Knowledge + Practice

AWS Certified Advanced Networking Specialty ANS-C01 (ANS-C01) — Questions 751–825

1621 questions total · 22pages · All types, answers revealed

Take a mock exam Exam hub

Page 11 of 22

751

MCQeasy

A company is deploying a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB is internet-facing and uses a public subnet. The EC2 instances are in private subnets. The application needs to be accessible from the internet. The security group for the ALB allows inbound HTTP and HTTPS from 0.0.0.0/0. The security group for the EC2 instances allows inbound traffic from the ALB's security group. The route tables for the private subnets have a default route to a NAT gateway. Users report that they cannot access the application. The ALB target group shows the instances as unhealthy. What is the MOST likely cause?

A.The security group for the EC2 instances does not allow inbound traffic from the ALB's security group on the health check port.

B.The ALB is deployed in a private subnet instead of a public subnet.

C.The ALB does not have an associated internet gateway route.

D.The NAT gateway is not correctly routing traffic from the instances to the internet.

AnswerA

Health checks fail if security group blocks traffic.

Why this answer

When using an Application Load Balancer (ALB), the target group health checks originate from the ALB's nodes. The security group for the EC2 instances must allow inbound traffic from the ALB's security group on the health check port, typically port 80 or 443. If this rule is missing, the health checks fail and the instances are marked unhealthy, preventing traffic from being forwarded.

Option B is wrong because the ALB is described as internet-facing and deployed in a public subnet. Option C is wrong because an internet gateway route is attached to the public subnet where the ALB resides, not to the ALB itself. Option D is wrong because the NAT gateway handles outbound traffic from the private subnets, not inbound health check traffic from the ALB.

Full explanation →

752

MCQhard

A company is deploying a multi-tier application in a VPC. The web tier is in public subnets, and the application tier is in private subnets. The application tier needs to communicate with an on-premises database via an AWS Direct Connect connection. The company wants to minimize latency and maximize throughput. Which design should they use?

A.Place the application tier instances in a private subnet in the same VPC as the web tier. Attach a virtual private gateway to the VPC and connect it to the on-premises network via a Direct Connect private virtual interface.

B.Place the application tier in a private subnet and use a NAT Gateway to route traffic to the on-premises network.

C.Place the application tier in a separate VPC and peer it to the web tier VPC. Use a Direct Connect connection attached to the web tier VPC.

D.Place the application tier in a separate VPC and use a VPN connection over the internet to connect to on-premises.

AnswerA

This provides low-latency, high-throughput connectivity directly between the application tier and on-premises.

Why this answer

A Direct Connect private virtual interface (VIF) connected to a virtual private gateway (VGW) provides a dedicated, low-latency, high-throughput connection from the VPC to on-premises. The application tier in the private subnet can route traffic directly to the on-premises database via the VGW without traversing the internet or a NAT device, minimizing latency and maximizing throughput.

Exam trap

AWS often tests the misconception that a NAT Gateway or VPN can provide equivalent performance to Direct Connect, but the trap here is that NAT Gateways are for internet egress only and VPNs introduce internet-based latency, whereas a private VIF offers dedicated, consistent performance.

How to eliminate wrong answers

Option B is wrong because a NAT Gateway is used for outbound internet traffic from private subnets, not for routing to on-premises networks over Direct Connect; it would add unnecessary latency and does not leverage the private VIF. Option C is wrong because placing the application tier in a separate VPC and peering it to the web tier VPC introduces an extra hop (VPC peering) and requires the Direct Connect to be attached to the web tier VPC, which forces traffic to traverse the peering connection, increasing latency and complexity. Option D is wrong because a VPN connection over the internet introduces variable latency, potential throughput bottlenecks, and security risks compared to a dedicated Direct Connect private VIF, failing to minimize latency and maximize throughput.

Full explanation →

753

MCQeasy

A company wants to connect its on-premises data center to AWS using AWS Direct Connect. The company requires a dedicated 1 Gbps connection with low latency and high bandwidth for mission-critical workloads. Which type of Direct Connect interface should be used?

A.AWS Transit VIF

B.VPN Connection

C.Hosted Connection

D.Dedicated Connection

AnswerD

A dedicated connection provides a physical port dedicated to the customer.

Why this answer

A Dedicated Connection (Option D) is correct because it provides a physical, single-tenant Ethernet connection from the on-premises data center directly to AWS, offering dedicated 1 Gbps or 10 Gbps bandwidth with consistent low latency and high availability for mission-critical workloads. Unlike hosted connections, a dedicated connection is provisioned as a physical port at an AWS Direct Connect location, ensuring exclusive use and predictable performance without contention from other customers.

Exam trap

The trap here is that candidates confuse 'Dedicated Connection' with 'Hosted Connection' (Option C), mistakenly thinking a hosted connection provides the same dedicated bandwidth, but a hosted connection is a shared, multi-tenant link that cannot guarantee the same performance isolation or Service Level Agreement (SLA) as a dedicated physical port.

How to eliminate wrong answers

Option A is wrong because an AWS Transit VIF is a virtual interface type used to connect to an AWS Transit Gateway, not a physical connection type; it requires an existing Direct Connect connection (dedicated or hosted) to be created. Option B is wrong because a VPN Connection uses the public internet with IPSec encryption, introducing variable latency, potential packet loss, and bandwidth limitations that cannot guarantee the dedicated 1 Gbps low-latency requirement for mission-critical workloads. Option C is wrong because a Hosted Connection is a shared, multi-tenant connection provisioned by an AWS Direct Connect Partner, which does not provide the dedicated, single-tenant physical port and may have bandwidth contention or reduced performance guarantees compared to a dedicated connection.

Full explanation →

754

MCQmedium

A financial services company has a VPC with a public subnet and a private subnet. EC2 instances in the private subnet need to download patches from the internet. The company has a NAT gateway in the public subnet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT gateway. However, instances cannot reach the internet. The NAT gateway is in an 'available' state and has an Elastic IP attached. The security group for the NAT gateway allows all outbound traffic. What is the most likely cause of the issue?

A.The security group for the NAT gateway is blocking inbound traffic from private instances

B.The NAT gateway is not provisioned with sufficient bandwidth

C.The NAT gateway does not have an IAM role to access the internet

D.The route table for the public subnet does not have a default route (0.0.0.0/0) pointing to an internet gateway

AnswerD

Correct. The NAT gateway resides in a public subnet. For the NAT gateway to forward traffic to the internet, the route table associated with that public subnet must have a default route (0.0.0.0/0) pointing to an internet gateway. Without this route, traffic from the NAT gateway cannot reach the internet.

Why this answer

The most likely cause is that the route table for the public subnet (where the NAT gateway resides) does not have a default route (0.0.0.0/0) pointing to an internet gateway. The NAT gateway needs this route to forward traffic from private instances to the internet. Option A is incorrect because security groups for NAT gateways do not block inbound traffic from private instances; they only control traffic to the NAT gateway itself.

Option B is incorrect because bandwidth provisioning is not related to connectivity; the NAT gateway can handle traffic up to its bandwidth limit. Option C is incorrect because NAT gateways do not require IAM roles to access the internet; they use Elastic IPs.

Full explanation →

755

MCQeasy

A company is deploying a VPC with IPv6 support. The VPC has a CIDR block of 10.0.0.0/16 and an assigned IPv6 CIDR block of 2600:1f16:xxxx:xxxx::/56. The company wants EC2 instances in a public subnet to be able to communicate with the internet using IPv6. Which configuration is necessary?

A.Attach a NAT gateway to the VPC and add a route for ::/0 to the NAT gateway in the public subnet route table.

B.Attach an internet gateway to the VPC and add a route for 0.0.0.0/0 to the internet gateway in the public subnet route table.

C.Set up a NAT64 translation service to convert IPv6 requests to IPv4.

D.Attach an egress-only internet gateway to the VPC and add a route for ::/0 to the egress-only internet gateway in the public subnet route table.

AnswerD

Provides outbound-only IPv6 internet access.

Why this answer

An egress-only internet gateway (EIGW) is the AWS-managed service designed to enable outbound-only IPv6 communication from a VPC to the internet. Since IPv6 addresses are globally unique and publicly routable, a NAT gateway (used for IPv4) is not needed; instead, the EIGW allows instances to initiate outbound traffic while preventing any unsolicited inbound connections. Adding a route for ::/0 to the EIGW in the public subnet route table directs all outbound IPv6 traffic through it.

Exam trap

The trap here is that candidates often confuse the egress-only internet gateway with a NAT gateway or assume that an internet gateway alone suffices for IPv6, forgetting that the internet gateway supports both inbound and outbound traffic, whereas the EIGW is specifically required for outbound-only IPv6 communication to prevent inbound connections.

How to eliminate wrong answers

Option A is wrong because a NAT gateway is used for outbound IPv4 traffic from private subnets and does not support IPv6; attaching it would not enable IPv6 internet access. Option B is wrong because adding a route for 0.0.0.0/0 (IPv4 default route) to an internet gateway only handles IPv4 traffic, not IPv6; the question specifically requires IPv6 communication. Option C is wrong because NAT64 translates IPv6 requests to IPv4, which is unnecessary here since the VPC already has an assigned IPv6 CIDR and the goal is direct IPv6 internet access, not translation to IPv4.

Full explanation →

756

MCQmedium

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download patches from the internet. The company has a NAT gateway in a public subnet. The EC2 instance can connect to other instances in the VPC but cannot reach the internet. What is the most likely cause?

A.The security group of the EC2 instance blocks outbound HTTPS traffic.

B.The NAT gateway does not have an Elastic IP address.

C.The network ACL of the private subnet blocks inbound traffic from the NAT gateway.

D.The route table in the private subnet does not have a default route to the NAT gateway.

AnswerD

Missing default route prevents internet access.

Why this answer

For an EC2 instance in a private subnet to reach the internet via a NAT gateway, the private subnet's route table must include a default route (0.0.0.0/0) pointing to the NAT gateway as the target. Without this route, traffic destined for the internet has no path to the NAT gateway, so the instance can communicate within the VPC but cannot reach external hosts. Option D correctly identifies this missing route as the most likely cause.

Exam trap

The ANS-C01 exam often tests the distinction between security groups, network ACLs, and route tables, and the trap here is that candidates assume a connectivity issue must be a firewall or ACL block, overlooking the fundamental requirement of a correct default route in the subnet's route table.

How to eliminate wrong answers

Option A is wrong because the EC2 instance is in a private subnet and cannot reach the internet at all; even if outbound HTTPS were blocked, the issue would be a specific protocol failure, not a complete lack of internet connectivity. Option B is wrong because a NAT gateway requires an Elastic IP address to function correctly; if it lacked one, it would not be able to communicate with the internet, but the question states the company has a NAT gateway, implying it is properly configured. Option C is wrong because the network ACL of the private subnet controls inbound traffic to the subnet, but the EC2 instance initiates outbound traffic to the internet; the NAT gateway's response traffic would be inbound, but the primary failure is the missing route for outbound traffic, not an ACL blocking inbound responses.

Full explanation →

757

MCQmedium

A company has deployed a web application behind an Application Load Balancer (ALB) in a VPC with public and private subnets. The ALB is in public subnets, and the web servers are in private subnets. Clients report intermittent connection errors. Investigation shows that the ALB is marking targets as unhealthy. What is the MOST likely cause?

A.The network ACL for the private subnets is blocking inbound traffic from the ALB.

B.The security group for the web servers does not allow inbound traffic from the internet.

C.The ALB is deployed in private subnets and cannot reach the internet.

D.The health check is configured to use the public IP address of the targets, but the targets are in private subnets without public IPs.

AnswerD

Health checks must target the private IP of the instances; using public IPs will fail.

Why this answer

When health checks are configured to use the public IP address of targets, the ALB attempts to reach the targets via the internet. Since the web servers are in private subnets without public IPs, the health check traffic cannot be routed to them, causing the ALB to mark them as unhealthy. Health checks must target private IP addresses within the VPC for instances in private subnets.

Exam trap

The trap here is that candidates often overlook that health checks must target private IPs within the VPC, not public IPs, and mistakenly focus on security group or ACL rules instead of the health check configuration.

How to eliminate wrong answers

Option A is wrong because network ACLs are stateless and must allow both inbound and outbound traffic; however, the default network ACL allows all traffic, and even if custom rules were blocking, the ALB's health check traffic originates from its private IPs within the VPC, not from the internet, so the issue is not ACL blocking. Option B is wrong because the security group for web servers does not need to allow inbound traffic from the internet; it only needs to allow traffic from the ALB's security group or the ALB's private IPs, and the intermittent failures are due to health check misconfiguration, not internet access. Option C is wrong because the ALB is explicitly stated to be in public subnets, so it has internet connectivity; even if it were in private subnets, ALBs must be in public subnets to function correctly for internet-facing traffic.

Full explanation →

758

MCQhard

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team needs to block a specific IP address range that has been launching DDoS attacks. The solution must be implemented at the network edge, before traffic reaches the ALB. What should the security team do?

A.Update the security group for the ALB to deny traffic from the IP range.

B.Create an AWS WAF web ACL with an IP set rule that blocks the IP range and attach it to the ALB.

C.Add a network ACL rule on the ALB's subnet to deny inbound traffic from the IP range.

D.Deploy Amazon CloudFront in front of the ALB and use AWS WAF to block the IP range at CloudFront.

AnswerB

WAF at the ALB blocks traffic before it reaches the backend.

Why this answer

AWS WAF web ACL attached to the ALB can filter traffic based on IP addresses. Option B is correct because WAF is deployed at the edge (ALB or CloudFront) and can block IP sets. Option A is wrong because security groups are stateful but work at the instance level, not at the edge.

Option C is wrong because NACLs are applied at the subnet level, but ALB is in a subnet, so traffic reaches the ALB first; NACL is stateless and less suitable for layer 7 filtering. Option D is wrong because CloudFront with WAF is also edge, but the question says 'before traffic reaches the ALB' and ALB is already in place; adding CloudFront changes the architecture.

Full explanation →

759

MCQmedium

A company runs a web application on EC2 instances behind an Application Load Balancer. The security team requires that all traffic to the application be inspected by a third-party firewall appliance for compliance. The firewall appliance must be deployed in a separate VPC and must inspect traffic without introducing a single point of failure. Which architecture meets these requirements?

A.Configure the Application Load Balancer to send all traffic to the firewall appliance using Proxy Protocol v2.

B.Use AWS Direct Connect to route all traffic through the firewall appliance.

C.Use AWS Network Firewall to inspect traffic.

D.Deploy Gateway Load Balancer endpoints in the application VPC and attach them to the firewall appliance in the inspection VPC across multiple Availability Zones.

AnswerD

Gateway Load Balancer allows transparent inspection of traffic by third-party appliances and supports multi-AZ deployment.

Why this answer

Gateway Load Balancer endpoints in the application VPC allow traffic to be sent to a third-party firewall appliance deployed in a separate inspection VPC across multiple Availability Zones, providing high availability and traffic inspection. Option A is incorrect because Proxy Protocol v2, while used for preserving client IP, does not enable traffic inspection by a firewall. Option B is incorrect because AWS Direct Connect is a dedicated network connection to on-premises, not a mechanism for traffic inspection.

Option C is incorrect because AWS Network Firewall is a managed service that can inspect traffic, but it cannot be used to route traffic to a third-party firewall appliance in a separate VPC; it is itself the firewall.

Full explanation →

760

MCQhard

A company uses AWS Site-to-Site VPN to connect its on-premises network to a VPC. The VPN tunnel is up, but traffic from on-premises cannot reach EC2 instances in the VPC. The EC2 instances have a security group that allows inbound ICMP from the on-premises CIDR. What is the most likely cause?

A.The security group rule is using the wrong protocol.

B.The VPN connection does not have static routes configured.

C.The subnet route table does not have a route for the on-premises CIDR pointing to the virtual private gateway.

D.The subnet is not associated with the main route table.

AnswerC

Without this route, traffic from on-premises cannot be routed to the subnet.

Why this answer

For traffic from on-premises to reach EC2 instances in the VPC via Site-to-Site VPN, the subnet route table must include a route for the on-premises CIDR block with the virtual private gateway (VGW) as the target. Option A is incorrect because ICMP is allowed. Option B is incorrect because static routes are not required on the VPN connection itself; routes are needed in the route table.

Option D is incorrect because subnet association with the main route table is not necessary; any custom route table works.

Full explanation →

761

MCQeasy

A company needs to connect two VPCs in the same AWS account and region. They want to use private IP addresses and avoid any single point of failure. Which solution should they use?

A.AWS Transit Gateway

B.VPC peering connection

C.Internet Gateway and public IPs

D.AWS Site-to-Site VPN between the VPCs

AnswerB

VPC peering is simple, uses private IPs, and has no single point of failure as it is a direct connection.

Why this answer

VPC peering is the correct solution because it allows direct connectivity between two VPCs using private IP addresses, with no single point of failure since traffic flows directly between the VPCs without any intermediate device or bandwidth bottleneck. AWS handles the underlying routing and redundancy, and there is no additional cost for data transfer within the same Availability Zone or region when using private IPs.

Exam trap

The ANS-C01 exam often tests the misconception that Transit Gateway is always the best choice for any multi-VPC connectivity, but the trap here is that for exactly two VPCs in the same account and region, VPC peering is simpler, cheaper, and avoids the single point of failure inherent in a Transit Gateway.

How to eliminate wrong answers

Option A is wrong because AWS Transit Gateway introduces a single point of failure at the Transit Gateway level (unless you deploy multiple Transit Gateways in a complex, costly setup), and it is overkill for connecting just two VPCs in the same account and region. Option C is wrong because Internet Gateways and public IPs expose traffic to the public internet, violating the requirement to use private IP addresses and introducing security risks and potential failure points. Option D is wrong because an AWS Site-to-Site VPN between VPCs requires a virtual private gateway in each VPC and creates a single point of failure at the VPN connection (unless you configure redundant tunnels, but even then the VPN endpoints are still a bottleneck), and it introduces unnecessary complexity and latency compared to a simple VPC peering connection.

Full explanation →

762

MCQmedium

A company uses AWS Organizations and has multiple VPCs in different accounts. They want to centrally manage network firewall rules for all VPCs using a single firewall policy. Which AWS service should they use?

A.AWS Firewall Manager

B.AWS WAF

C.AWS Network Firewall

D.AWS Shield Advanced

AnswerA

Centrally manages firewall policies across accounts.

Why this answer

AWS Firewall Manager allows you to centrally manage firewall rules across accounts and VPCs. Option B is wrong because Network Firewall is a per-VPC service. Option C is wrong because Shield is for DDoS.

Option D is wrong because WAF is for web ACLs, not network firewalls.

Full explanation →

763

MCQhard

A company is designing a network for a multi-account AWS environment using AWS Organizations. They need to establish a central inspection VPC for traffic inspection using a Gateway Load Balancer (GWLB). Traffic from all other VPCs should be routed through the inspection VPC before reaching the internet or on-premises. Which architecture should be used?

A.Use VPC Peering to connect all VPCs to the inspection VPC and configure routes to the GWLB.

B.Use AWS Direct Connect Gateway to connect all VPCs and route traffic through the inspection VPC.

C.Use AWS Transit Gateway with a centralized inspection VPC that hosts a GWLB. Configure route tables on the Transit Gateway to send traffic to the GWLB endpoint.

D.Use AWS Network Firewall in each VPC and route traffic to it.

AnswerC

Transit Gateway allows transitive routing and can force traffic through the inspection VPC.

Why this answer

AWS Transit Gateway enables centralized routing between multiple VPCs, and when combined with a Gateway Load Balancer (GWLB) in an inspection VPC, it allows traffic from all other VPCs to be forwarded to the GWLB for inspection before reaching the internet or on-premises. Transit Gateway route tables can be configured with static routes pointing to the GWLB endpoint (using Gateway Load Balancer Endpoint service), ensuring all inter-VPC and egress traffic is steered through the inspection VPC. This architecture scales efficiently across many VPCs in an AWS Organizations multi-account setup without requiring complex peering or direct connections.

Exam trap

The trap here is that candidates often confuse VPC Peering's lack of transitive routing with the ability to create a hub-and-spoke model, leading them to select Option A, but AWS explicitly states that VPC Peering does not support transitive routing, making Transit Gateway the only viable option for centralized inspection across multiple VPCs.

How to eliminate wrong answers

Option A is wrong because VPC Peering does not support transitive routing; each peering connection is a one-to-one relationship, so traffic from one VPC cannot be routed through a central inspection VPC to another VPC or to the internet without explicit peering between every pair, making it unscalable and unable to enforce centralized inspection. Option B is wrong because AWS Direct Connect Gateway is used to connect on-premises networks to multiple VPCs via Direct Connect, but it does not provide routing between VPCs themselves or support forwarding traffic through a central inspection VPC; it lacks the transitive routing capability needed for this multi-VPC inspection pattern. Option D is wrong because AWS Network Firewall in each VPC would require deploying and managing separate firewall instances per VPC, which defeats the requirement for a central inspection VPC and does not provide a single point of traffic inspection across all VPCs; it also adds operational overhead and does not leverage the GWLB for centralized traffic steering.

Full explanation →

764

Multi-Selecteasy

A company is designing a VPC with public and private subnets. The company needs to provide internet access to instances in the private subnets. Which TWO components are required? (Choose TWO.)

Select 2 answers

A.Internet Gateway attached to the VPC

B.Transit Gateway

C.NAT Gateway in a public subnet

D.VPC Gateway Endpoint for S3

E.Virtual Private Gateway

AnswersA, C

IGW is needed for public subnet and NAT.

Why this answer

An Internet Gateway (IGW) is required to provide a target in the VPC route tables for internet-bound traffic. For instances in private subnets, a NAT Gateway placed in a public subnet translates their private IP addresses to the public IP of the NAT Gateway, allowing outbound internet access while preventing unsolicited inbound connections. The private subnet's route table must point 0.0.0.0/0 to the NAT Gateway, and the public subnet's route table must point 0.0.0.0/0 to the IGW.

Exam trap

The trap here is that candidates often think a NAT Gateway alone is sufficient, forgetting that an Internet Gateway must be attached to the VPC and the public subnet's route table must point to it for the NAT Gateway to reach the internet.

Full explanation →

765

Multi-Selecthard

A company wants to connect its on-premises data center to AWS using AWS Direct Connect and wants to use the same connection to access multiple VPCs in the same AWS region. The company also needs to maintain private IP connectivity between the VPCs. Which THREE components should the company use to meet these requirements? (Choose three.)

Select 3 answers

A.Transit Gateway VPC attachments

B.VPC peering connections between each VPC

C.AWS Site-to-Site VPN connection

D.AWS Direct Connect gateway

E.AWS Transit Gateway

AnswersA, D, E

Each VPC must be attached to the Transit Gateway to enable connectivity through the Transit Gateway.

Why this answer

Transit Gateway VPC attachments allow multiple VPCs to connect to a central transit gateway, enabling private IP connectivity between them. When combined with an AWS Direct Connect gateway, the on-premises data center can use a single Direct Connect connection to reach all attached VPCs via the transit gateway, meeting both requirements efficiently.

Exam trap

The trap here is that candidates often confuse VPC peering with transit gateway, assuming peering can provide transitive routing or work with a single Direct Connect connection, but AWS explicitly requires a transit gateway for hub-and-spoke connectivity with Direct Connect.

Full explanation →

766

MCQhard

A company is implementing a hybrid network architecture with AWS Direct Connect and a VPN backup. The company has two Direct Connect connections from different providers terminating at two AWS Direct Connect locations, each connecting to a separate AWS Transit Gateway in the same region. The VPCs are attached to both transit gateways. The company needs to ensure that traffic from on-premises to VPCs uses the primary Direct Connect connection when available and fails over to the secondary Direct Connect connection, then to the VPN. How should the company configure routing to achieve this?

A.Configure BGP AS_PATH prepending on the secondary Direct Connect and VPN connections to make them less preferred than the primary Direct Connect.

B.Disable route propagation from the VPN to the transit gateway route tables, and rely on the Direct Connect connections only.

C.Configure equal-cost multipath (ECMP) routing across all three connections to load balance traffic.

D.Use static routes in the transit gateway route tables with higher metric values for the secondary Direct Connect and VPN.

AnswerA

AS_PATH prepending influences BGP best path selection.

Why this answer

BGP AS_PATH prepending on the secondary Direct Connect and VPN connections artificially increases the AS path length, making those routes less preferred in the BGP best-path selection process. This ensures that the primary Direct Connect connection is chosen for traffic from on-premises to VPCs when available, with automatic failover to the secondary Direct Connect and then to the VPN as the least preferred path.

Exam trap

The trap here is that candidates may think static routes with metrics can be used in transit gateway route tables to influence path selection, but BGP-based routing in hybrid networks requires manipulating BGP attributes like AS_PATH, not static route metrics.

How to eliminate wrong answers

Option B is wrong because disabling route propagation from the VPN would prevent the VPN from being used as a backup path, leaving no failover option if both Direct Connect connections fail. Option C is wrong because ECMP routing would load balance traffic across all three connections, which does not meet the requirement for a primary/backup failover order. Option D is wrong because transit gateway route tables do not support metric-based static routes for BGP-learned routes; static routes with higher metrics cannot be used to influence BGP path selection in this hybrid architecture.

Full explanation →

767

MCQmedium

A company is designing a network for a three-tier web application in AWS. The web tier must be accessible from the internet, but the application and database tiers must be private. The company wants to use a single AWS Region and ensure high availability across multiple Availability Zones. What is the MOST cost-effective network design that meets these requirements?

A.Place web servers in public subnets across three AZs. Place application and database servers in private subnets across three AZs. Use a NAT Gateway in each AZ for outbound traffic.

B.Place web servers in public subnets across three AZs. Place application and database servers in private subnets across three AZs. Use NAT instances in each AZ behind an Auto Scaling group.

C.Place web servers in public subnets and application/database servers in private subnets in one AZ. Use a single NAT Gateway in the public subnet for outbound traffic.

D.Place all tiers in public subnets and use security groups to restrict inbound traffic to the web tier only.

AnswerA

Highly available and cost-effective managed service.

Why this answer

It places web servers in public subnets across three Availability Zones (AZs) for internet-facing access and high availability, while application and database servers reside in private subnets across three AZs for isolation. A NAT Gateway in each AZ provides cost-effective outbound internet connectivity for private instances without exposing them to inbound traffic, and using one NAT Gateway per AZ avoids cross-AZ data transfer charges, which would increase costs if a single NAT Gateway were shared across AZs.

Exam trap

AWS often tests the misconception that a single NAT Gateway is more cost-effective than multiple, but the trap is that cross-AZ data transfer costs from using a single NAT Gateway in a multi-AZ setup can exceed the cost of deploying one NAT Gateway per AZ, making the per-AZ design more cost-effective overall.

How to eliminate wrong answers

Option B is wrong because NAT instances behind an Auto Scaling group introduce management overhead, potential single points of failure during scaling events, and higher operational cost compared to managed NAT Gateways, making it less cost-effective. Option C is wrong because deploying all tiers in a single AZ violates the high availability requirement across multiple Availability Zones, as a single AZ failure would take down the entire application. Option D is wrong because placing all tiers in public subnets exposes application and database servers to the internet, violating the requirement that they remain private, even with security group restrictions, as security groups do not prevent all potential attack vectors like direct IP spoofing or misconfigurations.

Full explanation →

768

MCQmedium

A company is deploying a multi-VPC architecture with connectivity requirements. The network team needs to establish private connectivity between VPCs in the same AWS account and region, using services that can scale to 100 Gbps throughput. Which solution meets these requirements?

A.Use AWS PrivateLink with Network Load Balancers to connect VPCs

B.Deploy AWS Client VPN and configure routes between VPCs

C.Create an AWS Transit Gateway and attach all VPCs to it

D.Configure VPC peering connections between each pair of VPCs

AnswerC

Transit Gateway provides scalable connectivity up to 100 Gbps per attachment.

Why this answer

AWS Transit Gateway (TGW) acts as a regional hub-and-spoke router that can interconnect thousands of VPCs and on-premises networks, supporting burst throughput up to 100 Gbps per attachment. It simplifies multi-VPC connectivity by eliminating the need for full-mesh peering and provides centralized routing, making it the only option that meets both the scalability and private connectivity requirements.

Exam trap

The ANS-C01 exam often tests the misconception that VPC peering can scale to high throughput by simply adding more connections, but the trap here is that VPC peering has a per-connection bandwidth cap (typically 10 Gbps) and lacks transitive routing, making it unsuitable for high-throughput multi-VPC architectures compared to Transit Gateway's hub-and-spoke design.

How to eliminate wrong answers

Option A is wrong because AWS PrivateLink with Network Load Balancers is designed for service-to-service connectivity (e.g., exposing a service in one VPC to consumers in another), not for general VPC-to-VPC routing, and it does not scale to 100 Gbps aggregate throughput between multiple VPCs. Option B is wrong because AWS Client VPN is a remote access VPN solution for individual clients (e.g., laptops) to connect to AWS, not for private VPC-to-VPC connectivity, and it cannot handle 100 Gbps throughput. Option D is wrong because VPC peering connections are limited to a maximum of 10 Gbps per peering link (depending on instance type) and require a full-mesh topology for multiple VPCs, which does not scale to 100 Gbps aggregate throughput and becomes operationally complex.

Full explanation →

769

MCQmedium

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. The on-premises network team reports that they can ping the VPC's private IP addresses, but they cannot reach an internet-facing application hosted on an EC2 instance in a public subnet. The EC2 instance has a public IP and a security group allowing HTTP/HTTPS from 0.0.0.0/0. What is the most likely cause?

A.The route table in the public subnet does not have a default route to an internet gateway.

B.The security group is blocking traffic from the on-premises IP range.

C.The BGP session is not exchanging routes for the public IP range.

D.The private VIF does not route traffic to public IP addresses; the on-premises traffic to the public IP must traverse the internet.

AnswerD

A private VIF only carries traffic destined to private IP addresses in the VPC. Traffic to public IPs must go over the internet.

Why this answer

The issue is that the private VIF (private virtual interface) is designed to route traffic only between private IP addresses, not public IP addresses. Even though the EC2 instance has a public IP and the security group allows HTTP/HTTPS from anywhere, traffic from on-premises destined for the public IP of the EC2 instance will not traverse the Direct Connect private VIF because the private VIF does not route public IP traffic. Instead, that traffic would need to go over the internet.

Therefore, the most likely cause is that the private VIF does not route traffic to public IP addresses, as stated in option D. Option A is incorrect because the route table in the public subnet can have a default route to an internet gateway; that is not the issue. Option B is incorrect because the security group allows all inbound HTTP/HTTPS.

Option C is incorrect because BGP exchanges routes for prefixes advertised over the VIF, but even if routes were exchanged, the private VIF would not route public IP traffic.

Full explanation →

770

MCQmedium

A company has multiple VPCs in the same AWS region that need to communicate with each other. The network team wants to minimize the number of connections and simplify management. The solution must support transitive routing between all VPCs. Which AWS service should be used?

A.VPC Peering

B.AWS Direct Connect Gateway

C.AWS Transit Gateway

D.VPC Endpoints

AnswerC

Correct; Transit Gateway provides transitive routing and simplifies connections.

Why this answer

AWS Transit Gateway (TGW) is a network transit hub that enables transitive routing between multiple VPCs and on-premises networks through a single gateway. It uses a hub-and-spoke architecture, which inherently supports transitive routing (e.g., VPC A can reach VPC C via the TGW without requiring direct peering between A and C). This minimizes the number of connections (N VPCs require only N attachments instead of N*(N-1)/2 VPC peering connections) and simplifies management with a central routing table.

Exam trap

The trap here is that candidates often confuse VPC Peering's lack of transitive routing with the ability to route through a central VPC (e.g., using a third-party appliance), but AWS explicitly prohibits transitive routing through VPC peering, making Transit Gateway the only native service that supports transitive routing between multiple VPCs.

How to eliminate wrong answers

Option A is wrong because VPC Peering does not support transitive routing; traffic cannot flow from VPC A to VPC C through a peering connection with VPC B, as peering is a one-to-one, non-transitive relationship. Option B is wrong because AWS Direct Connect Gateway is designed to connect on-premises networks to multiple VPCs via Direct Connect, but it does not provide transitive routing between VPCs themselves; it only facilitates connectivity between on-premises and VPCs. Option D is wrong because VPC Endpoints (Gateway or Interface endpoints) provide private connectivity to AWS services (e.g., S3, DynamoDB) from within a VPC, not inter-VPC routing or transitive connectivity between VPCs.

Full explanation →

771

MCQeasy

A company wants to centrally manage and enforce security policies across multiple AWS accounts and VPCs. They need to ensure that all VPCs have a specific set of rules, such as disabling public subnets. Which AWS service should be used?

A.AWS Organizations with Service Control Policies (SCPs)

B.AWS Identity and Access Management (IAM)

C.AWS Shield

D.AWS Config

AnswerA

SCPs allow central control over the maximum permissions for accounts, enabling enforcement of network policies.

Why this answer

AWS Organizations with Service Control Policies (SCPs) can centrally control permissions across accounts, allowing enforcement of rules like disabling public subnets. Option B is wrong because IAM is for users and roles, not for VPC-level controls. Option C is wrong because AWS Shield is for DDoS protection.

Option D is wrong because AWS Config evaluates resource configurations but does not enforce policies.

Full explanation →

772

Multi-Selecteasy

A company is deploying a web application in a VPC. They need to ensure that the web servers can be accessed from the internet and that traffic is encrypted. Which TWO services should they use?

Select 2 answers

A.AWS WAF

B.Application Load Balancer (ALB)

C.NAT Gateway

D.AWS Certificate Manager (ACM)

E.Amazon CloudFront

AnswersB, D

ALB can terminate SSL/TLS and route traffic to targets.

Why this answer

The Application Load Balancer (ALB) is correct because it can terminate TLS connections, offloading encryption from the web servers, and it distributes incoming internet traffic across multiple targets in a VPC. Combined with AWS Certificate Manager (ACM), the ALB can use a managed SSL/TLS certificate to encrypt traffic between clients and the load balancer, meeting the requirement for encrypted internet access.

Exam trap

The trap here is that candidates often select CloudFront (Option E) thinking it is required for encryption, but the ALB with ACM directly provides TLS termination and internet-facing access without needing a CDN, and the question specifically asks for two services that ensure encrypted internet access, not content delivery optimization.

Full explanation →

773

MCQeasy

A company is designing a VPC with public and private subnets. They want EC2 instances in private subnets to be able to access the internet for software updates. Which AWS service should they use?

A.AWS Direct Connect

B.Internet Gateway (IGW)

C.VPC Peering connection

D.NAT Gateway

AnswerD

A NAT Gateway enables outbound internet access for instances in private subnets.

Why this answer

A NAT Gateway enables EC2 instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing the internet from initiating inbound connections to those instances. It translates the private IP addresses of the instances to the NAT Gateway's Elastic IP address using source network address translation (SNAT), allowing them to reach public endpoints.

Exam trap

The ANS-C01 exam often tests the misconception that an Internet Gateway (IGW) can be used for private subnet outbound access, but the trap is that IGWs only work with public subnets that have a route to the IGW and instances with public IPs; private subnets require a NAT device for outbound-only internet access.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect is a dedicated private network connection from on-premises to AWS, not a mechanism for private subnet instances to access the internet. Option B is wrong because an Internet Gateway (IGW) is attached to a VPC and used for public subnets; it does not provide outbound-only internet access for private subnets—instances in private subnets cannot route directly to an IGW. Option C is wrong because VPC Peering connects two VPCs privately, it does not provide internet access; it only allows traffic between the peered VPCs.

Full explanation →

774

MCQmedium

A company is designing a network for a three-tier web application. The web tier must be able to scale out and in automatically based on CPU utilization. The database tier must be highly available and use Multi-AZ deployment. Which combination of AWS services should the architect use?

A.Network Load Balancer, Auto Scaling group, Amazon RDS Multi-AZ

B.Application Load Balancer, Auto Scaling group, Amazon DynamoDB

C.Application Load Balancer, Auto Scaling group, Amazon RDS Multi-AZ

D.Classic Load Balancer, Auto Scaling group, Amazon RDS Single-AZ

AnswerC

ALB handles HTTP/HTTPS traffic, Auto Scaling adjusts capacity, and RDS Multi-AZ provides HA.

Why this answer

An Application Load Balancer (ALB) operates at Layer 7, which is ideal for distributing HTTP/HTTPS traffic to a web tier that scales out and in automatically via an Auto Scaling group based on CPU utilization. Amazon RDS Multi-AZ provides synchronous standby replication across Availability Zones, ensuring high availability for the database tier by automatically failing over to the standby in case of an outage.

Exam trap

AWS often tests the misconception that a Network Load Balancer is suitable for all web applications, but the trap here is that the web tier requires Layer 7 features (like HTTP header inspection) for proper scaling and routing, which only the Application Load Balancer provides.

How to eliminate wrong answers

Option A is wrong because a Network Load Balancer (NLB) operates at Layer 4 and is not optimized for HTTP/HTTPS traffic inspection or path-based routing, which is typically required for a three-tier web application; it also lacks native integration with Auto Scaling group health checks for web tier scaling. Option B is wrong because Amazon DynamoDB is a NoSQL database, not a relational database, and does not support Multi-AZ deployment in the same way as RDS; it also does not meet the requirement for a highly available database tier using Multi-AZ deployment. Option D is wrong because Amazon RDS Single-AZ does not provide high availability, as it lacks automatic failover to a standby instance in a different Availability Zone, and the Classic Load Balancer is a legacy option that does not support advanced Layer 7 features like host-based or path-based routing.

Full explanation →

775

MCQeasy

A network engineer needs to capture TCP traffic between an EC2 instance (eni-abc123) and an RDS instance (eni-def456) in the same VPC for troubleshooting. Which AWS service should be used to capture the traffic and store it in S3?

A.Amazon Inspector

B.AWS CloudTrail

C.AWS Config

D.VPC Flow Logs

AnswerD

VPC Flow Logs capture IP traffic information for network interfaces and can be published to S3 or CloudWatch Logs.

Why this answer

VPC Flow Logs capture IP traffic information at the network interface level and can be published to S3. They can filter traffic by ENI, so they can capture traffic between eni-abc123 and eni-def456. Option D is correct.

Amazon Inspector (A) is for vulnerability assessment, not traffic capture. AWS CloudTrail (B) records API activity, not network traffic. AWS Config (C) tracks configuration changes, not packet-level data.

Full explanation →

776

Multi-Selecteasy

A company is designing a high-availability architecture for an application that will be deployed across multiple Availability Zones. Which THREE components are recommended for this design? (Choose three.)

Select 3 answers

A.One EC2 instance in each AZ

B.Application Load Balancer across multiple AZs

C.NAT Gateway in each AZ

D.Auto Scaling group with instances in multiple AZs

E.Single NAT Gateway in one AZ

AnswersB, C, D

Distributes traffic across AZs.

Why this answer

An Application Load Balancer (ALB) distributes incoming traffic across multiple targets in different Availability Zones (AZs). By enabling cross-zone load balancing, the ALB can route requests to healthy instances in any AZ, ensuring that if one AZ fails, traffic is automatically redirected to instances in the remaining AZs. This is a foundational component for high availability because it eliminates a single point of failure at the traffic distribution layer.

Exam trap

AWS often tests the misconception that a single NAT Gateway is sufficient for high availability, but in a multi-AZ architecture, you must deploy a NAT Gateway in each AZ to maintain outbound connectivity during an AZ failure.

Full explanation →

777

MCQhard

A company uses AWS Direct Connect with multiple virtual interfaces (VIFs) to connect to multiple VPCs. The network team wants to ensure high availability and failover. Which configuration provides the best resiliency?

A.Provision two Direct Connect connections from different providers and configure BGP

B.Use a single Direct Connect connection with a VPN backup over the internet

C.Configure BGP with multiple AS paths on the same Direct Connect connection

D.Create multiple private VIFs on a single Direct Connect connection

AnswerA

Two separate connections from different providers provide physical diversity and high availability.

Why this answer

Using two separate Direct Connect connections from different providers provides path diversity and eliminates single points of failure. If one connection fails, BGP will route traffic through the other connection. Option B is wrong because a single Direct Connect connection with a VPN backup still shares the same physical infrastructure and the internet backup may not provide the same SLA.

Option C is wrong because multiple AS paths on the same connection do not provide physical redundancy; they only affect route selection. Option D is wrong because multiple private VIFs on a single connection still depend on that single physical link.

Full explanation →

778

MCQeasy

A company wants to connect its on-premises data center to AWS using AWS Direct Connect with a public VIF to access Amazon S3. The on-premises network team reports that they can ping the Direct Connect public VIF IP but cannot access S3. The VPC has a private subnet with an S3 VPC endpoint. What is the most likely reason for the failure?

A.Direct Connect does not support access to Amazon S3; you must use VPN.

B.The S3 endpoint is configured in the VPC, but the on-premises traffic is not using the endpoint.

C.The on-premises network is not routing traffic to S3 through the Direct Connect public VIF; instead, it is attempting to use the internet.

D.A security group is blocking traffic from the on-premises network to S3.

AnswerC

On-premises traffic to S3 must be routed through the Direct Connect public VIF. If the on-premises network does not have routes pointing to the public VIF, traffic may go over the internet, causing failure.

Why this answer

To access S3 via a Direct Connect public VIF, traffic must be routed through the public VIF, not through the internet. On-premises traffic destined for S3 will use the public VIF only if the on-premises routing directs it appropriately. If the on-premises network does not have specific routes pointing S3 traffic to the Direct Connect public VIF, it may attempt to use the internet, which can be blocked or not intended.

Option A is incorrect because Direct Connect does support access to S3 via public VIF. Option B is incorrect because the S3 VPC endpoint is for instances within the VPC, not for on-premises traffic. Option D is incorrect because security groups do not apply to traffic that traverses Direct Connect; they apply to VPC traffic.

Full explanation →

779

MCQeasy

A network engineer is configuring a Site-to-Site VPN connection between an on-premises network and AWS. The engineer wants to ensure that if the primary VPN tunnel goes down, traffic automatically fails over to the secondary tunnel. Which configuration is required?

A.Use static routes with equal-cost multipath (ECMP)

B.Enable VPN CloudHub

C.Enable dynamic routing (BGP) on the VPN connection

D.Configure a second customer gateway device

AnswerC

BGP allows dynamic route advertisement and failover.

Why this answer

Dynamic routing with BGP enables automatic failover between VPN tunnels because BGP advertises routes and automatically withdraws them when a tunnel fails, causing the routing table to update and traffic to use the other tunnel. Static routes (A) require manual intervention for failover, as they do not dynamically adapt. VPN CloudHub (B) is designed to interconnect multiple VPN connections, not for failover between tunnels.

Configuring a second customer gateway device (D) is necessary for redundancy but does not itself enable automatic failover without BGP.

Full explanation →

780

Multi-Selecthard

A company has a VPC with public and private subnets. They use a NAT Gateway in the public subnet to allow instances in the private subnet to access the internet. The security team wants to ensure that all outbound traffic from the private subnet is logged and inspected. Which THREE services should they use together to achieve this? (Choose THREE.)

Select 3 answers

A.VPC Flow Logs

B.AWS Direct Connect

C.AWS Network Firewall

D.Amazon Route 53 Resolver DNS Firewall

E.AWS Transit Gateway

AnswersA, C, D

Flow logs capture IP traffic information for logging.

Full explanation →

781

MCQeasy

A company is designing a hybrid network where an Amazon VPC is connected to an on-premises data center via AWS Direct Connect and a VPN backup. They have a VPC with CIDR 10.0.0.0/16 and on-premises CIDR 192.168.0.0/16. They want to ensure that all traffic between the VPC and on-premises uses the Direct Connect connection when it is available, and automatically fails over to the VPN if Direct Connect fails. What should they do?

A.Create a virtual private gateway with a Direct Connect private virtual interface. Additionally, create a separate VPN connection directly to the VPC. Set longer AS path for the Direct Connect routes.

B.Create a virtual private gateway and establish both a Direct Connect private virtual interface and a VPN connection. Use BGP with equal AS path lengths to enable ECMP.

C.Create a virtual private gateway and attach a Direct Connect private virtual interface. For failover, add a static route in the VPC route table pointing to the VPN connection.

D.Create a virtual private gateway attached to the VPC. Establish a Direct Connect private virtual interface and a VPN connection to the virtual private gateway. Configure BGP on both connections and use a shorter AS path for the Direct Connect routes.

AnswerD

The shorter AS path makes Direct Connect preferred, and BGP provides automatic failover.

Why this answer

It uses a virtual private gateway (VGW) for both the Direct Connect private virtual interface and the VPN connection, and configures BGP on both. By advertising a shorter AS path (e.g., prepending fewer AS numbers) for the Direct Connect routes, the VPC and on-premises routers prefer the Direct Connect path when available. If Direct Connect fails, the BGP session drops, and the VPN routes (with a longer AS path) become active, providing automatic failover.

Exam trap

AWS often tests the misconception that you can simply attach a Direct Connect private virtual interface to a VGW and then add a static route for failover, but this ignores the need for BGP-based dynamic failover and the risk of route conflicts or black-holing when both paths are active.

How to eliminate wrong answers

Option A is wrong because setting a longer AS path for Direct Connect routes would make them less preferred, causing traffic to use the VPN instead of Direct Connect when both are available. Option B is wrong because using equal AS path lengths with ECMP would load-balance traffic across both connections, not prioritize Direct Connect as the primary path. Option C is wrong because adding a static route in the VPC route table for failover does not provide automatic failover; the static route would be active simultaneously, potentially causing asymmetric routing or black-holing, and it lacks BGP-based dynamic failover detection.

Full explanation →

782

MCQmedium

A security engineer is designing a network ACL for a public subnet. The subnet hosts a web server on port 443. Which inbound and outbound rules should be configured to allow HTTPS traffic from the internet? (Assume default deny all rule.)

A.Inbound: allow TCP 443 from 0.0.0.0/0; Outbound: allow TCP 1024-65535 to 0.0.0.0/0.

B.Inbound: allow TCP 443 from 0.0.0.0/0; Outbound: allow TCP 443 to 0.0.0.0/0.

C.Inbound: allow TCP 1024-65535 from 0.0.0.0/0; Outbound: allow TCP 443 to 0.0.0.0/0.

D.Inbound: allow TCP 443 from 0.0.0.0/0; Outbound: allow TCP 443 to 0.0.0.0/0 for responses.

AnswerA

This allows incoming HTTPS and outgoing return traffic on ephemeral ports.

Why this answer

NACLs are stateless, requiring explicit inbound and outbound rules. The inbound rule allows HTTPS (TCP 443) from the internet. The outbound rule allows return traffic on ephemeral ports (1024-65535) back to the internet.

Option B is wrong because the outbound rule only allows TCP 443, which is too restrictive for return traffic. Option C is wrong because the inbound rule only allows ephemeral ports, not HTTPS. Option D is wrong because it incorrectly states 'for responses' and the outbound rule is still too restrictive.

Full explanation →

783

MCQmedium

A company has a VPN connection between an on-premises network and AWS using two tunnels for redundancy. The BGP sessions are established, but traffic is only flowing through one tunnel. The engineer wants to ensure both tunnels are actively used. What should be configured?

A.Enable load balancing on the VPN connection in the AWS console.

B.Configure static routes for the second tunnel.

C.Assign different BGP ASNs to each tunnel.

D.Advertise the same BGP prefixes over both tunnels from the on-premises router.

AnswerD

This allows AWS to load balance traffic across both tunnels.

Why this answer

When both tunnels advertise the same BGP prefixes, the AWS VPN endpoint will see equal-cost paths and load-balance traffic across both tunnels using ECMP (Equal-Cost Multi-Path) routing. This ensures active-active utilization of both tunnels, which is the standard design for AWS VPN redundancy.

Exam trap

The trap here is that candidates assume AWS VPN requires manual load balancing (Option A) or that static routes are needed for the second tunnel (Option B), when in fact BGP multipath with identical prefix advertisements is the correct method to achieve active-active utilization.

How to eliminate wrong answers

Option A is wrong because AWS VPN connections do not have a configurable 'load balancing' toggle in the console; traffic distribution is determined by BGP path selection, not a manual setting. Option B is wrong because adding static routes for the second tunnel would create a conflict with the dynamic BGP routes and could cause asymmetric routing or black-holing, as AWS prefers BGP over static routes. Option C is wrong because each VPN tunnel uses its own BGP session, but both sessions must use the same BGP ASN on the customer side (typically a private ASN); assigning different ASNs would break BGP peering or cause the tunnels to be treated as separate routing domains, preventing ECMP.

Full explanation →

784

Multi-Selecteasy

A network engineer needs to monitor network traffic in a VPC. Which TWO AWS services can capture and analyze VPC flow logs?

Select 2 answers

A.Amazon GuardDuty

B.Amazon S3

C.VPC Traffic Mirroring

D.Amazon CloudWatch Logs

E.AWS Config

AnswersB, D

Flow logs can be delivered to S3.

Why this answer

Amazon S3 is a correct destination for VPC Flow Logs because you can publish flow log data directly to an S3 bucket, where it can be stored, queried with Amazon Athena, or processed by other analytics tools. Amazon CloudWatch Logs is also a correct destination, allowing you to publish flow logs to a log group for real-time monitoring, metric filters, and integration with CloudWatch alarms or third-party solutions via subscription filters.

Exam trap

AWS often tests the misconception that VPC Traffic Mirroring is a type of flow log, but it is a separate feature for capturing full packet payloads, not the aggregated metadata logs that VPC Flow Logs provide.

Full explanation →

785

MCQeasy

A company is designing a multi-VPC architecture in the same region. The VPCs need to communicate with each other using private IP addresses. The company must minimize cost and operational overhead. Which solution should the company use?

A.Set up AWS Site-to-Site VPN connections between each VPC.

B.Use ClassicLink to connect the VPCs.

C.Create VPC peering connections between each pair of VPCs.

D.Create a Transit Gateway and attach all VPCs.

AnswerC

VPC peering is simple, low-cost, and uses private IPs.

Why this answer

VPC peering connections provide direct, private IP connectivity between VPCs using the AWS global network, with no bandwidth bottlenecks or single points of failure. It is the most cost-effective solution for a small number of VPCs (e.g., fewer than 10) as there are no hourly charges for the peering connection itself—only data transfer costs. This minimizes operational overhead compared to managing VPN tunnels or a Transit Gateway, as peering is a simple, one-to-one relationship that does not require additional appliances or complex routing policies.

Exam trap

The trap here is that candidates often choose Transit Gateway (Option D) because it is a modern, centralized solution, but they overlook the specific constraint of minimizing cost and operational overhead for a small number of VPCs, where VPC peering is simpler and cheaper.

How to eliminate wrong answers

Option A is wrong because AWS Site-to-Site VPN connections require a virtual private gateway on each VPC and incur hourly charges per VPN connection, plus data transfer costs, making it more expensive and operationally complex than VPC peering for intra-region VPC communication. Option B is wrong because ClassicLink is a legacy feature that only allows EC2 instances in the EC2-Classic platform to communicate with VPCs using private IPs; it does not support connecting multiple VPCs together and has been deprecated for most use cases. Option D is wrong because while a Transit Gateway simplifies routing for many VPCs, it incurs an hourly attachment fee per VPC and data transfer costs, which is unnecessary overhead for a small number of VPCs that can be directly peered at lower cost.

Full explanation →

786

MCQeasy

A company wants to allow its developers to access Amazon RDS databases from their on-premises network without traversing the public internet. Which solution meets this requirement?

A.Use a NAT gateway in the VPC

B.Create a VPC endpoint for RDS

C.Configure VPC Peering between the on-premises network and the VPC

D.Establish an AWS Site-to-Site VPN connection

AnswerD

A VPN connection securely connects on-premises to the VPC, allowing private access to RDS.

Why this answer

An AWS Site-to-Site VPN connection establishes a secure, encrypted tunnel between the on-premises network and the Amazon VPC, allowing resources like RDS databases to be accessed privately without traversing the public internet. Option A is incorrect because a NAT gateway enables outbound internet traffic from a private subnet, not inbound private access from on-premises. Option B is incorrect because while Amazon RDS supports interface VPC endpoints, these endpoints are only accessible from within the VPC and do not provide connectivity from an on-premises network; a VPC endpoint alone does not meet the requirement.

Option C is incorrect because VPC Peering connects two VPCs within AWS, not an on-premises network to a VPC.

Full explanation →

787

MCQhard

Refer to the exhibit. A network engineer reviews the NACL entries for a subnet. What is the effect of this NACL on inbound traffic?

A.Only SSH from the internal network and HTTPS from any IP are allowed.

B.All inbound traffic is allowed.

C.Only HTTPS traffic is allowed from any IP.

D.All inbound traffic is denied.

AnswerA

Inbound rules allow SSH from 10.0.0.0/16 and HTTPS from 0.0.0.0/0.

Why this answer

Inbound rules: Rule 100 allows SSH from 10.0.0.0/16 (internal network). Rule 200 allows HTTPS from 0.0.0.0/0 (any IP). Rule 300 (implicit deny) denies all other inbound traffic.

Therefore, only SSH from the internal network and HTTPS from any IP are allowed. Option B is incorrect because not all inbound traffic is allowed; SSH from external networks is denied. Option C is incorrect because HTTPS is allowed from anywhere.

Option D is incorrect because the NACL does not deny all traffic; it allows specific traffic.

Full explanation →

788

Multi-Selectmedium

A company is designing a network security architecture for a multi-tier application. Which TWO of the following are best practices for implementing defense in depth?

Select 2 answers

A.Use network ACLs as stateful firewalls at the subnet level

B.Use security groups to control traffic between instances

C.Attach internet gateways to all subnets for high availability

D.Place web servers in public subnets and application servers in private subnets

E.Use the same security group for all tiers to simplify management

AnswersB, D

Security groups act as instance-level firewalls.

Why this answer

The correct answers are B and D. Security groups act as stateful, instance-level firewalls, making them a best practice for controlling traffic between instances (B). Placing web servers in public subnets and application servers in private subnets provides network segmentation, a key defense-in-depth principle (D).

Option A is incorrect because network ACLs are stateless, not stateful. Option C is incorrect because internet gateways should only be attached to public subnets, not all subnets. Option E is incorrect because using the same security group for all tiers reduces security boundaries.

Full explanation →

789

MCQhard

A company is deploying a critical application that requires low latency between EC2 instances in the same AWS region but across multiple Availability Zones. The instances are part of an Auto Scaling group behind a Network Load Balancer. Which network design provides the lowest latency while maintaining high availability?

A.Use a cluster placement group across two Availability Zones.

B.Do not use a placement group; enable Enhanced Networking (ENA) on all instances.

C.Use a spread placement group across two Availability Zones.

D.Use a partition placement group across two Availability Zones.

AnswerB

Placement groups are limited to single AZ for low latency; Enhanced Networking provides low latency across AZs without placement group constraints.

Why this answer

Enhanced Networking (ENA) provides the highest possible packet-per-second performance and lowest latency by offloading network processing to dedicated hardware on the instance. Since the application requires low latency across multiple Availability Zones, a placement group is not suitable because cluster placement groups cannot span multiple AZs, and spread/partition placement groups do not improve latency — they only control instance placement for fault isolation. ENA alone, combined with a Network Load Balancer, delivers the lowest latency while maintaining high availability across AZs.

Exam trap

The trap here is that candidates assume a placement group is always beneficial for low latency, but they fail to recognize that cluster placement groups cannot span AZs and that spread/partition placement groups do not reduce network latency — they only control physical placement for fault tolerance.

How to eliminate wrong answers

Option A is wrong because a cluster placement group cannot span multiple Availability Zones — it is confined to a single AZ, which would violate the high-availability requirement across AZs. Option C is wrong because a spread placement group is designed to isolate instances across distinct hardware to reduce correlated failures, not to reduce network latency; it does not provide any latency benefit over standard placement. Option D is wrong because a partition placement group is used for large distributed workloads like HDFS or Cassandra to isolate failure domains, and it does not improve inter-instance latency.

Full explanation →

790

Multi-Selecteasy

A company is designing a hybrid network using AWS Direct Connect. Which TWO of the following are required to establish a private virtual interface (VIF) to a single VPC?

Select 2 answers

A.A Direct Connect Gateway to connect to the VPC.

B.A VLAN ID for the virtual interface.

C.A public IP address for the AWS side of the BGP session.

D.A BGP session with the AWS Direct Connect endpoint using public IPs.

E.A BGP session to exchange routing information.

AnswersB, E

VLAN ID is required to tag traffic.

Why this answer

A VLAN ID is required to create a private virtual interface (VIF) because it uniquely identifies the 802.1Q VLAN tag used to segregate traffic on the Direct Connect link. Without a VLAN ID, the physical connection cannot logically separate the private VIF from other virtual interfaces (e.g., public or transit VIFs) on the same circuit.

Exam trap

The ANS-C01 exam often tests the misconception that a Direct Connect Gateway is mandatory for any private VIF, but it is only required when connecting to multiple VPCs or using a transit VIF, not for a single VPC connection.

Full explanation →

791

MCQmedium

A company wants to use AWS Certificate Manager (ACM) to provide a TLS certificate for a website hosted on an ALB. The domain is example.com, and the certificate must be renewed automatically. Which type of certificate should be requested?

A.A private certificate issued by ACM Private CA

B.A self-signed certificate generated with OpenSSL

C.A certificate imported into ACM from a third-party CA

D.A public certificate issued by ACM with DNS validation

AnswerD

ACM handles renewal automatically.

Why this answer

ACM automatically renews public certificates if DNS validation is used. Option A is incorrect because private certificates issued by ACM Private CA are not trusted by public browsers. Option B is incorrect because self-signed certificates are not trusted by browsers and must be manually renewed.

Option C is incorrect because imported certificates from third-party CAs must be manually renewed.

Full explanation →

792

Multi-Selecthard

A company wants to implement a defense-in-depth strategy for a web application hosted on AWS. Which THREE services should they combine to protect against common web attacks and network threats?

Select 3 answers

A.Amazon GuardDuty

B.AWS WAF

C.AWS Shield Advanced

D.AWS Direct Connect

E.AWS Certificate Manager (ACM)

AnswersA, B, C

GuardDuty provides intelligent threat detection by analyzing logs and network traffic.

Why this answer

A defense-in-depth strategy for web applications includes AWS WAF to protect against web exploits (e.g., SQL injection, cross-site scripting), AWS Shield Advanced for comprehensive DDoS protection, and Amazon GuardDuty for continuous threat detection using anomaly detection and threat intelligence. Option D (AWS Direct Connect) is for dedicated network connectivity, not security. Option E (AWS Certificate Manager) is for SSL/TLS certificate management, not direct attack protection.

Full explanation →

793

Multi-Selecthard

A company is deploying a global application and wants to use AWS Global Accelerator to improve performance. The application runs behind an Application Load Balancer (ALB) in us-east-1. Which THREE components are part of a Global Accelerator deployment?

Select 3 answers

A.Route 53 hosted zones

B.Endpoint groups

C.AWS edge locations

D.Lambda@Edge functions

E.Two static anycast IP addresses

AnswersB, C, E

Endpoint groups define endpoints and traffic distribution.

Why this answer

Endpoint groups are a core component of AWS Global Accelerator that define the AWS Region and traffic routing for a listener. Each endpoint group contains one or more endpoints (such as an ALB, NLB, or EC2 instance) and allows you to control traffic distribution and health checking. In this scenario, the ALB in us-east-1 would be added to an endpoint group associated with that region.

Exam trap

The ANS-C01 exam often tests the misconception that Global Accelerator uses DNS-based routing like Route 53, but the key differentiator is that Global Accelerator relies on static anycast IPs and edge locations for traffic optimization, not DNS resolution.

Full explanation →

794

MCQhard

Refer to the exhibit. A subnet is created in VPC vpc-abcde but no explicit route table association is set. What is the default route for internet-bound traffic from this subnet?

A.Traffic is dropped because no explicit association is set.

B.Traffic goes through the Internet Gateway.

C.Traffic goes through the NAT Gateway nat-67890.

D.Traffic is dropped because no Internet Gateway is present.

AnswerC

The main route table has a route to the NAT Gateway.

Why this answer

When a subnet is created in a VPC without an explicit route table association, it is implicitly associated with the VPC's main route table. The main route table in this scenario includes a default route (0.0.0.0/0) pointing to NAT Gateway nat-67890, so internet-bound traffic from this subnet is directed through the NAT Gateway. This allows instances in private subnets to initiate outbound internet connections while preventing inbound traffic from the internet.

Exam trap

The ANS-C01 exam often tests the misconception that a subnet without an explicit route table association has no routing, when in fact it inherits the VPC's main route table, which may include a default route to a NAT Gateway or Internet Gateway.

How to eliminate wrong answers

Option A is wrong because the subnet is automatically associated with the VPC's main route table, so traffic is not dropped; it follows the routes in that table. Option B is wrong because the main route table's default route points to the NAT Gateway, not an Internet Gateway, and no Internet Gateway is listed in the route table. Option D is wrong because traffic is not dropped due to the absence of an Internet Gateway; it is routed through the NAT Gateway, which provides outbound internet access without requiring a direct Internet Gateway in the subnet's route table.

Full explanation →

795

MCQeasy

Refer to the exhibit. An EC2 instance is associated with the IAM role shown. Which action can the EC2 instance perform?

A.Read objects from any S3 bucket.

B.Write objects to any S3 bucket.

C.Delete objects from any S3 bucket.

D.Upload objects to any S3 bucket.

AnswerA

s3:Get* includes GetObject.

Why this answer

The policy allows s3:Get* and s3:List* actions, which include GetObject. Option B is wrong because PutObject is not allowed. Option C is wrong because DeleteObject is not allowed.

Option D is wrong because no write actions are allowed.

Full explanation →

796

MCQmedium

An organization needs to securely connect its on-premises data center to multiple VPCs in different AWS Regions. The on-premises network uses BGP. Which AWS service should be used to simplify routing and provide a single point of attachment for the on-premises router?

A.Direct Connect gateway with a private VIF.

B.AWS Transit Gateway with inter-Region peering attachments.

C.VPC Peering connections between each VPC and the on-premises network.

D.AWS Client VPN endpoint.

AnswerB

Centralized hub with BGP and multi-region support.

Why this answer

AWS Transit Gateway with inter-Region peering attachments is the correct choice because it provides a single point of attachment for the on-premises router, simplifying routing and connectivity to multiple VPCs across different AWS Regions. The Transit Gateway supports BGP over VPN connections or Direct Connect, allowing the on-premises network to peer with a single Transit Gateway, which then centrally manages inter-VPC and inter-Region traffic through peering attachments, eliminating the need for multiple separate connections.

Exam trap

The trap here is that candidates often confuse Direct Connect gateway with Transit Gateway, assuming a Direct Connect gateway can natively handle inter-Region routing, but it requires additional VPN or Transit Gateway attachments to achieve multi-Region connectivity, whereas Transit Gateway with peering attachments is the designed solution for this exact use case.

How to eliminate wrong answers

Option A is wrong because a Direct Connect gateway with a private VIF only provides connectivity to a single AWS Region or multiple VPCs in the same Region via a Direct Connect connection, but it does not natively support inter-Region routing or simplify multi-Region VPC attachment as a single point for the on-premises router. Option C is wrong because VPC Peering connections do not support transitive routing; each peering connection is a one-to-one relationship, requiring the on-premises router to establish separate BGP sessions and routing tables for each VPC, which does not simplify routing or provide a single point of attachment. Option D is wrong because AWS Client VPN endpoint is a remote access VPN solution for individual clients, not a site-to-site connectivity option for an on-premises data center router using BGP, and it cannot provide a single point of attachment for multiple VPCs across Regions.

Full explanation →

797

MCQhard

A company is using AWS Direct Connect to connect its on-premises data center to AWS. The company has a single hosted virtual interface (VIF) with a private VIF to a VPC. The network team notices that traffic from on-premises to AWS is asymmetric—some packets go through the Direct Connect while others use a VPN backup. The team wants all traffic to use Direct Connect when available. What should they do?

A.Disable AS_PATH prepending on the Direct Connect BGP session.

B.Convert the private VIF to a public VIF.

C.Remove the VPN connection to force all traffic through Direct Connect.

D.Advertise more specific prefixes (e.g., /24) over Direct Connect and less specific (e.g., /16) over VPN.

AnswerD

Correct: More specific BGP routes are preferred, so Direct Connect will be used when available.

Why this answer

BGP route selection prefers more specific prefixes (longest prefix match) over less specific ones. By advertising a more specific prefix (e.g., /24) over Direct Connect and a less specific prefix (e.g., /16) over the VPN, the on-premises router will prefer the Direct Connect path for the more specific route, ensuring all traffic uses Direct Connect when available. This leverages BGP's prefix-length-based path selection without requiring removal of the VPN backup.

Exam trap

The trap here is that candidates often assume AS_PATH prepending or removing the VPN is the solution, but the key is understanding that BGP's longest prefix match overrides all other path selection attributes, making prefix specificity the most reliable way to enforce traffic flow.

How to eliminate wrong answers

Option A is wrong because disabling AS_PATH prepending on the Direct Connect BGP session would make the Direct Connect path appear shorter (lower AS_PATH length), but it does not address the root cause of asymmetric routing if the VPN is advertising a more specific prefix or if the on-premises router is using a different metric. Option B is wrong because converting a private VIF to a public VIF would change the connectivity type from private (VPC access) to public (AWS public services), which is unrelated to fixing asymmetric routing between on-premises and a VPC. Option C is wrong because removing the VPN connection eliminates the backup path entirely, which violates the requirement to have a backup available and does not solve the routing preference issue—it forces traffic through Direct Connect but removes redundancy.

Full explanation →

798

MCQmedium

A company has deployed a transit gateway with multiple VPC attachments and VPN attachments. The network team notices that traffic between two VPCs is taking an unexpected path and experiencing high latency. Which tool should be used to trace the path and identify the specific transit gateway route table that is being used?

A.AWS CloudTrail

B.Amazon CloudWatch ServiceLens

C.AWS X-Ray

D.VPC Reachability Analyzer

AnswerD

Reachability Analyzer performs path analysis between resources and shows the route table decisions, including transit gateway routes.

Why this answer

VPC Reachability Analyzer performs connectivity and path analysis between sources and destinations, showing the route table decisions, including the specific transit gateway route table used. Option D is correct. Options A (CloudTrail), B (CloudWatch ServiceLens), and C (X-Ray) are not designed for path tracing.

Full explanation →

799

MCQhard

A company is using AWS Certificate Manager (ACM) to manage SSL/TLS certificates for an Application Load Balancer (ALB). The security team notices that an ACM-issued certificate is about to expire. How can they automate renewal?

A.Set a CloudWatch alarm to send a notification when the certificate is about to expire, then manually renew.

B.Manually remove the certificate from ACM and re-issue a new one.

C.Use AWS Certificate Manager's automatic renewal feature; no additional configuration is required if the certificate was issued by ACM.

D.Configure an AWS Lambda function to monitor certificate expiration and re-issue the certificate.

AnswerC

ACM automatically renews certificates it issued, provided the domain validation records are in place.

Why this answer

ACM automatically renews certificates issued by ACM if the domain is validated with DNS or email. No manual action is needed. Imported certificates must be manually renewed.

Removing and re-adding is not automatic. Lambda is unnecessary.

Full explanation →

800

MCQmedium

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Direct Connect and VPN. They have a central inspection VPC that uses AWS Network Firewall to inspect traffic. The security team wants to ensure that all traffic between VPCs and between VPCs and on-premises is routed through the inspection VPC. They have created a transit gateway route table for each VPC and the Direct Connect/VPN attachments. They have configured the route tables to propagate routes from the inspection VPC's attachment. However, traffic is still bypassing the inspection VPC. What should the security team do to ensure traffic is inspected?

A.Enable route propagation for all attachments in the transit gateway route tables.

B.Create static routes in each VPC's transit gateway route table pointing to the inspection VPC attachment for all destination CIDRs, and remove any routes that point directly to other attachments.

C.Configure network ACLs in the inspection VPC to block traffic that does not come from the transit gateway.

D.Create VPC peering connections between all VPCs and the inspection VPC.

AnswerB

Static routes can force traffic to the inspection VPC.

Why this answer

Creating static routes in each VPC's transit gateway route table pointing to the inspection VPC attachment for all destination CIDRs, and removing any routes that point directly to other attachments, ensures that all traffic is sent to the inspection VPC. Without static routes, propagated routes from the inspection VPC attachment create routes to the inspection VPC, but other attachments may also propagate routes that allow direct communication, bypassing inspection. Option A is incorrect because enabling route propagation alone does not force traffic through the inspection VPC; it only adds routes automatically, but other routes (e.g., from Direct Connect or VPN attachments) can still allow direct paths.

Option C is incorrect because network ACLs in the inspection VPC control traffic to and from its subnets but do not influence routing decisions in the transit gateway; they cannot prevent traffic from bypassing the inspection VPC. Option D is incorrect because VPC peering connections bypass the transit gateway entirely, so traffic would not be inspected by the Network Firewall in the inspection VPC.

Full explanation →

801

MCQhard

A company has a multi-account AWS environment with hundreds of VPCs connected via a transit gateway. The network team needs to centrally monitor network traffic and detect anomalies such as unusual outbound data transfers. Which combination of services would provide the most scalable and cost-effective solution?

A.Use AWS Trusted Advisor to check for unusual traffic patterns

B.Enable VPC Flow Logs in each VPC, publish to CloudWatch Logs, and create cross-account CloudWatch dashboards

C.Use AWS Network Manager to monitor all VPCs and Transit Gateway attachments

D.Enable VPC Flow Logs in each VPC, publish to Amazon S3, and use Amazon Athena to query logs from a central account

AnswerD

S3 is cost-effective for storage and Athena allows querying across accounts.

Why this answer

VPC Flow Logs capture IP traffic metadata at scale, and publishing to Amazon S3 provides a cost-effective, durable storage layer. Using Amazon Athena to query the logs from a central account enables serverless, on-demand analysis across hundreds of VPCs without provisioning servers, making it both scalable and cost-effective for anomaly detection.

Exam trap

The trap here is that candidates assume CloudWatch Logs is the only or best destination for VPC Flow Logs, overlooking the cost and scalability advantages of S3 combined with Athena for large-scale, cross-account analysis.

How to eliminate wrong answers

Option A is wrong because AWS Trusted Advisor checks for AWS service limits, security best practices, and cost optimization, but it does not analyze VPC traffic patterns or detect anomalies in outbound data transfers. Option B is wrong because publishing VPC Flow Logs to CloudWatch Logs incurs ingestion and storage costs that become prohibitively expensive at scale across hundreds of VPCs, and cross-account CloudWatch dashboards do not provide a queryable interface for ad-hoc anomaly detection. Option C is wrong because AWS Network Manager provides a global view of transit gateway networks and topology, but it does not perform deep packet inspection or traffic anomaly detection; it lacks the query and analysis capabilities needed to identify unusual outbound data transfers.

Full explanation →

802

MCQmedium

A company is implementing a network architecture for a critical application that requires ultra-low latency between two Amazon EC2 instances. The instances are launched in two different Availability Zones within the same AWS Region. The network engineer needs to ensure that traffic between the instances uses the lowest latency path possible. The instances are placed in a cluster placement group. The application uses TCP. The engineer has configured the security groups to allow all traffic between the instances. However, latency is higher than expected. What should the engineer do to reduce latency?

A.Configure the instances to use their private IP addresses instead of public IPs for communication.

B.Enable Elastic Network Adapter (ENA) and enhanced networking on both instances.

C.Move the instances to the same subnet within the same Availability Zone.

D.Set up a VPC peering connection between the subnets in the two Availability Zones.

AnswerB

ENA reduces latency by offloading network processing.

Why this answer

Elastic Network Adapter (ENA) with enhanced networking provides lower latency and higher throughput by offloading network processing to hardware. While the cluster placement group minimizes network distance, it does not guarantee the lowest latency without ENA. Option A is incorrect because instances in the same VPC already communicate via private IPs by default.

Option C is incorrect because moving to the same AZ is not necessary and would reduce fault tolerance. Option D is incorrect because VPC peering does not improve latency within the same VPC.

Full explanation →

803

Multi-Selecthard

A company is using AWS Transit Gateway to interconnect multiple VPCs and on-premises networks. The network engineer needs to ensure that traffic between VPC A and VPC B follows a specific path through a Network Virtual Appliance (NVA) in VPC C. Which TWO actions should the engineer take?

Select 2 answers

A.Associate VPC A's and VPC B's route tables with a different Transit Gateway route table that has a default route pointing to the VPC C attachment.

B.Add a static route in the Transit Gateway route table for VPC A's CIDR pointing to the VPC B attachment with a blackhole.

C.Enable route propagation for VPC A and VPC B attachments in the same Transit Gateway route table.

D.Add a specific route for VPC B's CIDR in the Transit Gateway route table used by VPC A, pointing to the VPC C attachment.

E.Create a VPC peering connection between VPC A and VPC B.

AnswersB, D

This prevents VPC A from directly reaching VPC B via the Transit Gateway.

Why this answer

Adding a static route in the Transit Gateway route table for VPC A's CIDR pointing to the VPC B attachment with a blackhole forces traffic destined to VPC B to be dropped at the Transit Gateway, preventing direct routing. Option D is correct because adding a specific route for VPC B's CIDR in the Transit Gateway route table used by VPC A, pointing to the VPC C attachment, ensures traffic from VPC A to VPC B is forwarded through the NVA in VPC C, enforcing the desired inspection path.

Exam trap

The trap here is that candidates often think enabling route propagation (Option C) is sufficient for traffic inspection, but it actually allows direct routing between VPCs, bypassing the NVA, unless specific static routes are added to override the propagated routes.

Full explanation →

804

MCQmedium

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The network team notices that traffic is intermittently dropping and the BGP session between the on-premises router and the AWS Direct Connect virtual interface goes down. Which configuration should be checked first to resolve this issue?

A.Ensure the BGP hold timer values are consistent on both ends

B.Increase the BGP keepalive timer on the on-premises router to 90 seconds

C.Disable BGP authentication on the virtual interface

D.Enable BGP MD5 authentication on the on-premises router

AnswerA

Correct. Consistent BGP hold timers on both ends prevent session timeouts due to mismatch.

Why this answer

Ensure the BGP hold timer values are consistent on both ends. A mismatch in BGP hold timers can cause the BGP session to flap intermittently. Configuring consistent hold times on both routers stabilizes the session.

Option B is incorrect because increasing the keepalive timer may postpone failure detection but does not fix the root cause. Option C is incorrect because disabling BGP authentication is unnecessary and insecure. Option D is incorrect because enabling MD5 authentication is optional and unrelated to the flapping.

Exam trap

The trap is assuming that simply increasing timers will solve the flapping; the actual fix is ensuring timers match.

Full explanation →

805

MCQmedium

An engineer is reviewing VPC Flow Logs for connectivity issues between two EC2 instances (10.0.1.5 and 10.0.2.10) on TCP port 443. The first log entry shows ACCEPT, the second shows REJECT. What is the most likely cause of the REJECT?

A.The destination instance has an incorrect network interface configuration.

B.The network ACL is blocking the traffic due to an incorrect inbound rule.

C.The route table for the subnet does not have a route to the destination.

D.A security group rule is blocking the return traffic.

AnswerB

Correct. Network ACLs are stateless, so they require explicit inbound rules for return traffic. The REJECT on the return packet indicates a missing or incorrect inbound NACL rule.

Why this answer

The first log entry shows ACCEPT for the outbound SYN packet, indicating the initial connection attempt succeeded. The second REJECT indicates that the return SYN-ACK packet from 10.0.2.10 to 10.0.1.5 was dropped. Since security groups are stateful and automatically allow return traffic for established connections, they cannot cause this REJECT.

Network ACLs are stateless, so they require explicit inbound rules for return traffic. If the inbound rule on the NACL for the subnet of 10.0.2.10 does not allow the return traffic (e.g., using an ephemeral port range), it will be REJECTED. Therefore, option B is correct.

Exam trap

The ANS-C01 exam often tests the nuance that asymmetric routing can cause security groups to drop return traffic. Even though security groups are stateful, if the return packet takes a different path (e.g., different subnet or ENI) than the outbound packet, the security group on that interface may not recognize it as part of an established connection and will evaluate it against inbound rules. If no appropriate inbound rule exists, the packet is REJECTED.

Candidates frequently assume a REJECT on return traffic must be due to a stateless NACL, overlooking this asymmetric routing scenario.

How to eliminate wrong answers

Option A is wrong because an incorrect network interface configuration (e.g., wrong IP or subnet mask) would prevent the initial SYN packet from reaching the destination, but the first log entry shows ACCEPT, indicating the packet was delivered. Option B is wrong because network ACLs are stateless and would need explicit inbound rules for return traffic; if the NACL were blocking the return traffic, the first log entry (outbound) would still show ACCEPT, but the second REJECT could be due to a missing inbound NACL rule, but the question states the first entry shows ACCEPT and the second REJECT, which is more consistent with a stateful security group issue rather than a stateless NACL (NACLs would also require a rule for the ephemeral port range). Option C is wrong because if the route table lacked a route to the destination, the initial SYN packet would be dropped at the source subnet's router, resulting in a REJECT on the first log entry, not an ACCEPT.

Full explanation →

806

MCQhard

A company is migrating a legacy application to AWS. The application requires that all network traffic between two VPCs be inspected by a third-party firewall appliance. The firewall must be able to inspect traffic bidirectionally and automatically fail over if the appliance becomes unhealthy. Which architecture meets these requirements?

A.Use AWS Transit Gateway with a Network Load Balancer in front of multiple firewall appliances

B.Use VPC Peering between the two VPCs and route traffic through a firewall instance in one of the VPCs

C.Deploy a single firewall instance in a shared VPC and route all inter-VPC traffic through it

D.Use AWS PrivateLink to connect the VPCs and place the firewall in the consumer VPC

AnswerA

Transit Gateway enables centralized routing, and NLB provides health checks and failover.

Why this answer

AWS Transit Gateway with a Network Load Balancer (NLB) in front of multiple firewall appliances enables bidirectional traffic inspection and automatic failover. The NLB performs health checks and distributes traffic to healthy firewall instances, ensuring high availability. Option B is wrong because VPC Peering does not support a central inspection point; traffic flows directly between VPCs without passing through a firewall.

Option C is wrong because a single firewall instance is a single point of failure, lacking automatic failover. Option D is wrong because AWS PrivateLink uses VPC Endpoints for connectivity, which does not allow traffic inspection by a third-party firewall in the consumer VPC; it only allows one-way initiated connections.

Full explanation →

807

MCQmedium

A network engineer is troubleshooting connectivity between two VPCs that are peered. The VPC peering connection is active, and the route tables have appropriate routes. However, instances in VPC A cannot reach instances in VPC B. The security groups in both VPCs allow all traffic. What is the most likely issue?

A.The security groups are not allowing ICMP traffic

B.The route tables in both VPCs do not have routes pointing to the peering connection for the other VPC's CIDR

C.The VPC peering connection is not in the 'active' state

D.The instances are in different availability zones

AnswerB

Without these routes, traffic cannot traverse the peering connection.

Why this answer

The most likely issue is that the route tables in both VPCs do not have routes pointing to the VPC peering connection for the other VPC's CIDR. Although the VPC peering connection is active, without explicit routes in the route tables, traffic cannot be directed to the peer VPC. Since security groups allow all traffic, they are not the cause.

Different availability zones do not affect VPC peering. Therefore, the correct answer is B.

Full explanation →

808

MCQmedium

A company is using AWS Client VPN to provide remote access to its VPC. Users report that they can connect to the VPN but cannot reach resources in the VPC. The Client VPN endpoint is associated with a single subnet in the VPC, and the authorization rules allow access to the entire VPC CIDR (10.0.0.0/16). The security group assigned to the Client VPN endpoint allows all traffic. What is the most likely cause of this issue?

A.The security group assigned to the Client VPN endpoint does not allow inbound traffic from the client CIDR.

B.The route table associated with the Client VPN subnet does not have a route for the client IP range.

C.The authorization rule is too broad and is blocking traffic.

D.The Client VPN endpoint does not have a security group association group configured.

AnswerB

Without a return route, traffic from instances cannot reach the VPN clients.

Why this answer

The Client VPN endpoint is associated with a single subnet in the VPC. For traffic from the VPN clients to reach resources in the VPC, the route table of that subnet must include a route pointing the client IP range back to the VPN endpoint's network interface. Without this route, the subnet has no path to forward return traffic to the clients, even though the clients can establish the VPN tunnel.

Option B correctly identifies this missing route as the root cause.

Exam trap

AWS often tests the misconception that security groups or authorization rules are the primary cause of connectivity issues after a successful VPN connection, when in reality the missing route in the subnet's route table is the most common culprit for one-way traffic failures in AWS Client VPN.

How to eliminate wrong answers

Option A is wrong because the security group assigned to the Client VPN endpoint controls traffic entering or leaving the endpoint itself, not inbound traffic from the client CIDR; the security group already allows all traffic, so this is not the issue. Option C is wrong because an authorization rule that is too broad (allowing the entire VPC CIDR) would permit traffic, not block it; authorization rules are permissive, not restrictive. Option D is wrong because a 'security group association group' is not a valid AWS Client VPN configuration; the endpoint uses a single security group, and the absence of such a group does not cause connectivity failures.

Full explanation →

809

MCQeasy

Refer to the exhibit. A company applies this bucket policy to an S3 bucket. What is the effect of the policy?

A.All requests are denied

B.Only HTTPS requests are allowed, and HTTP requests are denied

C.Only HTTP requests are allowed

D.All requests are allowed

AnswerB

The Deny effect blocks HTTP requests; HTTPS requests are implicitly allowed.

Why this answer

The bucket policy uses a Deny effect that blocks any request where SecureTransport is false, which corresponds to HTTP requests. Therefore, only HTTPS requests are allowed, and HTTP requests are denied. Option B is correct.

Full explanation →

810

MCQmedium

Refer to the exhibit. A security engineer is reviewing this S3 bucket policy. The bucket contains sensitive data that should only be accessible from the corporate network (192.0.2.0/24). What is a potential security issue with this policy?

A.The condition should be applied to the Principal element

B.The Resource ARN is missing the bucket name

C.The policy does not require authentication; anonymous access is allowed from the specified IP range

D.The IP address range is not specific enough

AnswerC

The Principal is "*", which includes anonymous users.

Why this answer

The policy allows any principal (Principal: '*') to perform the s3:GetObject action under the condition that the request comes from the specified IP range. However, this condition only checks the IP address; it does not require authentication. If the bucket is publicly accessible (no bucket policy or ACL denying anonymous access), then unauthenticated requests from the allowed IP range would be allowed, which is a security issue.

Option A is wrong because the condition belongs on the Action element, not the Principal. Option B is wrong because the Resource ARN includes the bucket name correctly (arn:aws:s3:::example-bucket/*). Option D is wrong because the IP range is specific and appropriate for the requirement.

Full explanation →

811

MCQhard

A company has a VPC (10.0.0.0/16) with two subnets: public (10.0.1.0/24) and private (10.0.2.0/24). They have an Application Load Balancer (ALB) in the public subnet that distributes traffic to EC2 instances in the private subnet. The ALB is internet-facing and has a security group that allows inbound HTTP/S from 0.0.0.0/0. The EC2 instances have a security group that allows inbound HTTP from the ALB's security group. Users report that they can access the application, but the application is slow and sometimes times out. The network engineer checks CloudWatch metrics and sees that the ALB's target response time is high. The engineer suspects that the EC2 instances are overwhelmed. Which action should the engineer take to improve performance?

A.Add a NAT gateway in the public subnet to reduce latency.

B.Replace the ALB with a Network Load Balancer to reduce overhead.

C.Increase the size of the EC2 instances in the private subnet.

D.Add EC2 instances in another Availability Zone and register them with the ALB.

AnswerD

Distributing load across AZs improves performance and availability.

Why this answer

Adding EC2 instances in another Availability Zone increases capacity and distributes traffic across multiple AZs, reducing the load on each instance and improving performance and fault tolerance. Option A is incorrect because a NAT gateway is for outbound internet access, not for reducing latency between ALB and targets. Option B is incorrect because an NLB does not automatically distribute traffic across AZs as effectively for HTTP applications and does not offload processing.

Option C is incorrect because simply increasing instance size (vertical scaling) may not provide the same benefits as horizontal scaling across AZs for handling variable loads.

Full explanation →

812

MCQhard

A company has a multi-account AWS Organizations setup with hundreds of VPCs across multiple regions. The network team needs to centralize outbound internet traffic through a set of inspection VPCs for security monitoring. Which solution is MOST scalable and cost-effective?

A.Use a Network Load Balancer in each VPC to distribute traffic to inspection appliances.

B.Create a Transit Gateway with a central inspection VPC that has a NAT Gateway and route all VPCs to the inspection VPC for egress.

C.Deploy a NAT Gateway in each VPC and route traffic directly to the internet.

D.Set up VPC peering between all VPCs and route traffic through a single VPC with an Internet Gateway.

AnswerB

Scalable, centralized, and cost-effective.

Why this answer

A Transit Gateway with a central inspection VPC centralizes egress traffic through a single NAT Gateway, eliminating the need for per-VPC NAT Gateways. This architecture scales horizontally by attaching hundreds of VPCs to the Transit Gateway and routing all 0.0.0.0/0 traffic to the inspection VPC, which is cost-effective as it reduces NAT Gateway hourly charges and data processing costs across multiple regions.

Exam trap

The trap here is that candidates may assume VPC peering can be used for transitive routing (Option D), but AWS explicitly prohibits transitive routing through VPC peering, making Transit Gateway the only scalable solution for hub-and-spoke egress with hundreds of VPCs.

How to eliminate wrong answers

Option A is wrong because a Network Load Balancer in each VPC distributes traffic to inspection appliances but does not centralize egress; it still requires per-VPC NAT Gateways or internet gateways, increasing cost and complexity without addressing the centralization requirement. Option C is wrong because deploying a NAT Gateway in each VPC directly contradicts the need to centralize outbound traffic; it distributes egress across all VPCs, increasing costs and losing centralized security monitoring. Option D is wrong because VPC peering does not support transitive routing (per AWS documentation, VPC peering is non-transitive), so routing traffic through a single VPC with an Internet Gateway would require full-mesh peering between all VPCs, which does not scale to hundreds of VPCs and violates the non-transitive peering rule.

Full explanation →

813

MCQeasy

A company has a VPC with multiple subnets. They want to centrally manage and inspect all traffic between subnets using a security appliance. Which AWS service should be used to achieve this?

A.VPC peering

B.AWS Route 53 Resolver

C.AWS Network Firewall

D.Transit Gateway with a security appliance in a central VPC

AnswerD

Allows centralized inspection.

Why this answer

Transit Gateway with a security appliance in a central VPC (Option D) is the correct approach because it allows centralized inspection of all traffic between subnets by routing traffic through a central inspection VPC where security appliances are deployed. Option A (VPC peering) is incorrect because it only provides direct connectivity between two VPCs and does not support centralized inspection. Option B (AWS Route 53 Resolver) is a DNS service and has no traffic inspection capability.

Option C (AWS Network Firewall) is a managed firewall service, but it does not provide the multi-VPC architecture needed to centrally route traffic from multiple subnets/VPCs; Transit Gateway is required to route traffic to the firewall.

Full explanation →

814

Multi-Selecteasy

A company has an AWS Transit Gateway with multiple VPC attachments. They need to inspect traffic between VPCs using a third-party firewall appliance. Which THREE steps are necessary?

Select 3 answers

A.Create a VPC peering connection between the VPCs to allow traffic flow

B.Deploy a Gateway Load Balancer (GWLB) in the firewall VPC and register the firewall instances as targets

C.Configure Transit Gateway route tables to route traffic between VPCs through the firewall VPC

D.Configure a NAT Gateway in each VPC to route traffic through the firewall

E.Attach a VPC containing the firewall appliance to the Transit Gateway

AnswersB, C, E

GWLB integrates with Transit Gateway and transparently routes traffic to the firewall instances.

Why this answer

A Gateway Load Balancer (GWLB) is designed to transparently insert third-party firewall appliances into network traffic paths. By deploying a GWLB in the firewall VPC and registering the firewall instances as targets, traffic can be inspected at Layer 3/4 without modifying the source or destination IP addresses, enabling seamless integration with Transit Gateway routing.

Exam trap

The ANS-C01 exam often tests the misconception that VPC peering can be used for transitive routing through a central inspection VPC, but peering is non-transitive and requires a full mesh, making Transit Gateway with GWLB the correct approach.

Full explanation →

815

MCQhard

A company has a Direct Connect connection to AWS. They want to encrypt all traffic between their on-premises network and their VPC. Which solution meets this requirement?

A.Use MACsec on the Direct Connect connection.

B.Set up a VPN connection over the Direct Connect link using IPsec.

C.Enable encryption on the Direct Connect virtual interface.

D.Use TLS for all traffic between on-premises and AWS.

AnswerB

IPsec VPN over Direct Connect encrypts all traffic between the customer gateway and the VPC.

Why this answer

Direct Connect does not inherently encrypt traffic. To encrypt all traffic between on-premises and the VPC, you can establish an IPsec VPN tunnel over the Direct Connect link. This encrypts traffic at the network layer.

Option A is incorrect: MACsec provides physical-layer encryption but is not supported on all Direct Connect connections and does not encrypt all traffic end-to-end. Option C is incorrect: Direct Connect virtual interfaces do not provide encryption. Option D is incorrect: TLS is an application-layer protocol; it would require individual applications to support it and does not encrypt all traffic at the network layer.

Full explanation →

816

MCQhard

An IAM policy is applied to a user. The user reports that they cannot run 'aws ec2 describe-instances --region eu-west-1' but can run the same command in us-east-1. What is the most likely reason?

A.The policy only applies to resources in us-east-1, so other regions are implicitly denied.

B.The policy condition uses StringEquals, which only allows requests from us-east-1.

C.The policy denies ec2:Describe* when the region is not us-east-1.

D.The policy allows ec2:Describe* in all regions, but the user lacks permissions in eu-west-1.

AnswerC

The condition denies requests to regions other than us-east-1.

Why this answer

The condition 'StringNotEquals' with 'aws:RequestedRegion' denies the action if the region is not us-east-1. Option A is wrong because the policy explicitly denies ec2:Describe* actions. Option B is wrong because the condition is StringNotEquals, not StringEquals.

Option D is wrong because the policy does not specify resource-level conditions.

Full explanation →

817

MCQmedium

A company has an Amazon RDS for MySQL database in a private subnet. The database should only be accessible from a specific fleet of EC2 instances in the same VPC. Which combination of security controls should be used to meet this requirement?

A.Use a network ACL on the private subnet that allows MySQL traffic from the EC2 instances' IP addresses.

B.Set up a VPN connection between the EC2 instances and the RDS instance.

C.Use a security group for the RDS instance that allows inbound MySQL traffic from the security group of the EC2 instances.

D.Enable IAM database authentication for the RDS instance and require EC2 instances to use IAM credentials.

AnswerC

Security group rules can reference other security groups, providing instance-level access control.

Why this answer

A security group on the RDS instance that allows inbound MySQL traffic from the security group of the EC2 instances restricts access to only those instances that are members of that security group. Option A is incorrect because network ACLs are stateless and operate at the subnet level, requiring explicit inbound and outbound rules; they cannot reference security groups. Option B is incorrect because a VPN connection is used for connectivity to external networks, not for communication within the same VPC.

Option D is incorrect because IAM database authentication controls user authentication to the database, not network-level access from EC2 instances.

Full explanation →

818

MCQeasy

A small company has a single VPC with one public subnet and one private subnet. They have a web server in the public subnet and a database server in the private subnet. The web server needs to access the database server on port 3306 (MySQL). The network engineer has configured the security group for the database server to allow inbound TCP port 3306 from the security group of the web server. However, the web server cannot connect to the database server. The network ACL for the private subnet is the default (allows all inbound and outbound). The web server can ping the database server's private IP. What is the MOST likely cause of the connection failure?

A.The web server cannot reach the private IP of the database server because it is in a different subnet

B.The network ACL for the private subnet is blocking inbound traffic on port 3306

C.The security group for the database server is not allowing inbound traffic from the web server's security group

D.The MySQL service on the database server is not running or not listening on port 3306

AnswerD

Correct; the application layer is the most likely issue.

Why this answer

The database server's security group is correctly configured to allow inbound traffic from the web server's security group on port 3306. The network ACL for the private subnet is default allow, so it is not blocking traffic. The web server can ping the database server's private IP, indicating network connectivity exists.

Therefore, the issue is that the MySQL service on the database server is not running or not listening on port 3306. Option D is correct.

Exam trap

Remember that security groups are stateful and automatically allow return traffic. The default network ACL allows all inbound and outbound traffic. If ping works but a specific port connection fails, the application service may not be running.

Full explanation →

819

MCQeasy

A company is deploying a web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application must be accessible from the internet. Which component must be attached to the VPC to allow internet traffic to reach the ALB?

A.NAT gateway

B.Virtual private gateway

C.Internet gateway

D.Transit gateway

AnswerC

An internet gateway is required for internet traffic to reach resources in a VPC.

Why this answer

An Internet Gateway (IGW) is a horizontally scaled, redundant component that allows communication between a VPC and the internet. For an Application Load Balancer (ALB) to receive traffic from the internet, the ALB must be deployed in public subnets, and those subnets must have a route table entry pointing 0.0.0.0/0 to an IGW. Without the IGW, the ALB cannot accept inbound connections from the internet.

Exam trap

The trap here is that candidates often confuse the NAT gateway (which provides outbound-only internet access) with the Internet Gateway (which provides bidirectional internet access), leading them to select the NAT gateway for inbound traffic scenarios.

How to eliminate wrong answers

Option A is wrong because a NAT gateway is used to enable outbound internet access for instances in private subnets, not to allow inbound internet traffic to reach an ALB. Option B is wrong because a Virtual Private Gateway is used to connect a VPC to an on-premises network via VPN or Direct Connect, not for internet-facing traffic. Option D is wrong because a Transit Gateway is a hub for interconnecting VPCs and on-premises networks, not a device that provides internet connectivity to a VPC.

Full explanation →

820

MCQeasy

A company wants to provide internet access to instances in a public subnet. Which component must be attached to the VPC and have a route to it in the subnet's route table?

A.Transit Gateway

B.Virtual Private Gateway

C.NAT Gateway

D.Internet Gateway

AnswerD

Internet Gateway enables internet access for public subnets.

Why this answer

An Internet Gateway (IGW) is a horizontally scaled, redundant component that allows communication between a VPC and the internet. For instances in a public subnet to have outbound internet access and be reachable from the internet, the IGW must be attached to the VPC, and the subnet's route table must include a default route (0.0.0.0/0) pointing to the IGW as the target.

Exam trap

The trap here is that candidates confuse the NAT Gateway (which provides outbound-only internet access for private subnets) with the Internet Gateway (which provides bidirectional internet access for public subnets), leading them to select Option C for a public subnet scenario.

How to eliminate wrong answers

Option A is wrong because a Transit Gateway is used to interconnect multiple VPCs and on-premises networks, not to provide direct internet access to instances; it does not perform NAT or have a public IP. Option B is wrong because a Virtual Private Gateway is used to establish VPN connections from on-premises networks to a VPC, not to provide internet access; it cannot route traffic to the internet. Option C is wrong because a NAT Gateway enables outbound internet access for instances in private subnets, but it does not allow inbound traffic from the internet and is not used for public subnets; public subnets require an Internet Gateway.

Full explanation →

821

MCQeasy

A network engineer needs to capture and analyze network traffic between two EC2 instances in the same VPC for troubleshooting. Which AWS service should be used?

A.AWS CloudTrail.

B.Amazon CloudWatch Metrics.

C.VPC Flow Logs.

D.AWS Config.

AnswerC

VPC Flow Logs capture IP traffic information for network interfaces, enabling traffic analysis between instances.

Why this answer

VPC Flow Logs capture IP traffic information for network interfaces within a VPC, enabling analysis of traffic between EC2 instances. Option A is wrong because CloudTrail logs API calls, not network traffic. Option B is wrong because CloudWatch Metrics provide performance metrics, not packet-level details.

Option D is wrong because AWS Config monitors configuration changes, not traffic.

Full explanation →

822

Multi-Selecteasy

A company is deploying a web application on EC2 instances behind an Application Load Balancer. The security team needs to protect the application from common web exploits like SQL injection and cross-site scripting. Which AWS service should be used?

Select 1 answer

A.AWS Shield Advanced

B.AWS WAF

C.AWS Network Firewall

D.Amazon GuardDuty

E.AWS Firewall Manager

AnswersB

AWS WAF integrates with Application Load Balancers to filter HTTP/HTTPS requests and can block common web exploits such as SQL injection and cross-site scripting. This directly addresses the security team's requirement.

Why this answer

AWS WAF (Option B) is the correct service because it integrates with Application Load Balancers to filter HTTP/HTTPS requests and can block common web exploits such as SQL injection and cross-site scripting. AWS Shield Advanced (Option A) provides enhanced DDoS protection, which does not mitigate web application layer attacks like SQL injection or XSS. AWS Network Firewall (Option C) operates at the network layer and is not designed for application-layer threats.

Amazon GuardDuty (Option D) is a threat detection service, not a prevention tool. AWS Firewall Manager (Option E) centralizes firewall rule management but does not directly protect against web exploits. Therefore, only Option B is correct for this requirement.

Full explanation →

823

Multi-Selectmedium

A company is designing a network architecture for a critical application that requires high availability across multiple AWS regions. The application uses an Application Load Balancer (ALB) in each region. Which TWO services can provide global routing and failover between the two ALBs?

Select 2 answers

A.Amazon Route 53 with failover routing and health checks

B.AWS WAF

C.Network Load Balancer (NLB)

D.Amazon CloudFront

E.AWS Global Accelerator

AnswersA, E

Route 53 can route traffic to the primary region and failover to the secondary based on health checks.

Why this answer

Amazon Route 53 with failover routing policy and health checks can route traffic to the primary ALB and automatically fail over to the secondary ALB in another region when the primary health check fails. This provides global DNS-based routing and failover across regions, meeting the high-availability requirement.

Exam trap

The trap here is that candidates may think CloudFront or an NLB can provide cross-region failover, but CloudFront lacks health-check-based failover routing and an NLB is regional, while only Route 53 failover routing and Global Accelerator offer global traffic steering with health check integration.

Full explanation →

824

Multi-Selecteasy

Which TWO statements about AWS Key Management Service (KMS) are correct? (Choose two.)

Select 2 answers

A.Customer master keys (CMKs) can be automatically rotated every year.

B.KMS uses symmetric encryption only.

C.KMS can store encrypted data.

D.KMS is a regional service.

E.You cannot import your own key material into KMS.

AnswersA, D

AWS KMS can automatically rotate CMKs annually.

Why this answer

Options A and D are correct. AWS KMS allows automatic yearly rotation of customer master keys (CMKs) (A). KMS is a regional service, meaning CMKs are tied to a specific AWS Region (D).

Option B is incorrect because KMS supports both symmetric and asymmetric encryption. Option C is incorrect because KMS does not store encrypted data; it manages encryption keys. Option E is incorrect because you can import your own key material into KMS using the 'import key material' feature.

Full explanation →

825

MCQmedium

A company has a VPC with resources that need to access an S3 bucket in the same region. To minimize latency and avoid internet traffic, which configuration should be used?

A.Use a NAT Gateway in a public subnet and route traffic through it

B.Create a VPC Gateway Endpoint for S3

C.Use VPC peering to connect to an S3 bucket

D.Create a VPC Interface Endpoint for S3

AnswerB

Creating a VPC Gateway Endpoint for S3 is the correct method for private, low-latency access to S3 within the same region. It is free and uses prefix lists in route tables.

Why this answer

A VPC Gateway Endpoint for S3 provides private connectivity without traversing the internet, minimizing latency and avoiding data transfer costs. It is the recommended approach for accessing S3 from a VPC. While VPC Interface Endpoints for S3 also provide private access, they incur hourly charges and additional data processing fees.

In most scenarios, Gateway Endpoints are preferred for S3 and DynamoDB due to their simplicity and cost-effectiveness. NAT Gateway (A) is used for internet-bound traffic, not private S3 access. VPC peering (C) connects VPCs but does not provide direct access to S3.

Exam trap

Some may select VPC Interface Endpoint (D) because it also offers private access to S3; however, AWS recommends Gateway Endpoints for S3 and DynamoDB as they are free and purpose-built for these services. Interface Endpoints are more suitable for other services via PrivateLink.

Full explanation →

Page 11 of 22

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

Practice ANS-C01 by domain

Target a specific domain to shore up weak areas.

Network Management and Operations Network Security, Compliance and Governance Network Design Network Implementation

See all domains with question counts →