Courseiva

AWS Certified Advanced Networking Specialty ANS-C01 (ANS-C01) — Questions 826–900

1621 questions total · 22pages · All types, answers revealed

Take a mock examExam hub
Page 11

Page 12 of 22

Page 13
826
MCQmedium

A company is migrating a legacy application that requires static IP addresses for its clients' firewall whitelisting. The application will be hosted on EC2 instances behind a Network Load Balancer (NLB) in a private subnet. Which approach should the company use to provide static IP addresses for outbound traffic?

A.Assign Elastic IPs to the EC2 instances
B.Use an internet-facing NLB with Elastic IPs
C.Use a VPC endpoint for the application
D.Deploy a NAT Gateway in a public subnet with an Elastic IP
AnswerD

NAT Gateway with an Elastic IP provides a static source IP for outbound traffic from private subnets.

Why this answer

A NAT Gateway in a public subnet with an Elastic IP provides a static source IP address for outbound traffic from private subnets. Since the EC2 instances are in a private subnet behind an NLB, they cannot directly reach the internet; the NAT Gateway translates their private IPs to the Elastic IP, which clients can whitelist. This ensures consistent outbound IPs without exposing the instances to inbound traffic.

Exam trap

The trap here is that candidates confuse inbound static IPs (NLB with Elastic IPs) with outbound static IPs, or mistakenly think Elastic IPs on instances work in private subnets without a NAT device.

How to eliminate wrong answers

Option A is wrong because assigning Elastic IPs to EC2 instances in a private subnet does not provide outbound internet access; Elastic IPs only work for instances in public subnets with an internet gateway, and private subnets lack a direct route to the internet. Option B is wrong because an internet-facing NLB with Elastic IPs handles inbound traffic, not outbound; it cannot provide a static source IP for outbound connections initiated by the instances. Option C is wrong because a VPC endpoint is used for private connectivity to AWS services (e.g., S3, DynamoDB) over the AWS network, not for general outbound internet traffic to external clients.

Full explanation →
827
MCQhard

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to add a new CIDR block 10.1.0.0/16 to accommodate more subnets. The VPC already has multiple subnets and route tables. What is the impact of adding this secondary CIDR?

A.The secondary CIDR will be automatically advertised to all route tables.
B.Existing subnets and route tables remain unchanged; new subnets can be created in the new CIDR.
C.The VPC will experience a brief outage while the new CIDR is being associated.
D.Existing subnets will automatically be extended to include IPs from the new CIDR.
AnswerB

Secondary CIDRs do not affect existing resources.

Why this answer

Adding a secondary CIDR block to an existing VPC is a non-disruptive operation. The existing subnets and route tables remain completely unchanged because the secondary CIDR is an additional IP address space, not a modification of the existing one. New subnets can be created within the new CIDR block, and you must explicitly associate them with route tables as needed.

Exam trap

AWS often tests the misconception that adding a secondary CIDR automatically propagates to route tables or extends existing subnets, when in fact it requires manual route table updates and new subnet creation.

How to eliminate wrong answers

Option A is wrong because secondary CIDRs are not automatically advertised to route tables; you must explicitly add routes for the new CIDR to each route table where it is needed. Option C is wrong because adding a secondary CIDR does not cause any outage or disruption to the VPC or its existing resources. Option D is wrong because existing subnets are not automatically extended; they are tied to their original CIDR block, and new subnets must be created in the new CIDR range.

Full explanation →
828
MCQeasy

A company needs to resolve DNS names for their EC2 instances using custom domain names like "app.example.com". Which AWS service should they use?

A.AWS Cloud Map
B.AWS Directory Service
C.Amazon Route 53
D.Amazon Cognito
AnswerC

Managed DNS service.

Why this answer

Amazon Route 53 is a scalable DNS web service that can resolve custom domain names like 'app.example.com' to EC2 instance IP addresses. It supports private hosted zones for VPCs, enabling DNS resolution for internal resources without exposing them to the internet, and integrates with EC2 via alias records or health checks.

Exam trap

The trap here is that candidates confuse AWS Cloud Map's service discovery capabilities with DNS resolution, but Cloud Map is designed for dynamic service endpoints (e.g., ECS tasks) and does not natively resolve arbitrary custom domain names like 'app.example.com' without Route 53.

How to eliminate wrong answers

Option A is wrong because AWS Cloud Map is a service for service discovery that manages dynamic resource mappings (e.g., for microservices), not a DNS resolver for custom domain names; it relies on Route 53 for DNS resolution. Option B is wrong because AWS Directory Service provides managed Microsoft Active Directory or LDAP-based directory services for authentication and authorization, not DNS resolution for custom domain names. Option D is wrong because Amazon Cognito is an identity and access management service for user sign-up, sign-in, and federation, not a DNS service.

Full explanation →
829
MCQeasy

A company wants to use Amazon Route 53 to resolve DNS queries for a domain they own. They want to ensure that DNS queries are answered quickly and that there is no single point of failure. Which configuration should they use?

A.Deploy Route 53 in multiple AWS Regions.
B.Create a hosted zone and let Route 53 automatically handle the DNS resolution.
C.Create multiple hosted zones in separate AWS accounts.
D.Create a single hosted zone and assign it to one Route 53 name server.
AnswerB

Route 53 is inherently highly available.

Why this answer

When you create a hosted zone in Route 53, AWS automatically provisions four authoritative name servers (NS records) distributed across multiple globally redundant data centers. This design inherently provides high availability and low-latency DNS resolution without any additional configuration, as Route 53 uses Anycast routing to direct queries to the nearest healthy name server.

Exam trap

The trap here is that candidates may think Route 53 is a regional service like EC2 or RDS, leading them to choose Option A, or they may mistakenly believe that creating multiple hosted zones or accounts increases redundancy, when in fact a single hosted zone with its four automatically assigned name servers already provides full fault tolerance and low latency.

How to eliminate wrong answers

Option A is wrong because Route 53 is a global service, not a regional one; deploying it in multiple AWS Regions is not possible or necessary, as the service already operates from multiple edge locations worldwide via Anycast. Option C is wrong because creating multiple hosted zones in separate AWS accounts does not improve DNS resolution speed or fault tolerance; it only adds administrative complexity and potential synchronization issues, as each hosted zone would be authoritative for the same domain, causing conflicts. Option D is wrong because a single hosted zone is automatically assigned to four Route 53 name servers, not one; assigning it to a single name server would create a single point of failure and violate DNS best practices (RFC 1034/1035 require multiple authoritative servers).

Full explanation →
830
Multi-Selecteasy

A company is setting up AWS Site-to-Site VPN for connectivity between its on-premises network and AWS VPC. They want to ensure the VPN tunnel is highly available. Which THREE components should be configured? (Choose THREE.)

Select 3 answers
A.A single VPN connection with one tunnel
B.BGP dynamic routing over the VPN tunnels
C.Static routing instead of BGP
D.Two VPN tunnels per VPN connection
E.A second customer gateway device on-premises
AnswersB, D, E

Correct; BGP allows automatic failover between tunnels.

Why this answer

Options B, D, and E are correct. BGP dynamic routing enables automatic failover between VPN tunnels, ensuring high availability. Two VPN tunnels per VPN connection provide redundant paths in case one tunnel fails.

A second customer gateway device on-premises eliminates the single point of failure at the on-premises side. Option A is incorrect because a single tunnel does not provide redundancy. Option C is incorrect because static routing does not support automatic failover like BGP does.

Full explanation →
831
Multi-Selectmedium

A company is designing a hybrid network using AWS Direct Connect. The company has a single 1 Gbps dedicated connection and wants to connect to multiple VPCs in the same region. Which THREE steps are necessary to achieve this connectivity?

Select 3 answers
A.Create a Direct Connect gateway.
B.Create a private virtual interface for each VPC.
C.Create a public virtual interface for each VPC.
D.Attach the VPCs to the transit gateway.
E.Create a transit virtual interface and associate it with a transit gateway.
AnswersA, D, E

A Direct Connect gateway can connect to multiple VPCs.

Why this answer

A Direct Connect gateway acts as a central hub that allows a single private virtual interface to connect to multiple VPCs in the same or different AWS regions. Without a Direct Connect gateway, a private virtual interface can only connect to a single VPC. By using a Direct Connect gateway, you can associate it with multiple VPCs (either directly or via a transit gateway), enabling the desired multi-VPC connectivity over the single 1 Gbps dedicated connection.

Exam trap

The trap here is that candidates often confuse the need for multiple private virtual interfaces (one per VPC) with the correct architecture, not realizing that a Direct Connect gateway combined with a transit gateway enables a single private virtual interface to serve multiple VPCs, and that a transit virtual interface is required to connect the Direct Connect gateway to the transit gateway.

Full explanation →
832
MCQhard

A company has a hub-and-spoke network architecture using AWS Transit Gateway. The hub VPC contains a central inspection appliance (NVA) for traffic inspection. Spoke VPCs are attached to the Transit Gateway and have routes pointing to the Transit Gateway for all traffic. The Transit Gateway has a default route table that routes traffic to the NVA for inspection. Recently, the network team noticed that traffic between two spoke VPCs is not being inspected. The team verified that the Transit Gateway route tables are correctly configured and that the NVA is healthy. What should the team do to ensure that inter-spoke traffic is inspected?

A.Configure route propagation in the Transit Gateway route tables to propagate routes from the spoke attachments
B.Enable VPC Flow Logs on the spoke VPCs to capture traffic
C.Add static routes in the spoke VPC route tables pointing to the NVA
D.Increase the bandwidth of the Transit Gateway attachments
AnswerA

Propagation ensures that spoke routes are learned and traffic is forwarded to the NVA for inspection.

Why this answer

Configuring route propagation in the Transit Gateway route tables from the spoke attachments allows the Transit Gateway to learn the specific CIDR blocks of each spoke VPC. With these routes, the Transit Gateway can forward inter-spoke traffic to the NVA for inspection. Option B is incorrect because VPC Flow Logs only capture traffic logs and do not affect routing.

Option C is incorrect because adding static routes in the spoke VPC route tables pointing to the NVA would bypass the Transit Gateway and break the hub-and-spoke design. Option D is incorrect because bandwidth increase does not address the routing issue.

Full explanation →
833
MCQmedium

A company is deploying a new VPC with both public and private subnets. The public subnet hosts an internet-facing Application Load Balancer (ALB), and the private subnet hosts EC2 instances running a web application. The EC2 instances need to download updates from the internet, but they must not be directly accessible from the internet. Which combination of steps should a network engineer implement to meet these requirements?

A.Create a NAT Gateway in a public subnet, and add a default route (0.0.0.0/0) to the NAT Gateway in the private subnet's route table.
B.Launch a proxy server in the public subnet and configure the private instances to use it for outbound traffic.
C.Set up a VPN connection to an on-premises network and route all internet traffic through the VPN.
D.Attach an Internet Gateway to the VPC and add a default route (0.0.0.0/0) to the Internet Gateway in the private subnet's route table.
AnswerA

This allows outbound internet access while blocking inbound connections.

Why this answer

A NAT Gateway in a public subnet allows EC2 instances in private subnets to initiate outbound traffic to the internet (e.g., for updates) while preventing any unsolicited inbound connections from the internet. Adding a default route (0.0.0.0/0) to the NAT Gateway in the private subnet's route table directs all outbound internet traffic through the NAT Gateway, which translates the private IPs to the NAT Gateway's Elastic IP. This meets the requirement of internet access for downloads without direct internet accessibility.

Exam trap

AWS often tests the misconception that an Internet Gateway in a private subnet's route table provides outbound-only access, but in reality, an Internet Gateway enables bidirectional traffic, making instances publicly reachable if they have public IPs or if the route is present.

How to eliminate wrong answers

Option B is wrong because a proxy server in the public subnet is an alternative but not the simplest or most AWS-native solution; it adds management overhead and a single point of failure, whereas a NAT Gateway is fully managed and highly available. Option C is wrong because a VPN connection to an on-premises network routes traffic through the corporate network, which does not provide direct internet access for the EC2 instances unless the on-premises network itself has internet connectivity and is configured to forward traffic, adding unnecessary complexity and latency. Option D is wrong because attaching an Internet Gateway and adding a default route to it in the private subnet's route table would make the EC2 instances directly accessible from the internet (since the Internet Gateway allows bidirectional traffic), violating the requirement that they must not be directly accessible.

Full explanation →
834
Multi-Selecteasy

Which TWO of the following are valid options for implementing network segmentation in a VPC?

Select 2 answers
A.Security Groups
B.Subnets
C.Route Tables
D.NAT Gateway
E.Internet Gateway
AnswersA, B

Security groups act as virtual firewalls for instances.

Why this answer

Security Groups (A) are stateful virtual firewalls that operate at the instance level (ENI), allowing you to control inbound and outbound traffic based on rules. They are a valid mechanism for network segmentation because you can assign different Security Groups to different instances or groups of instances to isolate traffic between tiers (e.g., web, app, database). Subnets (B) provide network segmentation at the VPC subnet level by dividing the VPC's IP address range into smaller segments, each associated with a specific Availability Zone and route table, enabling logical separation of resources.

Exam trap

AWS often tests the misconception that Route Tables or NAT Gateways provide segmentation, but they are routing and translation services, not access control boundaries; the trap is confusing traffic direction with traffic filtering.

Full explanation →
835
Multi-Selecthard

Which TWO of the following are characteristics of an AWS Network Load Balancer (NLB)?

Select 2 answers
A.Supports SSL offloading
B.Supports routing based on HTTP headers
C.Preserves the source IP address of the client
D.Operates at Layer 7 of the OSI model
E.Can handle millions of requests per second
AnswersC, E

NLB preserves the client IP.

Why this answer

Network Load Balancers operate at Layer 4 and preserve the client source IP address by default. When a client sends a request, the NLB forwards the packet with the original source IP intact, unlike Application Load Balancers which replace it with their own IP. This is critical for applications that require client IP logging or security filtering.

Exam trap

The trap here is that candidates confuse the capabilities of Network Load Balancers with Application Load Balancers, assuming NLBs support Layer 7 features like SSL offloading or HTTP header routing, when in fact NLBs are strictly Layer 4 devices.

Full explanation →
836
Multi-Selectmedium

Which TWO actions should a network engineer take to troubleshoot a BGP session that is not establishing between an on-premises router and AWS Direct Connect? (Select TWO.)

Select 2 answers
A.Verify that the BGP ASN configured on the customer router matches the one provided by AWS.
B.Increase the MTU on the customer router interface.
C.Ensure that the virtual interface is in the 'available' state.
D.Verify that the peer IP addresses on both sides are correct and reachable.
E.Check that the Direct Connect connection is in the 'available' state.
AnswersA, D

Mismatched ASN prevents BGP session establishment.

Why this answer

Common BGP issues include incorrect BGP ASN, incorrect peer IP addresses, missing authentication, and firewall rules blocking TCP port 179. Verifying these settings on both sides is key.

Full explanation →
837
MCQmedium

A company has a VPC with a CIDR block of 10.0.0.0/16. They have two subnets: subnet-A (10.0.1.0/24) and subnet-B (10.0.2.0/24). An EC2 instance in subnet-A needs to communicate with an RDS database in subnet-B. Both subnets are in the same Availability Zone. What is the most efficient way to enable this communication?

A.Create a Transit Gateway and attach both subnets to it.
B.Place a NAT Gateway in subnet-A and configure route tables accordingly.
C.No additional configuration is required. The instance and database can communicate within the same VPC.
D.Create a VPC Peering connection between the two subnets.
AnswerC

VPC internal routing allows communication between subnets in the same VPC.

Why this answer

Both the EC2 instance and the RDS database reside within the same VPC (10.0.0.0/16), and subnets within a VPC can communicate with each other by default using the VPC's local route. No additional configuration is needed, as the VPC's main route table or subnet route tables already include a local route for the VPC CIDR, enabling direct communication within the same Availability Zone.

Exam trap

The trap here is that candidates may overthink the scenario and assume that different subnets require additional networking components like a Transit Gateway or VPC Peering, forgetting that subnets within the same VPC inherently have local connectivity via the VPC's route table.

How to eliminate wrong answers

Option A is wrong because a Transit Gateway is used to connect multiple VPCs or on-premises networks, not to enable communication between subnets within the same VPC, which already have native connectivity. Option B is wrong because a NAT Gateway is used to provide outbound internet access to instances in private subnets, not to enable communication between two subnets within the same VPC; it would add unnecessary complexity and cost. Option D is wrong because VPC Peering is used to connect two different VPCs, not subnets within the same VPC; subnets in the same VPC already communicate via the local route.

Full explanation →
838
MCQmedium

A company is implementing an AWS Client VPN endpoint to provide remote access to its VPC resources. The company's on-premises network uses a split-tunneling configuration to route only corporate traffic through the VPN. The Client VPN endpoint is associated with a single subnet in the VPC. Users report that they can connect to the Client VPN but cannot reach resources in the VPC. The Client VPN endpoint's security group allows all traffic. What is the MOST likely cause of this issue?

A.The security group associated with the Client VPN endpoint does not allow inbound traffic from the client CIDR.
B.The authorization rules do not grant access to the target subnets.
C.The route table of the subnet where the Client VPN endpoint is attached does not have a route to the VPC CIDR.
D.The Client VPN endpoint is configured with full-tunneling instead of split-tunneling.
AnswerC

Without a route, traffic from clients won't reach VPC resources.

Why this answer

The Client VPN endpoint is attached to a subnet. For clients to reach resources in the VPC, the subnet's route table must have a route to the VPC CIDR. Without this route, traffic from the VPN clients cannot reach the VPC resources, even though the VPN connection is established.

Option A is incorrect because the security group for the Client VPN endpoint already allows all traffic, so inbound rules are not the issue. Option B is incorrect because authorization rules control access to specific target networks, but the fundamental routing issue prevents any traffic from reaching the VPC. Option D is incorrect because split-tunneling is about routing client traffic; the routing issue here is on the AWS side, not the client side.

Full explanation →
839
MCQmedium

A company wants to connect multiple VPCs across different AWS Regions using AWS Transit Gateway. Which feature allows the VPCs to communicate with each other using private IP addresses without creating peering connections?

A.AWS Direct Connect gateway
B.AWS PrivateLink
C.Transit Gateway inter-Region peering
D.VPC Peering
AnswerC

Transit Gateway supports inter-Region peering for transitive routing between VPCs across Regions.

Why this answer

Transit Gateway inter-Region peering allows VPCs in different AWS Regions to communicate using private IP addresses through a central Transit Gateway, without requiring individual VPC peering connections. This feature uses the AWS global network to route traffic between peered Transit Gateways, enabling cross-region connectivity with a hub-and-spoke architecture.

Exam trap

The trap here is that candidates may confuse Transit Gateway inter-Region peering with VPC Peering, assuming VPC Peering is the only way to connect VPCs across regions, but Transit Gateway provides a scalable, centralized alternative without the need for full-mesh peering.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect gateway is used to connect on-premises networks to AWS via Direct Connect, not to connect VPCs across regions. Option B is wrong because AWS PrivateLink enables private connectivity to services via Network Load Balancers and interface VPC endpoints, but it does not provide routing between multiple VPCs. Option D is wrong because VPC Peering requires creating individual peering connections between each pair of VPCs, which does not scale and does not use a central Transit Gateway.

Full explanation →
840
MCQeasy

A company uses AWS Client VPN to provide remote access to its corporate network. Users report that they can connect to the VPN but cannot reach resources in the VPC. The VPN is configured with mutual authentication and authorization rules. What should the network engineer verify first?

A.The security group associated with the VPN endpoint allows inbound traffic from the client CIDR
B.The server certificate is valid and trusted by the client
C.The client CIDR range does not overlap with the VPC CIDR
D.The authorization rules grant access to the target network
AnswerD

Authorization rules are required to allow traffic to the VPC.

Why this answer

AWS Client VPN uses authorization rules to control which groups of clients can access specific target networks (e.g., subnets in the VPC). Even if the VPN connection is established, without proper authorization rules granting access to the target network, traffic will not be forwarded to the VPC resources. Option A is incorrect because the security group associated with the VPN endpoint controls inbound traffic to the endpoint itself, not traffic between clients and VPC resources.

Option B is incorrect because if the client can connect, the server certificate is valid and trusted. Option C is incorrect because while overlapping CIDR ranges can cause routing issues, the fact that the connection succeeds indicates that the client CIDR range is valid and does not overlap with the VPC CIDR.

Full explanation →
841
MCQmedium

An organization is migrating to AWS and needs to connect multiple VPCs in different AWS regions using a hub-and-spoke topology. The hub VPC will host centralized services. Which solution is most cost-effective and provides high throughput?

A.Deploy a software VPN appliance in the hub VPC and connect each spoke VPC with VPN tunnels.
B.Create VPC peering connections between the hub VPC and each spoke VPC.
C.Establish Direct Connect connections from each VPC to a central on-premises location.
D.Set up AWS Transit Gateway with attachments to each VPC.
AnswerB

VPC peering is cost-effective and high throughput for hub-and-spoke across regions.

Why this answer

VPC peering connections provide high-throughput, low-latency connectivity between VPCs using the AWS global network, with no bandwidth limits and no single point of failure. For a hub-and-spoke topology with a limited number of VPCs, VPC peering is the most cost-effective solution as it incurs no hourly or per-GB data transfer charges beyond standard inter-region data transfer costs, unlike Transit Gateway which has hourly attachment fees. This makes it ideal for organizations migrating to AWS that need simple, direct connectivity without the complexity or cost of additional appliances or transit infrastructure.

Exam trap

The trap here is that candidates often choose AWS Transit Gateway (Option D) because it is explicitly marketed for hub-and-spoke topologies, but they overlook the cost implications for small-scale deployments where VPC peering is more cost-effective and provides equivalent throughput.

How to eliminate wrong answers

Option A is wrong because deploying a software VPN appliance in the hub VPC introduces a single point of failure, adds latency due to encryption/decryption overhead, and incurs ongoing costs for the EC2 instance and licensing, making it less cost-effective and lower throughput than native AWS peering. Option C is wrong because Direct Connect connections from each VPC to a central on-premises location would require each VPC to have its own Direct Connect virtual interface and associated router, which is extremely expensive, complex to manage, and does not directly connect VPCs to each other—it forces traffic through on-premises, adding latency and defeating the purpose of a cloud-native hub-and-spoke topology. Option D is wrong because AWS Transit Gateway, while designed for hub-and-spoke architectures, incurs hourly attachment fees per VPC and per-GB data transfer charges, making it more expensive than VPC peering for a small number of VPCs; it is only cost-effective at scale (e.g., hundreds of VPCs) or when centralized routing policies are required.

Full explanation →
842
MCQmedium

A company has a VPC with public and private subnets. The private subnets need outbound internet access for software updates. The company wants to ensure that traffic from private subnets uses a single, highly available IP address for outbound traffic. Which solution meets these requirements?

A.Deploy a single EC2 instance configured as a NAT instance in a public subnet.
B.Configure a fleet of proxy servers in an Auto Scaling group with a Network Load Balancer.
C.Create a NAT gateway in a public subnet and route traffic from private subnets to it.
D.Use a VPC endpoint for Amazon S3 to access software updates.
AnswerC

NAT gateway is managed, highly available, and provides a single Elastic IP.

Why this answer

A NAT gateway provides managed, highly available outbound internet access for private subnets using a single elastic IP address. It is deployed in a public subnet and automatically handles failover within an Availability Zone, meeting the requirement for a single, highly available IP for outbound traffic.

Exam trap

The ANS-C01 exam often tests the misconception that a single NAT instance or a proxy fleet with an NLB can provide both high availability and a single outbound IP, but the trap here is that a NAT gateway is the only managed service that inherently combines high availability with a single elastic IP for outbound traffic without additional configuration.

How to eliminate wrong answers

Option A is wrong because a single EC2 instance configured as a NAT instance is a single point of failure and does not provide high availability; it also requires manual management and lacks automatic failover. Option B is wrong because a fleet of proxy servers with a Network Load Balancer introduces unnecessary complexity and does not guarantee a single outbound IP address (the NLB preserves client IPs by default, and proxy servers may use multiple IPs unless explicitly configured). Option D is wrong because a VPC endpoint for Amazon S3 only provides private connectivity to S3, not general outbound internet access for software updates from other sources.

Full explanation →
843
MCQeasy

A network engineer is troubleshooting intermittent connectivity issues between two VPCs that are peered. The VPC peering connection is in the 'active' state. ICMP ping from an instance in VPC A to an instance in VPC B fails intermittently. What is the most likely cause?

A.The network ACLs are blocking ICMP traffic.
B.The security groups on the instances do not allow inbound ICMP.
C.The VPC peering connection is not in the 'active' state.
D.The route tables in one or both VPCs lack routes to the peer VPC's CIDR via the peering connection.
AnswerD

Intermittent issues could be due to route propagation delays, but typical cause is missing routes.

Why this answer

Since the VPC peering connection is active, the issue is likely that the route tables in one or both VPCs are not correctly configured to route traffic to the peered VPC's CIDR via the peering connection. Without proper routes, traffic is dropped.

Full explanation →
844
Multi-Selecteasy

Which TWO of the following are required to establish an AWS Site-to-Site VPN connection? (Select TWO.)

Select 2 answers
A.Direct Connect gateway
B.Virtual private gateway
C.Customer gateway
D.Transit gateway
E.VPN connection
AnswersB, C

AWS-side endpoint for the VPN.

Why this answer

A virtual private gateway (VGW) is required as the AWS-side endpoint for the VPN tunnel; it anchors the encrypted IPsec session and routes traffic from the VPC to the on-premises network. The customer gateway (CGW) represents the on-premises VPN device in AWS, providing the public IP and BGP ASN (for dynamic routing) or static route configuration needed to establish the tunnel. Both are mandatory components of an AWS Site-to-Site VPN connection.

Exam trap

AWS often tests the misconception that a transit gateway is required for Site-to-Site VPN, but it is only needed when connecting multiple VPCs or using advanced routing features; a simple VPN to a single VPC only needs a VGW and CGW.

Full explanation →
845
Multi-Selecthard

A company is designing a multi-account AWS environment using AWS Transit Gateway. They want to centralize network management and ensure that VPCs in different accounts can communicate. Which THREE steps are required to achieve this? (Select THREE.)

Select 3 answers
A.Create a Transit Gateway in the central networking account
B.Use AWS Resource Access Manager (RAM) to share the Transit Gateway with other accounts
C.Create a separate Transit Gateway in each account and peer them together
D.Create a Transit Gateway route table and associate VPC attachments
E.Create a VPC peering connection between each VPC and the Transit Gateway
AnswersA, B, D

A central Transit Gateway is created in the networking account.

Why this answer

The Transit Gateway must be created in a central networking account to serve as the hub for all VPC traffic. This centralizes routing and simplifies network management across the multi-account environment.

Exam trap

The trap here is that candidates might think each account needs its own Transit Gateway (Option C) or that VPC peering is required to connect to the Transit Gateway (Option E), when in fact a single shared Transit Gateway with VPC attachments is the correct approach.

Full explanation →
846
Multi-Selecteasy

A company needs to log all network traffic to and from EC2 instances for security analysis. Which TWO services can capture this data? (Choose 2)

Select 2 answers
A.AWS Config
B.VPC Flow Logs
C.AWS CloudTrail
D.Traffic Mirroring
E.Amazon CloudWatch Logs
AnswersB, D

VPC Flow Logs capture metadata about network traffic.

Why this answer

Options B and D are correct. VPC Flow Logs capture metadata (IP addresses, ports, protocols) about network traffic. Traffic Mirroring captures actual packet content for deep packet inspection.

Option A (AWS Config) is incorrect because it records configuration changes, not network traffic. Option C (AWS CloudTrail) is incorrect because it logs API calls, not network traffic. Option E (Amazon CloudWatch Logs) is incorrect because it is for log storage and monitoring, not for capturing network traffic.

Full explanation →
847
MCQeasy

A company has an existing VPC with a public subnet and a private subnet. The company launches an EC2 instance in the private subnet. The instance needs to access an S3 bucket to download software updates. The company does not want the instance to have a public IP address. The company creates a VPC endpoint for S3 (Gateway type) in the VPC, and associates it with the private subnet route table by adding a route for the S3 prefix list. However, the instance still cannot access the S3 bucket. The security group for the instance allows all outbound traffic. The network ACL for the private subnet allows all inbound and outbound traffic. What is the MOST likely reason for the connectivity failure?

A.The network ACL is blocking the traffic
B.The security group does not allow outbound HTTPS traffic
C.The VPC endpoint policy does not grant access to the S3 bucket
D.The instance does not have a route to the internet
AnswerC

Correct; the endpoint policy may be restrictive.

Why this answer

The most likely reason is that the VPC endpoint policy does not grant access to the S3 bucket. Even though the Gateway VPC Endpoint is created and associated with the private subnet route table, the endpoint's policy controls which S3 buckets and actions are allowed. If the policy is too restrictive (e.g., default deny or does not explicitly allow access to the specific bucket), traffic will be dropped at the endpoint, preventing the instance from downloading updates.

The security group and network ACL are already permissive, and internet access is not required because the Gateway endpoint uses AWS's private network.

Exam trap

AWS often tests the misconception that a Gateway VPC Endpoint automatically grants access to all S3 buckets once the route is added, ignoring that the endpoint policy must explicitly allow the desired S3 actions and resources.

How to eliminate wrong answers

Option A is wrong because the network ACL for the private subnet allows all inbound and outbound traffic, so it is not blocking anything. Option B is wrong because the security group allows all outbound traffic (including HTTPS), so outbound HTTPS is permitted. Option D is wrong because the instance does not need a route to the internet; a Gateway VPC Endpoint for S3 provides connectivity to S3 over the AWS private network without requiring internet access.

Full explanation →
848
Multi-Selecthard

A company is migrating a legacy application to AWS. The application uses multicast traffic between servers. The company needs to support multicast in the AWS VPC. Which TWO solutions can the network engineer recommend? (Choose TWO.)

Select 2 answers
A.Deploy a third-party virtual firewall or router that supports multicast inside the VPC.
B.Use VPC endpoints for multicast support.
C.Use VPC peering connections to allow multicast traffic between VPCs.
D.Use a transit gateway with multicast domain configuration.
E.Use AWS Direct Connect to extend the on-premises multicast domain.
AnswersA, D

Virtual appliances can handle multicast routing.

Why this answer

A third-party virtual firewall or router appliance (e.g., from vendors like Palo Alto Networks or Cisco) can be deployed in the VPC and configured to forward multicast traffic using protocols such as IGMP and PIM. This allows the legacy application to continue using multicast within the VPC without native AWS multicast support. Option D is correct because AWS Transit Gateway now supports multicast domains, enabling you to create a multicast group and associate subnets, allowing multicast traffic to flow between attached VPCs and VPN connections.

Exam trap

The trap here is that candidates often assume VPC peering or Direct Connect can carry multicast traffic, but AWS explicitly blocks multicast and broadcast at the hypervisor level, so only Transit Gateway multicast domains or third-party appliances can solve this requirement.

Full explanation →
849
MCQmedium

A network engineer is configuring a Site-to-Site VPN connection between an on-premises network and AWS. The VPN tunnel status shows 'UP' but traffic is not passing. The engineer checks the route tables and finds that the VPC route table has a route pointing to the virtual private gateway for the on-premises CIDR. What is the most likely missing configuration?

A.The VPC route table does not have a route for the on-premises CIDR pointing to the virtual private gateway
B.The security group of the EC2 instances does not allow inbound traffic from on-premises
C.The VPN tunnel is using the wrong pre-shared key
D.The on-premises router is not advertising the VPC CIDR over BGP
AnswerB

Correct. Security groups are stateful and must allow inbound traffic from the on-premises network. Without this rule, traffic can reach the VPC but will be blocked at the instance level.

Why this answer

Since the VPN tunnel status is 'UP', the pre-shared key and Phase 2 parameters are correctly configured. With the VPC route table already pointing to the virtual private gateway for the on-premises CIDR, the most likely missing configuration is that the security group associated with the EC2 instances in the VPC does not allow inbound traffic from the on-premises network. Security groups act as a virtual firewall for instances, and inbound traffic from on-premises must be explicitly allowed.

Option A is incorrect because the stem states the route exists. Option C is incorrect because a tunnel UP status confirms the pre-shared keys match. Option D is less likely because even if the on-premises router is not advertising the VPC CIDR, that would affect return traffic but not necessarily all traffic; also the question does not specify BGP usage.

Full explanation →
850
MCQmedium

A company is designing a multi-region architecture with VPCs in us-east-1 and eu-west-1. The company needs low-latency connectivity between the VPCs and wants to avoid traffic over the public internet. The VPCs have overlapping CIDR blocks (10.0.0.0/16). Which solution should the network engineer recommend?

A.Set up an AWS Transit Gateway in each region and connect them via Transit Gateway peering.
B.Use a Direct Connect connection between the regions.
C.Use VPC peering between the two VPCs.
D.Place all resources in a single VPC with multiple Availability Zones.
AnswerA

This is correct. Although not the most optimal solution (Transit Gateway peering would be ideal), a VPN attachment between Transit Gateways can provide private connectivity between regions, even with overlapping CIDRs, by using separate route tables per VPC attachment.

Why this answer

AWS Transit Gateway supports inter-region peering, which uses the AWS global backbone to provide low-latency, private connectivity between VPCs in different regions without traversing the public internet. This solution also handles overlapping CIDRs by using separate route tables per VPC attachment, ensuring isolation. Option B (Direct Connect) is used for on-premises connectivity, not inter-region.

Option C (VPC peering) does not support overlapping CIDRs. Option D (single VPC) does not meet the multi-region requirement.

Exam trap

Candidates may mistakenly think that VPN attachments are required for inter-region connectivity, but Transit Gateway peering is the native, low-latency solution that avoids the public internet. They may also confuse Transit Gateway peering with VPC peering, which cannot handle overlapping CIDRs.

How to eliminate wrong answers

Option B is wrong because Direct Connect is a dedicated connection from on-premises to AWS, not between AWS regions; it does not provide inter-region VPC connectivity. Option C is wrong because VPC peering requires non-overlapping CIDR blocks; with overlapping 10.0.0.0/16 CIDRs, peering is impossible as it would cause routing conflicts and AWS explicitly prohibits peering with overlapping ranges. Option D is wrong because the requirement is for a multi-region architecture, and placing all resources in a single VPC with multiple Availability Zones only provides high availability within one region, not cross-region connectivity.

Full explanation →
851
MCQeasy

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to add an IPv6 CIDR block to the VPC. Which action should they take?

A.Request an IPv6 CIDR block from your regional internet registry and associate it with the VPC.
B.Enable IPv6 on the subnets directly without associating a VPC CIDR.
C.Manually assign a /56 IPv6 CIDR block to the VPC.
D.Associate an Amazon-provided IPv6 CIDR block with the VPC.
AnswerD

Amazon provides a /56 block from their pool.

Why this answer

Amazon VPC supports IPv6 through an Amazon-provided IPv6 CIDR block that is automatically allocated from Amazon's pool of global unicast addresses. You cannot bring your own IPv6 CIDR or manually assign one; the only supported method is to associate an Amazon-provided /56 IPv6 CIDR block with the VPC. This enables dual-stack networking, allowing resources to communicate over both IPv4 and IPv6.

Exam trap

The trap here is that candidates assume they can bring their own IPv6 address space (like with IPv4) or manually configure the CIDR, but AWS only supports Amazon-provided IPv6 CIDR blocks for VPCs.

How to eliminate wrong answers

Option A is wrong because AWS does not support bringing your own IPv6 CIDR from a regional internet registry; you must use an Amazon-provided IPv6 block. Option B is wrong because IPv6 cannot be enabled on subnets without first associating an IPv6 CIDR block with the VPC; subnets inherit the VPC's IPv6 CIDR. Option C is wrong because you cannot manually assign a /56 IPv6 CIDR; AWS automatically allocates the /56 block from its own pool when you request an Amazon-provided IPv6 CIDR.

Full explanation →
852
MCQeasy

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. They want to add a second Direct Connect connection for redundancy. What is the MINIMUM number of virtual interfaces required to achieve active-active failover for the VPC?

A.Two transit virtual interfaces (one on each connection)
B.One private virtual interface and one transit virtual interface
C.Two private virtual interfaces (one on each connection)
D.One private virtual interface
AnswerC

Correct; two VIFs allow BGP to provide active-active failover.

Why this answer

For active-active failover to a VPC using Direct Connect, you need at least two private virtual interfaces (VIFs), one on each Direct Connect connection. This allows both connections to be used simultaneously for traffic load balancing, and if one fails, the other can carry all traffic. Option C is correct because it specifies two private VIFs.

Option A (two transit VIFs) is incorrect because transit VIFs connect to a Direct Connect Gateway, not directly to a VPC. Option B (one private and one transit) is incorrect because transit VIFs do not provide direct VPC connectivity, and mixing types does not help. Option D (one private VIF) lacks redundancy.

Full explanation →
853
MCQmedium

A security engineer needs to block traffic from a specific country from reaching an Application Load Balancer. Which AWS service should be used to accomplish this?

A.Network ACLs on the VPC subnet
B.Security groups associated with the ALB
C.Route 53 Resolver DNS Firewall
D.AWS WAF web ACL associated with the ALB
AnswerD

AWS WAF supports geo-match conditions to block traffic from specific countries.

Why this answer

AWS WAF can be associated with an Application Load Balancer to create web ACLs with geographic match conditions, enabling geo-blocking. Option A (Network ACLs) is incorrect because NACLs operate at the subnet level and do not support geo-blocking. Option B (Security groups) is incorrect because security groups do not support geo-blocking.

Option C (Route 53 Resolver DNS Firewall) is incorrect because it filters DNS queries, not HTTP traffic. Option D (AWS WAF web ACL associated with the ALB) is correct because WAF supports geographic match conditions to block traffic from specific countries.

Full explanation →
854
MCQeasy

A company has a VPC with an Application Load Balancer (ALB) in front of a fleet of EC2 instances. The security group for the EC2 instances must allow traffic only from the ALB. Which source should be specified in the security group inbound rule?

A.The ALB's public IP address
B.The subnet CIDR block of the ALB's subnets
C.The ID of the ALB's security group
D.The VPC CIDR block
AnswerC

Referencing the ALB's security group as a source ensures only traffic from the ALB is allowed.

Why this answer

You can reference the ALB's security group ID as the source in the EC2 instances' security group inbound rule. This allows traffic from any network interface that is associated with the ALB's security group, regardless of the ALB's IP addresses or subnets. This is the recommended AWS best practice for controlling traffic between an ALB and its target instances, as it automatically adapts to changes in the ALB's underlying infrastructure.

Exam trap

The trap here is that candidates often assume they need to use the ALB's IP addresses or subnet CIDR, not realizing that AWS security groups can reference other security groups as a source, which is the most secure and scalable method for this scenario.

How to eliminate wrong answers

Option A is wrong because the ALB does not have a single public IP address; it uses a fully qualified domain name (FQDN) that resolves to multiple public IP addresses that can change over time. Option B is wrong because specifying the subnet CIDR block of the ALB's subnets would allow traffic from any resource in those subnets, not just the ALB, violating the principle of least privilege. Option D is wrong because the VPC CIDR block would allow traffic from any resource in the entire VPC, including other EC2 instances or services, not just the ALB.

Full explanation →
855
MCQeasy

A network engineer is analyzing VPC Flow Logs for a VPC with CIDR 10.0.0.0/16. The exhibit shows a sample log entry. The engineer notices that traffic from 10.0.1.10 to 10.0.2.10 on port 443 is being accepted. However, the application team reports that the connection is failing. What is the most likely reason for the disconnect?

A.The security groups are blocking the traffic.
B.The route tables are incorrectly configured, causing packet loss.
C.The flow logs are misconfigured and not capturing all traffic.
D.The application layer is failing to establish a proper connection.
AnswerD

Flow logs only show network-level acceptance; application issues are not captured.

Why this answer

The VPC Flow Logs show that traffic from 10.0.1.10 to 10.0.2.10 on port 443 is being accepted (ACCEPT record), which indicates that the network layer (security groups, network ACLs, and routing) is permitting the traffic. Since the application team reports the connection is failing, the issue must be at a higher layer, specifically the application layer (e.g., TLS handshake failure, certificate mismatch, or the application not listening on port 443). Flow logs capture only network-layer metadata (IP, port, protocol, action) and cannot detect application-layer errors.

Exam trap

AWS often tests the distinction between network-layer acceptance (ACCEPT in flow logs) and application-layer success, trapping candidates who assume an ACCEPT record guarantees a successful connection.

How to eliminate wrong answers

Option A is wrong because if security groups were blocking the traffic, the flow log entry would show a REJECT or DROP action, not ACCEPT. Option B is wrong because incorrect route tables would cause packet loss or unreachability, which would also result in DROP or no flow log entry for the destination, not an ACCEPT record. Option C is wrong because the flow log entry is present and shows ACCEPT, indicating the logs are capturing traffic correctly; misconfiguration would result in missing or incomplete logs, not a false ACCEPT.

Full explanation →
856
MCQhard

A company is designing a multi-region active-active architecture using Application Load Balancers (ALBs) and AWS Global Accelerator. The application must have the lowest possible latency for global users. Which design meets these requirements?

A.Use AWS Global Accelerator with endpoints in both regions and configure traffic dials to distribute traffic.
B.Use Amazon CloudFront with multiple origins pointing to each ALB.
C.Use Amazon Route 53 with latency routing policy to route users to the closest ALB.
D.Use AWS Global Accelerator with a single endpoint in one region and failover to the other region.
AnswerA

Global Accelerator provides anycast IPs and can distribute traffic across multiple regions with traffic dials.

Why this answer

AWS Global Accelerator uses the Anycast static IP addresses to route traffic over the AWS global network to the optimal endpoint based on health, latency, and traffic dials. By configuring endpoints in both regions with traffic dials, you can distribute traffic actively across both regions, ensuring the lowest possible latency for global users by directing them to the nearest healthy endpoint.

Exam trap

The trap here is that candidates often confuse DNS-based routing (Route 53 latency routing) with anycast-based routing (Global Accelerator), not realizing that DNS caching and propagation delays prevent true real-time, lowest-latency routing for active-active architectures.

How to eliminate wrong answers

Option B is wrong because Amazon CloudFront is a content delivery network (CDN) optimized for caching static and dynamic content at edge locations, not for accelerating TCP/UDP traffic to ALBs with active-active multi-region load balancing; it adds an extra hop and does not provide the same low-latency, anycast-based routing for non-HTTP(S) workloads. Option C is wrong because Amazon Route 53 latency routing policy operates at the DNS level, which introduces DNS caching and propagation delays, and cannot route traffic based on real-time network conditions or provide fast failover for active-active architectures; it also does not offer static IP addresses. Option D is wrong because using a single endpoint in one region with failover to the other region creates an active-passive architecture, not active-active, which means users are always routed to the primary region unless it fails, increasing latency for users far from that region and failing to meet the requirement for lowest possible latency for global users.

Full explanation →
857
MCQmedium

A company is deploying a new application in a VPC that uses a single Availability Zone. The application consists of an Application Load Balancer (ALB) in a public subnet and EC2 instances in a private subnet. The EC2 instances need to send logs to an Amazon S3 bucket. The company has created a VPC gateway endpoint for S3 and associated it with the route table for the private subnet. The EC2 instances have an instance profile that grants access to the S3 bucket. However, the log delivery fails. The network team has verified that the route table for the private subnet includes a route to the S3 prefix list via the gateway endpoint. What is the MOST likely cause of the failure?

A.The route table does not have a route to the S3 prefix list.
B.The VPC endpoint is not configured with private DNS.
C.The security group on the EC2 instances does not allow outbound traffic to the S3 prefix list.
D.The VPC endpoint policy does not allow the PutObject action on the S3 bucket.
AnswerD

Correct: Endpoint policy must allow the action.

Why this answer

The most likely cause is that the VPC endpoint policy does not allow the PutObject action on the S3 bucket. Even though the route table has a route to the S3 prefix list via the gateway endpoint and the EC2 instance profile grants access, the endpoint policy acts as an additional layer of authorization. If the endpoint policy does not explicitly allow the s3:PutObject action for the target bucket, requests will be denied, causing the log delivery to fail.

Exam trap

The trap here is that candidates often assume that if routing is correct and the instance has IAM permissions, the request will succeed, overlooking that the VPC endpoint policy is a separate authorization layer that must explicitly allow the action.

How to eliminate wrong answers

Option A is wrong because the network team has verified that the route table includes a route to the S3 prefix list via the gateway endpoint, so routing is correctly configured. Option B is wrong because private DNS is only relevant for interface endpoints (which use private IP addresses and DNS resolution), not for gateway endpoints, which do not support private DNS. Option C is wrong because security groups do not filter traffic to prefix lists for gateway endpoints; gateway endpoints use route tables for routing and security groups apply to traffic at the instance level, but outbound traffic to the S3 prefix list is not blocked by a security group since the traffic is routed through the endpoint and not through a NAT or internet gateway.

Full explanation →
858
MCQhard

A company attaches the above bucket policy to an S3 bucket. A user from the IP range 203.0.113.0/24 makes a request over HTTPS (TLS) to download an object from the bucket. Will the request succeed?

A.Yes, but only if the request also includes a valid AWS signature.
B.No, because the Allow statement is overridden by the Deny statement.
C.No, because the Deny statement denies all requests regardless of the condition.
D.Yes, because the request uses HTTPS and comes from the allowed IP range.
AnswerD

The Deny only blocks non-HTTPS requests, and the Allow permits the IP range.

Why this answer

The bucket policy includes an Allow statement that grants s3:GetObject access to requests coming from the IP range 203.0.113.0/24 over HTTPS (using the aws:SecureTransport condition). The Deny statement only denies requests that do not use HTTPS (i.e., aws:SecureTransport equals false), so a request from the allowed IP range using TLS is not affected by the Deny and is permitted by the Allow statement.

Exam trap

AWS often tests the nuance that an explicit Deny only applies when its conditions are fully satisfied, and candidates mistakenly assume any Deny statement automatically blocks all requests regardless of conditions.

How to eliminate wrong answers

Option A is wrong because the policy does not require a valid AWS signature; the Allow statement uses only IP address and HTTPS conditions, and anonymous requests from the allowed IP range over HTTPS are permitted without authentication. Option B is wrong because the Deny statement does not override the Allow statement for this request; the Deny only applies when aws:SecureTransport is false, which is not the case for an HTTPS request. Option C is wrong because the Deny statement does not deny all requests; it is conditional on the request not using HTTPS, so requests over HTTPS are not denied.

Full explanation →
859
MCQhard

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. They have a VPC with a CIDR of 10.0.0.0/16 attached to the transit gateway. They also have a Direct Connect virtual interface attached to the transit gateway. The on-premises network can reach some VPCs but not the VPC with CIDR 10.0.0.0/16. The transit gateway route table has a static route for the on-premises CIDR and a route propagation from the VPC attachment. What is the most likely issue?

A.The transit gateway has reached the maximum number of attachments
B.The VPC CIDR overlaps with the on-premises CIDR
C.The transit gateway route table does not have a route to the on-premises network
D.The VPC attachment is not associated with the transit gateway route table
AnswerB

Overlapping CIDRs cause routing issues in a transit gateway.

Why this answer

The most likely issue is that the VPC CIDR (10.0.0.0/16) overlaps with the on-premises CIDR. When CIDR blocks overlap, the transit gateway cannot distinguish between destinations in the VPC and on-premises, leading to routing conflicts. This explains why the on-premises network can reach other VPCs with non-overlapping CIDRs but not this VPC.

The static route for the on-premises CIDR and the propagated route from the VPC attachment both exist in the transit gateway route table, but the overlap causes the transit gateway to forward traffic inconsistently or drop it. Options A, C, and D are incorrect: A) The transit gateway has no such attachment limit; C) The route table does have a route to the on-premises network via the static route; D) The VPC attachment is associated and propagating routes.

Full explanation →
860
Multi-Selecteasy

A company is setting up a new VPC and needs to ensure that instances in the VPC can resolve DNS names within AWS (e.g., ec2-203-0-113-25.compute-1.amazonaws.com). Which TWO configurations are required? (Select TWO.)

Select 2 answers
A.Set the VPC's 'enableDnsSupport' attribute to true
B.Set the VPC's 'enableDnsHostnames' attribute to true
C.Configure the Amazon Route 53 Resolver to forward queries to the VPC DNS
D.Create a public hosted zone in Amazon Route 53 and associate it with the VPC
E.Create a custom DHCP option set with the domain-name-servers option set to the VPC DNS IP
AnswersA, B

This enables DNS resolution through the Amazon DNS server.

Why this answer

Setting the VPC's 'enableDnsSupport' attribute to true (Option A) ensures that the VPC uses the Amazon-provided DNS server (the VPC DNS Resolver at the base VPC CIDR +2 address) to resolve DNS queries. This is required for instances to resolve public AWS DNS names like ec2-203-0-113-25.compute-1.amazonaws.com, as the VPC DNS Resolver handles both public and private DNS resolution within AWS.

Exam trap

The ANS-C01 exam often tests the misconception that enabling only 'enableDnsSupport' is sufficient, but the trap here is that 'enableDnsHostnames' must also be set to true for instances to receive and resolve public DNS hostnames, making both attributes required for the described scenario.

Full explanation →
861
MCQmedium

Refer to the exhibit. A VPC endpoint for S3 is created as a Gateway endpoint. The route tables rtb-11111111 and rtb-22222222 are associated with the endpoint. An EC2 instance in a subnet associated with rtb-11111111 cannot access S3 via the endpoint. What is the most likely cause?

A.The route table rtb-11111111 does not have a route to the S3 prefix list with the target as the VPC endpoint.
B.The endpoint policy denies access to S3 from the instance's IAM role.
C.The security group on the EC2 instance does not allow outbound traffic to the S3 prefix list.
D.The VPC does not have DNS resolution enabled for the endpoint.
AnswerA

Without this route, traffic to S3 does not go through the endpoint.

Why this answer

A Gateway VPC Endpoint for S3 works by adding a route in the subnet's route table that points the S3 prefix list (com.amazonaws.region.s3) to the endpoint ID (vpce-xxx). Without this specific route, traffic destined for S3 from the subnet associated with rtb-11111111 will follow the default route (e.g., an Internet Gateway or NAT Gateway) instead of being routed through the endpoint. Since the endpoint is only associated with rtb-11111111 and rtb-22222222, but rtb-11111111 lacks the required prefix list route, traffic from that subnet cannot reach S3 via the endpoint.

Exam trap

The ANS-C01 exam often tests the distinction between associating a route table with a Gateway Endpoint and actually adding the route to the S3 prefix list — candidates mistakenly think association alone is sufficient, but the route entry is mandatory for traffic to flow through the endpoint.

How to eliminate wrong answers

Option B is wrong because an endpoint policy controls access based on the IAM principal and S3 actions, but the question states the instance cannot access S3 at all, which is a routing issue, not a policy denial; a policy denial would typically result in an AccessDenied error, not a complete inability to reach S3. Option C is wrong because security groups do not filter traffic to a prefix list; they filter based on IP addresses or CIDR blocks, and S3 prefix lists resolve to multiple IP ranges, but the fundamental issue is that traffic is not even being routed to the endpoint, not that it is blocked by a security group rule. Option D is wrong because DNS resolution for a Gateway Endpoint is not required; Gateway Endpoints use prefix lists and route tables, not DNS names — DNS resolution is relevant for Interface Endpoints (e.g., for services like DynamoDB or API Gateway) where private DNS names are used.

Full explanation →
862
MCQmedium

A company is designing a multi-region application with Amazon RDS for MySQL as the primary database. The application requires read-after-write consistency across regions. Which design should the company choose to meet this requirement?

A.Use Amazon RDS with cross-Region replication enabled using MySQL binary log
B.Use Amazon RDS Multi-AZ deployments in each region with read replicas
C.Use Amazon Aurora Global Database with cluster endpoints in each region
D.Use Amazon RDS with synchronous replication across regions
AnswerC

Aurora Global Database uses dedicated replication infrastructure with typical latency under 1 second and supports read-after-write consistency via global transaction IDs.

Why this answer

Amazon Aurora Global Database is the correct choice because it provides dedicated cluster endpoints in each region that automatically route write traffic to the primary region and read traffic to local replicas, ensuring read-after-write consistency through its storage-layer replication with typical latency under 1 second. Unlike standard RDS cross-Region replication, Aurora Global Database uses a physical storage-based replication mechanism that guarantees global consistency without relying on MySQL binary logs, which can introduce replication lag and potential inconsistency.

Exam trap

AWS often tests the misconception that standard RDS cross-Region replication (Option A) can provide read-after-write consistency, but the trap is that MySQL binary log replication is inherently asynchronous and cannot guarantee global consistency, whereas Aurora Global Database's storage-level replication is designed specifically for this purpose.

How to eliminate wrong answers

Option A is wrong because cross-Region replication using MySQL binary log is asynchronous and can introduce significant replication lag, making it impossible to guarantee read-after-write consistency across regions. Option B is wrong because Multi-AZ deployments provide high availability within a single region only and do not support cross-Region read replicas for global consistency; read replicas in other regions would still be asynchronous. Option D is wrong because Amazon RDS does not support synchronous replication across regions; synchronous replication would require a custom solution and would introduce unacceptable latency over inter-region distances.

Full explanation →
863
Multi-Selectmedium

A company is designing a multi-account AWS environment using AWS Organizations. They need to enforce that all new S3 buckets created across accounts have encryption enabled and block public access. Which TWO approaches meet these requirements? (Choose two.)

Select 2 answers
A.Apply a service control policy (SCP) to the root organizational unit that denies s3:PutBucketPublicAccessBlock and s3:PutBucketEncryption if the configuration does not meet requirements.
B.Use an S3 bucket policy that denies all principals unless encryption is enabled.
C.Create an AWS Config conformance pack with rules that check for encryption and public access, and auto-remediate non-compliant buckets.
D.Enable AWS CloudTrail to monitor bucket creation and send alerts to the security team.
E.Create an IAM role in each account that requires MFA for creating S3 buckets.
AnswersA, C

Correct: SCPs can deny non-compliant actions across accounts.

Why this answer

SCPs can be applied to the root OU to deny s3:PutBucketPublicAccessBlock and s3:PutBucketEncryption unless the bucket meets encryption and public access requirements, thus enforcing the policy organization-wide. Option C is correct because AWS Config conformance packs can include managed rules to detect buckets without encryption or with public access, and automatic remediation actions can be configured to fix non-compliant buckets. Option B is incorrect because an S3 bucket policy only applies to a single bucket and cannot enforce requirements across all buckets in all accounts; it also cannot prevent creation of buckets that don't meet the policy.

Option D is incorrect because CloudTrail only provides logging and alerting; it does not enforce or remediate. Option E is incorrect because an IAM role with MFA requirement does not enforce encryption or public access settings on buckets; it only controls who can create buckets.

Full explanation →
864
Multi-Selecthard

A company is designing a network for a critical application that requires an SLA of 99.99% availability. The application runs on EC2 instances in an Auto Scaling group across three Availability Zones. The company needs to ensure that the network design meets the SLA. Which THREE components should the company include? (Choose THREE.)

Select 3 answers
A.A single AWS Direct Connect connection for all inbound traffic.
B.A NAT gateway in each Availability Zone for outbound internet access.
C.A single AWS Site-to-Site VPN connection for administrative access.
D.VPC endpoints for AWS services used by the application.
E.An Application Load Balancer (ALB) configured to route traffic to instances in all three Availability Zones.
AnswersB, D, E

NAT gateways per AZ eliminate single point of failure.

Why this answer

A NAT gateway in each Availability Zone ensures that outbound internet traffic remains within the same AZ, preventing cross-AZ data transfer costs and avoiding a single point of failure. This design supports the 99.99% SLA by maintaining high availability for outbound connectivity, as each AZ can independently handle its own traffic without relying on a shared resource.

Exam trap

The ANS-C01 exam often tests the misconception that a single Direct Connect or VPN connection is sufficient for high availability, but the trap here is that 99.99% SLA requires redundancy at every layer, including network connectivity, so a single connection is a single point of failure regardless of its reliability.

Full explanation →
865
MCQmedium

A company wants to ensure that all traffic to and from its Amazon EC2 instances in a VPC is inspected by a third-party security appliance. The instances are in private subnets and must maintain their private IP addresses. Which solution should be used?

A.Deploy a Transit Gateway with a site-to-site VPN to the appliance
B.Configure a Gateway Load Balancer and Gateway Load Balancer endpoints in the VPC
C.Use VPC Peering to connect to a central inspection VPC
D.Set up a Network Load Balancer in front of the instances
AnswerB

Gateway Load Balancer with GWLBe allows transparent inline inspection of traffic.

Why this answer

Gateway Load Balancer (GWLB) with Gateway Load Balancer endpoints (GWLBe) allows you to insert third-party appliances inline for traffic inspection without changing the instances' private IP addresses. The GWLB acts as a transparent layer between the VPC and the appliance, inspecting all traffic. Option A is incorrect because a Transit Gateway with a site-to-site VPN does not provide inline inspection without modifying the routing and IP addresses.

Option C is incorrect because VPC Peering does not inherently provide traffic inspection; you would still need to route traffic through an appliance. Option D is incorrect because a Network Load Balancer is designed for load balancing, not for inline inspection of all traffic.

Full explanation →
866
Matchingmedium

Match each AWS networking monitoring or troubleshooting tool to its primary purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Capture IP traffic information for security and troubleshooting

Monitor network performance metrics like throughput and latency

Test network path between two resources and identify configuration issues

Copy network traffic for content inspection or security analysis

Trace requests through distributed applications, including network calls

Why these pairings

The correct matches are: VPC Flow Logs ↔ IP traffic capture, AWS CloudWatch Logs ↔ centralized log monitoring, AWS CloudTrail ↔ API activity recording. Common confusions include swapping VPC Flow Logs with CloudTrail, or CloudWatch Logs with VPC Reachability Analyzer.

Full explanation →
867
Multi-Selectmedium

A company is designing a highly available architecture for a web application using an Application Load Balancer (ALB) in multiple Availability Zones. Which TWO configurations are required to achieve high availability?

Select 2 answers
A.The ALB must be configured with subnets in at least two Availability Zones
B.The ALB must be internet-facing
C.At least three EC2 instances must be registered with the ALB
D.A NAT gateway must be deployed in each Availability Zone
E.Cross-zone load balancing must be enabled on the ALB
AnswersA, B

Multiple AZs provide redundancy.

Why this answer

The ALB must be configured with subnets in at least two Availability Zones to remain available if one AZ fails. Option B is correct because an internet-facing ALB is required to accept traffic from the internet; an internal ALB would not be accessible. Option C is incorrect because high availability does not require three instances; two instances (one per AZ) can provide high availability.

Option D is incorrect because NAT gateways are not required for ALB high availability; they are used for outbound internet access from private subnets. Option E is incorrect because cross-zone load balancing is enabled by default, but it is not a requirement for high availability; high availability is achieved by having instances in multiple AZs.

Full explanation →
868
Multi-Selectmedium

A network engineer is troubleshooting high latency on a Direct Connect connection. The engineer wants to use monitoring tools to identify the source of the latency. Which two AWS services can provide metrics and logs to help diagnose the issue? (Choose TWO.)

Select 2 answers
A.AWS CloudTrail
B.AWS Config
C.Amazon CloudWatch
D.AWS Trusted Advisor
E.VPC Flow Logs
AnswersC, E

Provides Direct Connect metrics.

Why this answer

The correct answers are C (Amazon CloudWatch) and E (VPC Flow Logs). CloudWatch provides metrics for Direct Connect, including connection state, BGP status, packet loss, and latency. VPC Flow Logs capture IP traffic information that can be analyzed to identify latency patterns.

Option A (AWS CloudTrail) is incorrect because it logs API calls, not network metrics. Option B (AWS Config) is incorrect because it tracks configuration changes. Option D (AWS Trusted Advisor) is incorrect because it provides recommendations, not real-time metrics or logs.

Full explanation →
869
Multi-Selectmedium

A company is deploying a new application that requires low latency between EC2 instances. Which THREE placement group strategies should the network engineer consider?

Select 3 answers
A.Cross-zone load balancing
B.Spread placement group
C.Availability Zone placement group
D.Partition placement group
E.Cluster placement group
AnswersB, D, E

Spreads instances across distinct hardware for high availability.

Why this answer

The correct placement group strategies are Cluster placement group (lowest latency, highest throughput), Spread placement group (protects against hardware failures by placing instances on distinct racks), and Partition placement group (reduces likelihood of correlated failures for large distributed and replicated workloads). Option A (Cross-zone load balancing) is a feature of Elastic Load Balancing, not a placement group. Option C (Availability Zone placement group) is not a valid placement group type.

Full explanation →
870
MCQeasy

A company wants to securely connect an on-premises data center to a VPC in AWS. The connection must be encrypted and use the public internet. The company has a moderate volume of traffic and needs a quick setup. Which solution meets these requirements?

A.AWS Client VPN
B.AWS Transit Gateway
C.AWS Site-to-Site VPN
D.AWS Direct Connect
AnswerC

Site-to-Site VPN provides encrypted tunnels over the internet and can be set up quickly.

Why this answer

AWS Site-to-Site VPN creates an encrypted IPSec tunnel over the public internet and can be set up quickly. Option A is wrong because AWS Client VPN is for individual client connections, not site-to-site. Option B is wrong because AWS Transit Gateway is a network transit hub, not a connection method.

Option D is wrong because AWS Direct Connect provides a dedicated private connection, not over the public internet.

Full explanation →
871
Multi-Selecteasy

Which TWO of the following are valid methods to connect an on-premises network to an Amazon VPC? (Select TWO.)

Select 2 answers
A.AWS Direct Connect
B.AWS Site-to-Site VPN
C.VPC peering connection
D.VPC endpoint
E.Internet Gateway
AnswersA, B

Provides a dedicated private connection.

Why this answer

AWS Direct Connect provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet for consistent latency and higher bandwidth. This is a valid method for connecting an on-premises network to a VPC, as it establishes a direct physical link that can be associated with a virtual interface to a VPC.

Exam trap

The ANS-C01 exam often tests the misconception that VPC peering or VPC endpoints can be used for on-premises connectivity, but these services are strictly for inter-VPC or service-to-VPC communication within AWS, not for extending an on-premises network.

Full explanation →
872
MCQhard

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to initiate outbound connections to the internet for software updates. The company wants to ensure that all outbound traffic goes through a single, highly available IP address for whitelisting purposes. Which solution should be used?

A.Launch a NAT instance in a public subnet and assign an Elastic IP. Configure the private subnet route table to point to the NAT instance.
B.Create an internet gateway and attach it to the private subnet, then configure the route table.
C.Create a VPC endpoint for Amazon S3 and route software update traffic through that endpoint.
D.Create a NAT gateway in each Availability Zone and assign the same Elastic IP to both.
AnswerA

Correct. A NAT instance with an Elastic IP provides a single IP for outbound traffic. It can be placed in a public subnet and configured as a route target for the private subnet, allowing instances to initiate outbound connections to the internet.

Why this answer

A NAT instance in a public subnet with an Elastic IP provides a single, stable IP address for outbound traffic from the private subnet. By configuring the private subnet route table to point to the NAT instance, all outbound internet traffic goes through that instance. While not inherently highly available across Availability Zones, the solution meets the core requirement of a single IP for whitelisting and can be made more resilient using Auto Scaling and instance recovery.

Exam trap

The question asks for a 'single, highly available IP address' for whitelisting. While NAT gateways offer high availability, they do not support sharing the same Elastic IP across multiple gateways. A NAT instance, though not fully highly available by default, can still serve as a single IP solution and may be improved with Auto Scaling.

Full explanation →
873
MCQeasy

A company needs to block traffic from a specific IP address range in their VPC. Which component should be used?

A.Route table
B.Network ACL
C.Internet gateway
D.Security group
AnswerB

NACLs can deny traffic from specific IP ranges.

Why this answer

Network ACLs are stateless and can explicitly deny traffic from specific IP address ranges at the subnet level. Option A is wrong because route tables control the path of network traffic, not filtering. Option C is wrong because an internet gateway provides internet connectivity but does not filter traffic.

Option D is wrong because security groups are stateful and can only allow traffic, not deny specific IP ranges.

Full explanation →
874
Multi-Selecthard

A company has a multi-account AWS environment using AWS Organizations. The network team wants to centralize VPC traffic inspection using a Transit Gateway and a firewall appliance in a central account. Which THREE steps are required to implement this design? (Choose THREE.)

Select 3 answers
A.Create a VPC peering connection between each spoke VPC and the central VPC.
B.Create a Transit Gateway in the central account and attach the central VPC.
C.Accept the Transit Gateway share in each spoke account and attach their VPCs.
D.Deploy a firewall appliance in each spoke VPC.
E.Use AWS Resource Access Manager to share the Transit Gateway with spoke accounts.
AnswersB, C, E

Transit Gateway is the hub.

Why this answer

A Transit Gateway (TGW) in the central account acts as the hub for VPC traffic inspection. Attaching the central VPC (which contains the firewall appliance) to the TGW allows all inter-VPC traffic to be routed through the central inspection VPC, enabling centralized traffic inspection without requiring VPC peering or per-spoke firewalls.

Exam trap

AWS often tests the misconception that VPC peering can be used for transitive routing in a hub-and-spoke model, but the trap here is that VPC peering does not support transitive routing, so a Transit Gateway is required for centralized inspection across multiple VPCs.

Full explanation →
875
Multi-Selectmedium

Which TWO configuration steps are required to enable VPC Flow Logs to be published to an S3 bucket in a different AWS account? (Select TWO.)

Select 2 answers
A.Attach a resource-based policy to the S3 bucket that grants the source account's Flow Logs service permission to write.
B.Configure the Flow Logs destination as a CloudWatch Logs log group in the source account.
C.Create an IAM role in the source account with a trust policy that allows the Flow Logs service to assume it and grants s3:PutObject to the destination bucket.
D.Create an IAM user in the source account with programmatic access and share the access keys.
E.Enable S3 cross-account replication.
AnswersA, C

The bucket policy must allow cross-account writes.

Why this answer

To publish VPC Flow Logs to an S3 bucket in a different AWS account, two steps are required: (1) Attach a resource-based policy to the destination S3 bucket that grants the source account's Flow Logs service permission to write objects. This is option A. (2) Create an IAM role in the source account with a trust policy that allows the Flow Logs service to assume it and grants s3:PutObject permission to the destination bucket. This is option C.

Option B is incorrect because CloudWatch Logs in the source account would not enable cross-account delivery to S3. Option D is incorrect because sharing IAM user access keys is not a secure or supported method for cross-account flow logs. Option E is incorrect because S3 cross-account replication does not enable the Flow Logs service to write to the bucket.

Full explanation →
876
MCQmedium

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. It needs to connect to an on-premises data center over AWS Direct Connect. The on-premises network uses the 10.0.0.0/8 address space. The company cannot change the on-premises addressing. Which solution will allow connectivity without overlapping IP addresses?

A.Use VPC peering between the existing VPC and a new VPC with a non-overlapping CIDR, then route traffic through the new VPC.
B.Create a new VPC with a non-overlapping CIDR such as 172.16.0.0/16 and migrate resources.
C.Assign IPv6 CIDR to the existing VPC, use IPv6 for all resources, and connect over Direct Connect using IPv6.
D.Use AWS Transit Gateway with a Network Address Translation (NAT) attachment to translate the VPC CIDR.
AnswerC

IPv6 addresses do not overlap with the on-premises IPv4 space, providing unique addressing.

Why this answer

Assigning an IPv6 CIDR to the existing VPC and using IPv6 for all resources avoids the IPv4 address overlap with the on-premises 10.0.0.0/8 network. AWS Direct Connect supports both IPv4 and IPv6 traffic, so you can establish a BGP session over IPv6 and route IPv6 traffic between the VPC and on-premises, completely bypassing the conflicting IPv4 address space.

Exam trap

The trap here is that candidates assume Direct Connect only works with IPv4 or that overlapping IPv4 addresses can be resolved with NAT or Transit Gateway, but the exam tests the understanding that IPv6 is a clean way to avoid IPv4 overlap without changing the existing VPC CIDR.

How to eliminate wrong answers

Option A is wrong because VPC peering does not resolve IP address overlap; the existing VPC still uses 10.0.0.0/16, which overlaps with the on-premises 10.0.0.0/8, and routing through a new VPC does not change the fact that overlapping addresses cannot be communicated with directly. Option B is wrong because migrating resources to a new VPC with a non-overlapping CIDR (e.g., 172.16.0.0/16) is a valid long-term solution but does not allow connectivity without changing the existing VPC's addressing; the question asks for a solution that allows connectivity without overlapping IP addresses, and migration is a disruptive change, not a direct connectivity solution. Option D is wrong because AWS Transit Gateway does not have a 'NAT attachment'; NAT is typically implemented at the instance or gateway level (e.g., NAT gateway or instance), and Transit Gateway itself cannot perform network address translation between the VPC and on-premises networks.

Full explanation →
877
Multi-Selecthard

A company is designing a network architecture for a multi-tier web application. The application includes a public-facing Application Load Balancer (ALB) in a public subnet, web servers in private subnets, and an Amazon RDS database in a private subnet. The company requires that the database is not directly accessible from the application servers except through specific ports, and that traffic between the web servers and the database is encrypted. Which TWO actions should the company take to meet these requirements? (Choose two.)

Select 2 answers
A.Place the RDS database in a public subnet with a security group that allows only the web servers' IP addresses
B.Establish a VPC peering connection between the web servers' VPC and the RDS VPC
C.Enable SSL/TLS encryption for connections between the web servers and the RDS database
D.Configure a security group on the RDS instance that allows inbound traffic from the web servers' security group on the database port
E.Use a network ACL to restrict inbound traffic to the RDS subnet to only the web server's IP range
AnswersC, D

SSL/TLS encrypts data in transit, meeting the encryption requirement.

Why this answer

Enabling SSL/TLS encryption for connections between the web servers and the RDS database ensures that data in transit is encrypted, meeting the requirement for encrypted traffic. Option D is correct because configuring a security group on the RDS instance that allows inbound traffic from the web servers' security group on the database port provides a stateful, instance-level firewall rule that restricts direct access to only the web servers, without exposing the database to the public subnet or relying on IP-based rules.

Exam trap

AWS often tests the distinction between security groups (stateful, instance-level) and network ACLs (stateless, subnet-level), and candidates mistakenly choose network ACLs for fine-grained access control when security groups are the correct choice for allowing traffic based on source security group IDs.

Full explanation →
878
MCQeasy

A company uses VPC Flow Logs to monitor network traffic. The flow logs are published to Amazon S3. The security team wants to analyze the logs for suspicious traffic patterns using Amazon Athena. After creating the Athena table, queries return zero results. The logs are in the correct S3 bucket. What is the most likely cause?

A.The flow logs are encrypted with SSE-KMS and Athena does not have permission to decrypt
B.The Athena table is in a different AWS Glue database
C.The flow logs are in gzip format, which Athena does not support
D.The Athena table is not configured to read from the correct S3 partition structure
AnswerD

Partition structure must match the log location.

Why this answer

VPC Flow Logs are stored in a partitioned folder structure (e.g., AWSLogs/account-id/vpcflowlogs/region/year/month/day/). If the Athena table does not use partition projection or is not configured to read from the correct partition structure, queries return no data. Option A is wrong because SSE-KMS encryption can be used with Athena if proper permissions are granted.

Option B is wrong because the table can be in any AWS Glue database. Option C is wrong because Athena supports gzip format.

Full explanation →
879
Multi-Selecthard

A company is deploying a new VPC with public and private subnets. The VPC will host web servers in the public subnet and database servers in the private subnet. The web servers need to access the internet for updates, and the database servers need to receive traffic only from the web servers. Which THREE components are essential for this architecture?

Select 3 answers
A.NAT gateway in the public subnet
B.Network ACL for subnets
C.Internet gateway
D.VPC endpoint for S3
E.Security groups for web and database servers
AnswersB, C, E

Network ACLs are essential for subnet-level security, controlling traffic between public and private subnets.

Why this answer

An internet gateway (IGW) is essential to allow web servers in the public subnet to directly access the internet. Security groups are essential to control traffic between web and database servers, ensuring only web servers can access the database. Network ACLs are essential for subnet-level traffic control, such as allowing inbound traffic from the public subnet to the private subnet while denying other inbound traffic.

A NAT gateway is not essential because the database servers do not require outbound internet access (only web servers need internet for updates). A VPC endpoint for S3 is not essential as there is no requirement to access S3.

Exam trap

Candidates often mistakenly think a NAT gateway is required for the private subnet, but the database servers do not need internet access. Additionally, they may overlook Network ACLs as essential because security groups alone can allow traffic between web and database instances, but Network ACLs provide subnet-level control required by the architecture.

Full explanation →
880
Multi-Selecthard

A company is setting up a Site-to-Site VPN connection between an on-premises network and AWS. The VPN tunnel is established, but traffic is not flowing. Which THREE configuration items should be checked?

Select 3 answers
A.Route tables in the VPC and on-premises router.
B.Security group rules for the EC2 instances.
C.NAT gateway configuration in the VPC.
D.Network ACL rules for the subnets.
E.Internet gateway attachment to the VPC.
AnswersA, B, D

Routes are required for traffic forwarding.

Why this answer

Route tables in both the VPC and the on-premises router must have entries directing traffic for the remote network (e.g., the on-premises CIDR in the VPC route table, and the VPC CIDR in the on-premises route table) toward the VPN gateway or the VPN tunnel interface. Without these routes, packets have no path to reach the other side, even if the tunnel itself is up. This is a fundamental requirement for any Site-to-Site VPN to forward traffic.

Exam trap

The trap here is that candidates assume a 'UP' tunnel status guarantees traffic flow, but AWS explicitly tests that routing, security groups, and network ACLs are separate layers that must all be correctly configured for end-to-end connectivity.

Full explanation →
881
MCQeasy

Refer to the exhibit. The bucket policy shown is applied to an S3 bucket. A VPC endpoint for S3 is created in a VPC with CIDR 10.0.0.0/16. An EC2 instance in the VPC tries to access an object in the bucket using the VPC endpoint. The request fails. What is the most likely reason?

A.The bucket policy does not allow s3:ListBucket.
B.The condition uses aws:SourceIp, which does not work with VPC endpoint traffic.
C.The EC2 instance does not have an IAM role that allows s3:GetObject.
D.The VPC endpoint does not have a route table associated with the instance's subnet.
AnswerB

aws:SourceIp is not applicable for VPC endpoint requests; use aws:SourceVpce instead.

Why this answer

The bucket policy uses the `aws:SourceIp` condition key, which is not supported for traffic originating from a VPC endpoint. When requests are made through a VPC endpoint, the source IP address is replaced by the endpoint's private IP, making `aws:SourceIp` ineffective. To restrict access based on the VPC endpoint, you must use the `aws:SourceVpce` or `aws:SourceVpc` condition keys instead.

Exam trap

The ANS-C01 exam often tests the distinction between `aws:SourceIp` (which works for internet-based traffic) and `aws:SourceVpce`/`aws:SourceVpc` (which are required for VPC endpoint traffic), trapping candidates who assume all condition keys work universally with VPC endpoints.

How to eliminate wrong answers

Option A is wrong because the request is for accessing an object (s3:GetObject), not listing the bucket (s3:ListBucket), so the absence of s3:ListBucket permission is irrelevant to the failure. Option C is wrong because the bucket policy itself denies the request based on the condition, so even if the EC2 instance had an IAM role allowing s3:GetObject, the explicit deny in the bucket policy would override it. Option D is wrong because a missing route table association would cause a connectivity failure (e.g., timeout), not an access denied error; the question states the request fails, which aligns with a policy denial rather than a routing issue.

Full explanation →
882
MCQmedium

A company uses AWS Direct Connect with a private VIF to connect to a VPC. The network team wants to monitor the bandwidth utilization of the Direct Connect connection in real time. Which AWS service should be used?

A.AWS CloudTrail
B.VPC Flow Logs
C.AWS Config
D.Amazon CloudWatch
AnswerD

CloudWatch provides Direct Connect metrics such as ConnectionBandwidthUtilization.

Why this answer

CloudWatch provides metrics for Direct Connect connections including bandwidth utilization. Option A is incorrect because CloudTrail logs API calls. Option B is incorrect because VPC Flow Logs capture traffic per interface, not aggregate bandwidth.

Option C is incorrect because AWS Config records configuration changes.

Full explanation →
883
MCQmedium

A company wants to securely connect an on-premises data center to a VPC using AWS Site-to-Site VPN. The security team requires that all traffic between the on-premises network and the VPC be encrypted and that the VPN tunnel be highly available. Which design BEST meets these requirements?

A.Use AWS Direct Connect with a private VIF and enable encryption on the connection.
B.Create a single VPN tunnel with a virtual private gateway and enable encryption.
C.Create two VPN tunnels to the same virtual private gateway for redundancy.
D.Create a VPN connection with two tunnels, each terminating on a different virtual private gateway in the same VPC.
AnswerC

Correct. Creating two VPN tunnels to the same virtual private gateway provides redundancy for the tunnels. The virtual private gateway is a highly available service, so this design meets both encryption and high availability requirements.

Why this answer

AWS Direct Connect with a private VIF does not inherently encrypt traffic; a VPN overlay would be required, and a single Direct Connect connection is not highly available. Option B is incorrect because a single VPN tunnel provides encryption but not high availability; if the tunnel fails, connectivity is lost. Option C is correct because a VPN connection with two tunnels to the same virtual private gateway provides redundancy for the tunnels, and the virtual private gateway is a highly available service within a region.

Option D is incorrect because an AWS VPC can only have one virtual private gateway; you cannot attach two virtual private gateways to the same VPC. The recommended design for high availability is to use a single VPN connection with two tunnels (Option C) or multiple VPN connections to different VPCs.

Exam trap

Candidates may think that high availability requires multiple virtual private gateways, but AWS only allows one virtual private gateway per VPC. The correct approach is to use two tunnels to the same virtual private gateway for redundancy.

Full explanation →
884
Multi-Selecteasy

A company is designing a VPC for a web application that requires high availability. The application will be deployed across multiple Availability Zones. Which THREE components are essential for a highly available network design? (Choose THREE.)

Select 3 answers
A.Subnets in at least two Availability Zones
B.A single VPN connection to on-premises
C.A NAT gateway in each Availability Zone
D.VPC peering with a backup VPC
E.An internet gateway attached to the VPC
AnswersA, C, E

Provides AZ redundancy.

Why this answer

Deploying subnets in at least two Availability Zones (AZs) ensures that if one AZ fails, the application can continue serving traffic from the other AZ. This is the foundational principle of high availability in AWS, as it provides fault isolation at the data center level. Without multi-AZ subnets, a single AZ failure would cause a complete outage.

Exam trap

The ANS-C01 exam often tests the misconception that a single VPN connection or VPC peering provides high availability, but in reality, these are single points of failure unless explicitly designed with redundancy (e.g., multiple VPN tunnels or multi-region peering).

Full explanation →
885
Multi-Selecteasy

A company wants to encrypt all data in transit between an Application Load Balancer (ALB) and its target EC2 instances. Which TWO actions should be taken?

Select 1 answer
A.Enable Client Certificate Authentication on the ALB
B.Configure the target group to use HTTPS as the protocol
C.Add a listener rule to forward traffic based on path
D.Configure the ALB listener to use HTTPS
E.Configure security groups to allow only HTTPS traffic
AnswersB

HTTPS target group ensures traffic from ALB to targets is encrypted.

Why this answer

To encrypt data in transit between an Application Load Balancer (ALB) and its target EC2 instances, only the target group protocol needs to be configured to use HTTPS (Option B). The ALB listener protocol (HTTPS) encrypts traffic between the client and the ALB, not between the ALB and targets, so Option D is not required for this specific goal. Option A is incorrect because Client Certificate Authentication is for mutual TLS between client and ALB.

Option C is incorrect because adding a listener rule based on path affects traffic routing, not encryption. Option E is incorrect because security group rules control access but do not encrypt traffic.

Full explanation →
886
MCQmedium

A company is designing a hybrid network architecture that connects multiple VPCs in different AWS regions to an on-premises data center. The company wants to minimize the number of VPN tunnels and reduce management overhead. Which AWS service should be used to simplify this design?

A.AWS Transit Gateway with VPN attachments
B.AWS Direct Connect with multiple virtual interfaces
C.AWS VPN CloudHub
D.VPC peering between each VPC and the on-premises network
AnswerA

Transit Gateway provides a central hub that can connect multiple VPCs and on-premises networks via VPN, reducing the number of connections and simplifying management.

Why this answer

AWS Transit Gateway with VPN attachments is correct because it acts as a central hub that connects multiple VPCs across different AWS regions and an on-premises data center through a single VPN connection. This minimizes the number of VPN tunnels by eliminating the need for individual VPN connections between each VPC and the on-premises network, and reduces management overhead through a single point of configuration and routing.

Exam trap

The trap here is that candidates often confuse VPC peering as a viable option for on-premises connectivity, not realizing that VPC peering only works between VPCs and cannot extend to an on-premises network, leading them to overlook the centralized hub-and-spoke model of Transit Gateway.

How to eliminate wrong answers

Option B is wrong because AWS Direct Connect with multiple virtual interfaces does not inherently reduce the number of VPN tunnels; it still requires separate VPN connections or complex routing for multi-region VPC connectivity, and does not provide a centralized hub for inter-VPC and on-premises traffic. Option C is wrong because AWS VPN CloudHub is designed for connecting multiple on-premises sites to AWS via VPN, but it does not natively support inter-VPC connectivity across different regions without additional configuration and still requires multiple VPN tunnels for each VPC. Option D is wrong because VPC peering between each VPC and the on-premises network is not supported; VPC peering only connects VPCs within AWS and cannot directly connect to an on-premises data center, requiring additional VPN or Direct Connect attachments for each VPC, which increases management overhead.

Full explanation →
887
MCQhard

A company has a Direct Connect connection with two private virtual interfaces (VIFs) to two different VPCs. The company wants to use the same Direct Connect connection for both VPCs, but the on-premises router only has one physical port. The network engineer configures a single BGP session over a VLAN-tagged interface. After configuration, only one VPC is reachable. What is the most likely reason?

A.The on-premises router is using the same BGP ASN for both VIFs, which is not allowed
B.The BGP peer IP addresses must be in the same subnet for both VIFs
C.The VLAN ID must be the same for both VIFs to work over a single physical port
D.Each private VIF requires a separate BGP session, and only one session was configured
AnswerD

Each VIF needs its own BGP session.

Why this answer

Each private VIF requires a separate BGP session. With only one BGP session configured, only one VIF can be established. Option A is incorrect because the same BGP ASN can be used on both VIFs if connecting through a Direct Connect gateway.

Option B is incorrect because the BGP peer IPs can be in different subnets. Option C is incorrect because each VIF requires a unique VLAN ID; they cannot share the same VLAN.

Full explanation →
888
MCQhard

A company has a VPC with multiple subnets and an AWS Transit Gateway. They have a requirement to inspect traffic between subnets using a third-party firewall appliance that is deployed in a centralized inspection VPC. The firewall appliance must process all traffic between the VPC subnets, including traffic between subnets in the same Availability Zone. Which routing configuration achieves this?

A.Create a VPC route table that routes all traffic (0.0.0.0/0) to the Transit Gateway.
B.Create a VPC route table that routes the VPC CIDR to the Transit Gateway and associate it with each subnet.
C.Use the main route table and add a route for the VPC CIDR to the Transit Gateway.
D.None of the options are correct.
AnswerD

Same as B and C but associates custom route tables with each subnet. The local route still overrides, so intra-VPC traffic remains local.

Why this answer

None of the provided routing configurations can achieve this requirement because the local route for the VPC CIDR in any VPC route table cannot be overridden. Therefore, intra-VPC traffic will always use the local route and will not be sent to the Transit Gateway. To inspect traffic between subnets within the same VPC, alternative architectures such as a Gateway Load Balancer or a Transit Gateway with VPC peering between different VPCs must be used.

Exam trap

Candidates often assume that adding a route for the VPC CIDR to a Transit Gateway will override the implicit local route, but this is not possible. Intra-VPC traffic remains local.

How to eliminate wrong answers

Option A is wrong because routing 0.0.0.0/0 to the Transit Gateway only directs internet-bound traffic, not traffic within the VPC CIDR, leaving inter-subnet traffic to use the default local route. Option C is wrong because using the main route table with a VPC CIDR route to the Transit Gateway would affect only subnets that are not explicitly associated with a custom route table, but subnets with explicit associations would ignore the main table, and the local route still takes precedence for intra-VPC traffic unless overridden. Option D is wrong because while it correctly associates custom route tables with subnets, the route for the VPC CIDR to the Transit Gateway must be added to each subnet's route table; simply associating a custom route table without that specific route does not redirect inter-subnet traffic.

Full explanation →
889
MCQmedium

A company is using AWS WAF to protect its web application. The security team notices that the WAF logs show a high number of requests from a specific IP address range that are being blocked by the SQL injection rule. However, the application team reports that legitimate users from that IP range are unable to access the application. Which action should the security team take to resolve this issue while maintaining security?

A.Disable the SQL injection rule for the specific IP range.
B.Increase the rate limit for the entire WAF.
C.Add the IP range to the allow list in the WAF.
D.Create a rate-based rule to limit requests from the IP range.
AnswerD

Creating a rate-based rule limits the request rate from the IP range, allowing legitimate traffic while still blocking excessive requests that may indicate an attack.

Why this answer

Creating a rate-based rule can limit the request rate from the specific IP range, allowing legitimate traffic while still blocking excessive requests that may be part of a SQL injection attempt. This maintains security by not outright allowing the IP range or disabling protections. Option A is wrong because disabling the SQL injection rule for the IP range removes protection against actual SQL injection attacks from that range.

Option B is wrong because increasing the rate limit for the entire WAF is not granular and may affect other traffic. Option C is wrong because adding the IP range to the allow list completely bypasses security, leaving the application vulnerable.

Full explanation →
890
Multi-Selectmedium

A company is designing a hybrid network using AWS Direct Connect. They need to ensure high availability and failover. Which THREE components should be deployed to meet these requirements?

Select 3 answers
A.A single AWS Direct Connect connection.
B.Two Customer Gateways (CGWs).
C.Two Virtual Private Gateways (VGWs).
D.Two AWS Direct Connect connections.
E.An AWS Site-to-Site VPN connection as backup.
AnswersB, C, D

Two CGWs provide on-premises redundancy.

Why this answer

To achieve high availability and failover with AWS Direct Connect, you need at least two Direct Connect connections (option D) to provide physical diversity and eliminate single points of failure. Additionally, you must deploy two Virtual Private Gateways (VGWs) (option C) to attach to separate Direct Connect Virtual Interfaces (VIFs) and enable active/active or active/passive routing. Finally, two Customer Gateways (CGWs) (option B) are required to terminate the BGP sessions from each Direct Connect connection, ensuring that if one CGW or connection fails, the other can take over traffic forwarding.

Exam trap

The trap here is that candidates often think a single Direct Connect connection with a VPN backup (option E) is sufficient for high availability, but the exam expects you to recognize that true high availability requires redundant physical connections and redundant BGP termination points (two VGWs and two CGWs) to avoid any single point of failure in the network path.

Full explanation →
891
Multi-Selecthard

A company needs to ensure that all outbound internet traffic from a VPC goes through a centralized inspection appliance. The VPC has multiple subnets. Which THREE steps are required to implement this?

Select 2 answers
A.Configure security groups to allow outbound traffic from the instances
B.Launch a NAT gateway in a public subnet and associate it with an Elastic IP
C.Attach an Internet Gateway to the VPC and route all traffic to it
D.Create VPC endpoints for all required AWS services
E.Configure route tables in each private subnet to send 0.0.0.0/0 traffic to a NAT gateway in a public subnet
AnswersA, B

Correct: Security groups must allow outbound traffic from instances so that traffic can exit.

Why this answer

To ensure all outbound internet traffic goes through a centralized inspection appliance, the required steps are: configure security groups to allow outbound traffic (Option A) and launch a NAT gateway in a public subnet with an Elastic IP (Option B) to provide outbound connectivity. The third step, which is not listed among the options, is to route private subnet traffic to the inspection appliance rather than directly to the NAT gateway. Option E is incorrect because routing 0.0.0.0/0 to a NAT gateway would bypass the inspection appliance, failing the requirement.

Full explanation →
892
MCQhard

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. The on-premises network uses BGP to advertise a route for 10.0.0.0/8. The VPC CIDR is 10.1.0.0/16. The company wants to ensure that all traffic from the VPC to on-premises uses the Direct Connect connection, but if the Direct Connect fails, traffic should fail over to a VPN connection. Which configuration achieves this?

A.Create a static route in the VPC route table pointing to the VPN with a metric of 100, and let BGP propagate the Direct Connect route.
B.Configure a BGP local preference of 200 on the Direct Connect VIF and 100 on the VPN connection, and use the same ASN for both.
C.Set the MED attribute on the Direct Connect VIF to 100 and on the VPN to 200.
D.Configure AS path prepend on the Direct Connect side to advertise a longer AS path.
AnswerB

Higher local preference is preferred; thus Direct Connect will be primary and VPN backup.

Why this answer

B is correct because BGP local preference is an administrative weight used to prefer one path over another within the same AS. By setting a higher local preference (200) on the Direct Connect VIF and a lower value (100) on the VPN, the on-premises router will prefer the Direct Connect path for outbound traffic. If the Direct Connect fails, the BGP session drops, and the VPN route with the lower local preference becomes active, providing failover.

Using the same ASN for both connections ensures the routes are compared as equal under BGP best-path selection.

Exam trap

The trap here is that candidates often confuse MED and local preference, incorrectly assuming MED controls outbound path selection, when in fact local preference is the correct attribute for influencing traffic leaving an AS, while MED influences inbound traffic from a neighboring AS.

How to eliminate wrong answers

Option A is wrong because a static route in the VPC route table with a higher metric does not influence BGP path selection on the on-premises side; the question requires controlling which path on-premises uses to send traffic back to the VPC, not the VPC's outbound routing. Option C is wrong because the MED (Multi-Exit Discriminator) attribute is used to influence inbound traffic from a neighboring AS, not outbound path selection from the on-premises router; setting MED on the Direct Connect VIF to 100 and VPN to 200 would actually make the VPN more preferred for inbound traffic to on-premises, which is the opposite of the desired behavior. Option D is wrong because AS path prepend makes a route less preferred by lengthening the AS path, so prepending on the Direct Connect side would make the Direct Connect path less attractive, causing traffic to prefer the VPN instead of using Direct Connect as the primary path.

Full explanation →
893
Drag & Dropmedium

Arrange the steps to configure VPC Flow Logs for a VPC and publish logs to CloudWatch Logs:

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First create the log group, then the IAM role, then the flow log, then verify, then analyze.

Full explanation →
894
Multi-Selecthard

A company is designing a multi-VPC architecture with AWS Transit Gateway. The security requirements include: (1) all inter-VPC traffic must be inspected by a central firewall, (2) traffic to the internet must egress through a centralized egress VPC, and (3) traffic to on-premises via Direct Connect must go through the same inspection firewall. Which THREE components are required to meet these requirements?

Select 3 answers
A.VPC peering connections between all VPCs
B.AWS Network Firewall in an inspection VPC
C.Virtual Private Gateway (VGW) attachment to the inspection VPC
D.NAT gateways in each VPC
E.AWS Transit Gateway with multiple route tables
AnswersB, C, E

Provides centralized traffic inspection.

Why this answer

The correct components are B, C, and E. Option B (AWS Network Firewall in an inspection VPC) provides the central firewall to inspect inter-VPC traffic. Option C (Virtual Private Gateway (VGW) attachment to the inspection VPC) enables on-premises Direct Connect traffic to be routed through the inspection VPC and firewall.

Option E (AWS Transit Gateway with multiple route tables) allows segmentation of traffic and ensures that inter-VPC traffic and traffic to/from on-premises is routed through the inspection VPC. Option A (VPC peering connections between all VPCs) is not needed because Transit Gateway provides the connectivity. Option D (NAT gateways in each VPC) is not required because internet egress is centralized through an egress VPC, not through individual NAT gateways.

Full explanation →
895
Multi-Selecteasy

A company is deploying a VPC with public and private subnets. They need to provide internet access to instances in the private subnets for software updates. Which THREE components are required to achieve this?

Select 3 answers
A.Route table in the private subnet with a default route pointing to the NAT Gateway
B.AWS Site-to-Site VPN connection
C.NAT Gateway in a public subnet
D.Internet Gateway attached to the VPC
E.AWS Direct Connect connection
AnswersA, C, D

The route table must direct traffic to the NAT Gateway for internet access.

Why this answer

A route table in the private subnet with a default route (0.0.0.0/0) pointing to a NAT Gateway ensures that outbound traffic from private instances destined for the internet is forwarded to the NAT Gateway. This allows instances in private subnets to initiate outbound connections for software updates while preventing any unsolicited inbound traffic from the internet.

Exam trap

The ANS-C01 exam often tests the misconception that a NAT Gateway alone provides internet access without an Internet Gateway, but the Internet Gateway is mandatory for the NAT Gateway to reach the internet; candidates may also incorrectly think a VPN or Direct Connect can substitute for internet access.

Full explanation →
896
Multi-Selecteasy

Which TWO components are required when configuring a transit gateway to connect multiple VPCs and an on-premises network via Direct Connect? (Choose 2)

Select 2 answers
A.Internet gateway (IGW)
B.Transit Gateway association with the Direct Connect gateway
C.Virtual private gateway (VGW)
D.Customer gateway (CGW)
E.Direct Connect gateway
AnswersB, E

Transit Gateway association with the Direct Connect gateway is required.

Why this answer

When using Transit Gateway with Direct Connect, you need a Direct Connect gateway, and the Transit Gateway must be associated with the Direct Connect gateway. A virtual private gateway (VGW) is not used with Transit Gateway; it is used with a VPC alone. A customer gateway is used for VPN, not Direct Connect.

An internet gateway is for public internet traffic.

Full explanation →
897
MCQeasy

A company is deploying a web application on EC2 instances behind an ALB. The application must be accessible only over HTTPS. Which security group rule should be added to the ALB security group?

A.Inbound: TCP port 22 from 0.0.0.0/0
B.Inbound: TCP port 443 from 0.0.0.0/0
C.Inbound: TCP port 3306 from 0.0.0.0/0
D.Inbound: TCP port 80 from 0.0.0.0/0
AnswerB

HTTPS uses port 443.

Why this answer

The ALB must terminate HTTPS traffic, which requires an inbound rule allowing TCP port 443 (HTTPS) from 0.0.0.0/0. This ensures clients can establish encrypted TLS connections to the load balancer, as the application is only accessible over HTTPS.

Exam trap

AWS often tests the distinction between the ALB's security group (which needs port 443 for HTTPS) and the EC2 instances' security group (which needs only the ALB's source security group), leading candidates to mistakenly choose port 80 (HTTP) or port 22 (SSH) for the ALB.

How to eliminate wrong answers

Option A is wrong because TCP port 22 (SSH) is used for remote administration of EC2 instances, not for web traffic to an ALB, and opening it to 0.0.0.0/0 would expose management interfaces unnecessarily. Option C is wrong because TCP port 3306 (MySQL) is a database port that should never be exposed to the internet from an ALB; database access should be restricted to application servers via private subnets. Option D is wrong because TCP port 80 (HTTP) would allow unencrypted traffic, which violates the requirement that the application be accessible only over HTTPS; allowing HTTP would bypass the encryption mandate.

Full explanation →
898
Multi-Selectmedium

A company is designing a network architecture for a critical application that requires high availability and fault tolerance. The application will be deployed on EC2 instances in an Auto Scaling group across three Availability Zones. The instances must be able to communicate with each other across AZs. Which TWO design decisions improve the fault tolerance of the application? (Choose TWO.)

Select 2 answers
A.Use a single NAT Gateway in one Availability Zone for internet access
B.Use VPC endpoints for Amazon S3 to reduce internet dependency
C.Configure the Auto Scaling group to launch instances in multiple Availability Zones
D.Use a single Network Load Balancer in one Availability Zone
E.Deploy EC2 instances evenly across three Availability Zones
AnswersC, E

Auto Scaling across AZs automatically replaces failed instances and maintains capacity.

Why this answer

Launching instances in multiple Availability Zones (AZs) ensures that if one AZ fails, the Auto Scaling group can still maintain capacity from the remaining AZs, providing fault tolerance. This design leverages the isolation boundaries of AZs within a region, which are physically separate data centers with independent power and networking.

Exam trap

The ANS-C01 exam often tests the misconception that a single NAT Gateway or a single NLB is sufficient for high availability, but the trap here is that these components must be deployed in a redundant manner (e.g., one per AZ) to avoid a single point of failure, while VPC endpoints improve security but not fault tolerance.

Full explanation →
899
MCQhard

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access an S3 bucket. The security team wants to ensure that traffic to S3 does not traverse the internet. Which solution meets this requirement?

A.Create a VPC gateway endpoint for S3 and attach an endpoint policy that restricts access to the specific bucket
B.Establish a VPN connection to the on-premises network and route through it
C.Set up a NAT gateway in the public subnet and route private subnet traffic to it
D.Deploy a proxy server in the public subnet and configure the instance to use it
AnswerA

Traffic stays within AWS network.

Why this answer

A VPC gateway endpoint for S3 allows private subnet instances to access S3 without traversing the internet. Option B is wrong because a VPN connection is used to connect to on-premises networks, not to access S3 privately. Option C is wrong because a NAT gateway still routes traffic through the internet.

Option D is wrong because a proxy server also introduces internet connectivity.

Full explanation →
900
Multi-Selecthard

A company has a multi-account AWS environment with hundreds of VPCs interconnected via a transit gateway. The network team needs to centrally monitor VPC reachability and identify asymmetric routing paths. Which THREE services or features should be used together to achieve this? (Choose three.)

Select 3 answers
A.Amazon CloudWatch Contributor Insights
B.VPC Reachability Analyzer
C.AWS Network Manager
D.AWS Config
E.AWS CloudHSM
AnswersA, B, C

Analyzes VPC Flow Logs to detect traffic patterns and anomalies.

Why this answer

VPC Reachability Analyzer can test paths and detect asymmetric routing. AWS Network Manager provides central visibility for transit gateway networks. Amazon CloudWatch Contributor Insights helps analyze VPC Flow Logs to identify traffic patterns.

AWS Config evaluates rules but not real-time path analysis. AWS CloudHSM is for hardware security modules.

Full explanation →
Page 11

Page 12 of 22

Page 13

All pages

12345678910111213141516171819202122

Practice ANS-C01 by domain

Target a specific domain to shore up weak areas.

Network Management and OperationsNetwork Security, Compliance and GovernanceNetwork DesignNetwork Implementation
See all domains with question counts →