Client VPN subnet is too small.
C.MTU mismatch between the client and the VPN endpoint.
D.Route propagation is not enabled in the VPC route table.
AnswerC

MTU mismatch leads to fragmentation and packet loss.

Why this answer

An MTU mismatch between the client and VPN endpoint can cause fragmentation and packet loss, leading to slow speeds. Option A is incorrect because an expired certificate would cause authentication failure, not packet loss. Option B is incorrect because subnet size affects IP address availability, not packet loss.

Option D is incorrect because route propagation affects reachability, not packet loss.

Full explanation →
678
MCQeasy

A company is planning to connect multiple VPCs in different AWS accounts using AWS Transit Gateway. The VPCs must be able to communicate with each other, but the company wants to centralize egress traffic to the internet through a single VPC that has a NAT gateway. Which configuration meets these requirements?

A.Attach all VPCs to a Transit Gateway, create a central egress VPC with a NAT gateway, and configure Transit Gateway route tables to send default traffic to the central VPC.
B.Use AWS Site-to-Site VPN to connect the VPCs and route traffic through a central VPN endpoint.
C.Use VPC peering to connect all VPCs and configure a NAT gateway in one VPC.
D.Attach each VPC to a Transit Gateway and configure a NAT gateway in each VPC.
AnswerA

Centralizes internet egress while allowing VPC-to-VPC communication.

Why this answer

AWS Transit Gateway allows you to attach multiple VPCs from different accounts and centrally manage routing. By configuring the Transit Gateway route tables to send default traffic (0.0.0.0/0) to a central egress VPC that contains a NAT gateway, all other VPCs can route internet-bound traffic through that single NAT gateway, centralizing egress while maintaining inter-VPC communication.

Exam trap

The trap here is that candidates often confuse VPC peering with Transit Gateway, assuming VPC peering supports transitive routing (which it does not), or they think placing a NAT gateway in each VPC is acceptable, missing the explicit requirement for centralized egress.

How to eliminate wrong answers

Option B is wrong because AWS Site-to-Site VPN is designed for connecting on-premises networks to AWS, not for inter-VPC connectivity, and it would introduce unnecessary complexity, latency, and bandwidth limitations. Option C is wrong because VPC peering does not support transitive routing; to connect all VPCs in a mesh, you would need a full mesh of peering connections, which does not scale and still requires manual route table entries in each VPC to direct traffic to the central NAT gateway. Option D is wrong because configuring a NAT gateway in each VPC defeats the requirement to centralize egress traffic; each VPC would have its own independent internet egress, not a single centralized point.

Full explanation →
679
Multi-Selecthard

Which THREE are valid methods to secure data in transit between a VPC and an on-premises network over the internet? (Choose three.)

Select 3 answers
A.VPC Endpoint (Gateway or Interface)
B.AWS Direct Connect with a VPN
C.AWS Client VPN
D.VPC Peering
E.AWS Site-to-Site VPN
AnswersB, C, E

Combines Direct Connect for reliability and VPN for encryption.

Why this answer

To secure data in transit between a VPC and an on-premises network over the internet, the valid methods are AWS Direct Connect with a VPN (B), AWS Client VPN (C), and AWS Site-to-Site VPN (E).

AWS Site‑to‑Site VPN creates an IPsec VPN tunnel over the internet between the VPC and the on‑premises network, encrypting all traffic.

AWS Client VPN is a managed service that allows individual clients to securely connect to the VPC over the internet using an OpenVPN tunnel.

AWS Direct Connect with a VPN combines a dedicated physical connection (Direct Connect) with an IPsec VPN to provide both low latency and encryption. While Direct Connect itself is not over the internet, the VPN layer secures the data in transit.

Option A (VPC Endpoint) is used to access AWS services privately within the VPC, not for on‑premises connectivity.

Option D (VPC Peering) connects VPCs, not on‑premises networks.

Full explanation →
680
MCQeasy

A company wants to use AWS Direct Connect to connect their on-premises network to a VPC. They have two Direct Connect locations and want high availability. What is the minimum number of Direct Connect virtual interfaces needed?

A.One public VIF and one private VIF
B.Four private VIFs
C.Two private VIFs
D.One private VIF
AnswerC

Two VIFs, each on a separate Direct Connect connection, provide high availability.

Why this answer

For high availability across two Direct Connect locations, you need at least two private virtual interfaces (VIFs), one at each location, each connecting to the same VPC. This ensures that if one Direct Connect connection or location fails, traffic can still flow through the other private VIF. A single private VIF provides no redundancy, and public VIFs are used for accessing public AWS services, not VPC connectivity.

Exam trap

The ANS-C01 exam often tests the misconception that a public VIF is needed for VPC connectivity or that more VIFs automatically mean better availability, when in reality private VIFs are the only type that provide VPC access, and exactly two private VIFs (one per location) meet the minimum high-availability requirement.

How to eliminate wrong answers

Option A is wrong because a public VIF is used for accessing AWS public services (e.g., S3, DynamoDB) and does not provide connectivity to a VPC; mixing a public VIF with a private VIF does not achieve high availability for VPC access. Option B is wrong because four private VIFs exceed the minimum requirement; two private VIFs (one per Direct Connect location) are sufficient for high availability, and additional VIFs are unnecessary and increase complexity. Option D is wrong because a single private VIF creates a single point of failure; if the Direct Connect connection or location fails, connectivity to the VPC is lost, violating high availability requirements.

Full explanation →
681
Multi-Selecthard

A company has a VPC with multiple subnets spanning three Availability Zones. They have deployed an Application Load Balancer (ALB) in the VPC and need to ensure high availability and scalability for a web application. Which of the following are design considerations for implementing the ALB in this environment? (Choose THREE.)

Select 3 answers
A.Enable the ALB in at least two Availability Zones to provide high availability.
B.Remove an Availability Zone from the ALB if the targets in that AZ are unhealthy.
C.Configure the ALB to use subnets that span multiple Availability Zones.
D.Use VPC peering to connect the ALB to subnets in other VPCs.
E.Enable cross-zone load balancing to evenly distribute traffic across all targets.
AnswersA, B, E

ALB must have targets in multiple AZs to be highly available.

Why this answer

AWS requires an Application Load Balancer to be enabled in at least two Availability Zones to achieve high availability. If one AZ fails, the ALB can continue routing traffic to healthy targets in the remaining AZs, ensuring fault tolerance and compliance with the ALB's regional service model.

Exam trap

AWS often tests the misconception that subnets can span multiple Availability Zones or that VPC peering can directly integrate an ALB with subnets in another VPC, but both are architecturally invalid in AWS.

Full explanation →
682
MCQhard

A company uses AWS Direct Connect to connect their on-premises network to AWS. They want to encrypt all traffic between their on-premises router and the AWS Direct Connect location. Which solution should they implement?

A.Use an IPsec VPN over the internet for additional encryption.
B.Use AWS PrivateLink to create a secure connection.
C.Enable MACsec on the Direct Connect connection.
D.Use TLS to encrypt the traffic at the application layer.
AnswerC

MACsec encrypts the Direct Connect link at Layer 2.

Why this answer

MACsec provides encryption at Layer 2 for Direct Connect. Option A is wrong because IPsec VPN over the internet is not over Direct Connect. Option B is wrong because TLS is for application layer.

Option D is wrong because AWS PrivateLink is for VPC endpoints.

Full explanation →
683
Multi-Selecthard

A security engineer is designing a network security architecture for a hybrid cloud environment. The company has an AWS Direct Connect connection to its on-premises data center. They want to ensure that all traffic between on-premises and AWS is encrypted and that the encryption is enforced at the network layer. Which TWO solutions should the engineer consider?

Select 2 answers
A.Enable MACsec on the Direct Connect dedicated connection.
B.Set up an SSL VPN between on-premises and AWS.
C.Use VPC Peering to connect on-premises to AWS.
D.Configure an IPsec VPN over the Direct Connect virtual interface.
E.Use TLS encryption at the application layer.
AnswersA, D

MACsec provides Layer 2 encryption on the Direct Connect physical link.

Why this answer

(MACsec) is correct because it provides encryption at Layer 2 on the Direct Connect connection. Option D (IPsec VPN over Direct Connect) is correct because it creates an encrypted tunnel over the Direct Connect link. TLS is Layer 5+ and not network layer.

SSL VPN is not relevant. VPC Peering does not apply to on-premises.

Full explanation →
684
MCQeasy

A company wants to restrict access to an S3 bucket so that only objects with server-side encryption using AWS KMS (SSE-KMS) can be uploaded. Which bucket policy condition should be used?

A.kms:ViaService
B.s3:x-amz-server-side-encryption
C.aws:SourceVpce
D.s3:x-amz-server-side-encryption-aws-kms-key-id
AnswerD

This condition enforces a specific KMS key ID for SSE-KMS.

Why this answer

S3:x-amz-server-side-encryption-aws-kms-key-id. This condition key in an S3 bucket policy allows you to enforce that objects must be encrypted with a specific AWS KMS key when the SSE-KMS header is used. Option A (kms:ViaService) is a condition key used in KMS key policies, not in S3 bucket policies; it controls which AWS services can use the KMS key.

Option B (s3:x-amz-server-side-encryption) checks the encryption header but cannot enforce a specific KMS key ID—it only checks for the value 'aws:kms' or 'AES256', but not the key ID. Option C (aws:SourceVpce) is used to restrict access to a specific VPC endpoint, not encryption settings. Therefore, only D provides the granularity to require a specific KMS key ID for SSE-KMS.

Full explanation →
685
MCQeasy

A company wants to block outbound traffic from a VPC to the internet except through a NAT Gateway for updates to specific software repositories. Which AWS service should be used to control outbound traffic?

A.Security Groups
B.Route Tables
C.VPC Endpoints
D.Network ACLs
AnswerD

Network ACLs are stateless and can control outbound traffic at the subnet level.

Why this answer

Network ACLs can be attached to subnets to control inbound and outbound traffic at the subnet level, and can be used to block outbound internet traffic except through the NAT Gateway. Option A is wrong because Security Groups are stateful and cannot block outbound traffic based on destination IP ranges in a granular manner. Option B is wrong because Route Tables control routing, not filtering.

Option C is wrong because VPC Endpoints are for private connectivity to AWS services, not for controlling outbound internet traffic.

Full explanation →
686
MCQmedium

A network engineer is troubleshooting a Direct Connect private VIF. The VIF is in 'available' state but traffic is not flowing to the VPC. The VGW is attached to the VPC. What is the most likely cause?

A.The VPC route table lacks a route to the on-premises network pointing to the VGW.
B.The route filter prefix for the VPC CIDR is misconfigured.
C.BGP is not established between the on-premises router and the VGW.
D.The VIF state is not 'available'.
AnswerA

Without this route, traffic cannot be forwarded.

Why this answer

When a Direct Connect private VIF is in the 'available' state, the physical and logical layer 2 connectivity is established, and BGP sessions are typically up. However, traffic still cannot flow to the VPC unless the VPC route table contains a route that directs traffic destined for the on-premises network to the Virtual Private Gateway (VGW). Without this route, the VPC has no path to send traffic over the Direct Connect connection, even though the VIF and BGP are operational.

Exam trap

The trap here is that candidates assume an 'available' VIF and established BGP automatically mean traffic flows, but they overlook the critical requirement of a VPC route table entry pointing to the VGW as the next hop.

How to eliminate wrong answers

Option B is wrong because route filter prefixes control which BGP routes are advertised or accepted, but they do not prevent traffic flow if the VPC route table already has a static route pointing to the VGW; the question states the VIF is available and BGP is likely established, so a misconfigured route filter would affect route propagation, not the immediate lack of a route in the VPC. Option C is wrong because if BGP were not established, the VIF would typically show a 'down' or 'pending' BGP status, but the VIF is 'available' and the issue is traffic not flowing, implying BGP is up. Option D is wrong because the VIF state is explicitly stated as 'available', which means the physical and logical layer 2 connectivity is functioning correctly.

Full explanation →
687
MCQhard

Refer to the exhibit. A network engineer has this IAM policy attached to their user. They attempt to create a VPC peering connection between VPC A (in account 123456789012) and VPC B (in account 210987654321). The request fails. Which additional permission is required?

A.The ec2:CreateVpcPeeringConnection action is not allowed on the accepter VPC.
B.The policy must include a condition that the accepter VPC owner is the target account.
C.The user needs ec2:ModifyVpcPeeringConnectionOptions permission.
D.The user needs ec2:CreateVpcEndpoint permission.
AnswerB

Without a condition, the peering request may be denied if the accepter account is not specified.

Why this answer

When creating a VPC peering connection across AWS accounts, the requester's IAM policy must include a condition that explicitly allows the action only when the accepter VPC owner is the target account. Without this condition, the ec2:CreateVpcPeeringConnection action will fail because the policy lacks the necessary cross-account authorization context. The condition key aws:SourceAccount or ec2:AccepterVpcOwnerId must be used to restrict the action to the specific accepter account.

Exam trap

The ANS-C01 exam often tests the misconception that the ec2:CreateVpcPeeringConnection action alone is sufficient for cross-account peering, but the trap is that the IAM policy must include a condition to specify the accepter account ID, otherwise the request fails due to missing authorization context.

How to eliminate wrong answers

Option A is wrong because the ec2:CreateVpcPeeringConnection action is allowed on the requester VPC, not the accepter VPC; the accepter VPC is specified as a parameter, and the action itself is performed on the requester side. Option C is wrong because ec2:ModifyVpcPeeringConnectionOptions is used to update DNS resolution or other peering options after the connection is established, not to create the peering connection itself. Option D is wrong because ec2:CreateVpcEndpoint is unrelated to VPC peering; it is used to create VPC endpoints for AWS services like S3 or DynamoDB.

Full explanation →
688
MCQhard

Refer to the exhibit. An AWS administrator is troubleshooting an issue where an EC2 instance cannot access an S3 bucket using an instance profile. The instance profile is associated with an IAM role that has the above trust policy. The S3 bucket policy allows s3:GetObject only for the role's ARN. What is the most likely cause of the access failure?

A.The VPC does not have an S3 VPC endpoint
B.The instance profile is not attached to the EC2 instance
C.The S3 bucket policy does not allow s3:ListBucket
D.The trust policy does not allow the S3 service to assume the role
AnswerB

Without the instance profile, the EC2 instance cannot assume the role.

Why this answer

The instance profile must be attached to the EC2 instance for the IAM role's credentials to be available to the instance. Without this attachment, the EC2 instance cannot assume the role or use its permissions to access the S3 bucket, even if the trust policy and bucket policy are correctly configured.

Exam trap

The trap here is that candidates often overlook the instance profile attachment step and instead focus on policy misconfigurations, assuming the trust policy or bucket policy is the issue when the real problem is the missing link between the instance and the role.

How to eliminate wrong answers

Option A is wrong because an S3 VPC endpoint is not required for EC2 instances to access S3 via an instance profile; it is only needed for private connectivity without traversing the internet. Option C is wrong because the s3:GetObject permission is sufficient to read an object; s3:ListBucket is only required for listing objects, not for a direct GetObject request. Option D is wrong because the trust policy in the exhibit allows the EC2 service (not S3) to assume the role, which is correct for an instance profile; the S3 service does not need to assume the role.

Full explanation →
689
MCQmedium

A company is setting up a new AWS Direct Connect connection. They have provisioned a 1 Gbps dedicated connection. They need to create a private virtual interface (VIF) to connect to their VPC. The VIF has been created and is in the 'available' state, but the BGP session is not coming up. What is the most likely cause?

A.The BGP hold timer is set too high on the customer router.
B.The VLAN ID assigned to the VIF is already in use on another VIF.
C.The BGP authentication key does not match between the customer router and AWS.
D.The Direct Connect interface is in the 'down' state.
AnswerC

If BGP MD5 authentication is configured, both sides must have the same key, or the session will not establish.

Why this answer

The most likely cause is a BGP authentication key mismatch. When the BGP session fails to establish but the virtual interface is in the 'available' state, it indicates the Layer 2 (VLAN) and Layer 1 (physical) connectivity are working. BGP authentication uses MD5 (per RFC 2385), and if the pre-shared key configured on the customer router does not exactly match the key specified in the AWS Direct Connect console for the private VIF, the TCP MD5 signature will fail, preventing the BGP session from coming up.

Exam trap

The ANS-C01 exam often tests the distinction between Layer 2 (VIF state) and Layer 3 (BGP session) issues, tricking candidates into thinking a 'down' physical interface or VLAN conflict is the cause when the VIF is already in the 'available' state.

How to eliminate wrong answers

Option A is wrong because a BGP hold timer set too high would not prevent the session from coming up; it would only cause the session to take longer to detect a failure, but the initial OPEN message exchange would still succeed if other parameters match. Option B is wrong because if the VLAN ID were already in use on another VIF, the VIF creation would fail or the interface would show an error state; the VIF being in 'available' state confirms the VLAN ID is unique and accepted. Option D is wrong because the Direct Connect interface being in the 'down' state would prevent the VIF from reaching the 'available' state; the question explicitly states the VIF is 'available', confirming the physical and logical link is up.

Full explanation →
690
MCQhard

Refer to the exhibit. An IAM role ARN is shown. A security engineer wants to allow an EC2 instance to assume this role. What is required for the EC2 instance to successfully assume the role?

A.The trust policy must specify the EC2 instance's private IP address.
B.The role's trust policy must allow the EC2 service principal to assume the role, and the EC2 instance must be launched with an instance profile that includes this role.
C.The role's permissions policy must include an Allow for the EC2 instance's security group.
D.The EC2 instance must have a public IP address to access the IAM endpoint.
AnswerB

The trust policy grants the EC2 service permission to assume the role, and the instance profile associates the role with the instance.

Why this answer

To allow an EC2 instance to assume an IAM role, two conditions must be met: 1) The role's trust policy must allow the EC2 service principal (ec2.amazonaws.com) to assume the role, 2) The EC2 instance must be launched with an instance profile that includes that role. This is correctly described in option B. Option A is incorrect because the trust policy specifies the service principal, not an IP address.

Option C is incorrect because the permissions policy defines what the role can do, not who can assume it; the trust policy controls who can assume the role. Option D is incorrect because the EC2 instance can access the IAM endpoint via private IP as long as it has network connectivity (e.g., through a VPC endpoint or NAT), and a public IP is not required.

Full explanation →
691
MCQmedium

A company has an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The ALB is configured with a target group that has a health check path of /health. Some instances are failing health checks and being marked unhealthy, but the application logs show the instances are healthy. What is the most likely cause?

A.The health check path is incorrect
B.The target group's slow start duration is too long
C.The security group for the instances does not allow inbound traffic from the ALB's security group on the health check port
D.The ALB's stickiness is preventing health checks
AnswerC

The ALB's health checks must be allowed by the instance security group.

Why this answer

The most likely cause is that the security group for the EC2 instances does not allow inbound traffic from the ALB's security group on the health check port. ALB health checks originate from the ALB's private IP addresses, and if the instance security group lacks an inbound rule permitting traffic from the ALB's security group (or its CIDR) on the health check port, the health check requests are dropped, causing the target to be marked unhealthy even though the application itself is running fine.

Exam trap

The trap here is that candidates assume health check failures always indicate application problems, but The ANS-C01 exam often tests the security group misconfiguration where the ALB's health check traffic is blocked, causing a false unhealthy status despite the application being healthy.

How to eliminate wrong answers

Option A is wrong because the health check path /health is explicitly stated as the configured path, and the application logs show the instances are healthy, indicating the path is correct. Option B is wrong because slow start duration only affects how traffic is gradually sent to newly registered targets; it does not impact health check success or failure. Option D is wrong because ALB stickiness (session affinity) is a traffic routing feature based on cookies, and it does not interfere with or prevent health checks from being sent to targets.

Full explanation →
692
MCQmedium

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that no VPC in any account can have an internet gateway attached. Which option meets this requirement?

A.Create an IAM policy that denies ec2:AttachInternetGateway and attach it to each account's admin role.
B.Use security groups to block traffic from internet gateways.
C.Apply a service control policy (SCP) that denies ec2:AttachInternetGateway at the root level.
D.Use network ACLs to block traffic from internet gateways.
AnswerC

SCPs centrally control permissions for all accounts in the organization and can deny the action.

Why this answer

A service control policy (SCP) applied at the root organizational unit (OU) level can deny the ec2:AttachInternetGateway action across all accounts in the organization. This centrally enforces the restriction. Option A is incorrect because IAM policies are applied per account and do not prevent the action if the user has permissions through other means.

Option B is incorrect because security groups control traffic at the instance level, not internet gateway attachments. Option D is incorrect because network ACLs control traffic at the subnet level, not internet gateway attachments.

Full explanation →
693
MCQeasy

A company has an AWS Site-to-Site VPN connection between their on-premises network and a VPC. The VPN tunnel status shows 'UP'. However, instances in the VPC cannot ping an on-premises server at 192.168.1.10. Which step should be taken to troubleshoot?

A.Verify that the internet gateway is attached to the VPC
B.Verify that the VPC route table has a route to the on-premises network via the virtual private gateway
C.Verify that the security group for the instances allows outbound ICMP
D.Verify that the VPN tunnel is up on both ends
AnswerB

Without this route, traffic from VPC to on-premises is dropped.

Why this answer

Even though the VPN tunnel is 'UP', traffic from the VPC to the on-premises network must be routed through the virtual private gateway (VGW). If the VPC route table does not contain a route for the on-premises CIDR (e.g., 192.168.1.0/24) pointing to the VGW, the instances have no path to reach the on-premises server, regardless of tunnel status.

Exam trap

The trap here is that candidates see 'VPN tunnel status UP' and assume connectivity is fully functional, overlooking the critical requirement of a VPC route pointing to the virtual private gateway for traffic to traverse the tunnel.

How to eliminate wrong answers

Option A is wrong because an internet gateway is used for internet-bound traffic, not for traffic destined to an on-premises network over a VPN; the VPC can route to on-premises without an internet gateway. Option C is wrong because the issue is about reachability at the network layer (routing), not about firewall rules; outbound ICMP from the security group would be a secondary check only after routing is confirmed. Option D is wrong because the question explicitly states the VPN tunnel status shows 'UP', so the tunnel is already up on both ends; rechecking the tunnel status does not address the missing route.

Full explanation →
694
MCQmedium

A company has a VPC with a CIDR block of 10.0.0.0/16. It needs to create a secondary CIDR block for additional subnets that must not overlap with the existing CIDR. Which CIDR block should be used?

A.172.16.0.0/16
B.10.0.0.0/16
C.10.0.0.0/8
D.10.1.0.0/16
AnswerA, D

Correct: 172.16.0.0/16 is a private, non-overlapping CIDR from a different RFC 1918 block.

Why this answer

Both A (172.16.0.0/16) and D (10.1.0.0/16) are correct because they are private, non-overlapping secondary CIDRs. The primary CIDR is 10.0.0.0/16; any non-overlapping CIDR is valid, regardless of RFC 1918 class. Options B and C overlap with the primary and therefore cannot be used.

Exam trap

The ANS-C01 exam often tests whether candidates know that secondary CIDRs can be from the same RFC 1918 class as the primary as long as they do not overlap. Many mistakenly eliminate D (10.1.0.0/16) because it is in the 10.0.0.0/8 range, but it is actually valid. Both A and D are acceptable.

How to eliminate wrong answers

Option A is wrong because 172.16.0.0/16 is a valid RFC 1918 private range, but AWS does not allow mixing different RFC 1918 address classes (10.x.x.x, 172.16.x.x, 192.168.x.x) as secondary CIDRs for a VPC; all CIDRs in a VPC must be from the same RFC 1918 class (e.g., all 10.x.x.x). Option B is wrong because 10.0.0.0/16 is identical to the existing CIDR, causing an overlap, which AWS explicitly prohibits when adding a secondary CIDR. Option C is wrong because 10.0.0.0/8 is a supernet that entirely contains the existing 10.0.0.0/16, resulting in overlap; AWS requires secondary CIDRs to be non-overlapping and typically within the same /16 or smaller prefix length.

Full explanation →
695
MCQeasy

A company needs to centrally manage network security policies across multiple VPCs and on-premises networks. Which AWS service provides a centralized dashboard for managing firewall rules?

A.Network ACLs
B.Security Groups
C.AWS WAF
D.AWS Network Firewall
AnswerD

AWS Network Firewall provides a centralized firewall management service with a dashboard to manage rules across multiple VPCs and on-premises networks.

Why this answer

AWS Network Firewall offers a centralized dashboard for managing network-level firewall rules across multiple VPCs and on-premises networks, with policy-based management. Option A is incorrect because Network ACLs are stateless, applied at the subnet level, and lack centralized management capabilities. Option B is incorrect because Security Groups are stateful, applied at the ENI level, and not designed for centralized cross-VPC management.

Option C is incorrect because AWS WAF protects web applications at the application layer (HTTP/S), not network-layer firewall rules.

Full explanation →
696
MCQhard

Refer to the exhibit. A Lambda function is attached to a VPC using the network interface eni-1234567890abcdef0. The Lambda function needs to send traffic to an on-premises server via a Direct Connect connection. The traffic is failing. Which setting on the network interface is most likely causing the issue?

A.The network interface is in a subnet that does not have a route to the Direct Connect.
B.The network interface has two private IP addresses.
C.The SourceDestCheck flag is enabled, which prevents the Lambda function from sending traffic that it is not the source or destination of.
D.The security group attached to the network interface may be blocking outbound traffic.
AnswerC

Lambda functions that forward traffic need to disable source/destination check.

Why this answer

Lambda functions attached to a VPC use elastic network interfaces (ENIs) with the Source/Destination Check flag enabled by default. This flag causes the ENI to drop any traffic where the ENI's IP address is not the source or destination of the packet. Since the Lambda function is sending traffic to an on-premises server via Direct Connect, the ENI is acting as an intermediate hop, and the flag must be disabled for the traffic to pass.

Exam trap

The ANS-C01 exam often tests the Source/Destination Check flag as a hidden default setting that candidates forget to disable when an ENI is used for forwarding traffic, leading them to incorrectly blame routing or security groups.

How to eliminate wrong answers

Option A is wrong because the subnet's route table can be configured with a route to the Direct Connect virtual interface (VIF) or Direct Connect Gateway, and the question does not indicate a missing route; the issue is at the ENI level. Option B is wrong because having two private IP addresses on an ENI does not inherently prevent outbound traffic; it is a common configuration for multi-homed workloads and does not affect source/destination checks. Option D is wrong because security groups are stateful and, by default, allow all outbound traffic; unless explicitly modified, they would not block the Lambda function's outbound traffic.

Full explanation →
697
MCQmedium

Refer to the exhibit. A VPN connection has two tunnels. Which statement is correct about this VPN configuration?

A.The VPN uses BGP dynamic routing
B.The VPN provides high availability with two tunnels
C.The tunnel inside CIDRs are /24 networks
D.Both tunnels use the same inside CIDR
AnswerB

Two tunnels provide redundancy.

Why this answer

The exhibit shows a VPN connection with two tunnels, which is the standard design for AWS Site-to-Site VPN to provide high availability. Each tunnel is on a separate device and path, so if one tunnel fails, traffic automatically fails over to the other tunnel. This ensures that the VPN connection remains operational even during maintenance or failure of a single tunnel.

Exam trap

AWS often tests the misconception that two tunnels in a VPN connection are for load balancing, but in AWS Site-to-Site VPN, they are strictly for high availability (active/standby or active/active with BGP), not for aggregating bandwidth.

How to eliminate wrong answers

Option A is wrong because the VPN configuration shown does not indicate BGP dynamic routing; the tunnels could be using static routing or BGP, but the exhibit alone does not confirm BGP. Option C is wrong because the tunnel inside CIDRs are not necessarily /24 networks; AWS VPN tunnels use /30 or /31 networks for the inside IP addresses. Option D is wrong because both tunnels use different inside CIDRs (e.g., 169.254.10.0/30 and 169.254.11.0/30) to avoid IP overlap and allow independent routing.

Full explanation →
698
MCQhard

Refer to the exhibit. A VPN connection is established between an on-premises network (10.0.0.0/16) and an AWS VPC (172.16.0.0/16). The on-premises network can ping the VPC's private IP addresses, but the VPC cannot ping the on-premises network's IP addresses. The VPC route table has a route to 10.0.0.0/16 pointing to the VGW. What is the MOST likely cause?

A.The VPN tunnels are not both in UP state
B.The VPN acceleration is disabled, causing high latency
C.The VPN connection is configured with static routes only and BGP is not used
D.The on-premises network does not have a route to the VPC CIDR (172.16.0.0/16) pointing to the customer gateway
AnswerD

Without a return route, traffic from VPC reaches on-premises but replies are dropped.

Why this answer

The on-premises network can ping the VPC because the VPC route table has a route to 10.0.0.0/16 pointing to the virtual private gateway (VGW), so return traffic from the VPC is correctly forwarded. However, the VPC cannot ping the on-premises network because the on-premises router lacks a route back to the VPC CIDR (172.16.0.0/16) pointing to the customer gateway (CGW). Without this return route, traffic from the VPC reaches the on-premises network, but the on-premises router drops the response packets as it does not know how to reach 172.16.0.0/16.

Exam trap

The ANS-C01 exam often tests the concept that a VPN tunnel being 'UP' does not guarantee bidirectional traffic; candidates mistakenly assume tunnel status implies full connectivity, but the real issue is often a missing return route on the on-premises side.

How to eliminate wrong answers

Option A is wrong because the VPN tunnels being in UP state is required for any traffic to flow; since the on-premises network can already ping the VPC, at least one tunnel must be UP. Option B is wrong because VPN acceleration (Accelerated Site-to-Site VPN) reduces latency but does not affect basic connectivity or routing; high latency would not prevent ping responses from being returned. Option C is wrong because using static routes versus BGP does not cause unidirectional connectivity; static routes can work correctly as long as both sides have proper routes.

The issue is the missing return route on the on-premises side, not the routing method.

Full explanation →
699
MCQeasy

A company runs a web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB) across multiple Availability Zones. The application uses a MySQL database on an RDS instance in a private subnet. Security compliance requires that all traffic between the ALB and EC2 instances must be encrypted. The security team finds that the ALB currently sends traffic to the EC2 instances using HTTP on port 80. The EC2 security group allows inbound HTTP traffic from the ALB security group. The team needs to implement encryption with minimal changes and without disrupting the application. Which solution meets these requirements?

A.Set up an AWS Client VPN endpoint and have the ALB send traffic through the VPN to the EC2 instances.
B.Deploy an internal ALB in front of the EC2 instances and configure it with an HTTPS listener. Route traffic from the public ALB to the internal ALB.
C.Modify the ALB listener to use HTTPS on port 443. Create a new target group with protocol HTTPS on port 443. Install a valid SSL/TLS certificate on each EC2 instance. Update the EC2 security group to allow inbound HTTPS from the ALB security group.
D.Replace the ALB with a Network Load Balancer (NLB) and use TLS listeners to the EC2 instances.
AnswerC

This encrypts traffic between ALB and EC2 with minimal changes.

Why this answer

It directly modifies the existing ALB to use an HTTPS listener on port 443, creates a new target group with HTTPS on port 443, and requires installing a valid SSL/TLS certificate on each EC2 instance. This ensures all traffic between the ALB and EC2 instances is encrypted with TLS, meeting the security requirement with minimal changes and no disruption to the application. The EC2 security group update to allow inbound HTTPS from the ALB security group completes the configuration.

Exam trap

The trap here is that candidates may think simply changing the ALB listener to HTTPS is enough, but they overlook the requirement to create a new target group with HTTPS protocol and install certificates on the EC2 instances to encrypt the traffic between the ALB and the instances, not just the client-to-ALB leg.

How to eliminate wrong answers

Option A is wrong because introducing an AWS Client VPN endpoint adds unnecessary complexity, latency, and cost; it does not encrypt traffic between the ALB and EC2 instances natively and would disrupt the existing architecture. Option B is wrong because deploying an internal ALB in front of the EC2 instances creates an unnecessary hop and does not encrypt the traffic between the public ALB and the internal ALB unless that leg is also configured with HTTPS, which still requires changes to the EC2 instances and adds complexity. Option D is wrong because replacing the ALB with an NLB would require reconfiguring the entire load balancing setup, potentially disrupting the application, and NLBs do not support native HTTPS health checks or path-based routing that the application may rely on; TLS listeners on an NLB still require certificates on the EC2 instances, but the change is more invasive than modifying the existing ALB.

Full explanation →
700
MCQeasy

Based on the output, which of the following is true?

A.The Direct Connect Gateway uses ASN 64512
B.The Direct Connect Gateway is in a 'deleted' state
C.The Direct Connect Gateway is a virtual private gateway
D.The Direct Connect Gateway is owned by a different account
AnswerA

The amazonSideAsn is set to 64512.

Why this answer

The output shows the Direct Connect Gateway with ASN 64512, which is a private autonomous system number commonly used for Direct Connect Gateways. This ASN is assigned to the gateway and is visible in the output, confirming that option A is correct.

Exam trap

The ANS-C01 exam often tests the distinction between a Direct Connect Gateway and a virtual private gateway, where candidates confuse the two because both are used for hybrid connectivity, but they serve different purposes and use different ASN configurations.

How to eliminate wrong answers

Option B is wrong because the output does not indicate a 'deleted' state; the gateway is listed with an active state and associated VIFs. Option C is wrong because a Direct Connect Gateway is a distinct resource from a virtual private gateway (VPG) — VPGs are used for VPN connections, not Direct Connect. Option D is wrong because the output does not show any cross-account ownership; the gateway is owned by the same account as indicated by the consistent account ID in the output.

Full explanation →
701
Multi-Selecthard

A company is setting up a Site-to-Site VPN connection between their on-premises network and AWS. Which THREE components are required for a VPN connection?

Select 3 answers
A.VPN Tunnel
B.Transit Gateway
C.Internet Gateway
D.Virtual Private Gateway
E.Customer Gateway
AnswersA, D, E

Encrypted connection.

Why this answer

A VPN tunnel is a required component for an AWS Site-to-Site VPN connection because it provides the encrypted, secure communication channel between the on-premises customer gateway and the AWS virtual private gateway. Each VPN connection consists of two tunnels for high availability, each using IPsec (IKEv1 or IKEv2) to encrypt traffic. Without at least one VPN tunnel, no encrypted data can traverse the VPN connection.

Exam trap

AWS often tests the misconception that a Transit Gateway is a required component for a Site-to-Site VPN, but the correct required components are only the VPN Tunnel, Virtual Private Gateway, and Customer Gateway.

Full explanation →
702
MCQhard

A company is experiencing high latency for traffic between EC2 instances in the same VPC but in different Availability Zones. The network team suspects the issue is related to the placement group used. The instances are in a spread placement group. What should the network engineer do to reduce latency?

A.Change the placement group to a cluster placement group and ensure instances are in the same Availability Zone.
B.Enable enhanced networking on the instances and increase the instance size.
C.Move the instances to the same subnet within the same Availability Zone but keep the spread placement group.
D.Create a VPC peering connection between the two AZs and route traffic through it.
AnswerA

A cluster placement group is recommended for low-latency, high-throughput traffic.

Why this answer

A cluster placement group is designed for low-latency, high-throughput traffic by ensuring instances are in close proximity. Option B is incorrect because enabling enhanced networking and increasing instance size can improve throughput but does not directly reduce latency caused by inter-AZ distance. Option C is incorrect because moving instances to the same AZ helps, but a spread placement group still places instances on different racks, which introduces additional latency compared to a cluster placement group.

Option D is incorrect because VPC peering is used for connectivity between different VPCs; for intra-VPC traffic, adding a VPC peering connection does not reduce latency and may even add complexity.

Full explanation →
703
Multi-Selecthard

A company is troubleshooting connectivity issues between two VPCs that are peered using an inter-region VPC peering connection. The VPCs have the following CIDR blocks: VPC A (10.0.0.0/16) and VPC B (10.1.0.0/16). Which THREE of the following are possible reasons for the connectivity failure?

Select 3 answers
A.The VPC CIDR blocks overlap.
B.The VPC peering connection is in a 'pending-acceptance' state.
C.The route tables in each VPC do not have routes pointing to the peer VPC's CIDR.
D.The network ACLs in VPC A are blocking inbound traffic from VPC B's CIDR.
E.The security group rules in VPC A do not allow inbound traffic from VPC B's CIDR.
AnswersC, D, E

Without routes, traffic will not be forwarded to the peering connection.

Why this answer

For inter-region VPC peering to function, each VPC must have explicit routes in its route tables pointing to the CIDR block of the peer VPC, with the VPC peering connection as the target. Without these routes, traffic destined for the peer VPC will not be forwarded over the peering link, causing connectivity failure.

Exam trap

The ANS-C01 exam often tests the misconception that overlapping CIDRs are the only cause of peering failures, but here the CIDRs are non-overlapping, so candidates must recognize that missing routes and security group/NACL misconfigurations are equally valid causes.

Full explanation →
704
MCQhard

An organization is using AWS Direct Connect with a private VIF to connect to a VPC. They want to extend connectivity to multiple VPCs in the same region without creating multiple private VIFs. Which solution should they implement?

A.Create VPC peering connections from the VPC with the Direct Connect VIF to the other VPCs.
B.Create a Direct Connect gateway and associate it with a Transit Gateway that is attached to the VPCs.
C.Provision separate private VIFs for each VPC.
D.Use a Transit VIF to connect directly to a Transit Gateway.
AnswerB

A Direct Connect gateway can be associated with multiple virtual private gateways or a Transit Gateway to connect to multiple VPCs.

Why this answer

A Direct Connect gateway allows you to associate a single private VIF with multiple VPCs in the same region by connecting to a Transit Gateway. The Transit Gateway then acts as a hub, enabling transitive routing between all attached VPCs without needing separate VIFs. This solution scales efficiently and avoids the complexity of managing multiple private VIFs.

Exam trap

The trap here is that candidates often confuse Transit VIFs with private VIFs, thinking a Transit VIF can directly connect to a Transit Gateway, but in reality, a Transit VIF always connects to a Direct Connect gateway, which then associates with a Transit Gateway.

How to eliminate wrong answers

Option A is wrong because VPC peering does not support transitive routing; you would need a full mesh of peering connections, and it does not leverage the Direct Connect private VIF to extend connectivity natively. Option C is wrong because provisioning separate private VIFs for each VPC defeats the requirement to avoid multiple private VIFs and increases cost and management overhead. Option D is wrong because a Transit VIF is used to connect to a Direct Connect gateway, not directly to a Transit Gateway; the Transit Gateway must be associated with the Direct Connect gateway, not directly attached via a Transit VIF.

Full explanation →
705
MCQeasy

A company has an on-premises data center connected to AWS via a Site-to-Site VPN. The VPN connection uses BGP for dynamic routing. The company wants to add an additional VPN tunnel for redundancy. What must be configured?

A.Create a second virtual private gateway and attach it to the VPC.
B.Add a transit gateway to replace the virtual private gateway.
C.Create a second VPN connection to a second customer gateway device.
D.Configure static routes instead of BGP.
AnswerC

Provides redundant tunnels.

Why this answer

To add an additional VPN tunnel for redundancy, you must create a second VPN connection that uses a second customer gateway device. This provides a second BGP session and a separate tunnel, ensuring failover if the primary tunnel or customer gateway fails. The existing virtual private gateway can support multiple VPN connections, so no replacement or additional VGW is needed.

Exam trap

The trap here is that candidates assume you need a second virtual private gateway for redundancy, but AWS allows multiple VPN connections to the same VGW, so the correct approach is to add a second VPN connection with a separate customer gateway device.

How to eliminate wrong answers

Option A is wrong because a single VPC can only have one virtual private gateway attached at a time; you cannot attach a second VGW to the same VPC. Option B is wrong because replacing the VGW with a transit gateway is unnecessary for simply adding a redundant VPN tunnel; a transit gateway is used for complex multi-VPC or hybrid network topologies, not for basic VPN redundancy. Option D is wrong because switching from BGP to static routes would eliminate the dynamic failover and route propagation benefits that BGP provides, which is counterproductive for redundancy.

Full explanation →
706
MCQeasy

A company is deploying a new web application on AWS. They need to distribute incoming HTTPS traffic across multiple EC2 instances in different Availability Zones. Which AWS service should they use?

A.Amazon Route 53
B.Amazon CloudFront
C.Application Load Balancer (ALB)
D.Network Load Balancer (NLB)
AnswerC

ALB operates at Layer 7, can terminate HTTPS, and distribute traffic across instances in multiple AZs.

Why this answer

The Application Load Balancer (ALB) is the correct choice because it operates at Layer 7 (HTTP/HTTPS) and can terminate TLS, inspect HTTPS headers, and route traffic based on content. It is designed to distribute incoming HTTPS traffic across multiple EC2 instances in different Availability Zones, providing health checks and automatic scaling.

Exam trap

The trap here is that candidates often confuse Layer 4 (NLB) with Layer 7 (ALB) and incorrectly choose NLB because it handles high throughput, but they miss that HTTPS requires application-layer inspection and TLS termination, which only ALB provides natively.

How to eliminate wrong answers

Option A is wrong because Amazon Route 53 is a DNS service that resolves domain names to IP addresses, not a traffic distributor for HTTPS requests; it cannot perform load balancing or health checks on EC2 instances. Option B is wrong because Amazon CloudFront is a content delivery network (CDN) that caches content at edge locations and accelerates delivery, but it does not distribute traffic across EC2 instances in different Availability Zones; it can be used with an ALB but is not a substitute for a load balancer. Option D is wrong because Network Load Balancer (NLB) operates at Layer 4 (TCP/UDP) and does not understand HTTPS headers or perform TLS termination, making it unsuitable for distributing HTTPS traffic based on application-layer content.

Full explanation →
707
MCQeasy

A company has a VPC with both IPv4 and IPv6 CIDRs. They need to allow outbound IPv6 traffic from private subnets to the internet. What should they use?

A.An internet gateway attached to the VPC.
B.A customer-managed prefix list.
C.A NAT gateway in a public subnet.
D.An egress-only internet gateway.
AnswerD

Designed for outbound-only IPv6 traffic from private subnets.

Why this answer

An egress-only internet gateway (EIGW) is a horizontally scaled, redundant VPC component that allows outbound IPv6 traffic from instances in a VPC to the internet, while preventing the internet from initiating an IPv6 connection to those instances. It is specifically designed for IPv6 traffic and must be used with a route table entry that directs all outbound IPv6 traffic (::/0) to the EIGW. Unlike an internet gateway, an EIGW does not support inbound IPv6 connections, making it the correct choice for private subnets that need outbound-only IPv6 internet access.

Exam trap

The trap here is that candidates often confuse the egress-only internet gateway with a NAT gateway, assuming NAT can handle IPv6, or they incorrectly select an internet gateway thinking it can be restricted to outbound-only traffic, but AWS does not support such a configuration for IPv6.

How to eliminate wrong answers

Option A is wrong because an internet gateway supports both inbound and outbound IPv6 traffic, which would expose private subnet instances to inbound connections from the internet, violating the requirement for outbound-only access. Option B is wrong because a customer-managed prefix list is used to define a set of IP address ranges for route tables or security groups, not to provide internet connectivity or routing for IPv6 traffic. Option C is wrong because a NAT gateway is designed for IPv4 traffic only; it does not support IPv6 and cannot be used to route IPv6 traffic to the internet.

Full explanation →
708
MCQeasy

A company wants to deploy a web application on EC2 instances behind an Application Load Balancer (ALB). The application must support sticky sessions (session affinity). What configuration is required on the ALB?

A.Enable stickiness on the target group and specify a cookie duration
B.Use path-based routing
C.Configure health checks on the target group
D.Enable proxy protocol v2
AnswerA

Stickiness (session affinity) ensures the same client is routed to the same target.

Why this answer

Sticky sessions (session affinity) are enabled at the target group level on an Application Load Balancer. By enabling stickiness and specifying a cookie duration, the ALB generates a session cookie (AWSALB) that binds a client's session to a specific target for the duration, ensuring subsequent requests from the same client are routed to the same EC2 instance.

Exam trap

The trap here is confusing target group-level stickiness with listener-level routing rules (path-based) or connection metadata protocols (Proxy Protocol), leading candidates to select options that address different ALB features.

How to eliminate wrong answers

Option B is wrong because path-based routing controls which target group handles requests based on URL path patterns, not session stickiness. Option C is wrong because health checks determine target availability for routing traffic, but do not affect session affinity or cookie behavior. Option D is wrong because Proxy Protocol v2 is used to pass client connection information (source IP, port) to the backend, not to enable sticky sessions.

Full explanation →
709
MCQeasy

A company has a VPC peering connection between VPC A (10.0.0.0/16) and VPC B (10.1.0.0/16). They have added routes in both route tables. However, instances in VPC A cannot ping instances in VPC B. The security groups and network ACLs allow ICMP. What is the most likely cause?

A.The security groups in VPC B do not allow inbound ICMP from VPC A CIDR
B.The route tables in VPC A do not have a route to VPC B CIDR pointing to the peering connection
C.The VPC peering connection is not in the 'active' state
D.The instances are in different Availability Zones
AnswerB

Without a specific route to the peered VPC CIDR, traffic will not be sent over the peering connection.

Why this answer

The question states that routes have been added in both route tables, but the most likely cause is that the route in VPC A's route table does not point to the VPC peering connection as the target. Without a specific route for VPC B's CIDR (10.1.0.0/16) with the peering connection ID as the target, traffic from VPC A to VPC B will not be forwarded over the peering link, even if security groups and NACLs permit ICMP.

Exam trap

The trap here is that candidates often assume that simply creating a VPC peering connection and adding routes generically is sufficient, but they overlook the requirement that the route must explicitly point to the peering connection ID as the target, not just any route to the peer CIDR.

How to eliminate wrong answers

Option A is wrong because the question explicitly states that security groups allow ICMP, and even if they didn't, the issue is at the routing layer, not the security layer. Option C is wrong because if the peering connection were not in the 'active' state, the instances would not be able to communicate at all, but the question describes a scenario where routes have been added, implying the peering exists and is accepted; a non-active state would prevent route propagation and is less likely than a missing route. Option D is wrong because VPC peering works across Availability Zones; instances in different AZs can communicate over a peering connection as long as routing and security are correctly configured.

Full explanation →
710
MCQmedium

A security engineer is designing a network firewall solution for a VPC with multiple subnets. The solution must inspect traffic between instances in the same VPC, including traffic within the same subnet. Which AWS service should be used?

A.Security Groups
B.VPC Flow Logs
C.AWS Network Firewall
D.AWS WAF
AnswerC

Provides stateful and stateless inspection for all VPC traffic.

Why this answer

(AWS Network Firewall) is correct because it is a managed service that can inspect traffic between subnets and within a subnet in a VPC, providing stateful and stateless rules for deep packet inspection. Option A (Security Groups) is wrong because they are stateful but cannot inspect traffic within the same subnet; they only allow or deny traffic based on rules. Option B (VPC Flow Logs) is wrong because they capture metadata about traffic but do not inspect packets.

Option D (AWS WAF) is wrong because it is designed for web application layer 7 inspection, not for general network traffic inspection.

Full explanation →
711
Multi-Selectmedium

A company is deploying a web application that will be accessed over the internet. They want to use an Application Load Balancer (ALB) to distribute traffic across EC2 instances in multiple Availability Zones. Which TWO configurations are required to make the ALB internet-facing? (Choose TWO.)

Select 2 answers
A.Configure a security group that allows inbound traffic from 0.0.0.0/0.
B.Assign an Elastic IP address to the ALB.
C.Associate the ALB with private subnets only.
D.Associate the ALB with public subnets that have a route to an Internet Gateway.
E.Select 'Internet-facing' as the scheme when creating the ALB.
AnswersD, E

Required for internet-facing ALB.

Why this answer

An internet-facing ALB must be associated with public subnets that have a route to an Internet Gateway (IGW). This ensures the ALB's nodes receive public IP addresses and can accept traffic from the internet. Option E is correct because the scheme must be explicitly set to 'internet-facing' during creation; this determines whether the ALB gets public IP addresses and is reachable from the internet.

Exam trap

The trap here is that candidates confuse security group rules (Option A) or Elastic IP assignment (Option B) with the fundamental requirement of an internet-facing scheme and public subnet association, which are the only two configurations that actually make the ALB internet-facing.

Full explanation →
712
Multi-Selectmedium

A company wants to implement a defense-in-depth strategy for a web application hosted on AWS. Which TWO services should they use to protect against common web exploits and DDoS attacks?

Select 2 answers
A.AWS WAF
B.AWS Shield Advanced
C.Amazon Inspector
D.AWS Network Firewall
E.Amazon GuardDuty
AnswersA, B

WAF protects against web exploits.

Why this answer

And B are correct: AWS WAF protects against common web exploits like SQL injection and cross-site scripting, and AWS Shield Advanced provides enhanced DDoS protection for web applications. Option C (Amazon Inspector) is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, not inline protection. Option D (AWS Network Firewall) is a managed network firewall for filtering traffic at the VPC level, not specifically for web exploits.

Option E (Amazon GuardDuty) is a threat detection service that continuously monitors for malicious activity, but it does not provide inline prevention.

Full explanation →
713
Multi-Selecthard

A company is migrating its on-premises data center to AWS using Direct Connect and a VPN connection as backup. The company has multiple VPCs connected via a Transit Gateway. They want to ensure high availability for the Direct Connect connection. Which TWO actions should be taken? (Choose TWO.)

Select 2 answers
A.Replace the VPN backup with a second Direct Connect connection
B.Enable jumbo frames on the Direct Connect connection
C.Use a single Direct Connect connection but with higher bandwidth
D.Configure BGP with multiple virtual interfaces on the Direct Connect connections
E.Provision a second Direct Connect connection at a different location
AnswersD, E

Correct; BGP allows dynamic failover between virtual interfaces.

Why this answer

Options D and E are correct. To achieve high availability for Direct Connect, you need redundant physical connections at different locations (Option E) and configure BGP with multiple virtual interfaces to enable active-active or active-passive failover (Option D). Option A is not required because a VPN backup already exists, and a second Direct Connect connection alone does not guarantee location diversity.

Option B (jumbo frames) does not affect availability, and Option C (higher bandwidth) does not provide redundancy.

Full explanation →
714
Multi-Selecthard

A company is designing a hybrid network using AWS Direct Connect. They have a VPC with CIDR 10.0.0.0/16 and an on-premises network with CIDR 192.168.0.0/16. They want to establish a Direct Connect private virtual interface with a virtual private gateway. Which THREE steps are required to complete the connectivity? (Choose three.)

Select 3 answers
A.Create a Transit Gateway and attach the VPC to it.
B.Create a virtual private gateway and attach it to the VPC.
C.Update the VPC route table to add a route for the on-premises CIDR pointing to the virtual private gateway.
D.Configure a private virtual interface on the Direct Connect connection, associating it with the virtual private gateway.
E.Create a customer gateway object in the AWS account.
AnswersB, C, D

The virtual private gateway is the AWS side endpoint for the Direct Connect private virtual interface.

Why this answer

A virtual private gateway (VGW) is the required AWS-side endpoint for a Direct Connect private virtual interface (VIF) to terminate on a single VPC. The VGW must be created and attached to the VPC before the private VIF can be associated with it, enabling private connectivity between the on-premises network and the VPC.

Exam trap

The trap here is that candidates confuse the customer gateway object (used for VPN) with the virtual private gateway (used for Direct Connect), leading them to incorrectly select Option E as a required step.

Full explanation →
715
Multi-Selecthard

A company is troubleshooting connectivity issues between an on-premises network and a VPC connected via AWS Direct Connect. The network team has verified that the virtual interface (VIF) is up and BGP is established. However, traffic is not flowing. Which two configuration issues could cause this problem? (Choose TWO.)

Select 2 answers
A.The on-premises router is not advertising the on-premises CIDR prefix via BGP.
B.The AWS Direct Connect connection is not associated with the correct Direct Connect gateway.
C.The virtual interface is in a 'down' state.
D.The VPC route table does not have a route to the on-premises CIDR pointing to the Direct Connect virtual interface.
E.The security group attached to the EC2 instance blocks inbound traffic from on-premises.
AnswersA, D

If BGP does not advertise the prefix, the Direct Connect gateway will not propagate the route to the VPC.

Why this answer

Correct routes on both sides are needed. If the VPC route table does not have a route to the on-premises CIDR via the Direct Connect VIF, traffic won't flow. Similarly, if the on-premises router does not advertise the correct prefix, or if the VPC's route table lacks a route, connectivity fails.

Security group rules might block, but they are not the most likely if BGP is up. The VIF state is up, so that's not the issue.

Full explanation →
716
MCQeasy

A company is designing a VPC with a public subnet for a web server and a private subnet for a database. The web server needs to download patches from the internet. The database should not have direct internet access. Which architecture meets these requirements?

A.Place the web server in the public subnet with an Internet Gateway, and the database in the private subnet without any internet access.
B.Place both instances in the public subnet and use security groups to restrict inbound access to the database.
C.Place the web server in the public subnet with an Internet Gateway, and the database in the private subnet with a route to a NAT Gateway in the public subnet for outbound access only.
D.Place the web server in the private subnet with a NAT Gateway, and the database in the public subnet with an Internet Gateway.
AnswerC

Web server gets internet via IGW; database can initiate outbound traffic via NAT Gateway without being directly reachable.

Why this answer

It places the web server in a public subnet with a route to an Internet Gateway (IGW) for direct outbound internet access to download patches, while the database resides in a private subnet with a route to a NAT Gateway in the public subnet. The NAT Gateway enables outbound-only internet access for the database (e.g., for license validation or updates) without exposing it to unsolicited inbound connections, meeting the requirement that the database should not have direct internet access.

Exam trap

The trap here is that candidates often assume a private subnet must have zero internet access, forgetting that outbound-only access via a NAT Gateway is allowed and commonly required for patching or updates, while a public subnet with an IGW is for bidirectional internet access.

How to eliminate wrong answers

Option A is wrong because placing the database in a private subnet without any internet access prevents it from performing necessary outbound operations (e.g., contacting license servers or sending logs), which is overly restrictive and not aligned with the requirement that only direct inbound internet access is prohibited. Option B is wrong because placing both instances in a public subnet exposes the database to the internet; security groups alone cannot prevent the database from having a public IP address or being reachable from the internet if the subnet has a route to an IGW, violating the 'no direct internet access' requirement. Option D is wrong because placing the web server in a private subnet with a NAT Gateway would force all its internet traffic through the NAT, adding unnecessary latency and cost, while placing the database in a public subnet with an IGW directly exposes it to the internet, contradicting the requirement.

Full explanation →
717
MCQeasy

A company wants to ensure that traffic between EC2 instances in the same VPC but different subnets is encrypted. Which solution should be used?

A.Use security groups to allow traffic.
B.Use VPC Peering.
C.Use network ACLs to allow traffic.
D.Use IPsec VPN between the instances.
AnswerD

IPsec provides encryption for traffic between instances.

Why this answer

An IPsec VPN between EC2 instances creates an encrypted tunnel at Layer 3, ensuring that all traffic between the instances is encrypted regardless of the underlying network path. This is necessary because traffic within a VPC traversing different subnets is not encrypted by default, even though it stays within the AWS network.

Exam trap

The trap here is that candidates confuse network-layer access control (security groups, NACLs) with encryption, assuming that allowing traffic through a firewall or using VPC Peering inherently secures the data, when in fact neither provides confidentiality or integrity of the payload.

How to eliminate wrong answers

Option A is wrong because security groups act as a virtual firewall at the instance level, controlling allowed traffic based on IP addresses and ports, but they do not provide encryption of the traffic itself. Option B is wrong because VPC Peering connects two VPCs at Layer 3 and does not encrypt traffic between them; it simply routes packets without any encryption overhead. Option C is wrong because network ACLs are stateless packet filters at the subnet boundary that allow or deny traffic based on rules, but they do not encrypt the data payload.

Full explanation →
718
MCQhard

A network engineer is reviewing VPC Flow Logs for a VPC. The logs show that traffic from 10.0.1.5 to 10.0.2.10 on port 443 is being accepted and rejected intermittently. Both instances are in the same VPC. What is the most likely cause?

A.The security group on the destination instance is configured to allow inbound HTTPS but deny outbound traffic.
B.The network ACL is blocking traffic.
C.The route table is misconfigured.
D.The source instance's security group is denying outbound traffic.
AnswerB

Correct. A network ACL is stateless and requires both inbound and outbound rules to allow traffic. If outbound rules block response traffic, the flow will show intermittent ACCEPT and REJECT.

Why this answer

VPC Flow Logs show intermittent ACCEPT and REJECT for traffic from 10.0.1.5 to 10.0.2.10 on port 443. Since the traffic is within the same VPC, the route table is not involved (Option C is unlikely). Security groups are stateful, so even if the destination security group denies outbound traffic, return traffic for the established inbound connection is still allowed; thus Option A is incorrect.

The intermittent behavior is characteristic of a stateless network ACL (NACL). A NACL is applied at the subnet level and evaluates inbound and outbound rules independently. If the NACL allows inbound traffic but blocks outbound response traffic (or vice versa), the flow will be partially accepted (initial packets) and then rejected when return packets hit the blocking rule.

This matches the logs showing both ACCEPT and REJECT for the same flow. Therefore, the most likely cause is a misconfigured NACL (Option B).

Exam trap

The ANS-C01 exam often tests the distinction between stateful security groups and stateless network ACLs. Candidates may incorrectly assume that intermittent traffic issues are due to security group rules, but the key indicator is the 'intermittent' pattern—a hallmark of stateless firewall behavior where response traffic can be blocked if outbound rules are missing.

How to eliminate wrong answers

Option B is wrong because network ACLs are stateless and evaluate traffic in both directions independently; if a network ACL were blocking traffic, it would consistently reject packets, not intermittently, and the logs would show a clear pattern of 'REJECT' for all packets in a given direction. Option C is wrong because a misconfigured route table would cause traffic to be sent to a different target (e.g., an internet gateway or a different subnet) or be dropped entirely, resulting in consistent failure rather than intermittent acceptance and rejection. Option D is wrong because the source instance's security group controls outbound traffic from the source; if it denied outbound traffic, the source would never send packets to the destination, and the VPC Flow Logs would not show any 'ACCEPT' entries for the traffic from 10.0.1.5 to 10.0.2.10.

Full explanation →
719
Multi-Selecthard

A financial services company is deploying a multi-account environment using AWS Organizations. The security team requires that all network traffic to and from the internet must flow through a centralized inspection VPC that hosts third-party firewall appliances. The architecture uses a single AWS Transit Gateway with a centralized inspection VPC attached. Which THREE steps are necessary to enforce this architecture? (Choose THREE.)

Select 3 answers
A.Configure each VPC's route table with a default route (0.0.0.0/0) pointing to the transit gateway attachment.
B.Use AWS Organizations service control policies to prevent direct internet access from spoke VPCs.
C.Deploy VPC Gateway Endpoints for S3 and DynamoDB in each spoke VPC.
D.In the inspection VPC, route traffic from the transit gateway to the firewall appliances, then back to the transit gateway for egress.
E.Create separate transit gateway route tables for the inspection VPC and spoke VPCs, and propagate routes appropriately.
AnswersA, D, E

Correct. Spoke VPCs route all internet-bound traffic to the transit gateway, which then forwards it to the inspection VPC.

Why this answer

Spoke VPCs need a default route (0.0.0.0/0) pointing to the transit gateway attachment to send internet-bound traffic to the inspection VPC. Option D is correct: in the inspection VPC, traffic from the transit gateway must be routed to the firewall appliances, inspected, and then sent back to the transit gateway for egress to the internet. Option E is correct: separate transit gateway route tables for the inspection VPC and spoke VPCs are required, with appropriate propagation and static routes to enforce traffic flow through the inspection VPC.

Option B is incorrect because service control policies (SCPs) can be used to restrict actions in AWS Organizations but do not directly enforce routing; routing is handled via route tables. Option C is incorrect because VPC Gateway Endpoints for S3 and DynamoDB do not affect internet traffic routing; they provide private access to those services.

Full explanation →
720
MCQhard

A company is designing a network for a real-time trading application that requires extremely low latency (sub-millisecond) between two EC2 instances located in the same AWS region. The instances are in different Availability Zones. The trading application uses a proprietary protocol over TCP. The company wants to minimize latency as much as possible. They are considering using a placement group. Which type of placement group should they use, and what network optimization should they apply?

A.Use a spread placement group and enable dedicated tenancy
B.Use a partition placement group and enable EBS-optimized instances
C.Use a cluster placement group for both instances and enable enhanced networking (SR-IOV)
D.Use a cluster placement group but launch instances in different Availability Zones
AnswerC

Cluster placement group provides low latency; enhanced networking reduces overhead.

Why this answer

A cluster placement group is the only placement group type that provides low-latency, high-bandwidth network performance by placing instances in a single Availability Zone within the same rack. Enhanced networking using SR-IOV (Single Root I/O Virtualization) bypasses the hypervisor's network stack, reducing per-packet processing latency and jitter, which is critical for sub-millisecond trading traffic over TCP.

Exam trap

AWS often tests the misconception that a cluster placement group can span multiple Availability Zones, but in reality, it is confined to a single AZ to guarantee low-latency physical proximity.

How to eliminate wrong answers

Option A is wrong because spread placement groups spread instances across distinct hardware to reduce failure risk, which increases network distance and latency, and dedicated tenancy does not improve network performance. Option B is wrong because partition placement groups isolate instances across logical partitions for large distributed workloads, not for low latency, and EBS-optimized instances improve storage throughput, not network latency. Option D is wrong because a cluster placement group requires all instances to be in the same Availability Zone to achieve low latency; placing instances in different Availability Zones negates the benefit and introduces cross-AZ latency.

Full explanation →
721
MCQeasy

A company wants to connect its VPC to an on-premises data center using AWS Direct Connect. The company has two Direct Connect locations in the same AWS region. For high availability, they plan to establish two separate connections. Which configuration ensures that if one connection fails, traffic automatically fails over to the other?

A.Establish one Direct Connect connection and one AWS Site-to-Site VPN connection as backup.
B.Establish two Direct Connect connections from the same Direct Connect location to the same VPC.
C.Establish two Direct Connect connections from different Direct Connect locations to the same VPC, each with a private VIF attached to the same virtual private gateway.
D.Establish a single Direct Connect connection with two virtual interfaces (VIFs) to the same VPC.
AnswerC

Different locations provide physical diversity; BGP routing handles failover automatically.

Why this answer

It provides true high availability by using two Direct Connect connections from different geographic locations, each with a private virtual interface (VIF) attached to the same virtual private gateway (VGW). This configuration ensures that if one connection fails, BGP sessions automatically withdraw the affected routes, and traffic is rerouted over the remaining connection via the VGW's active/active or active/passive routing behavior.

Exam trap

The ANS-C01 exam often tests the misconception that multiple connections from the same Direct Connect location provide sufficient redundancy, but the trap here is that a single location is a common failure domain, so you must use different locations to achieve true high availability.

How to eliminate wrong answers

Option A is wrong because using a Site-to-Site VPN as a backup to a single Direct Connect connection does not provide automatic failover within the same network path; VPNs have lower bandwidth and higher latency, and failover requires manual or scripted route manipulation unless using BGP with a VPN connection, which is not the scenario described. Option B is wrong because establishing two Direct Connect connections from the same location creates a single point of failure at that location; if the location goes down, both connections fail, violating high-availability requirements. Option D is wrong because a single Direct Connect connection with two virtual interfaces still relies on a single physical link; if the physical connection fails, both VIFs go down, providing no redundancy.

Full explanation →
722
Multi-Selectmedium

Which TWO measures can be taken to protect an AWS account's root user credentials? (Choose two.)

Select 2 answers
A.Create an IAM user with administrative privileges and use that instead of the root user
B.Use the root user for daily administrative tasks
C.Delete the root user account after creating IAM users
D.Enable multi-factor authentication (MFA) on the root user
E.Store the root user credentials in a shared password manager
AnswersA, D

Best practice is to use IAM users for administration.

Why this answer

Options A and D are correct. Creating an IAM user with administrative privileges allows you to avoid using the root user for daily tasks, which is a best practice. Enabling MFA on the root user adds an extra layer of security.

Option B is incorrect because using the root user for daily administrative tasks increases risk and violates security best practices. Option C is incorrect because the root user cannot be deleted. Option E is incorrect because storing credentials in a shared password manager is insecure and not recommended.

Full explanation →
723
MCQmedium

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team notices that traffic from a specific VPC to an on-premises network is being dropped. All other VPCs can reach the on-premises network. Which configuration should be checked first?

A.Check the on-premises firewall rules
B.Check the VPC's security groups
C.Check the VPC's network ACLs
D.Check the Transit Gateway route tables
AnswerD

The Transit Gateway route table associated with the VPC attachment might be missing the route to the on-premises network.

Why this answer

The issue is isolated to one VPC, so route tables are the most likely cause. Transit Gateway route tables might not have the route for the on-premises network propagated from that VPC's attachment.

Full explanation →
724
MCQhard

A company uses AWS Direct Connect with a public VIF to access Amazon S3. The on-premises network team reports that the BGP session for the public VIF is flapping intermittently. Which configuration change on the customer router would most likely stabilize the BGP session?

A.Set the BGP multi-hop TTL to 255.
B.Configure BGP route filtering to limit the number of routes advertised to AWS to no more than 100.
C.Increase the BGP hold timer to 180 seconds.
D.Disable BGP fast-external-fallover on the customer router.
AnswerB

AWS limits public VIF to 100 prefixes; exceeding causes flapping.

Why this answer

BGP flapping due to route advertisements exceeding the maximum allowed is a known issue. The maximum number of routes allowed on a public VIF is 100. Advertising more than this will cause the session to flap.

Limiting routes to 100 will stabilize.

Full explanation →
725
MCQmedium

A company has an S3 bucket with the bucket policy shown. The VPC endpoint ID is correct. However, an EC2 instance in a private subnet in the same VPC cannot download objects from the bucket. What is a possible reason?

A.The EC2 instance does not have a route to the VPC endpoint
B.The bucket policy does not allow s3:ListBucket
C.The EC2 instance is accessing S3 via a NAT Gateway instead of the VPC endpoint
D.The VPC endpoint security group is blocking traffic
AnswerC

The policy only allows requests coming through the VPC endpoint; requests via NAT Gateway are denied.

Why this answer

The bucket policy likely includes a condition that restricts access to only requests originating from the VPC endpoint (e.g., `aws:sourceVpce`). If the EC2 instance in the private subnet routes traffic through a NAT Gateway instead of the VPC endpoint, the source IP will be the NAT Gateway's public IP, not the VPC endpoint's private IP, causing the condition to fail and the request to be denied. The instance can still reach S3 via the NAT Gateway, but the policy explicitly blocks non-endpoint traffic.

Exam trap

The ANS-C01 exam often tests the misconception that VPC endpoints always require security groups or that any route to S3 (including via NAT) will satisfy a bucket policy condition, when in fact the condition `aws:sourceVpce` specifically requires traffic to traverse the VPC endpoint.

How to eliminate wrong answers

Option A is wrong because the EC2 instance in a private subnet with a VPC endpoint automatically has a route to the endpoint via the endpoint's prefix list in the route table; no additional route is needed. Option B is wrong because downloading an object requires only `s3:GetObject` permission, not `s3:ListBucket`; the bucket policy likely already allows `s3:GetObject` for the VPC endpoint. Option D is wrong because VPC endpoint security groups only apply to interface endpoints (e.g., for services like EC2 API), not to gateway endpoints (like S3 or DynamoDB), which do not use security groups.

Full explanation →
726
MCQeasy

A company is designing a network for a new VPC. They want to ensure that the VPC can connect to an on-premises data center via a site-to-site VPN. The on-premises network uses a CIDR block of 10.0.0.0/8. The VPC will use a CIDR block of 10.0.0.0/16. The network engineer is concerned about overlapping IP addresses. What is the best way to avoid IP address overlap?

A.Use the same CIDR block and rely on NAT
B.Use a different RFC 1918 CIDR block for the VPC
C.Use a smaller subnet within the same 10.0.0.0/8 range
D.Use a public IP range for the VPC
AnswerB

Avoids overlap.

Why this answer

Using a different RFC 1918 CIDR block (e.g., 172.16.0.0/12 or 192.168.0.0/16) for the VPC completely avoids IP address overlap with the on-premises 10.0.0.0/8 network. Overlapping CIDR blocks (both using 10.0.0.0/8) would prevent successful route propagation and cause asymmetric routing or connectivity failures in the site-to-site VPN. NAT can mitigate overlap but adds complexity and is not the 'best' design choice when a non-overlapping private range is available.

Exam trap

AWS often tests the misconception that NAT can always solve IP overlap issues, but the best practice is to design non-overlapping private IP spaces from the start to avoid complexity and routing failures.

How to eliminate wrong answers

Option A is wrong because using the same CIDR block (10.0.0.0/16 within 10.0.0.0/8) creates an overlap that NAT alone cannot fully resolve for bidirectional traffic without complex rules and potential performance issues; it is not the best architectural practice. Option C is wrong because using a smaller subnet within the same 10.0.0.0/8 range still overlaps with the on-premises network, as the on-premises CIDR encompasses the entire 10.0.0.0/8 space, leading to routing conflicts. Option D is wrong because using a public IP range for the VPC violates RFC 1918 private addressing best practices, is not routable over a VPN without additional NAT or BGP complexities, and can cause conflicts with internet-bound traffic.

Full explanation →
727
Multi-Selecthard

Which THREE factors should be considered when designing a VPC for a multi-tier application that requires high availability and security? (Choose three.)

Select 3 answers
A.Provision subnets in at least two Availability Zones
B.Assign public IP addresses to all instances for direct access
C.Use separate subnets for web, application, and database tiers
D.Use a single Availability Zone to reduce latency
E.Use NAT Gateways in public subnets for outbound internet access from private subnets
AnswersA, C, E

Provides high availability in case of AZ failure.

Why this answer

Deploying subnets across at least two Availability Zones (AZs) ensures high availability by eliminating a single point of failure. If one AZ experiences an outage, the application can continue serving traffic from the other AZ. This is a foundational principle for building fault-tolerant architectures in AWS.

Exam trap

AWS often tests the misconception that high availability can be achieved within a single Availability Zone by using redundant components, but the correct approach requires at least two AZs to survive an AZ-level failure.

Full explanation →
728
Multi-Selecthard

A company has a VPC with a public subnet and a private subnet. The private subnet needs to access an S3 bucket for backups. Which TWO actions are required to provide private connectivity to S3 without using a NAT Gateway?

Select 2 answers
A.Create a NAT Gateway in the public subnet.
B.Create a VPC Gateway Endpoint for S3.
C.Add a route for the S3 prefix list in the private subnet route table pointing to the gateway endpoint.
D.Create a VPC Interface Endpoint for S3.
E.Create a VPC Peering connection to an S3 VPC.
AnswersB, C

Gateway Endpoint provides private S3 access.

Why this answer

A VPC Gateway Endpoint provides private connectivity to S3 without traversing the internet or requiring a NAT Gateway. It uses AWS’s internal network to route traffic from the private subnet to S3, ensuring data never leaves the AWS backbone. This is the most cost-effective and secure method for private S3 access within a VPC.

Exam trap

The trap here is that candidates often confuse VPC Gateway Endpoints with VPC Interface Endpoints, assuming both are equally valid for private S3 access, but the question specifically requires two actions that do not use a NAT Gateway, and the correct pair (Gateway Endpoint + route) is the only combination that meets the criteria without additional costs or complexity.

Full explanation →
729
MCQmedium

A global company wants to connect multiple VPCs across different AWS Regions using a hub-and-spoke model. The hub VPC contains shared services such as Active Directory and DNS. Which AWS service provides the most scalable and maintainable solution for this architecture?

A.AWS VPN CloudHub to interconnect all VPCs.
B.AWS Direct Connect gateway with virtual interfaces to each VPC.
C.VPC peering between each spoke VPC and the hub VPC.
D.AWS Transit Gateway with inter-Region peering attachments.
AnswerD

Transit Gateway provides a scalable hub-and-spoke architecture and supports inter-Region peering.

Why this answer

AWS Transit Gateway with inter-Region peering attachments is the most scalable and maintainable solution because it provides a central hub to connect multiple VPCs across different AWS Regions using a fully managed service. Inter-Region peering attachments allow transitive routing between all attached VPCs without requiring full mesh peering, and they support route propagation and centralized management of shared services like Active Directory and DNS. This architecture scales linearly as new VPCs or Regions are added, unlike VPC peering which requires individual non-transitive connections.

Exam trap

The trap here is that candidates often choose VPC peering (Option C) because it is a familiar and simple solution, but they overlook the non-transitive nature of VPC peering, which prevents the hub from routing traffic between spoke VPCs and requires a full mesh of peering connections for transitive communication.

How to eliminate wrong answers

Option A is wrong because AWS VPN CloudHub uses multiple VPN connections from remote networks to a single virtual private gateway, but it does not support connecting VPCs directly—it is designed for on-premises branch connectivity, not VPC-to-VPC routing across Regions. Option B is wrong because AWS Direct Connect gateway with virtual interfaces is used to connect on-premises networks to multiple VPCs in different Regions, but it does not provide transitive routing between VPCs themselves and is not designed for VPC-to-VPC hub-and-spoke connectivity. Option C is wrong because VPC peering is non-transitive, meaning each spoke VPC must be individually peered to the hub VPC, and it does not support inter-Region transitive routing through a single hub—each peering connection is a one-to-one relationship that cannot be used to route traffic between spoke VPCs via the hub.

Full explanation →
730
MCQeasy

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. Which AWS service should be used to provide internet access to instances in the private subnets without assigning public IP addresses?

A.NAT gateway in a public subnet.
B.Internet gateway attached to the VPC.
C.VPC Gateway Endpoint for Amazon S3.
D.Site-to-Site VPN connection.
AnswerA

NAT gateway enables outbound internet access for private instances.

Why this answer

A NAT gateway allows instances in private subnets to initiate outbound traffic to the internet. Option B is wrong because Internet Gateway alone does not provide NAT; it requires public IPs. Option C is wrong because VPN does not provide direct internet access.

Option D is wrong because VPC endpoint is for accessing AWS services.

Full explanation →
731
MCQmedium

A company has a VPC with an AWS Transit Gateway connecting multiple VPCs and an on-premises network via AWS Direct Connect. The network team needs to ensure that only specific VPCs can communicate with each other. They create a transit gateway route table for each VPC and attach the VPC to the route table. They also propagate routes from the Direct Connect virtual interface. However, after configuration, traffic between two VPCs that should not communicate is still flowing. What is the MOST likely cause?

A.The VPC route tables have a route for the other VPC CIDR pointing to the transit gateway.
B.The transit gateway route tables are not associated with the VPC attachments.
C.The VPC attachments are using the default transit gateway route table instead of custom route tables.
D.The Direct Connect virtual interface is propagating routes into all route tables.
AnswerC

Default route table allows all routes.

Why this answer

The most likely cause is that the VPC attachments are using the default transit gateway route table instead of custom route tables. By default, a transit gateway has a default route table that is shared among all attachments, which can allow unintended inter-VPC traffic if the team did not explicitly associate each VPC attachment with a dedicated route table. The correct approach is to create individual route tables for each VPC and associate the respective VPC attachment with its custom route table, ensuring isolation.

Option A is incorrect because VPC route tables pointing to the transit gateway are necessary for VPCs to communicate via the transit gateway; they do not cause unintended traffic by themselves. Option B is incorrect because the issue is about which route table the attachments are associated with, not whether route tables exist. Option D is incorrect because propagating Direct Connect routes into all route tables would affect on-premises connectivity, but the issue is specifically inter-VPC traffic.

Full explanation →
732
MCQeasy

A company wants to allow a specific IP address range to access an EC2 instance in a private subnet using a bastion host. The bastion host is in a public subnet. Which security group configuration is correct?

A.Bastion security group: inbound SSH from the private instance security group. Private instance security group: inbound SSH from the bastion security group.
B.Bastion security group: inbound SSH from the private instance security group. Private instance security group: inbound SSH from the IP range.
C.Bastion security group: inbound SSH from the IP range. Private instance security group: inbound SSH from the IP range.
D.Bastion security group: inbound SSH from the IP range. Private instance security group: inbound SSH from the bastion security group.
AnswerD

This follows the principle of least privilege.

Why this answer

The bastion host, located in the public subnet, should allow inbound SSH from the specified IP address range (e.g., corporate network) because users initiate the connection from that range to the bastion. The private instance should only allow inbound SSH from the bastion host's security group, not directly from the IP range, to ensure that all access is mediated through the bastion. Option A is incorrect because the bastion should not allow SSH from the private instance; it's the other way around.

Option B is incorrect because the bastion should allow SSH from the IP range, not from the private instance. Option C is incorrect because the private instance should not allow SSH directly from the IP range, as it violates the principle of using a bastion.

Full explanation →
733
Multi-Selecthard

A company has a VPC with multiple subnets and uses AWS Transit Gateway to connect to on-premises via AWS Direct Connect. They want to implement network segmentation so that certain VPCs can only communicate with specific on-premises networks. Which THREE components should they use? (Choose THREE.)

Select 3 answers
A.VPC peering connections
B.Direct Connect gateway
C.Transit Gateway association to Direct Connect gateway
D.Transit Gateway route tables
E.Site-to-Site VPN connection
AnswersB, C, D

Provides connectivity to on-premises networks.

Why this answer

Options B, C, and D are correct. The Direct Connect gateway (B) integrates Direct Connect with Transit Gateway. The Transit Gateway association to the Direct Connect gateway (C) enables routing between VPCs and on-premises networks.

Transit Gateway route tables (D) allow separate routing domains to segment traffic. Option A (VPC peering) is not needed because Transit Gateway already handles inter-VPC routing. Option E (Site-to-Site VPN) is not required when using Direct Connect for connectivity.

Full explanation →
734
Multi-Selectmedium

A network engineer is diagnosing connectivity issues between an on-premises network and AWS over a Direct Connect connection. The BGP session is established, and the engineer can ping the VPC's private IP addresses. However, TCP connections to EC2 instances are failing. Which TWO actions should the engineer take to identify the issue?

Select 2 answers
A.Review the security group rules associated with the EC2 instance
B.Review the VPC route table for the subnet
C.Verify the BGP session status
D.Check the MTU settings on the Direct Connect virtual interface
E.Check the EC2 instance's operating system firewall
AnswersA, E

Security groups may be blocking TCP traffic.

Why this answer

Options A and E are correct. Checking the security group rules (A) is critical because security groups are stateful and may be blocking inbound TCP while allowing ICMP. Checking the EC2 instance's operating system firewall (E) is essential because OS firewalls can also block TCP while allowing ICMP.

Option B is incorrect because the BGP session is already established. Option C is incorrect because the VPC route table is likely correct if pings work. Option D is incorrect because MTU issues would affect all traffic, not just TCP.

Full explanation →
735
MCQeasy

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access the internet for software updates. The instance has a route to a NAT Gateway in the public subnet. However, the instance cannot reach the internet. Which step should the network engineer take to troubleshoot?

A.Move the NAT Gateway to a private subnet
B.Verify that the NAT Gateway is in the same subnet as the EC2 instance
C.Verify that the NAT Gateway has an Elastic IP and the private subnet's route table has a route to the NAT Gateway
D.Attach an Internet Gateway to the private subnet
AnswerC

These are required for outbound internet access.

Why this answer

For a NAT Gateway to provide internet access to instances in a private subnet, it must have an Elastic IP (EIP) attached, and the private subnet's route table must include a route pointing to the NAT Gateway as the target for 0.0.0.0/0. Option A is wrong because NAT Gateways must reside in a public subnet (with a route to an Internet Gateway) to work. Option B is wrong because the NAT Gateway must be in the same VPC but not necessarily the same subnet as the EC2 instance; it should be in a public subnet.

Option D is wrong because an Internet Gateway is attached to the VPC, not to individual subnets; attaching an Internet Gateway directly to a private subnet is not a valid configuration.

Full explanation →
736
MCQhard

A company has a VPC with public and private subnets in three Availability Zones. They have an Application Load Balancer (ALB) in the public subnets and a fleet of EC2 instances in the private subnets. The ALB needs to send traffic to the instances on port 443. What is the most secure way to configure the security groups?

A.ALB SG: inbound from 0.0.0.0/0 on all ports. Instance SG: inbound from ALB SG on all ports.
B.ALB SG: inbound from 0.0.0.0/0 on port 443. Instance SG: inbound from 0.0.0.0/0 on port 443.
C.ALB SG: inbound from 0.0.0.0/0 on port 443. Instance SG: inbound from ALB SG on port 443.
D.ALB SG: inbound from 0.0.0.0/0 on port 443. Instance SG: inbound from ALB SG on all ports.
AnswerC

Only allows HTTPS from ALB SG to instances.

Why this answer

It follows the principle of least privilege by restricting the ALB security group to only allow inbound traffic on port 443 from the internet (0.0.0.0/0) and the instance security group to only allow inbound traffic on port 443 from the ALB security group. This ensures that only the ALB can communicate with the instances on the required port, preventing direct access from other sources and reducing the attack surface.

Exam trap

The trap here is that candidates often assume that allowing traffic from 0.0.0.0/0 to the instances is acceptable because the instances are in private subnets, but security groups are stateful and do not consider subnet routing; they evaluate traffic based on the source IP, so a rule allowing 0.0.0.0/0 would permit direct internet traffic if the instances had a route to an internet gateway.

How to eliminate wrong answers

Option A is wrong because it allows inbound traffic to the ALB on all ports from the internet, which is overly permissive and violates security best practices. Option B is wrong because it allows inbound traffic to the instances directly from 0.0.0.0/0 on port 443, bypassing the ALB and exposing the instances to the internet, which is insecure. Option D is wrong because it allows inbound traffic to the instances from the ALB security group on all ports, which is unnecessary and violates the principle of least privilege since only port 443 is required.

Full explanation →
737
MCQmedium

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company has set up a NAT gateway in the public subnet. However, instances in the private subnet cannot reach the internet. What is the most likely cause?

A.The NAT gateway does not have a route to the internet gateway
B.The security group for the instances blocks outbound traffic
C.The NAT gateway is not associated with an Elastic IP
D.The private subnet route table does not have a route to the NAT gateway
AnswerD

Without a default route to the NAT gateway, traffic from private subnet cannot reach the internet.

Why this answer

Instances in a private subnet require a route to the NAT gateway to reach the internet. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT gateway as its target. Without this route, traffic from private instances sent to the internet will not be directed to the NAT gateway, and will instead remain in the VPC or be dropped.

Option A is incorrect because the NAT gateway itself resides in a public subnet and uses the internet gateway via that subnet's route table; it does not require its own route to the IGW. Option B is incorrect because security groups by default allow all outbound traffic, so this is unlikely to be the issue. Option C is incorrect because not having an Elastic IP would prevent the NAT gateway from having a public IP, but the question states a NAT gateway is set up, implying it has an Elastic IP; the more fundamental issue is the missing route.

Full explanation →
738
MCQhard

A company is using AWS Organizations with multiple accounts. The security team needs to enforce that all S3 buckets across the organization are encrypted with AWS KMS. Which approach should be used to enforce this policy?

A.Configure each S3 bucket with a bucket policy that denies access if encryption is not used.
B.Apply a service control policy (SCP) at the root level that denies S3 bucket creation unless encryption is configured.
C.Use AWS Config rules to detect unencrypted S3 buckets and automatically remediate them.
D.Create an IAM policy that denies creating S3 buckets without encryption and attach it to all users.
AnswerB

SCPs can be applied to organizational units to centrally enforce policies across accounts.

Why this answer

A service control policy (SCP) can be applied to the root organizational unit in AWS Organizations to centrally deny creating or modifying S3 buckets without KMS encryption across all accounts. Option A is incorrect because bucket policies are per-bucket and cannot enforce encryption at the organizational level. Option C is incorrect because AWS Config rules detect non-compliance after the fact but do not prevent creation; they require additional remediation.

Option D is incorrect because IAM policies are account-specific and cannot be enforced across the entire organization.

Full explanation →
739
Multi-Selectmedium

A company is deploying a containerized application on Amazon ECS using the Fargate launch type. The application requires outbound internet access to download updates, but the company does not want to assign public IP addresses to the tasks. Which TWO actions should the company take to provide internet access to the tasks? (Choose two.)

Select 2 answers
A.Configure a security group that allows outbound traffic to 0.0.0.0/0
B.Launch the tasks in private subnets that do not have a route to an Internet Gateway
C.Create a NAT gateway in a public subnet and update the route tables for the task subnets to route 0.0.0.0/0 traffic to the NAT gateway
D.Launch the tasks in public subnets with auto-assign public IP enabled
E.Create a VPC Gateway Endpoint for Amazon ECR
AnswersB, C

Private subnets ensure no public IPs are assigned; outbound traffic goes through the NAT gateway.

Why this answer

Tasks in private subnets without a route to an Internet Gateway cannot directly access the internet, which is the desired behavior to avoid public IP addresses. Option C is correct because a NAT gateway in a public subnet provides outbound internet access for tasks in private subnets by translating their private IP addresses to the NAT gateway's public IP, allowing them to reach the internet without assigning public IPs to the tasks.

Exam trap

AWS often tests the misconception that a security group rule allowing outbound traffic to 0.0.0.0/0 alone is sufficient for internet access, when in fact the subnet's route table must direct traffic to a NAT gateway or Internet Gateway.

Full explanation →
740
Multi-Selecthard

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team observes that traffic between two VPCs (VPC A and VPC B) is not being forwarded correctly. The transit gateway route table is configured with static routes for the VPC CIDRs. Which THREE steps should the engineer take to troubleshoot this issue? (Choose THREE.)

Select 3 answers
A.Verify that the transit gateway route table contains the CIDR blocks of both VPCs.
B.Check the route tables in VPC A and VPC B to ensure they have routes pointing to the transit gateway for the other VPC's CIDR.
C.Check the association of the VPC attachments with the transit gateway route table.
D.Check the Direct Connect virtual interface status.
E.Verify that the NAT Gateway in each VPC is properly configured.
AnswersA, B, C

The transit gateway route table must have routes for both VPC CIDRs to forward traffic between them.

Why this answer

The transit gateway route table must contain the CIDR blocks of both VPCs for traffic to be forwarded between them. Without these static routes, the transit gateway has no destination to route the traffic, causing it to be dropped. Verifying the route table entries ensures the necessary paths exist.

Exam trap

AWS often tests the misconception that NAT Gateway or Direct Connect configurations are involved in VPC-to-VPC routing, when in fact Transit Gateway relies solely on route tables and attachment associations for inter-VPC traffic.

Full explanation →
741
Multi-Selectmedium

Which TWO features are provided by AWS Shield Advanced that are not available in AWS Shield Standard? (Choose 2)

Select 2 answers
A.Automatic web application firewall rule updates
B.DDoS cost protection
C.Access to detailed DDoS logs
D.24/7 access to the AWS DDoS Response Team
E.Network-layer DDoS protection
AnswersB, D

Shield Advanced offers protection against scaling charges due to DDoS.

Why this answer

Shield Advanced provides DDoS cost protection (option B) and 24/7 access to the AWS DDoS Response Team (option D). Option A is incorrect because automatic web application firewall rule updates are not a feature of Shield Advanced; AWS WAF can be integrated but rules are not automatically updated. Option C is incorrect because detailed DDoS logs are not a distinct feature of Shield Advanced; both Standard and Advanced provide access to AWS Shield logs.

Option E is incorrect because network-layer DDoS protection (e.g., SYN flood, UDP flood) is provided by both Shield Standard and Shield Advanced; Advanced adds application-layer protection and other benefits.

Full explanation →
742
Multi-Selectmedium

Which TWO actions should be taken to secure an EC2 instance that is used as a bastion host? (Choose 2)

Select 2 answers
A.Use a security group that only allows necessary inbound ports
B.Use HTTPS instead of SSH for administration
C.Place the bastion host in a private subnet
D.Restrict inbound SSH access to a specific IP range using security group
E.Allow all inbound traffic on port 22 in the network ACL
AnswersA, D

Minimize attack surface.

Why this answer

A bastion host should only expose necessary inbound ports (typically TCP 22 for SSH) to minimize the attack surface. By using a security group that restricts inbound traffic to only required ports, you enforce the principle of least privilege at the network layer, preventing unauthorized access to other services that might be running on the instance.

Exam trap

AWS often tests the misconception that a bastion host should be placed in a private subnet for security, but the correct design requires it to be in a public subnet to serve as an entry point, with security group restrictions providing the necessary protection.

Full explanation →
743
MCQhard

A network engineer is troubleshooting high latency on a Direct Connect connection. The engineer notices that the BGP session is flapping intermittently. The connection is a 1 Gbps dedicated connection with a single private VIF. The router configuration uses default BGP timers. What is the most likely cause of the flapping?

A.The MTU size is set to 9001 (jumbo frames) on the Direct Connect interface.
B.The link experiences occasional packet loss causing BGP hold timer expiration.
C.The BGP authentication key is mismatched between the customer router and AWS.
D.The Multi-Exit Discriminator (MED) value is set too high on the customer router.
AnswerB

Packet loss can cause keepalive messages to be lost, leading to hold timer expiry and BGP session reset.

Why this answer

B is correct because the BGP hold timer (default 90 seconds) expires when the link experiences intermittent packet loss, causing the BGP session to flap. This is a common issue on Direct Connect when the underlying physical link has transient errors or congestion, leading to missed keepalive messages and session resets.

Exam trap

The trap here is that candidates often confuse BGP session flapping with configuration errors (like authentication or MED) rather than recognizing that transient packet loss is the most common cause of hold timer expiration on a single physical link.

How to eliminate wrong answers

Option A is wrong because jumbo frames (MTU 9001) are supported on Direct Connect and do not cause BGP flapping; they would instead cause fragmentation or connectivity issues if mismatched. Option C is wrong because a BGP authentication key mismatch would prevent the session from establishing at all, not cause intermittent flapping. Option D is wrong because the MED value influences route selection between multiple paths, not BGP session stability; a high MED does not cause flapping.

Full explanation →
744
Multi-Selectmedium

A network engineer is diagnosing a connectivity issue between an on-premises network and an Amazon VPC connected via a site-to-site VPN. The VPN tunnel is up, but traffic is not reaching the VPC. Which TWO actions should the engineer take to troubleshoot the issue? (Choose two.)

Select 2 answers
A.Review the security group rules associated with the VPC resources to ensure they allow traffic from the on-premises network
B.Confirm the customer gateway is associated with the correct VPC
C.Verify that the VPC route tables include routes for the on-premises network pointing to the virtual private gateway
D.Verify that the on-premises network has a NAT device configured
E.Check that the VPN tunnel's status is 'UP'
AnswersA, C

Security groups act as a firewall for the instances.

Why this answer

Security groups act as a virtual firewall for VPC resources. If traffic from the on-premises network is not reaching the VPC, the security group rules must allow inbound traffic from the on-premises IP range. Option C is correct because the VPC route tables need a route for the on-premises network pointing to the virtual private gateway (VGW) to direct traffic correctly.

Option B is incorrect because the customer gateway is the on-premises VPN endpoint, and its association with the VPC is already established since the VPN tunnel is up. Option D is incorrect because NAT is not a requirement for site-to-site VPN; the issue is about routing, not address translation. Option E is incorrect because the tunnel is already up, so checking its status again does not help diagnose why traffic is not flowing.

Full explanation →
745
MCQmedium

A company uses AWS Direct Connect and VPN as backup. The network team notices that during a VPN failover, traffic drops for several minutes. The VPN tunnels are configured with BGP dynamic routing. Which configuration change would MOST likely reduce failover time?

A.Configure static routes over the VPN instead of BGP
B.Increase the BGP keepalive interval and decrease the hold timer
C.Enable BFD on the VPN BGP sessions
D.Decrease the BGP keepalive interval and increase the hold timer
AnswerC

BFD provides sub-second failure detection, reducing failover time.

Why this answer

BFD (Bidirectional Forwarding Detection) provides sub-second failure detection for BGP sessions, significantly reducing failover time. Option A is wrong because static routes do not dynamically adapt to failures and would require manual intervention. Option B is wrong because increasing the BGP keepalive interval (making it longer) and decreasing the hold timer (making it shorter) would actually slow down failure detection or cause flapping; the opposite would be needed.

Option D is wrong because decreasing the keepalive interval and increasing the hold timer would also not be as fast as BFD; BFD is the optimal solution for fast failover.

Full explanation →
746
Multi-Selecthard

A company has a Direct Connect connection and wants to use it for both private and public resources. Which TWO components are required to achieve this?

Select 2 answers
A.Transit Gateway
B.Internet gateway
C.VPN connection to the VPC
D.Public virtual interface (VIF)
E.Private virtual interface (VIF)
AnswersD, E

Public VIF connects to public AWS services.

Why this answer

Options D and E are correct. A Direct Connect connection supports multiple virtual interfaces: a private VIF for private IP connectivity to VPCs, and a public VIF for public IP connectivity to AWS public services. Using both enables access to private and public resources.

Option A is incorrect because a Transit Gateway is optional and not required for this setup. Option B is incorrect because an Internet gateway provides internet access through the public internet, not through Direct Connect public VIF. Option C is incorrect because a VPN connection is a separate mechanism and not required for Direct Connect.

Full explanation →
747
Multi-Selecthard

A company has a multi-account AWS environment using AWS Transit Gateway with multiple VPC attachments. The network team wants to centralize logging of all network traffic crossing the Transit Gateway. Which TWO services can be used together to achieve this?

Select 2 answers
A.VPC Flow Logs published to a central Amazon S3 bucket
B.AWS Site-to-Site VPN flow logs
C.AWS Direct Connect Gateway flow logs
D.AWS Transit Gateway Network Manager
E.AWS CloudTrail for Transit Gateway events
AnswersA, D

VPC Flow Logs capture traffic; publishing to a central S3 bucket allows aggregation.

Why this answer

VPC Flow Logs can be published to a central Amazon S3 bucket, aggregating traffic logs from different VPCs attached to the Transit Gateway. Option D is correct because AWS Transit Gateway Network Manager allows centralized monitoring and can integrate flow logs. Option B is incorrect because Site-to-Site VPN does not generate its own flow logs; VPN traffic is captured by VPC Flow Logs on the VPN attachment.

Option C is incorrect because Direct Connect Gateway does not have flow logs; traffic is logged via VPC Flow Logs on the virtual interfaces. Option E is incorrect because AWS CloudTrail records API actions, not network traffic.

Full explanation →
748
Multi-Selecthard

Which THREE of the following are benefits of using AWS Global Accelerator over Amazon CloudFront for a global application that uses TCP traffic? (Select THREE.)

Select 3 answers
A.Provides content caching at edge locations.
B.Provides static IP addresses that act as a fixed entry point.
C.Supports TCP and UDP traffic.
D.Can be used with Application Load Balancers as endpoints.
E.Automatically integrates with AWS WAF and AWS Shield Advanced.
AnswersB, C, D

Global Accelerator provides anycast IPs.

Why this answer

AWS Global Accelerator provides static IP addresses that act as a fixed entry point for your application, which is a key benefit over Amazon CloudFront. CloudFront uses dynamic, regional edge IP addresses that can change, whereas Global Accelerator offers two static anycast IP addresses that remain constant, simplifying DNS management and firewall whitelisting for TCP-based global applications.

Exam trap

The trap here is that candidates often confuse AWS Global Accelerator with CloudFront, assuming both provide caching and similar features, but Global Accelerator focuses on network performance optimization for TCP/UDP traffic without caching, while CloudFront is a CDN that caches content and primarily supports HTTP/HTTPS.

Full explanation →
749
Multi-Selecthard

A company is using AWS Direct Connect with a private VIF to connect to multiple VPCs in the same region. The company wants to use AWS Transit Gateway to simplify management. Which three components are required to achieve this? (Choose THREE.)

Select 3 answers
A.Direct Connect private virtual interface
B.AWS Transit Gateway
C.VPC peering connection
D.AWS Site-to-Site VPN connection
E.AWS Direct Connect gateway
AnswersA, B, E

Required for Direct Connect connection.

Why this answer

Options A, B, and E are correct. A Direct Connect private virtual interface provides the physical connection from on-premises to AWS. AWS Transit Gateway serves as the central hub to interconnect multiple VPCs.

A Direct Connect gateway is required to associate the Direct Connect virtual interface with the Transit Gateway, enabling connectivity to multiple VPCs in the same region. Options C and D are incorrect: VPC peering and Site-to-Site VPN are not required when using Transit Gateway with Direct Connect.

Full explanation →
750
MCQeasy

A company has a VPC with public and private subnets. The public subnet hosts a web server that must be accessible from the internet. The private subnet hosts a database that should only be accessible from the web server. Which security group configuration should be used?

A.Database security group: inbound rule allowing traffic from the web server security group on the database port
B.Database security group: inbound rule allowing traffic from the VPC CIDR on the database port
C.Database security group: inbound rule allowing traffic from the web server's private IP on the database port
D.Database security group: inbound rule allowing traffic from 0.0.0.0/0 on the database port
AnswerA

This ensures only the web server can reach the database.

Why this answer

Security groups can reference other security groups as sources. Option A is correct because it allows traffic from the web server's security group, which ensures only the web server can access the database. Option B is wrong because it allows all traffic from the VPC CIDR, which is too permissive.

Option C is wrong because it allows traffic from a specific private IP, but that IP might change and is less flexible than using the security group. Option D is wrong because it allows traffic from 0.0.0.0/0, which permits inbound traffic from any IP address, making the database publicly accessible.

Full explanation →
Page 9

Page 10 of 22

Page 11

All pages

12345678910111213141516171819202122

Practice ANS-C01 by domain

Target a specific domain to shore up weak areas.

Network Management and OperationsNetwork Security, Compliance and GovernanceNetwork DesignNetwork Implementation
See all domains with question counts →