Knowledge + Practice

AWS Certified Advanced Networking Specialty ANS-C01 (ANS-C01) — Questions 901–975

1621 questions total · 22pages · All types, answers revealed

Take a mock exam Exam hub

Page 13 of 22

901

MCQhard

A company runs a critical application on EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB) in a VPC. The application experiences unpredictable traffic spikes. The company notices that during peak traffic, the ALB returns 503 errors. The network engineer checks the ALB's CloudWatch metrics and sees that the 'ActiveConnectionCount' is high but 'TargetResponseTime' is low. The ALB's target group is configured with a deregistration delay of 300 seconds. The ALB is internet-facing and uses an SSL/TLS certificate from AWS Certificate Manager. The security group for the ALB allows inbound HTTPS from 0.0.0.0/0. The target instances' security group allows inbound traffic from the ALB's security group. The VPC has a CIDR of 10.0.0.0/16 with public and private subnets. The ALB is in public subnets, and the instances are in private subnets. The route tables for private subnets have a default route to a NAT gateway in the public subnets. The company wants to resolve the 503 errors. What should the network engineer do?

A.Disable cross-zone load balancing on the ALB.

B.Increase the deregistration delay to 600 seconds.

C.Increase the idle timeout setting on the ALB to a higher value.

D.Move the ALB to private subnets and use a NAT gateway for internet access.

AnswerC

Higher idle timeout keeps connections alive, reducing connection rate.

Why this answer

The 503 errors are likely caused by the ALB reaching its connection limit (e.g., 50,000 concurrent connections). Increasing the idle timeout would keep connections open longer, increasing concurrent connections and worsening the issue. Decreasing the idle timeout would close idle connections faster, reducing concurrency.

Alternatively, scaling out the target group or adding more ALBs can distribute the load. None of the provided options are correct; the correct action is to reduce the idle timeout or increase the number of targets.

Full explanation →

902

MCQhard

A company has a VPC with multiple subnets across Availability Zones. An application load balancer (ALB) is deployed in public subnets. The network team notices that traffic from the ALB to targets in private subnets is intermittently failing. The targets are healthy. What is the MOST likely cause?

A.The ALB is not associated with a public subnet.

B.The target security group does not allow traffic from the ALB's security group.

C.The network ACL for the target subnets blocks outbound traffic.

D.Cross-zone load balancing is disabled.

AnswerB

Correct. The target security group must allow inbound traffic from the ALB's security group. Without this rule, traffic from the ALB will be blocked.

Why this answer

The ALB communicates with targets using its private IP addresses. For traffic to reach the targets, the target security group must allow inbound traffic from the ALB's security group. If this rule is missing, traffic from the ALB will be dropped by the target security group, even though the targets are healthy.

Option A is incorrect because the ALB is already deployed in public subnets, so it is associated with a public subnet. Option C is incorrect because network ACLs are stateless and only affect traffic crossing subnet boundaries; if the NACL blocked outbound traffic from targets, there would be issues with response traffic, but the question states traffic from ALB to targets is failing, so the issue is likely inbound to targets. Option D is incorrect because cross-zone load balancing is enabled by default and would not cause intermittent failures; it only affects distribution of traffic across zones.

Full explanation →

903

Multi-Selectmedium

A company is designing a network for a critical application that requires low-latency communication between EC2 instances in the same AWS Region. They want to maximize network throughput and minimize latency. Which TWO design choices should they make? (Choose two.)

Select 2 answers

A.Attach an internet gateway to the VPC and route traffic through it.

B.Enable enhanced networking (ENA) on the EC2 instances.

C.Use a VPN connection to route traffic between instances.

D.Use a spread placement group for the EC2 instances.

E.Place the EC2 instances in a cluster placement group.

AnswersB, E

Enhanced networking provides higher bandwidth and lower latency.

Why this answer

Enabling Enhanced Networking (ENA) on EC2 instances provides higher bandwidth, higher packet-per-second (PPS) performance, and consistently lower inter-instance latencies by using a modern network interface driver that offloads network processing to dedicated hardware. This is essential for critical applications requiring maximum throughput and minimal latency within the same AWS Region.

Exam trap

AWS often tests the misconception that spread placement groups improve network performance, when in fact they are designed for high availability and fault tolerance, not low latency or high throughput.

Full explanation →

904

MCQmedium

Refer to the exhibit. A network architect is reviewing an IAM policy for a junior engineer. What is the security concern with this policy?

A.The policy does not include a condition to restrict the actions to specific VPCs

B.The policy allows deletion of VPCs and subnets, which could lead to resource loss

C.The policy allows creation of VPCs and subnets, which could cause resource exhaustion

D.The policy allows read-only actions that could expose sensitive network configurations

AnswerB

Delete actions are destructive.

Why this answer

The IAM policy grants `ec2:DeleteVpc` and `ec2:DeleteSubnet` permissions, which allow the junior engineer to delete VPCs and subnets. This could lead to irreversible resource loss, including all associated resources like route tables, security groups, and network interfaces, disrupting network connectivity and services.

Exam trap

AWS often tests the misconception that allowing creation actions (like `ec2:CreateVpc`) is the primary risk, but the trap here is that destructive actions (like `ec2:DeleteVpc`) pose a more immediate and severe security concern due to potential data loss and service disruption.

How to eliminate wrong answers

Option A is wrong because the policy does not include a condition to restrict actions to specific VPCs, but the primary security concern is the ability to delete resources, not the lack of conditions; conditions are a best practice but not the most immediate risk here. Option C is wrong because while creating VPCs and subnets could cause resource exhaustion, the policy also allows deletion, which poses a more direct risk of data loss and service disruption; resource exhaustion is a potential issue but less critical than destructive actions. Option D is wrong because the policy does not include read-only actions; it includes `ec2:CreateVpc`, `ec2:CreateSubnet`, `ec2:DeleteVpc`, and `ec2:DeleteSubnet`, which are all write or destructive actions, not read-only.

Full explanation →

905

MCQmedium

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company has a NAT Gateway in the public subnet. The network team notices that instances in the private subnets cannot reach the internet. The route table for the private subnets has a default route (0.0.0.0/0) pointing to the NAT Gateway. What could be the issue?

A.The NAT Gateway does not have a route to the internet gateway

B.The NAT Gateway is in a private subnet

C.The VPC does not have a VPC endpoint for the software update service

D.The security group attached to the NAT Gateway is blocking traffic

AnswerB

For a NAT Gateway to route traffic from private subnets to the internet, it must reside in a public subnet with an associated route table that includes a default route (0.0.0.0/0) pointing to an internet gateway. Placing the NAT Gateway in a private subnet breaks this requirement, as the gateway itself has no path to the internet, so it cannot forward outbound traffic from the private instances.

Why this answer

The NAT Gateway must be in a public subnet with an internet gateway route to function. Option A is wrong because the NAT Gateway itself does not have a route; the route table of the subnet where it resides needs a route to the internet gateway. Option C is wrong because security groups are for instances, not NAT Gateways.

Option D is wrong because VPC endpoints are for specific AWS services, not general internet access.

Full explanation →

906

Multi-Selecteasy

Which TWO of the following are valid methods to connect an on-premises network to an Amazon VPC over a private, dedicated connection? (Select TWO.)

Select 2 answers

A.AWS Direct Connect Gateway

B.AWS Direct Connect

C.AWS Client VPN

D.VPC Peering

E.AWS VPN CloudHub

AnswersA, B

Extends Direct Connect to multiple VPCs.

Why this answer

AWS Direct Connect Gateway allows you to connect an on-premises network to multiple VPCs in different AWS regions over a single private, dedicated connection. AWS Direct Connect provides a dedicated private network link from your on-premises data center to AWS, bypassing the public internet for lower latency and increased security.

Exam trap

The trap here is that candidates confuse 'private, dedicated connection' with any VPN-based solution, but AWS Direct Connect is the only option that provides a physical, dedicated link not traversing the public internet.

Full explanation →

907

MCQhard

A financial services company must meet PCI DSS compliance for its VPC design. It requires that all traffic between application tiers be encrypted in transit and that no traffic can bypass the encryption. The architecture includes a public-facing Application Load Balancer (ALB), a web tier in public subnets, an app tier in private subnets, and a database tier in isolated subnets. Which design meets these requirements?

A.Terminate TLS at the ALB. Use HTTP between ALB and web tier. Use HTTPS between web and app tier. Use TLS between app and database tier.

B.Terminate TLS at the ALB. Use HTTP between ALB and web tier. Use HTTPS between web and app tier. Use TLS between app and database tier.

C.Terminate TLS at the ALB. Use HTTPS between ALB and web tier. Use TLS mutual authentication between web and app tier. Use TLS between app and database tier.

D.Terminate TLS at the ALB. Use HTTPS between ALB and web tier. Use HTTP between web and app tier. Use TLS between app and database tier.

AnswerC

All traffic is encrypted: ALB to web (HTTPS), web to app (TLS mutual auth), app to database (TLS).

Why this answer

It ensures encryption in transit for all traffic between application tiers, meeting PCI DSS requirements. The ALB terminates TLS from clients, then uses HTTPS (TLS) to the web tier, mutual TLS between web and app tiers for strong authentication and encryption, and TLS between app and database tiers. This design prevents any unencrypted traffic from bypassing encryption, as every hop uses TLS.

Exam trap

The trap here is that candidates may assume terminating TLS at the ALB is sufficient for all internal traffic, overlooking the need for encryption between every tier, especially the web-to-app hop where HTTP is often mistakenly considered acceptable.

How to eliminate wrong answers

Option A is wrong because it uses HTTP between the ALB and web tier, which transmits data in plaintext, violating the requirement that no traffic can bypass encryption. Option B is identical to A and thus also wrong for the same reason. Option D is wrong because it uses HTTP between the web and app tier, leaving that hop unencrypted and failing to meet PCI DSS encryption requirements.

Full explanation →

908

MCQmedium

An engineer is troubleshooting connectivity from on-premises to a VPC via Direct Connect private VIF. The BGP session is up, traffic is flowing, but the on-premises network cannot reach some subnets in the VPC. The VPC CIDR is 10.0.0.0/16. What is the most likely cause based on the exhibit?

A.The BGP session is up, but the on-premises router is not receiving the VPC CIDR route due to missing route propagation on the virtual private gateway.

B.The customer router configuration snippet is missing the BGP configuration for those subnets.

C.The security groups or network ACLs in the VPC are blocking traffic to those subnets.

D.The route filter prefixes only allow the VPC CIDR 10.0.0.0/16, but the VPC has additional CIDRs that are not being advertised.

AnswerC

Since the VPC CIDR is advertised, reachability issues within the VPC are more likely due to security group or NACL rules.

Why this answer

The BGP session being up and traffic flowing indicates that routing is properly configured between on-premises and the VPC. The inability to reach only some subnets suggests the issue is at the network security layer within the VPC. Security groups and network ACLs can block traffic to specific subnets while routing remains intact.

Therefore, the most likely cause based on the exhibit is that security groups or NACLs are filtering traffic to those subnets.

Full explanation →

909

MCQeasy

A company needs to provide temporary, limited-privilege credentials to users so they can access AWS resources from mobile apps. Which AWS service should they use?

A.AWS Key Management Service (KMS)

B.Amazon Cognito user pools

C.AWS Security Token Service (STS)

D.IAM user with access keys

AnswerC

STS provides temporary, limited-privilege credentials.

Why this answer

AWS Security Token Service (STS) enables you to request temporary, limited-privilege credentials for users, which is ideal for mobile apps. Option A (KMS) is used for encryption key management, not credential generation. Option B (Cognito user pools) provides user identity management but does not directly issue temporary AWS credentials.

Option D (IAM user with access keys) provides long-term credentials, not temporary.

Full explanation →

910

MCQhard

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to a partner VPC with CIDR 10.0.0.0/16. Both VPCs are in the same region. They want to use VPC Peering. After creating the peering connection and adding routes, connectivity fails. What is the most likely cause?

A.The peering connection is not set up for transitive routing.

B.The peering connection status is 'pending-acceptance'.

C.Overlapping CIDR blocks prevent VPC peering connectivity.

D.The route tables do not have a route to the peering connection.

AnswerC

VPC peering does not support overlapping CIDRs.

Why this answer

The most likely cause of connectivity failure is the overlapping CIDR blocks. VPC peering requires non-overlapping IP ranges for proper routing. Even if the peering connection is active and routes are added, the identical CIDR blocks (both 10.0.0.0/16) prevent the route tables from distinguishing the traffic destination, resulting in no connectivity.

Option A is incorrect because VPC peering does not support transitive routing, but that is not the issue here. Option B is incorrect because the status would need to be 'active' for connectivity, but the problem is overlapping CIDRs. Option D is incorrect because although routes may be missing, the primary issue is the overlapping CIDRs.

Full explanation →

911

MCQhard

A company has a large AWS environment with hundreds of VPCs connected via a Transit Gateway. The network team is implementing a new hub-and-spoke architecture where all traffic between VPCs must be inspected by a centralized firewall appliance in a shared services VPC. The firewall appliance is a third-party virtual appliance that supports VRF-like segmentation. The network engineer has configured the Transit Gateway with separate route tables for each VPC, and the shared services VPC is associated with all route tables. The firewall appliance is deployed in the shared services VPC with two ENIs: one in a 'trust' subnet and one in an 'untrust' subnet. The trust subnet is used for traffic coming from spoke VPCs, and the untrust subnet is used for traffic going to other spoke VPCs. The firewall appliance performs stateful inspection and returns traffic to the Transit Gateway via the correct ENI. However, after implementation, traffic between two spoke VPCs (VPC A and VPC B) is being dropped. The engineer verifies that the Transit Gateway route tables have static routes for each spoke VPC CIDR pointing to the shared services VPC attachment. The spoke VPCs have routes to each other's CIDR via the Transit Gateway. The firewall logs show that traffic from VPC A reaches the trust ENI, but the firewall is unable to send traffic to VPC B because it does not have a route to VPC B's CIDR. What is the most likely cause?

A.The shared services VPC attachment is not propagating routes to the Transit Gateway route tables.

B.The security group for the firewall's untrust ENI is blocking outbound traffic.

C.The Transit Gateway route table for VPC A does not have a route for VPC B's CIDR.

D.The route table for the untrust subnet does not have a route to VPC B's CIDR pointing to the Transit Gateway.

AnswerD

The untrust subnet needs a route to return traffic to the Transit Gateway. Without it, the firewall cannot send traffic to VPC B.

Why this answer

The firewall's untrust subnet route table must have a route pointing to the Transit Gateway for VPC B's CIDR. The firewall receives traffic from VPC A on its trust ENI, processes it, and then sends it out the untrust ENI. Without a route in the untrust subnet's route table directing traffic for VPC B's CIDR to the Transit Gateway, the firewall cannot forward the traffic back to the Transit Gateway for delivery to VPC B, causing the drop.

Exam trap

The trap here is that candidates often focus on Transit Gateway route tables and forget that the subnet route tables within the shared services VPC must also be configured to route traffic back to the Transit Gateway, especially when using a firewall with separate ENIs for trust and untrust subnets.

How to eliminate wrong answers

Option A is wrong because the shared services VPC attachment does not need to propagate routes to the Transit Gateway route tables; the static routes in the Transit Gateway route tables already point to the shared services VPC attachment for spoke-to-spoke traffic. Option B is wrong because the security group for the firewall's untrust ENI would block traffic at the firewall level, but the issue is that the firewall cannot send traffic due to a missing route, not that traffic is blocked by a security group. Option C is wrong because the Transit Gateway route table for VPC A does have a route for VPC B's CIDR pointing to the shared services VPC attachment, as verified by the engineer; the problem lies in the subnet route table within the shared services VPC.

Full explanation →

912

MCQhard

A financial services company must meet PCI DSS compliance requirements. The company's VPC contains a web server in a public subnet and an application server in a private subnet. The application server must communicate with a third-party payment gateway over the internet, but the security team prohibits using an Elastic IP address or a NAT gateway due to auditing concerns. Which solution satisfies these requirements?

A.Deploy a NAT instance in the public subnet and route traffic through it

B.Configure a proxy server in the public subnet and have the application server use the proxy

C.Use AWS PrivateLink to connect to the payment gateway via a VPC Endpoint Service

D.Attach an Internet Gateway to the VPC and use a default route to 0.0.0.0/0 in the private subnet

AnswerC

PrivateLink enables private connectivity to services over the AWS network, avoiding public IPs and internet transit, meeting compliance requirements.

Why this answer

AWS PrivateLink allows the application server in the private subnet to connect to the third-party payment gateway via a VPC Endpoint Service without traversing the internet, using private IP addresses. This eliminates the need for an Elastic IP address or a NAT gateway, satisfying the security team's auditing concerns while meeting PCI DSS compliance requirements.

Exam trap

The trap here is that candidates often assume a NAT gateway or proxy is required for outbound internet access, but PrivateLink provides a private, internet-free connection to third-party services, directly addressing the auditing and compliance constraints.

How to eliminate wrong answers

Option A is wrong because a NAT instance requires an Elastic IP address to provide outbound internet access, which is explicitly prohibited by the security team. Option B is wrong because a proxy server in the public subnet still requires an Elastic IP address or a NAT gateway for outbound connectivity, and it does not eliminate the auditing concerns. Option D is wrong because attaching an Internet Gateway and adding a default route to 0.0.0.0/0 in the private subnet would route traffic directly to the internet, but private subnets cannot route to an Internet Gateway without a NAT device or Elastic IP; this configuration would fail to provide outbound connectivity and violates the security team's requirements.

Full explanation →

913

MCQmedium

A company has an AWS Direct Connect connection and wants to ensure that all traffic from its VPC to an S3 bucket in another region stays within the AWS network. How should this be accomplished?

A.Create a VPC Gateway Endpoint for S3 in the source VPC

B.Create a VPC Interface Endpoint for S3 in the source VPC

C.Use a NAT gateway in the VPC and route traffic through the Direct Connect public VIF

D.Establish a VPN connection to the S3 bucket

AnswerC

Using a public VIF with Direct Connect allows traffic to S3 in any region via the AWS backbone, keeping it off the public internet.

Why this answer

To access an S3 bucket in another region from a VPC while keeping traffic on the AWS network, you can route traffic through a Direct Connect public virtual interface (VIF). A NAT gateway in the VPC can be used to route traffic from private subnets to the public VIF, which then connects to the S3 public endpoint across the AWS global backbone. This ensures traffic does not traverse the public internet.

Option A is incorrect because VPC Gateway Endpoints are regional and can only be used for S3 buckets in the same region. Option B is incorrect because VPC Interface Endpoints for S3 are region-specific and cannot be used to access S3 buckets in another region. Option D is incorrect because VPN connections cannot be established directly to S3 buckets.

Full explanation →

914

Multi-Selectmedium

A company is designing a network security architecture for a VPC that hosts a multi-tier application. The security team wants to implement defense in depth. Which three layers of security should be configured?

Select 3 answers

A.Security groups

B.AWS WAF

C.AWS Identity and Access Management (IAM) policies

D.VPC Flow Logs

E.Network ACLs

AnswersA, B, E

Instance-level firewall.

Why this answer

Security groups act as virtual firewalls at the instance level, providing stateful filtering. Network ACLs provide stateless filtering at the subnet level, adding a perimeter layer. AWS WAF protects web applications at the application layer, guarding against common web exploits.

Together, these three layers (A, B, E) implement defense in depth for network security. IAM policies (C) are for identity and access management, not network filtering. VPC Flow Logs (D) are for monitoring traffic, not blocking it.

Full explanation →

915

MCQhard

A company has a production VPC with CIDR 10.0.0.0/16. They have an internet-facing Application Load Balancer (ALB) in public subnets across two Availability Zones. The ALB distributes traffic to a fleet of EC2 instances in private subnets. The EC2 instances need to access an Amazon S3 bucket to retrieve configuration files. The company wants to minimize data transfer costs and ensure that traffic to S3 does not traverse the internet. A network engineer created a Gateway VPC Endpoint for S3 in the VPC and added a route in the public subnet route tables pointing to the endpoint. However, the EC2 instances still cannot access the S3 bucket. The security groups for the EC2 instances allow outbound HTTPS to 0.0.0.0/0. The NACLs are default (allow all). The S3 bucket policy allows access from the VPC endpoint. What is the MOST likely reason the EC2 instances cannot access S3?

A.The Gateway VPC Endpoint is in a different region than the S3 bucket

B.The security group for the EC2 instances does not allow outbound traffic to the S3 prefix list

C.The S3 bucket policy does not include a condition for the VPC endpoint

D.The route to the Gateway VPC Endpoint was added only to public subnets, not to private subnets

AnswerD

Correct; the route must be in the private subnet route table for EC2 instances to use the endpoint.

Why this answer

The Gateway VPC Endpoint for S3 must have a route in the route tables of the subnets where the EC2 instances reside. The engineer added the route only to public subnet route tables, not the private subnets. Therefore, traffic from the EC2 instances to S3 still uses the default route (0.0.0.0/0) via NAT Gateway or Internet Gateway, not the VPC endpoint.

Option A is incorrect because the endpoint is in the same region. Option B is incorrect because the security group allows outbound HTTPS to all destinations. Option C is incorrect because the S3 bucket policy includes the necessary condition.

Exam trap

A common trap is to think that adding a route to any subnet is sufficient. However, the route must be in the route table of the subnet where the instance resides. Public subnets have routes to the internet gateway, but private subnets need explicit routes to the gateway endpoint.

Full explanation →

916

MCQhard

A company has a VPC with CIDR 10.0.0.0/16. They have an on-premises network with CIDR 172.16.0.0/12 connected via AWS Site-to-Site VPN. The company also has a second VPC (VPC B) with CIDR 10.1.0.0/16 peered with the first VPC. They notice that instances in VPC B cannot reach the on-premises network. What is the most likely cause?

A.Route propagation is disabled in VPC B.

B.The VPN connection is not compatible with VPC peering.

C.The VPN tunnel is down.

D.VPC peering does not support transitive routing.

AnswerD

Transitive routing is not supported; on-premises cannot reach VPC B through VPC peering.

Why this answer

VPC peering does not support transitive routing. This means that if VPC A is peered with VPC B and also connected to an on-premises network via VPN, traffic from VPC B cannot use VPC A as a transit point to reach the on-premises network. Each VPC must have its own direct connection to the on-premises network, or a transit gateway must be used to enable transitive routing.

Exam trap

The trap here is that candidates often assume VPC peering works like a router or a hub-and-spoke model, not realizing that AWS explicitly disables transitive routing across VPC peering connections to prevent unintended network loops and complexity.

How to eliminate wrong answers

Option A is wrong because route propagation in VPC B is irrelevant; even if VPC B had propagated routes from the VPN, the VPC peering connection itself does not allow traffic to be forwarded from VPC B through VPC A to the on-premises network due to the lack of transitive routing. Option B is wrong because the VPN connection is fully compatible with VPC peering; the issue is not compatibility but the architectural limitation that VPC peering does not support transitive routing. Option C is wrong because if the VPN tunnel were down, instances in VPC A would also be unable to reach the on-premises network, but the problem is specific to VPC B, indicating the VPN is operational.

Full explanation →

917

MCQeasy

A company needs to audit all changes to security groups in a VPC. Which AWS service should be used?

A.VPC Flow Logs

B.AWS Config

C.Amazon CloudWatch

D.AWS CloudTrail

AnswerD

CloudTrail records all API calls made in the account, including security group modifications.

Why this answer

AWS CloudTrail records API calls, including changes to security groups, and can be used for auditing. Option A is wrong because VPC Flow Logs capture network traffic, not API activity. Option B is wrong because AWS Config can track resource configuration changes but is not primarily for auditing API calls; it focuses on compliance and configuration history.

Option C is wrong because Amazon CloudWatch is for monitoring metrics and logs, not API activity.

Full explanation →

918

MCQmedium

A company wants to audit all changes to security group rules in their AWS account. Which AWS service should be used to record these changes?

A.AWS CloudTrail

B.AWS Config

C.VPC Flow Logs

D.Amazon Inspector

AnswerA

CloudTrail records all API calls, including security group modifications.

Why this answer

AWS CloudTrail records API calls made in the AWS account, including calls to authorize security group rule changes (e.g., AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress). This makes it the appropriate service for auditing changes to security group rules. AWS Config (Option B) records resource configurations and can track changes, but it is not the primary service for API-level auditing.

VPC Flow Logs (Option C) capture network traffic metadata, not configuration changes. Amazon Inspector (Option D) is a vulnerability assessment service, not an audit service for changes.

Full explanation →

919

MCQhard

A network engineer is configuring VPC Flow Logs to deliver to an S3 bucket in a different account. The bucket policy is shown. The flow logs are not being delivered. What is the most likely reason?

A.The Action should be s3:PutObjectAcl instead of s3:PutObject

B.The Principal must be the destination account's log delivery service

C.The aws:SourceArn condition restricts access to a specific account, but the flow logs are from a different account

D.The Resource does not include the bucket ARN itself

AnswerC

The condition limits access to logs from account 123456789012 only.

Why this answer

The bucket policy uses the log delivery service principal from account 123456789012, but the flow logs are from a different account. The policy needs to allow access for the source account's log delivery service. Option A is incorrect because the action is correct.

Option B is incorrect because the resource includes the full path. Option D is incorrect because the Principal is correct for cross-account delivery.

Full explanation →

920

Multi-Selecteasy

Which TWO of the following are true about AWS VPC endpoints? (Choose two.)

Select 2 answers

A.Gateway Endpoints can be used to access Amazon S3 and DynamoDB.

B.Interface Endpoints are free of charge.

C.Gateway Endpoints use AWS PrivateLink.

D.Both Gateway and Interface Endpoints require a NAT gateway.

E.Interface Endpoints are powered by AWS PrivateLink.

AnswersA, E

Only S3 and DynamoDB have Gateway Endpoints.

Why this answer

Gateway VPC endpoints allow private connectivity to Amazon S3 and DynamoDB without traversing the internet, using route table entries rather than private IP addresses. This is the only AWS service pair supported by Gateway Endpoints, making them a cost-effective and simple solution for these two services.

Exam trap

The trap here is that candidates often confuse Gateway Endpoints with Interface Endpoints, assuming both use PrivateLink or that Gateway Endpoints support more than just S3 and DynamoDB.

Full explanation →

921

MCQeasy

A company is using AWS WAF to protect a web application. They want to block requests that originate from known malicious IP addresses. Which WAF rule type should be used?

A.String match condition

B.Regex match condition

C.SQL injection match condition

D.IP set match condition

AnswerD

IP set match condition allows blocking or allowing requests based on source IP.

Why this answer

IP set match conditions are used to match the source IP address of a request against a list of IP addresses. Regex, string match, and SQL injection are for other attack types.

Full explanation →

922

MCQmedium

A company is designing a multi-region architecture with an active-active setup. They need to route traffic to the nearest healthy endpoint. Which AWS service should they use?

A.Application Load Balancer (ALB)

B.Amazon Route 53 latency-based routing

C.AWS Global Accelerator

D.Amazon CloudFront

AnswerB

Route 53 latency-based routing directs traffic to the region with the lowest latency for the user.

Why this answer

Amazon Route 53 latency-based routing directs traffic to the AWS Region that provides the lowest latency for the end user, based on measurements between the user's DNS resolver and AWS endpoints. It also supports health checks, automatically excluding unhealthy endpoints from the routing pool, which enables an active-active multi-region architecture by routing each request to the nearest healthy endpoint. AWS Global Accelerator also routes to the nearest healthy endpoint but uses anycast IPs at the network layer, making it more suitable for optimizing TCP/UDP traffic rather than general DNS-level routing.

Exam trap

The ANS-C01 exam often tests the distinction between DNS-based routing (Route 53 latency routing) and network-layer anycast routing (Global Accelerator). Candidates might mistakenly choose Global Accelerator because it also routes to the nearest endpoint via anycast, but Route 53 latency routing is correct for scenarios that do not require static IPs or TCP/UDP optimization.

How to eliminate wrong answers

Option A is wrong because an Application Load Balancer (ALB) operates within a single AWS Region and cannot route traffic across multiple regions or select the nearest healthy endpoint globally. Option C is wrong because AWS Global Accelerator uses Anycast IPs and the AWS global network to route traffic to the nearest healthy endpoint, but it is designed for TCP/UDP traffic and provides static IP addresses, not DNS-based latency routing; while it can achieve similar goals, the question specifically asks for a service that routes traffic to the nearest healthy endpoint via DNS, which is Route 53 latency-based routing. Option D is wrong because Amazon CloudFront is a content delivery network (CDN) optimized for caching and delivering static and dynamic web content at edge locations, not for routing general application traffic to the nearest healthy origin endpoint based on latency measurements.

Full explanation →

923

Multi-Selecteasy

A company wants to monitor network traffic in its VPC for security analysis and troubleshooting. Which TWO AWS services can be used to capture and analyze IP traffic information? (Choose TWO.)

Select 2 answers

A.AWS Network Firewall

B.AWS CloudTrail

C.AWS Trusted Advisor

D.Amazon GuardDuty

E.VPC Flow Logs

AnswersA, E

Captures and inspects traffic.

Why this answer

Options A and E are correct. VPC Flow Logs capture IP traffic metadata for analysis, and AWS Network Firewall can capture and inspect network traffic. Option B (CloudTrail) is incorrect because it records API calls, not network traffic.

Option C (Trusted Advisor) is incorrect as it provides best practice checks. Option D (GuardDuty) is incorrect because it is a threat detection service that uses flow logs but does not capture them directly.

Full explanation →

924

Multi-Selectmedium

A company is designing a network for a critical application that requires maximum availability. The application will be deployed across multiple Availability Zones in a single region. Which THREE design choices improve network availability?

Select 3 answers

A.Use an Application Load Balancer with targets in multiple Availability Zones

B.Deploy EC2 instances in at least two Availability Zones

C.Use a single NAT gateway in one Availability Zone

D.Use a single subnet per Availability Zone

E.Use multiple NAT gateways, one in each Availability Zone

AnswersA, B, E

Distributes traffic across AZs.

Why this answer

An Application Load Balancer (ALB) with targets in multiple Availability Zones (AZs) improves availability by distributing incoming traffic across healthy targets in different AZs. If one AZ fails, the ALB automatically routes traffic to targets in the remaining AZs, ensuring the application remains accessible. This design eliminates a single point of failure at the load balancer level and leverages the regional nature of the ALB to provide cross-AZ fault tolerance.

Exam trap

AWS often tests the misconception that a single NAT gateway is sufficient for high availability because it can route traffic from multiple AZs, but the trap here is that the NAT gateway itself is a zonal resource—if its AZ fails, all outbound traffic is lost, making it a critical single point of failure.

Full explanation →

925

MCQhard

A company has a VPC with public and private subnets. An EC2 instance in the private subnet needs to download patches from the internet. The company wants to use a proxy server running on an EC2 instance in the public subnet. The security group for the proxy server must allow inbound HTTP/HTTPS from the instance in the private subnet. The security group for the private instance must allow outbound HTTP/HTTPS to the proxy server. However, the private instance cannot connect to the proxy. What is the most likely cause?

A.The security group for the private instance does not allow outbound traffic to the proxy server.

B.The network ACL for the private subnet blocks inbound traffic from the proxy.

C.The route table for the private subnet has a default route pointing to a NAT gateway instead of the proxy server.

D.The security group for the proxy server does not allow inbound traffic from the private instance's security group.

AnswerC

If the default route points to a NAT gateway, traffic to the internet goes through the NAT gateway instead of the proxy.

Why this answer

The route table for the private subnet likely has a default route pointing to a NAT gateway or internet gateway, causing traffic to bypass the proxy server. Even though security groups are configured correctly, routing decisions are made first. Traffic from the private instance to the proxy server would be directed to the default gateway (NAT/internet gateway) instead of the proxy's IP address.

Option A is incorrect: the security group for the private instance does allow outbound HTTP/HTTPS to the proxy. Option B is incorrect: network ACLs are stateless and must allow both inbound and outbound; but if they blocked inbound from the proxy, that would affect return traffic, not the initial connection. Option D is incorrect: the proxy's security group is configured to allow inbound from the private instance.

Full explanation →

926

MCQmedium

A company is designing a hybrid network architecture that connects an on-premises data center to AWS using AWS Direct Connect. The company requires high availability and uses BGP for dynamic routing. The on-premises router supports BGP multipath. Which configuration ensures the highest availability for the Direct Connect connection?

A.Provision two Direct Connect connections to two different Direct Connect locations and configure BGP multipath.

B.Provision a single Direct Connect connection and a Site-to-Site VPN as a backup.

C.Provision a single Direct Connect connection with two virtual interfaces.

D.Provision a single Direct Connect connection with multiple VLANs.

AnswerA

Physical diversity ensures high availability.

Why this answer

Provisioning two Direct Connect connections to two different Direct Connect locations eliminates single points of failure at the physical layer and the facility level. BGP multipath allows the on-premises router to load-balance traffic across both connections, maximizing availability by ensuring that if one connection or location fails, traffic continues over the other without relying on a slower failover mechanism like VPN.

Exam trap

The trap here is that candidates often confuse logical redundancy (multiple VLANs or virtual interfaces) with physical redundancy, assuming that multiple logical constructs on a single physical connection provide high availability, when in fact a single physical failure will take down all logical constructs.

How to eliminate wrong answers

Option B is wrong because a Site-to-Site VPN over the internet introduces latency, jitter, and potential bandwidth limitations, and it is typically used as a backup only when Direct Connect is unavailable, not as a primary high-availability solution; it does not provide the same SLA or consistent performance as a second Direct Connect. Option C is wrong because a single Direct Connect connection with two virtual interfaces still shares the same physical port, fiber path, and Direct Connect location, meaning a single failure at the physical layer (e.g., fiber cut, device failure) will bring down both virtual interfaces, violating high availability. Option D is wrong because multiple VLANs on a single Direct Connect connection are used to segregate traffic (e.g., public vs. private VIFs) but do not provide redundancy; they all depend on the same physical connection and location, so a single failure disrupts all VLANs.

Full explanation →

927

MCQeasy

A company wants to use AWS Direct Connect to establish a dedicated network connection from their on-premises data center to AWS. They need to connect to a VPC in the us-east-1 region. Which of the following is a required step in the setup process?

A.Attach a Transit Gateway to the VPC.

B.Configure CloudFront to route traffic through the Direct Connect.

C.Create a site-to-site VPN connection as a backup.

D.Create a private virtual interface and attach it to a Virtual Private Gateway.

AnswerD

This is the standard procedure for Direct Connect private VIF.

Why this answer

To establish a Direct Connect connection to a VPC, you must create a private virtual interface (VIF) and attach it to a Virtual Private Gateway (VGW) that is attached to the VPC. The private VIF carries traffic over the dedicated connection and uses BGP to exchange routes between the on-premises network and the VPC via the VGW. This is the core requirement for routing traffic from the Direct Connect link into a VPC.

Exam trap

AWS often tests the misconception that a Transit Gateway is mandatory for Direct Connect, but the correct requirement is a Virtual Private Gateway attached to the VPC, not a Transit Gateway.

How to eliminate wrong answers

Option A is wrong because a Transit Gateway is not required for a single VPC connection; it is used to interconnect multiple VPCs or VPNs, and attaching it is optional. Option B is wrong because CloudFront is a content delivery network (CDN) and does not route traffic through Direct Connect; Direct Connect is a Layer 2/3 dedicated link, not a CDN service. Option C is wrong because a site-to-site VPN is not a required step; it is an optional backup for redundancy and is not mandatory for the Direct Connect setup process.

Full explanation →

928

MCQmedium

A company uses a VPC with multiple subnets in different Availability Zones. The VPC has a NAT Gateway in a public subnet of us-east-1a, and a second NAT Gateway in us-east-1b for high availability. Each private subnet in us-east-1a routes 0.0.0.0/0 to the NAT Gateway in us-east-1a, and private subnets in us-east-1b route to the NAT Gateway in us-east-1b. The company's EC2 instances in private subnets need to access an external service using IPv6. The VPC is not configured for IPv6. The network engineer needs to enable IPv6 connectivity for these instances. Which solution is the most cost-effective and scalable?

A.Add an IPv6 CIDR block to the VPC and configure a NAT64 gateway to translate IPv6 to IPv4.

B.Add an IPv6 CIDR block to the VPC, assign IPv6 addresses to private subnets, and add a route for ::/0 to an egress-only internet gateway.

C.Attach an internet gateway to the VPC and add a route for ::/0 to the internet gateway in the private subnets.

D.Add an IPv6 CIDR block to the VPC and use the existing NAT Gateways with IPv6.

AnswerB

Egress-only IGW allows outbound IPv6 traffic from private subnets.

Why this answer

Since the VPC is not IPv6-enabled, adding an IPv6 CIDR block assigns IPv6 addresses to subnets. For outbound-only IPv6 access from private subnets, an egress-only internet gateway (EIGW) is the appropriate and most cost-effective solution because it allows outbound traffic to the internet while preventing inbound connections, similar to a NAT gateway for IPv4. A route for ::/0 to the EIGW from the private subnets achieves the goal.

Option A is incorrect because NAT64 translates IPv6 to IPv4, but the target service uses IPv6, so no translation is needed. Option C is incorrect because an internet gateway would permit inbound traffic and instances would need public IPv6 addresses, which is not stated and is less secure. Option D is incorrect because NAT Gateways do not support IPv6.

Full explanation →

929

MCQeasy

A company needs to establish private connectivity between two VPCs in different AWS accounts. The VPCs are in the same Region. Which AWS feature should be used?

A.AWS Transit Gateway

B.AWS Direct Connect

C.VPC peering

D.AWS Site-to-Site VPN

AnswerC

VPC peering enables private connectivity between VPCs across accounts.

Why this answer

VPC peering is the correct choice because it establishes a direct, private network connection between two VPCs in the same AWS Region, even across different AWS accounts, using the AWS backbone without requiring a transit hub or external connectivity. It leverages the existing AWS infrastructure to route traffic between the VPCs via private IPv4 or IPv6 addresses, with no bandwidth bottlenecks or single points of failure inherent in the design.

Exam trap

The trap here is that candidates often choose AWS Transit Gateway because they think it is required for cross-account connectivity, but VPC peering directly supports cross-account VPC connections in the same Region without needing a central hub.

How to eliminate wrong answers

Option A is wrong because AWS Transit Gateway is a hub-and-spoke architecture designed for connecting many VPCs and on-premises networks, which introduces additional cost and complexity for a simple two-VPC scenario where VPC peering is more straightforward and cost-effective. Option B is wrong because AWS Direct Connect provides dedicated private connectivity from an on-premises data center to AWS, not between two VPCs within the same Region; it requires physical infrastructure and is not designed for VPC-to-VPC peering. Option D is wrong because AWS Site-to-Site VPN establishes encrypted tunnels over the public internet to connect on-premises networks to AWS, not for direct VPC-to-VPC connectivity; using it for VPC peering would introduce unnecessary latency and complexity.

Full explanation →

930

MCQmedium

A company has a hub-and-spoke network topology using AWS Transit Gateway in us-east-1. The hub VPC hosts centralized inspection appliances from a third-party vendor. The spokes include VPCs with application workloads and a Direct Connect VIF attached to a Direct Connect gateway which is associated with the Transit Gateway. The company notices that traffic from the on-premises network to the spoke VPCs is not being inspected by the centralized appliances. They have verified that the Transit Gateway route tables are correctly configured with static routes pointing to the inspection VPC for all spoke CIDRs, and the inspection appliances are properly configured to forward traffic. What is the most likely cause of this issue?

A.The Direct Connect gateway is not propagating routes to the Transit Gateway, causing the on-premises traffic to be dropped.

B.The Transit Gateway route table associated with the Direct Connect gateway attachment does not have a route that sends traffic to the inspection VPC.

C.The inspection VPC is sending traffic back to the on-premises network via a different path, causing asymmetric routing that drops packets.

D.The Transit Gateway route table for the spoke VPC attachments does not have a route to the on-premises network via the Direct Connect gateway.

AnswerB

The route table associated with the attachment determines the path. Without a specific route to the inspection VPC, traffic goes directly to the spoke.

Why this answer

In a hub-and-spoke topology with AWS Transit Gateway, traffic from on-premises (via Direct Connect) to spoke VPCs must be routed through the inspection VPC. This requires the Transit Gateway route table associated with the Direct Connect gateway attachment to contain a static route pointing to the inspection VPC attachment for the spoke CIDRs. Without this route, traffic bypasses inspection entirely.

Exam trap

The trap here is that candidates assume configuring routes in the spoke VPC route tables or the inspection VPC is sufficient, but they overlook that the Transit Gateway route table associated with the Direct Connect gateway attachment must also direct traffic to the inspection VPC.

How to eliminate wrong answers

Option A is wrong because the Direct Connect gateway does not propagate routes to the Transit Gateway; instead, the Transit Gateway must have static routes or propagated routes from the Direct Connect gateway, and the issue is not about propagation but about missing inspection routes. Option C is wrong because asymmetric routing is not the primary cause; the problem is that traffic never reaches the inspection VPC in the first place, so asymmetric routing is irrelevant. Option D is wrong because the spoke VPC route tables do not need a route to on-premises via the Direct Connect gateway; the Transit Gateway handles inter-VPC routing, and the spoke attachments only need routes to the inspection VPC for return traffic, which is already configured.

Full explanation →

931

Multi-Selectmedium

Which TWO of the following are requirements for establishing an AWS Direct Connect private virtual interface? (Choose two.)

Select 2 answers

A.Jumbo frames support (MTU 9001).

B.A public IP address for the VIF.

C.A public BGP ASN.

D.A BGP session between the customer router and the AWS device.

E.A VLAN ID that is unique within the Direct Connect connection.

AnswersD, E

BGP is used to exchange routes.

Why this answer

A BGP session between the customer router and the AWS device is a fundamental requirement for establishing a private virtual interface. The private VIF uses BGP to exchange routing information (typically a /30 or /31 subnet) between the on-premises network and the VPC, enabling dynamic route advertisement and failover. Without this BGP session, the VIF cannot be activated or used for traffic.

Exam trap

The ANS-C01 exam often tests the misconception that a public BGP ASN is mandatory for all Direct Connect virtual interfaces, but private VIFs can use private ASNs (from the 64512–65535 range) without issue.

Full explanation →

932

MCQhard

A company is setting up a cross-account VPC peering connection between VPC A (account 1) and VPC B (account 2). The security team wants to ensure that only specific TCP ports are allowed between the VPCs. They have configured the route tables and the VPC peering connection is active. Which additional configuration is required to enforce the port restriction?

A.Modify the network ACLs in both VPCs to allow inbound traffic only on the required ports.

B.Use network ACLs with stateful filtering to allow only the required ports.

C.Update the security groups in both VPCs to allow inbound traffic only on the required ports from the peered VPC's CIDR or security group.

D.Configure the route tables to deny traffic on all ports except the allowed ones.

AnswerC

Security groups can restrict traffic based on port and protocol at the instance level.

Why this answer

Security groups can reference security groups from peered VPCs across accounts when the VPC peering connection is active, allowing fine-grained control over specific TCP ports at the instance level. Option A is incorrect because modifying network ACLs is possible but they are stateless and apply at the subnet level, not instance level; also, network ACLs cannot reference security groups from peered VPCs. Option B is incorrect because network ACLs are stateless, not stateful; security groups are stateful.

Option D is incorrect because route tables control the path of traffic, not port-level filtering; they cannot deny traffic based on ports.

Full explanation →

933

MCQhard

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. The company wants to add a second VPC in the same AWS Region using the same Direct Connect connection. Which solution meets the requirements with the least operational effort?

A.Create a Direct Connect gateway and associate both VPCs, then associate the private VIF with the Direct Connect gateway

B.Set up a VPN connection over the Direct Connect for the second VPC

C.Create a transit virtual interface and attach it to a transit gateway, then attach both VPCs

D.Create a second private virtual interface for the second VPC

AnswerA

Allows multiple VPCs to use the same private VIF via the Direct Connect gateway.

Why this answer

A Direct Connect gateway allows a single private virtual interface (VIF) to connect to multiple VPCs in the same AWS Region, eliminating the need for multiple VIFs or complex routing. By associating both VPCs with the Direct Connect gateway and attaching the private VIF to it, you achieve the goal with minimal operational overhead, as the gateway handles the routing between the on-premises network and the VPCs.

Exam trap

AWS often tests the misconception that a single private VIF can only connect to one VPC, leading candidates to choose Option D, but the Direct Connect gateway enables multi-VPC connectivity with the same VIF.

How to eliminate wrong answers

Option B is wrong because setting up a VPN over Direct Connect adds unnecessary complexity and operational effort, as it requires managing VPN tunnels and encryption, whereas a Direct Connect gateway provides a simpler native solution. Option C is wrong because a transit virtual interface is used with a transit gateway for connecting multiple VPCs or VPNs, but it requires creating a transit gateway and additional configuration, which is more effort than using a Direct Connect gateway with existing private VIF. Option D is wrong because creating a second private virtual interface would require additional Direct Connect configuration and potentially more bandwidth allocation, increasing operational effort compared to reusing the existing VIF via a Direct Connect gateway.

Full explanation →

934

Multi-Selecteasy

A network engineer is designing a Direct Connect solution with a public VIF and a private VIF. The private VIF will connect to a VPC via a Direct Connect Gateway. Which TWO of the following statements are correct regarding this setup? (Choose 2.)

Select 2 answers

A.The private VIF can be used without a virtual interface termination device on the customer side

B.The public VIF can be used to connect to a VPC via a Direct Connect Gateway

C.The private VIF can be used to access Amazon S3 over a private IP address

D.The Direct Connect Gateway allows the private VIF to connect to multiple VPCs in different AWS Regions

E.The public VIF can be used to access AWS public services such as Amazon S3 over Direct Connect

AnswersD, E

Direct Connect Gateway enables multi-region connectivity.

Why this answer

A Direct Connect Gateway enables a private VIF to connect to multiple VPCs, even across different AWS Regions, by acting as a transit hub. The gateway uses a single private VIF to route traffic to up to 10 VPCs (by default) in any region, provided the VPCs are associated via virtual private gateways and the appropriate route tables are configured.

Exam trap

The ANS-C01 exam often tests the misconception that a public VIF can be used to connect to a VPC via a Direct Connect Gateway, but in reality, Direct Connect Gateway only supports private VIFs, and public VIFs are strictly for accessing AWS public services over public IP addresses.

Full explanation →

935

MCQmedium

A company is migrating from a legacy MPLS network to AWS using Direct Connect. The network team wants to ensure high availability with a backup connection. They have two Direct Connect connections from different providers, both terminating at the same AWS Direct Connect location. Which configuration provides the most resilient setup?

A.Use both connections but from the same provider to simplify management.

B.Use both connections with separate virtual interfaces, each terminating on different customer routers.

C.Use one connection with two virtual interfaces for redundancy.

D.Use both connections with a single virtual interface on each, but terminate on the same router.

AnswerB

Full redundancy with diverse paths.

Why this answer

Using two separate Direct Connect connections with separate virtual interfaces, each terminating on different customer routers, provides high availability by eliminating single points of failure at both the physical and logical levels. Option A is wrong because using the same provider reduces diversity. Option C is wrong because using a single connection with two VIFs still has a single physical link.

Option D is wrong because terminating on the same router creates a single point of failure.

Full explanation →

936

MCQhard

Refer to the exhibit. A developer created this CloudFormation template to create a public subnet. However, instances in the subnet cannot access the internet. What is the MOST likely cause?

A.The subnet does not have auto-assign public IP enabled

B.The route to the internet gateway is missing

C.The route table is not associated with the subnet

D.The internet gateway is not attached to the VPC

AnswerA

Instances need public IPs for internet access; template does not enable it.

Why this answer

The CloudFormation template creates a public subnet but does not set the 'MapPublicIpOnLaunch' property to 'true'. Without this setting, EC2 instances launched in the subnet do not automatically receive a public IPv4 address, which is required for internet-bound traffic to be routed through the Internet Gateway (IGW). Even if the route table has a default route (0.0.0.0/0) pointing to the IGW, the instance lacks a public IP, so the IGW cannot perform source NAT for outbound traffic, making internet access impossible.

Exam trap

AWS often tests the misconception that a default route to an IGW alone guarantees internet access, but the trap here is that the instance must have a public IP address for the IGW to perform source NAT, and auto-assign public IP is disabled by default in CloudFormation unless explicitly enabled.

How to eliminate wrong answers

Option B is wrong because the route to the internet gateway is not missing; the template explicitly includes a route in the public route table with destination 0.0.0.0/0 and target referencing the Internet Gateway. Option C is wrong because the route table is associated with the subnet via the 'AWS::EC2::SubnetRouteTableAssociation' resource in the template. Option D is wrong because the Internet Gateway is created and attached to the VPC using the 'AWS::EC2::VPCGatewayAttachment' resource, so the attachment is present.

Full explanation →

937

MCQhard

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access the internet to download software updates. The company has a NAT gateway in the public subnet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT gateway. However, the EC2 instance cannot access the internet. The network engineer verifies that the NAT gateway has an Elastic IP, the security group for the EC2 instance allows outbound HTTPS traffic, and the network ACL for the private subnet allows inbound and outbound ephemeral ports. What is the most likely cause of the issue?

A.The security group attached to the NAT gateway does not allow outbound traffic.

B.The route table for the public subnet does not have a route to an internet gateway.

C.The route table for the private subnet does not have a route to the NAT gateway.

D.The NAT gateway does not support UDP traffic.

AnswerB

The public subnet must have a default route to an internet gateway for the NAT gateway to reach the internet.

Why this answer

The NAT gateway resides in the public subnet, which must have a route table with a default route (0.0.0.0/0) pointing to an internet gateway (IGW) for the NAT gateway to forward traffic to the internet. Without this route, the NAT gateway cannot reach the IGW, so traffic from the private subnet EC2 instance fails even though the private subnet route is correctly configured. The security group and network ACL settings are irrelevant if the NAT gateway itself lacks internet connectivity.

Exam trap

The ANS-C01 exam often tests the misconception that the private subnet route alone is sufficient, distracting candidates from verifying the public subnet’s route to the internet gateway, which is a prerequisite for NAT gateway functionality.

How to eliminate wrong answers

Option A is wrong because NAT gateways do not have security groups; they are controlled by network ACLs and route tables only. Option C is wrong because the question explicitly states the private subnet route table already has a default route (0.0.0.0/0) pointing to the NAT gateway, so this is not the issue. Option D is wrong because NAT gateways support TCP, UDP, and ICMP traffic; the problem is not protocol-specific.

Full explanation →

938

MCQeasy

A company has an S3 bucket that stores sensitive documents. They need to ensure that all objects in the bucket are encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). Additionally, they want to prevent any uploads that do not specify the required KMS key. Which combination of bucket policy and default encryption should they implement?

A.Enable default encryption on the bucket with SSE-KMS using the required KMS key, and add a bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption-aws-kms-key-id header with the required key ARN.

B.Enable default encryption with SSE-S3, and add a bucket policy that denies s3:PutObject unless the request uses the required KMS key.

C.Use a bucket policy that requires the kms:Encrypt permission for the required key, but do not enable default encryption.

D.Enable default encryption with SSE-KMS using the required key, and rely on IAM policies to enforce encryption, not bucket policies.

AnswerA

Default encryption ensures objects are encrypted if no header is provided. The bucket policy enforces that uploads must use the specific KMS key.

Full explanation →

939

MCQeasy

A network engineer is troubleshooting connectivity between two EC2 instances in the same VPC but different subnets. The instances can ping each other's private IP addresses, but traffic on TCP port 443 fails. What is the most likely cause?

A.VPC Flow Logs misconfiguration.

B.Internet gateway not attached to the VPC.

C.Security group or network ACL rules blocking port 443.

D.Missing route in the route table.

AnswerC

Port 443 is likely blocked by a firewall rule.

Why this answer

Since the instances can ping each other, ICMP traffic is working, which rules out routing issues and confirms that the instances are reachable at Layer 3. TCP port 443 failing specifically indicates that a firewall rule is blocking the HTTPS traffic. Security groups are stateful and operate at the instance level, while network ACLs are stateless and operate at the subnet level; either can block port 443 while allowing ICMP, making this the most likely cause.

Exam trap

The ANS-C01 exam often tests the distinction between stateful security groups and stateless network ACLs, and the trap here is that candidates assume ping success means all Layer 4 traffic is fine, ignoring that security groups and ACLs can selectively block specific ports while allowing others.

How to eliminate wrong answers

Option A is wrong because VPC Flow Logs are a monitoring feature that captures metadata about traffic but do not block or filter traffic; misconfiguration would only affect logging, not connectivity. Option B is wrong because an internet gateway is only required for traffic destined to or from the internet, not for communication between instances within the same VPC, even across subnets. Option D is wrong because a missing route would prevent all traffic between the subnets, including ICMP pings, which are working; the VPC's main route table or subnet-specific route tables already have local routes for intra-VPC communication.

Full explanation →

940

MCQeasy

A company has a VPC with public and private subnets in three Availability Zones. The company hosts a web application on Amazon EC2 instances in the private subnets. The instances need to download security patches from the internet but must not be directly accessible from the internet. Which solution meets these requirements with the least operational overhead?

A.Deploy a NAT instance in a public subnet and configure the private subnet route tables to point to the NAT instance.

B.Attach an internet gateway to the VPC and add a default route to the internet gateway in the private subnet route tables.

C.Create a VPC endpoint for Amazon S3 and configure the instances to use the endpoint.

D.Deploy a NAT gateway in each public subnet and configure the private subnet route tables to point to the respective NAT gateway.

AnswerD

Managed service, highly available, minimal operational overhead.

Why this answer

A NAT gateway is a fully managed AWS service that provides outbound internet connectivity for instances in private subnets while preventing inbound internet access. Deploying a NAT gateway in each public subnet across three Availability Zones ensures high availability and fault tolerance, and configuring private subnet route tables with a default route (0.0.0.0/0) pointing to the respective NAT gateway meets the requirement with minimal operational overhead, as AWS handles patching and scaling.

Exam trap

AWS often tests the distinction between managed NAT gateways and self-managed NAT instances, where candidates may choose the NAT instance option (A) due to lower cost, overlooking the 'least operational overhead' requirement, or they may incorrectly select the VPC endpoint option (C) thinking it provides general internet access.

How to eliminate wrong answers

Option A is wrong because a NAT instance is a self-managed EC2 instance that requires ongoing maintenance, patching, and scaling, which increases operational overhead compared to a managed NAT gateway. Option B is wrong because attaching an internet gateway and adding a default route to it in private subnet route tables would make the instances directly accessible from the internet, violating the requirement that instances must not be directly accessible. Option C is wrong because a VPC endpoint for Amazon S3 only provides private connectivity to S3, not general internet access for downloading security patches from arbitrary internet sources.

Full explanation →

941

MCQmedium

A company uses AWS Certificate Manager (ACM) to provision SSL/TLS certificates for their Application Load Balancer (ALB). They want to ensure that the ALB only accepts connections using TLS 1.2 or higher. How should they configure this?

A.Use ACM to generate a certificate that only supports TLS 1.2.

B.Configure the ALB with an appropriate security policy that enforces TLS 1.2.

C.Configure the ALB to use a CloudFront distribution with a TLS policy.

D.Use AWS Route 53 to enforce TLS version at the DNS level.

AnswerB

ALB security policies allow specifying minimum TLS protocol version.

Why this answer

The Application Load Balancer supports security policies that allow you to enforce TLS 1.2 or higher. Option A is incorrect because ACM provides certificates but does not dictate the TLS version; that is determined by the load balancer's security policy. Option C is incorrect because while CloudFront can enforce TLS policies, it is an additional service and not required; the ALB itself can enforce TLS 1.2.

Option D is incorrect because Route 53 is a DNS service and does not handle TLS version enforcement.

Full explanation →

942

MCQeasy

A company has a security group that allows inbound SSH (port 22) from 0.0.0.0/0. A security engineer needs to restrict access to only the company's public IP range (203.0.113.0/24). What is the correct way to modify the security group rule?

A.Edit the existing inbound rule and change the source CIDR to 203.0.113.0/24.

B.Add a new inbound rule allowing SSH from 203.0.113.0/24 and keep the existing rule.

C.Remove the security group rule and add a new rule to deny SSH from 0.0.0.0/0.

D.Create a network ACL that denies SSH from 0.0.0.0/0.

AnswerA

This restricts SSH access to the specified IP range.

Why this answer

The CIDR should be changed from 0.0.0.0/0 to 203.0.113.0/24. Option B is wrong because adding a second rule does not remove the open rule. Option C is wrong because security groups do not support deny rules; they are allow-only.

Option D is wrong because removing the rule and adding a new deny rule is not how security groups work; security groups are allow-only.

Full explanation →

943

MCQeasy

A company is deploying a hybrid network with AWS Direct Connect and a VPN backup. The Direct Connect virtual interface is configured for private VIF with BGP. The VPN uses IPsec tunnels over the internet. What is the best practice to ensure symmetric routing and failover?

A.Configure ASN prepending on the VPN BGP advertisements to make them less preferred.

B.Use different BGP ASNs for Direct Connect and VPN to allow AWS to prefer the Direct Connect path.

C.Disable BGP on the Direct Connect private VIF and use static routes to force traffic through Direct Connect.

D.Use the same BGP ASN for both Direct Connect and VPN, and set a higher MED (Multi-Exit Discriminator) on the VPN routes.

AnswerD

Same ASN ensures AWS sees both as same neighbor, and MED controls preference.

Why this answer

Using the same BGP ASN for both Direct Connect and VPN, and setting a higher MED on the VPN routes, ensures symmetric routing by making the Direct Connect path more preferred. AWS uses the BGP AS_PATH length as a tie-breaker; with the same ASN, the paths are equal in AS_PATH length, so MED is evaluated. A higher MED on the VPN routes causes AWS to prefer the Direct Connect path, and if Direct Connect fails, the VPN routes (with higher MED) become active, providing failover.

Exam trap

The trap here is that candidates often assume different ASNs are required for path preference, but AWS mandates the same ASN for private VIF and VPN to prevent BGP loop detection, and MED is the correct mechanism to influence inbound traffic preference.

How to eliminate wrong answers

Option A is wrong because ASN prepending on the VPN BGP advertisements would artificially lengthen the AS_PATH, making the VPN path less preferred, but this does not guarantee symmetric routing because AWS may still see the Direct Connect path as equal or prefer it based on other attributes; moreover, ASN prepending is typically used to influence outbound traffic from on-premises, not inbound traffic from AWS. Option B is wrong because using different BGP ASNs for Direct Connect and VPN would cause AWS to prefer the path with the shorter AS_PATH (Direct Connect), but this can lead to asymmetric routing if the on-premises router prefers the VPN for return traffic; also, AWS requires the same ASN for private VIFs and VPN attachments to avoid BGP loop prevention issues. Option C is wrong because disabling BGP on the Direct Connect private VIF and using static routes removes dynamic failover capabilities and BGP health checking, making the solution brittle; static routes cannot adapt to link failures, and AWS does not support static routes on private VIFs for route propagation.

Full explanation →

944

MCQeasy

A company wants to ensure that all IAM users have multi-factor authentication (MFA) enabled. Which AWS service can be used to enforce this policy?

A.AWS Organizations SCP

B.AWS Config

C.IAM policy with a condition for aws:MultiFactorAuthPresent

D.AWS CloudTrail

AnswerC

An IAM policy can require MFA for all actions.

Why this answer

An IAM policy with a condition that checks aws:MultiFactorAuthPresent can require MFA for API calls, enforcing MFA usage. Option A is wrong because AWS Organizations SCPs can enforce policies at the account level but cannot require MFA for individual IAM users without an accompanying IAM policy. Option B is wrong because AWS Config can detect non-compliance with MFA rules but cannot enforce the policy itself.

Option D is wrong because AWS CloudTrail is used for logging API activity, not for enforcement.

Full explanation →

945

MCQhard

A company has a VPC with a CIDR block of 10.0.0.0/16. It has a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). An EC2 instance in the private subnet needs to access an S3 bucket. The company wants to ensure that traffic to S3 does not traverse the internet. Which solution should be used?

A.Create a VPC Interface Endpoint for S3 and associate it with the private subnet

B.Create a NAT Gateway in the public subnet and add a route in the private subnet route table pointing to the NAT Gateway

C.Create a VPC Gateway Endpoint for S3 and add a route in the private subnet route table pointing to the endpoint

D.Set up an AWS Direct Connect connection and use a private virtual interface

AnswerC

Gateway Endpoint provides private access to S3.

Why this answer

A VPC Gateway Endpoint for S3 allows private subnet resources to access S3 without traversing the internet, using AWS's internal network. By adding a route in the private subnet's route table pointing to the gateway endpoint (prefix list for S3), traffic destined for S3 stays within the AWS network, meeting the requirement to avoid internet transit.

Exam trap

The trap here is that candidates confuse Interface Endpoints (powered by AWS PrivateLink) with Gateway Endpoints, assuming S3 supports Interface Endpoints, but S3 only supports Gateway Endpoints (and later, Gateway Load Balancer endpoints, not Interface Endpoints).

How to eliminate wrong answers

Option A is wrong because a VPC Interface Endpoint for S3 is not supported; S3 only supports Gateway Endpoints (and later, Gateway Load Balancer endpoints, but not Interface Endpoints). Option B is wrong because a NAT Gateway routes traffic through the internet, which violates the requirement that traffic to S3 does not traverse the internet. Option D is wrong because AWS Direct Connect is an over-engineered solution for simple S3 access; it incurs additional cost and complexity, and does not inherently prevent traffic from traversing the internet unless combined with a VPC endpoint, making it unnecessary for this use case.

Full explanation →

946

Multi-Selectmedium

A company is designing a highly available architecture for a web application using an Application Load Balancer (ALB) in a VPC. They need to ensure that the application can handle a sudden increase in traffic and that the ALB can scale automatically. Which TWO actions should they take? (Choose two.)

Select 2 answers

A.Configure the target group's deregistration delay to a low value to quickly remove unhealthy targets.

B.Use a single subnet for the ALB to reduce complexity.

C.Use a Network Load Balancer instead of an ALB to improve throughput.

D.Enable cross-zone load balancing on the ALB.

E.Disable deletion protection on the ALB to allow automatic replacement.

AnswersA, D

A low deregistration delay ensures that unhealthy instances are removed quickly, preventing them from receiving traffic.

Why this answer

Configuring a low deregistration delay on the target group allows the ALB to quickly stop sending traffic to unhealthy targets, reducing the risk of failed requests during traffic spikes. This setting controls how long the ALB waits for in-flight requests to complete before deregistering a target, and a lower value accelerates the removal of unhealthy instances to maintain application responsiveness. Option D is correct because enabling cross-zone load balancing distributes incoming traffic evenly across all healthy targets in all Availability Zones, maximizing resource utilization and ensuring the ALB can scale automatically by leveraging capacity from multiple zones.

Exam trap

AWS often tests the misconception that enabling cross-zone load balancing is optional or unnecessary for high availability, when in fact it is a critical feature for distributing traffic evenly and supporting automatic scaling across zones.

Full explanation →

947

MCQmedium

A company is designing a multi-Region Active-Active architecture using Application Load Balancers (ALBs) behind AWS Global Accelerator. The application requires sticky sessions (session affinity) and must maintain session persistence even during failover. Which configuration should be used to achieve this?

A.Enable stickiness on each ALB individually and use a single Regional endpoint group.

B.Configure Global Accelerator to use session affinity with the 'two-tuple' protocol.

C.Configure Route 53 with latency-based routing and enable stickiness on each ALB.

D.Use a custom application cookie for stickiness that is consistent across all ALBs, and set the cookie domain to the Global Accelerator DNS name.

AnswerD

A custom cookie with a shared domain allows session persistence across ALBs in different Regions.

Why this answer

AWS Global Accelerator does not natively support session affinity (sticky sessions). To maintain session persistence across multi-Region ALBs during failover, you must use a custom application cookie that is consistent across all ALBs and set the cookie domain to the Global Accelerator DNS name. This ensures the client's browser sends the same cookie to any healthy ALB in any Region, preserving the session even when traffic shifts due to a failover.

Exam trap

The trap here is that candidates assume Global Accelerator can provide session affinity natively, similar to an ALB's stickiness feature, but Global Accelerator is a Layer 3/4 service and cannot maintain application-layer session state; the solution requires a custom cookie approach at the application level.

How to eliminate wrong answers

Option A is wrong because using a single Regional endpoint group defeats the purpose of a multi-Region Active-Active architecture; it would not provide cross-Region failover. Option B is wrong because Global Accelerator does not support session affinity with any tuple (two-tuple, three-tuple, or five-tuple); it is a network-layer service that does not maintain session state. Option C is wrong because Route 53 latency-based routing does not provide the fast failover and client IP preservation that Global Accelerator offers, and enabling stickiness on each ALB individually does not ensure session persistence across Regions during failover.

Full explanation →

948

MCQhard

A company has a VPC with public and private subnets across two Availability Zones. The private subnets require outbound internet access for updates, but must not be directly reachable from the internet. The company has a NAT gateway in each public subnet. Security team reports that instances in private subnets cannot reach the internet. Which configuration should be verified first?

A.Verify that the route table for the public subnets has a default route pointing to an internet gateway, and the private subnets' route table has a default route pointing to the NAT gateway

B.Verify that the VPC has a VPC endpoint for S3 configured

C.Verify that the network ACLs for the private subnets allow outbound traffic to 0.0.0.0/0

D.Verify that the security groups attached to the instances allow outbound HTTPS traffic

AnswerA

NAT gateway must be in a public subnet with a route to an internet gateway, and private subnets must route 0.0.0.0/0 to the NAT gateway.

Why this answer

For instances in private subnets to reach the internet via a NAT gateway, the private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT gateway, and the NAT gateway must be placed in a public subnet whose route table has a default route pointing to an internet gateway. If either route is missing, outbound internet access will fail. Option B is incorrect because VPC endpoints are for accessing specific AWS services (e.g., S3), not general internet access.

Option C is incorrect because NACLs are stateless and by default allow all outbound traffic; although custom NACLs could block traffic, routing misconfiguration is a more common first issue. Option D is incorrect because security groups are stateful and outbound traffic is allowed by default; blocking outbound HTTPS would be an intentional change, not the first thing to verify.

Full explanation →

949

MCQmedium

A company is deploying a critical application across multiple Availability Zones in a single AWS Region. They need a network design that provides the lowest possible latency between application tiers and supports automatic failover if an AZ becomes unavailable. Which design meets these requirements?

A.Use Amazon Route 53 weighted routing to distribute traffic to each AZ

B.Deploy an internal NLB per Availability Zone, with each NLB only registering targets in its own AZ, and an internet-facing Application Load Balancer (ALB) with targets in all AZs

C.Use a single internal Classic Load Balancer across all AZs

D.Deploy an internal Network Load Balancer (NLB) in a single AZ and route traffic from other AZs through it

AnswerB

This keeps traffic within the AZ for lowest latency, and the ALB provides failover across AZs.

Why this answer

Deploying an internal NLB per Availability Zone ensures cross-zone traffic is minimized, reducing latency between application tiers, while the internet-facing ALB provides automatic failover by distributing incoming traffic across healthy targets in all AZs. The NLB's per-AZ design keeps traffic within the same AZ for internal communication, and the ALB's health checks enable automatic rerouting if an AZ becomes unavailable.

Exam trap

The trap here is that candidates often assume a single load balancer across all AZs is sufficient for low latency, but they overlook that cross-AZ traffic adds latency and that per-AZ NLBs with cross-zone load balancing disabled are required to keep traffic local.

How to eliminate wrong answers

Option A is wrong because Route 53 weighted routing operates at the DNS level and does not provide automatic failover within the same region; it requires manual intervention or health checks with failover routing, and it adds DNS resolution latency that is not suitable for low-latency inter-tier traffic. Option C is wrong because a single Classic Load Balancer across all AZs does not minimize latency (it may route traffic across AZs) and Classic Load Balancers lack advanced features like cross-zone load balancing control and are deprecated for new deployments. Option D is wrong because deploying a single NLB in one AZ creates a single point of failure and forces cross-AZ traffic for all requests, increasing latency and violating the automatic failover requirement.

Full explanation →

950

MCQmedium

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. After adding a new VPC attachment, traffic from the on-premises network cannot reach the new VPC. The on-premises BGP route table shows the prefixes of the new VPC as received. What should the engineer check?

A.Verify that the on-premises router is advertising the correct prefix to AWS.

B.Verify that the new VPC has a route to the Transit Gateway in its route table.

C.Verify that the new VPC attachment is associated with the Transit Gateway route table that has the on-premises routes.

D.Verify that the new VPC's DNS resolution is enabled.

AnswerC

Transit Gateway route tables control connectivity between attachments.

Why this answer

For traffic from an on-premises network to reach a new VPC via Transit Gateway, the new VPC attachment must be associated with a Transit Gateway route table that contains a route (static or propagated) pointing to the on-premises network. Without this association, the Transit Gateway will not forward traffic to the new VPC even if the on-premises BGP route table has learned the VPC prefixes. Option A is incorrect because the on-premises router already receives the VPC prefixes via BGP, so advertising is not the issue.

Option B is incorrect: the VPC's route table controls outbound traffic from the VPC, but inbound traffic from on-premises is governed by the Transit Gateway route table. Option D is irrelevant because DNS resolution does not affect IP routing.

Full explanation →

951

MCQhard

A company uses AWS Organizations with multiple accounts. The security team needs to enforce that all S3 buckets in the organization have block public access enabled. Which approach should be used?

A.Use AWS CloudTrail to monitor bucket creation and alert.

B.Use AWS Config rules to detect and remediate noncompliant buckets.

C.Apply a service control policy (SCP) that denies bucket creation without block public access.

D.Create an IAM role in each account that restricts bucket permissions.

AnswerC

SCPs can centrally enforce policies across all accounts.

Why this answer

A service control policy (SCP) can deny the s3:PutBucketPublicAccessBlock action or enforce the block public access settings across all accounts in the organization. Option A (CloudTrail) is incorrect because CloudTrail only logs API calls for auditing, it does not enforce compliance. Option B (AWS Config) is incorrect because although AWS Config can detect noncompliant buckets, it requires additional automation for remediation and is not a direct enforcement mechanism like an SCP.

Option D (IAM role) is incorrect because IAM roles grant permissions to principals and cannot enforce bucket-level settings across accounts; SCPs are the appropriate tool for organization-wide policy enforcement.

Full explanation →

952

Multi-Selectmedium

A company has a VPC with a CIDR of 10.0.0.0/16. The VPC contains a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). An EC2 instance in the private subnet needs to access an S3 bucket. The company wants to use a VPC endpoint for S3. Which TWO configurations are required?

Select 2 answers

A.Assign a public IP address to the EC2 instance.

B.Create an endpoint policy that allows access to the S3 bucket.

C.Deploy a NAT gateway in the public subnet.

D.Add a route in the private subnet's route table pointing to the gateway endpoint.

E.Attach a security group to the gateway endpoint.

AnswersB, D

The endpoint policy controls which resources can be accessed via the endpoint.

Why this answer

To access S3 from a private subnet using a VPC endpoint, two configurations are required. First, an endpoint policy must be created (Option B is correct) to control which S3 buckets and actions are allowed. Second, a route must be added in the private subnet's route table pointing to the gateway endpoint (Option D is correct) to direct S3 traffic through the endpoint.

Option A is incorrect because assigning a public IP to the EC2 instance is not needed; the endpoint provides private connectivity. Option C is incorrect because a NAT gateway is not required when using a VPC endpoint. Option E is incorrect because gateway endpoints do not use security groups; they use endpoint policies for access control.

Full explanation →

953

MCQmedium

A company has a multi-tier web application running on EC2 instances in a VPC. The web tier must be accessible from the internet, but the application tier should only be accessible from the web tier. Which network design configuration meets these requirements?

A.Use a VPN connection from the web tier to the application tier, and place both tiers in private subnets.

B.Place both tiers in public subnets and use security groups to restrict traffic from the web tier to the application tier.

C.Place web servers in a public subnet with a NAT gateway, and application servers in a private subnet with a default route to the NAT gateway.

D.Place web servers in a public subnet with an internet gateway, and application servers in a private subnet with a route to the web subnet via a VPC peering connection.

AnswerB

Public subnets expose both tiers to the internet, increasing attack surface.

Why this answer

Placing both tiers in public subnets with an internet gateway allows the web tier to be accessible from the internet. Security groups can then be used to restrict inbound traffic to the application tier to only come from the web tier's security group, ensuring that the application tier is not directly accessible from the internet. This design meets the requirement without unnecessary complexity.

Exam trap

The trap is that candidates may think a private subnet is required for the application tier, but security groups can provide sufficient isolation even in public subnets. Alternatively, they may incorrectly choose D because it mentions a private subnet, not realizing that VPC peering is for connecting separate VPCs, not subnets within the same VPC.

How to eliminate wrong answers

Option A is wrong because a VPN connection is typically used for site-to-site or remote access, not for routing traffic between tiers within the same VPC; placing both tiers in private subnets would block internet access to the web tier. Option B is wrong because placing both tiers in public subnets exposes the application tier to the internet, violating the requirement that it should only be accessible from the web tier. Option C is wrong because a NAT gateway provides outbound internet access for private instances, not inbound access; the web tier in a public subnet would need an internet gateway, and the default route to the NAT gateway does not enable the web tier to initiate traffic to the application tier in a private subnet without additional routing.

Full explanation →

954

Multi-Selecthard

A company's security team is designing a solution to restrict S3 bucket access based on the requester's network. The company has a set of on-premises IP ranges and wants to ensure that only requests originating from those IPs can access the bucket. Which combination of actions should be taken? (Choose TWO.)

Select 2 answers

A.Configure the EC2 instances in the VPC to use Elastic IPs and allow those IPs in the bucket policy

B.Create a VPC endpoint for S3 and attach a VPC endpoint policy that restricts access to the specific bucket

C.Use AWS WAF to inspect HTTP requests to the bucket

D.Enable S3 Block Public Access on the bucket

E.Create an S3 bucket policy that uses the aws:SourceIp condition to allow access only from the on-premises IP ranges

AnswersB, E

This ensures that even if requests originate from the VPC, they must go through the endpoint and be subject to the policy.

Why this answer

To restrict S3 bucket access based on the requester's network, you can use an S3 bucket policy with the aws:SourceIp condition to allow only requests from specified on-premises IP ranges (option E). However, if requests originate from within a VPC, they might appear to come from the VPC's public IPs (e.g., through a NAT gateway) rather than the on-premises IPs. To handle this, you can create a VPC endpoint for S3 and attach a VPC endpoint policy that restricts access to the specific bucket (option B).

This ensures traffic from the VPC to S3 goes through the endpoint and can be controlled separately. Option A is incorrect because using Elastic IPs does not reliably restrict access; the bucket policy would need to allow specific Elastic IPs, but this does not account for on-premises IPs. Option C is incorrect because AWS WAF is for web application traffic, not S3 bucket access.

Option D is incorrect because S3 Block Public Access prevents public access but does not restrict based on the requester's network.

Full explanation →

955

MCQmedium

A network engineer is configuring an AWS Transit Gateway to connect multiple VPCs and an on-premises network via Direct Connect. The on-premises network advertises a prefix 10.0.0.0/8. One of the VPCs has a CIDR of 10.0.0.0/16. What will happen to traffic destined to 10.0.0.5 from another VPC attached to the Transit Gateway?

A.Traffic is routed to the VPC because of a more specific route

B.Traffic is dropped due to conflicting routes

C.Traffic is routed to the on-premises network because it is learned via Direct Connect

D.Traffic is load-balanced between the VPC and on-premises

AnswerA

Correct; Transit Gateway uses longest prefix match, and /16 is more specific than /8.

Why this answer

AWS Transit Gateway uses longest prefix match routing. The VPC's CIDR 10.0.0.0/16 is more specific than the on-premises prefix 10.0.0.0/8, so traffic destined to 10.0.0.5 will be routed to the VPC. Option B is incorrect; routes conflict only if they have the same prefix length, but here different lengths allow the longest prefix to win.

Option C is incorrect because the on-premises route is less specific and will not be used. Option D is incorrect because there is no load-balancing; the more specific route takes precedence.

Full explanation →

956

Multi-Selecthard

A company has a Direct Connect connection with multiple virtual interfaces (VIFs). The network team notices that traffic to a specific VPC is intermittently failing. The team suspects an issue with BGP routing. Which THREE steps should the team take to troubleshoot the BGP session? (Choose THREE.)

Select 3 answers

A.View the BGP route advertisements received by the on-premises router from AWS.

B.Check the Direct Connect endpoint health in the AWS Management Console.

C.Verify the allowed prefixes configuration on the virtual interface in the AWS console.

D.Examine VPC Flow Logs for dropped packets on the virtual interface.

E.Check the BGP session status using the 'bgp session' command on the on-premises router.

AnswersA, C, E

This helps identify if AWS is advertising the expected routes.

Why this answer

Viewing the BGP route advertisements received by the on-premises router from AWS directly reveals whether the expected prefixes are being advertised. If the routes are missing or incorrect, the VPC traffic will fail intermittently, making this a primary troubleshooting step for BGP routing issues.

Exam trap

AWS often tests the distinction between physical connectivity checks (like endpoint health) and BGP-specific troubleshooting steps, leading candidates to select options that address layer 1/2 issues instead of the BGP routing layer.

Full explanation →

957

Multi-Selecthard

A company needs to ensure that all outbound traffic from a VPC goes through a centralized inspection appliance in a different VPC. Which TWO actions must be taken to achieve this?

Select 2 answers

A.Deploy VPC endpoints for all AWS services used.

B.Use AWS Direct Connect Gateway to route traffic between VPCs.

C.Create VPC peering connections between all VPCs.

D.Use AWS Transit Gateway with appropriate route tables to direct traffic to the inspection VPC.

E.Configure the inspection VPC to forward traffic to its destination after inspection.

AnswersD, E

Transit Gateway supports transitive routing through route tables.

Why this answer

The correct answers are D and E. D: AWS Transit Gateway enables transitive routing between VPCs. By configuring appropriate route tables, traffic from source VPCs can be directed to the inspection VPC for centralized inspection.

E: After the inspection appliance processes the traffic, it must be forwarded to its final destination. This requires proper routing in the inspection VPC to send the inspected traffic out to the internet or to another VPC. Option A is incorrect because VPC endpoints only provide private access to AWS services, not general internet traffic routing.

Option B is incorrect because AWS Direct Connect Gateway is used for connecting on-premises networks to AWS, not for routing between VPCs. Option C is incorrect because VPC peering does not support transitive routing; it only allows direct communication between two VPCs, not through a third VPC.

Full explanation →

958

MCQeasy

A company wants to improve disaster recovery by replicating data between two AWS Regions. Which AWS service provides a managed solution for cross-Region network connectivity?

A.AWS Direct Connect

B.VPC Peering

C.AWS Site-to-Site VPN

D.AWS Global Accelerator

AnswerB

VPC Peering supports cross-Region connectivity, providing a managed, private network path for data replication between VPCs in different Regions.

Why this answer

VPC Peering supports cross-Region connections, enabling direct network connectivity between VPCs in different AWS Regions. This allows data replication without traversing the public internet, providing low-latency, private connectivity. AWS Global Accelerator is for traffic optimization and failover, not for direct connectivity for data replication.

Exam trap

The ANS-C01 exam often tests that VPC Peering supports cross-Region connectivity, which is a managed solution for inter-Region data replication. Candidates may incorrectly choose Global Accelerator, which is for improving application performance and availability, not for establishing direct network paths for data replication.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect establishes dedicated private connections from on-premises to AWS, but it does not inherently provide managed cross-Region connectivity between two AWS Regions. Option B is wrong because VPC Peering connects VPCs within the same or different Regions but requires manual setup, does not support transitive routing, and is not a managed service for cross-Region replication. Option C is wrong because AWS Site-to-Site VPN creates encrypted tunnels between on-premises networks and AWS, but it is not designed for direct cross-Region connectivity between AWS Regions and lacks the global optimization and failover features of Global Accelerator.

Full explanation →

959

Multi-Selectmedium

A company wants to inspect traffic between VPCs in the same region using a third-party security appliance. Which THREE components are needed? (Choose 3)

Select 3 answers

A.VPC Peering connections between all VPCs

B.NAT Gateways in each VPC

C.AWS Transit Gateway

D.Route tables in the inspection VPC directing traffic through the appliance

E.A dedicated inspection VPC for the security appliance

AnswersC, D, E

Transit Gateway enables hub-and-spoke connectivity.

Why this answer

The correct answers are C, D, and E. AWS Transit Gateway (C) is required to centrally interconnect multiple VPCs and route traffic through a common inspection point. A dedicated inspection VPC (E) hosts the third-party security appliance, segregating inspection traffic from production workloads.

Route tables in the inspection VPC (D) must direct inbound and outbound traffic through the appliance to enforce inspection. Option A is incorrect because VPC Peering does not support centralized inspection and creates a full mesh. Option B is incorrect because NAT Gateways only provide outbound internet access, not inter-VPC traffic inspection.

Full explanation →

960

Multi-Selecthard

A network engineer is troubleshooting a VPN connection that is not passing traffic. The tunnel status shows as 'UP'. Which THREE steps should the engineer take to diagnose the issue?

Select 3 answers

A.Ensure that the security groups for instances allow inbound traffic from the on-premises network

B.Confirm that the on-premises router is advertising the correct routes via BGP

C.Check the IKE and IPSEC settings on the customer gateway

D.Verify that the VPC route table has a route to the on-premises network via the virtual private gateway

E.Check the internet gateway route table for the VPC

AnswersA, B, D

Security groups can block traffic even if the VPN is up.

Why this answer

Security groups act as a virtual firewall for instances, controlling inbound and outbound traffic at the instance level. Even if the VPN tunnel is up, traffic will be dropped if the security group does not explicitly allow inbound traffic from the on-premises network's IP range. This is a common misconfiguration that prevents traffic flow despite a healthy tunnel.

Exam trap

The trap here is that candidates assume a 'UP' tunnel guarantees traffic flow, but AWS often tests that Layer 3 routing and security group rules are separate from tunnel status and must be verified independently.

Full explanation →

961

MCQmedium

A company is using AWS Client VPN to provide remote access to their VPC. They want to ensure that only authenticated users from their corporate Active Directory can access the VPN. Which authentication method should they use?

A.IAM authorization

B.SAML-based federated authentication

C.Certificate-based authentication using AWS Certificate Manager

D.Mutual authentication

AnswerB

SAML allows integration with Active Directory for user authentication.

Why this answer

AWS Client VPN supports SAML-based federated authentication, which can integrate with your corporate Active Directory to authenticate users. Option A is wrong because IAM authorization is not an authentication method for Client VPN; it is used for controlling access to AWS APIs. Option C is wrong because certificate-based authentication uses client certificates and does not directly tie to Active Directory user identities.

Option D is wrong because mutual authentication still relies on certificates and does not inherently provide integration with Active Directory.

Full explanation →

962

MCQhard

A company is deploying a latency-sensitive application across multiple AWS Regions. They want to use the AWS global network to route traffic to the nearest edge location for fast content delivery. Which service should they use?

A.AWS Global Accelerator

B.Amazon Route 53

C.AWS Direct Connect

D.Amazon CloudFront

AnswerA

Global Accelerator improves performance by routing traffic over the AWS backbone to the nearest edge.

Why this answer

AWS Global Accelerator uses the AWS global network to direct traffic to the nearest edge location via Anycast IP addresses, then routes it over the AWS backbone to the optimal regional endpoint. This minimizes latency and jitter for latency-sensitive applications by avoiding the public internet and providing static IP addresses for traffic management.

Exam trap

The ANS-C01 exam often tests the distinction between a CDN (CloudFront) and a global network accelerator (Global Accelerator), where candidates mistakenly choose CloudFront for latency-sensitive non-HTTP traffic or real-time applications that require static IP addresses and TCP/UDP optimization.

How to eliminate wrong answers

Option B (Amazon Route 53) is wrong because it is a DNS service that resolves domain names to IP addresses; it does not provide edge-based traffic acceleration or use the AWS global network for routing, and its latency-based routing is DNS-level, not real-time path optimization. Option C (AWS Direct Connect) is wrong because it is a dedicated network connection from on-premises to AWS, not a service for routing traffic to edge locations or accelerating content delivery across regions. Option D (Amazon CloudFront) is wrong because it is a content delivery network (CDN) optimized for caching static and dynamic content at edge locations, not for accelerating TCP/UDP traffic for latency-sensitive applications that require real-time routing over the AWS global network.

Full explanation →

963

MCQhard

A company has a VPC with a CIDR of 10.0.0.0/16. They have two subnets: subnet A (10.0.1.0/24) and subnet B (10.0.2.0/24). They launch an EC2 instance in subnet A and another in subnet B. The security groups for both instances allow all traffic from the other instance's private IP. However, the instances cannot communicate. What is the most likely cause?

A.The instances are in different Availability Zones

B.The network ACLs are blocking the traffic

C.The security groups are stateful and block return traffic

D.The route tables do not have a local route

AnswerB

NACLs are stateless and need to allow both outbound and inbound traffic for each direction.

Why this answer

The most likely cause is that the network ACLs (NACLs) are blocking the traffic. Security groups are stateful and allow return traffic automatically, but NACLs are stateless and require explicit inbound and outbound rules for both directions. By default, custom NACLs deny all traffic, so even though the security groups permit communication, the NACLs on subnets A and B must allow the traffic.

The correct answer is B.

Exam trap

The trap here is that candidates often assume security groups are the only firewall layer or forget that NACLs are stateless and require explicit rules for both directions, leading them to overlook NACL misconfigurations when security groups appear permissive.

How to eliminate wrong answers

Option A is wrong because instances in different Availability Zones can communicate within the same VPC as long as routing and security rules permit; AZ placement does not inherently block traffic. Option C is wrong because security groups are stateful, meaning they automatically allow return traffic for permitted outbound connections, so they do not block return traffic. Option D is wrong because VPCs automatically have a local route in the main route table for the VPC CIDR (10.0.0.0/16), enabling communication between subnets without additional routes.

Full explanation →

964

Multi-Selectmedium

A company is setting up a site-to-site VPN connection between an on-premises network and AWS. The VPN uses two tunnels for high availability. The network engineer needs to ensure that if one tunnel goes down, traffic automatically fails over to the other tunnel. Which THREE steps should the engineer perform? (Choose THREE.)

Select 3 answers

A.Configure static routes pointing to the VPN connection.

B.Configure BGP on both VPN tunnels.

C.Use a single customer gateway device with multiple BGP sessions.

D.Configure two customer gateway devices on-premises, each with a separate BGP session.

E.Enable route propagation on the VPC route table for the virtual private gateway.

AnswersB, D, E

BGP provides automatic failover between tunnels.

Why this answer

BGP is the correct choice for automatic failover because it enables dynamic route advertisement and withdrawal over the VPN tunnels. When a tunnel fails, BGP withdraws the corresponding routes, causing the VPC route table to automatically use the remaining tunnel's routes. This eliminates the need for manual intervention or static route manipulation.

Exam trap

The ANS-C01 exam often tests the misconception that a single customer gateway device with multiple BGP sessions is sufficient for high availability, but the trap is that this only protects against tunnel failure, not device failure; the correct approach for full redundancy is to use two separate customer gateway devices, each with its own BGP session (Option D).

Full explanation →

965

MCQhard

A company designs a multi-account AWS environment using AWS Organizations. The networking team wants a centralized inspection VPC for traffic between VPCs and on-premises. Which architecture ensures that all inter-VPC traffic passes through the inspection VPC?

A.VPC peering between all VPCs and the inspection VPC.

B.AWS Network Firewall deployed in each VPC.

C.AWS Transit Gateway with centralized routing to the inspection VPC.

D.AWS Direct Connect Gateway with virtual interfaces.

AnswerC

Centralized routing enforces inspection.

Why this answer

AWS Transit Gateway enables centralized routing by attaching all VPCs and the on-premises network to a single transit gateway, then configuring route tables to force all inter-VPC traffic through a dedicated inspection VPC appliance (e.g., firewall or NGFW). This ensures traffic flows via the inspection VPC without requiring full-mesh peering or per-VPC firewalls.

Exam trap

The trap here is that candidates often confuse VPC peering with transitive routing, assuming that peering multiple VPCs to a central VPC automatically routes traffic through it, but VPC peering does not support transitive routing—each peering connection is non-transitive, so traffic between two spoke VPCs would not go through the central VPC unless explicit routing is configured, which is complex and not natively supported.

How to eliminate wrong answers

Option A is wrong because VPC peering creates direct, one-to-one connections between VPCs; traffic between peered VPCs does not traverse a central inspection point unless explicitly routed through an intermediate VPC, which would require complex transitive routing that VPC peering does not support (no transitive peering). Option B is wrong because AWS Network Firewall deployed in each VPC only inspects traffic entering or leaving that specific VPC; it does not force inter-VPC traffic to pass through a centralized inspection VPC, as traffic can still flow directly via peering or transit gateway without being routed through the inspection VPC. Option D is wrong because AWS Direct Connect Gateway is used to connect on-premises networks to multiple VPCs via Direct Connect, but it does not provide centralized routing or inspection for inter-VPC traffic; it only extends connectivity from on-premises to VPCs, not between VPCs.

Full explanation →

966

MCQmedium

A company is using AWS Transit Gateway to connect multiple VPCs. They notice that traffic between two VPCs in different Availability Zones is taking a suboptimal path, resulting in cross-AZ data transfer costs. How can they optimize the path and reduce costs?

A.Replace Transit Gateway with VPC Peering between the VPCs.

B.Use Availability Zone affinity by launching resources in the same AZ and using Transit Gateway to route within the same AZ.

C.Enable Transit Gateway multicast to replicate traffic across AZs.

D.Configure the Transit Gateway to use a single Availability Zone for all attachments.

AnswerB

Correct: Keeps traffic within AZ, avoiding cross-AZ charges.

Why this answer

Configuring resources in the same Availability Zone (AZ) and using Transit Gateway to route within that AZ eliminates cross-AZ data transfer costs. AWS Transit Gateway charges for cross-AZ traffic, so keeping traffic local to a single AZ avoids these charges while still leveraging Transit Gateway for centralized routing.

Exam trap

The trap here is that candidates confuse Transit Gateway's regional nature with AZ-specific routing, assuming that Transit Gateway can be pinned to a single AZ, when in fact it always routes traffic through the AZ of the attachment's ENI, and cross-AZ costs are incurred unless resources are in the same AZ.

How to eliminate wrong answers

Option A is wrong because replacing Transit Gateway with VPC Peering does not inherently optimize the path or reduce costs; VPC Peering also incurs cross-AZ data transfer charges and lacks centralized routing, making it a less scalable solution. Option C is wrong because Transit Gateway multicast is designed for one-to-many traffic replication (e.g., streaming media) and does not address suboptimal routing or cross-AZ costs for unicast traffic between two VPCs. Option D is wrong because configuring Transit Gateway to use a single Availability Zone for all attachments is not supported; Transit Gateway is a regional service that operates across all AZs in a region, and attachments are inherently AZ-aware, so this configuration is invalid and would break connectivity.

Full explanation →

967

MCQmedium

A company has a VPC with CIDR 172.16.0.0/16. They have two subnets: 172.16.1.0/24 (public) and 172.16.2.0/24 (private) in us-west-2a. They have an EC2 instance in the private subnet that needs to access an S3 bucket for log uploads. The company wants to avoid using a NAT Gateway to reduce costs. The S3 bucket is in the same region. Which solution should the network engineer implement?

A.Assign an IAM instance profile to the EC2 instance that allows S3 access.

B.Set up a VPN connection from the VPC to the S3 bucket.

C.Create a VPC Gateway Endpoint for S3 and add a route from the private subnet to the endpoint.

D.Create an S3 access point and configure the VPC to use it.

AnswerC

A gateway endpoint provides private connectivity to S3 without a NAT.

Why this answer

A VPC Gateway Endpoint for S3 allows private subnet resources to access S3 without traversing the internet or requiring a NAT Gateway. The endpoint uses AWS PrivateLink to route traffic directly to S3 over the AWS network, and you must add a route in the private subnet's route table pointing to the endpoint (prefix list ID) to enable connectivity.

Exam trap

AWS often tests the misconception that an IAM role alone provides network access, but the trap here is that private subnets require a route to S3, and without a NAT Gateway or VPC endpoint, traffic cannot leave the subnet even with correct IAM permissions.

How to eliminate wrong answers

Option A is wrong because an IAM instance profile grants permissions but does not provide network connectivity; the EC2 instance still needs a route to reach S3, and without a NAT Gateway or VPC endpoint, traffic from a private subnet cannot reach S3. Option B is wrong because a VPN connection is used to connect on-premises networks to a VPC, not to access AWS services like S3; S3 does not support VPN termination. Option D is wrong because an S3 access point is a feature for managing data access with specific policies and network controls, but it does not create a network path; you still need a VPC endpoint or other connectivity to route traffic from the private subnet to the access point.

Full explanation →

968

MCQeasy

A company wants to monitor network traffic to and from an EC2 instance to detect anomalous outbound traffic. Which AWS service should they use to capture and analyze the traffic?

A.Amazon GuardDuty

B.Amazon CloudWatch Logs

C.AWS Config

D.VPC Traffic Mirroring

AnswerD

Traffic Mirroring captures and copies traffic for analysis.

Why this answer

VPC Traffic Mirroring (option D) is correct because it captures and copies network traffic from EC2 instances for analysis. Amazon GuardDuty (option A) is a threat detection service that analyzes logs and findings but does not capture raw traffic. Amazon CloudWatch Logs (option B) can capture application and system logs, but not full packet-level traffic.

AWS Config (option C) records configuration changes to resources, not network traffic. Therefore, VPC Traffic Mirroring is the appropriate service for capturing and analyzing network traffic to detect anomalous outbound behavior.

Full explanation →

969

Multi-Selectmedium

A company has a VPC with public and private subnets. The private subnets must access an S3 bucket without traversing the internet. Which TWO methods can achieve this? (Choose TWO.)

Select 2 answers

A.Attach an internet gateway to the VPC and route traffic through it.

B.Create a VPC gateway endpoint for S3 and associate it with the private subnet route tables.

C.Set up a VPN connection to the on-premises network and access S3 from there.

D.Use AWS PrivateLink to create a VPC endpoint for the S3 bucket.

E.Place a NAT gateway in the public subnet and route traffic through it.

AnswersB, D

Gateway endpoint provides private access to S3.

Why this answer

A VPC gateway endpoint for S3 uses AWS's internal network to route traffic to S3 without traversing the internet. This endpoint is a horizontally scaled, redundant, and highly available gateway that is added to the route table of the private subnets, enabling direct, private connectivity to S3.

Exam trap

The trap here is that candidates often confuse gateway endpoints with interface endpoints (PrivateLink) or assume that a NAT gateway provides private connectivity, when in fact both gateway endpoints and PrivateLink can achieve private S3 access, but only gateway endpoints are free and do not require an ENI in the subnet.

Full explanation →

970

MCQeasy

A company wants to enable DNS resolution for hybrid network using Route 53 Resolver. The on-premises DNS servers are reachable via Direct Connect. The company wants to forward queries for a custom domain (example.corp) from VPC to on-premises. Which resource should be created in the VPC?

A.A VPC endpoint for Route 53 Resolver service.

B.Route 53 Resolver rule that forwards example.corp to on-premises DNS servers.

C.Route 53 Resolver inbound endpoint.

D.Route 53 Resolver outbound endpoint and associate a resolver rule.

AnswerD

An outbound endpoint forwards DNS queries from VPC to on-premises, and a rule specifies the domain.

Why this answer

To forward DNS queries from a VPC to on-premises DNS servers, you need a Route 53 Resolver outbound endpoint, which initiates outbound DNS traffic from the VPC. You then associate a resolver rule that specifies the domain (example.corp) and the target on-premises DNS server IPs, enabling conditional forwarding via Direct Connect.

Exam trap

The ANS-C01 exam often tests the distinction between inbound and outbound endpoints; the trap here is confusing the direction of DNS traffic, leading candidates to select the inbound endpoint (Option C) when outbound forwarding is required.

How to eliminate wrong answers

Option A is wrong because a VPC endpoint for Route 53 Resolver service is used to privately access Route 53 APIs, not to forward DNS queries to on-premises. Option B is wrong because a resolver rule alone is not a resource that can be created in a VPC; it must be associated with an outbound endpoint to function. Option C is wrong because a Route 53 Resolver inbound endpoint is used to receive DNS queries from on-premises into the VPC, not to forward queries outbound from the VPC to on-premises.

Full explanation →

971

MCQhard

A company is setting up AWS Direct Connect with a 1 Gbps dedicated connection. They want redundant connectivity with automatic failover. What is the most cost-effective way to achieve this?

A.Use a single connection with multiple VLANs.

B.Use a single connection with a VPN over the same connection for redundancy.

C.Provision a second Direct Connect connection at a different location and configure BGP.

D.Provision a single Direct Connect connection and use a VPN over the internet as backup.

AnswerC

A second Direct Connect connection at a different location with BGP provides true physical redundancy and automatic failover. This is the correct and most cost-effective choice among the options.

Why this answer

Achieving true redundancy with automatic failover for AWS Direct Connect requires physically diverse connections. A second Direct Connect connection at a different location, combined with BGP routing (e.g., using AS_PATH prepending or MED for traffic engineering), ensures that traffic automatically fails over if one connection goes down. While a VPN over the internet (option D) might seem cost-effective, it introduces variable latency, potential bandwidth constraints, and additional data transfer costs, making it less suitable for consistent performance and automatic failover in a dedicated connectivity context.

Therefore, provisioning a second Direct Connect connection is the most cost-effective approach that meets the requirements.

Exam trap

Candidates often assume that a VPN backup over the internet is the most cost-effective redundancy option, but the exam tests that for dedicated connections, physical diversity is required to maintain consistent performance and meet SLAs. A VPN over the same connection (option B) or multiple VLANs (option A) do not provide true physical redundancy.

How to eliminate wrong answers

Option A is wrong because a single connection with multiple VLANs does not provide physical redundancy; a single fiber cut or device failure would take down all VLANs and all traffic. Option B is wrong because using a VPN over the same Direct Connect connection does not add a physically diverse path; it still relies on the same underlying single connection, so it offers no failover if that connection fails. Option D is wrong because while a VPN over the internet provides a backup path, it introduces additional latency, potential bandwidth limitations, and ongoing VPN costs that are typically higher than the cost of a second Direct Connect connection at a different location, making it less cost-effective for a 1 Gbps dedicated connection scenario.

Full explanation →

972

MCQhard

A company has multiple AWS accounts and wants to centrally manage network resources using AWS Transit Gateway. Which feature allows sharing the Transit Gateway across accounts?

A.VPC peering

B.AWS Resource Access Manager (RAM)

C.AWS Organizations

D.AWS Service Catalog

AnswerB

RAM enables sharing Transit Gateways across accounts.

Why this answer

AWS Resource Access Manager (RAM). RAM enables sharing of Transit Gateways across multiple AWS accounts within an organization, simplifying centralized network management. Option A (VPC peering) is a separate feature for connecting VPCs, not for sharing resources.

Option C (AWS Organizations) helps manage accounts and policies but does not directly share resources. Option D (AWS Service Catalog) creates standardized products, not for sharing existing resources.

Full explanation →

973

MCQmedium

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team wants to ensure that traffic between VPCs is inspected by a centralized security appliance running in a security VPC. Which configuration should be used?

A.Configure network ACLs in each VPC to deny traffic directly between VPCs.

B.Attach the VPCs to the Transit Gateway and configure route tables to send inter-VPC traffic to the security VPC via a route pointing to the security VPC's attachment.

C.Create VPC peering connections between each VPC and the security VPC, then update route tables.

D.Use NAT gateways in each VPC to route traffic through the security VPC.

AnswerB

Forces traffic through the security VPC for inspection.

Why this answer

AWS Transit Gateway enables centralized traffic inspection by attaching VPCs and configuring route tables to route inter-VPC traffic to the security VPC's attachment. Note that the route must point to the security VPC attachment, not a blackhole route (which drops traffic). Option A is incorrect because network ACLs control traffic at the subnet level and cannot route traffic to another VPC.

Option C is incorrect because VPC peering does not provide a centralized inspection point without complex routing. Option D is incorrect because NAT gateways are for outbound internet traffic, not inter-VPC inspection.

Exam trap

Option B incorrectly uses 'blackhole route' which drops traffic; the intended configuration is to route traffic to the security VPC attachment, not use a blackhole.

Full explanation →

974

MCQmedium

A company is designing a network for a containerized microservices application running on Amazon ECS. The application consists of several microservices that need to communicate with each other. The company wants to use service discovery so that services can find each other by name. They also want to ensure that traffic between services is encrypted in transit. The microservices are deployed across multiple Availability Zones. Which combination of services should the company use?

A.Use AWS Cloud Map for service discovery and AWS App Mesh for encryption in transit

B.Use an Application Load Balancer for each service and configure HTTPS listeners

C.Use VPC peering between each service's VPC

D.Use Amazon Route 53 private hosted zones for service discovery and enable encryption at the application layer

AnswerA

Cloud Map provides service discovery; App Mesh provides encryption.

Why this answer

AWS Cloud Map provides service discovery by registering microservices with DNS names and health checks, allowing ECS tasks to resolve each other by name. AWS App Mesh uses Envoy sidecar proxies to enforce mutual TLS (mTLS) encryption between services, ensuring traffic is encrypted in transit without requiring changes to application code. This combination meets the requirements for name-based discovery and encrypted inter-service communication across multiple Availability Zones.

Exam trap

The trap here is that candidates often confuse service discovery with load balancing or assume that a private hosted zone alone provides encryption, when in fact DNS-based discovery (Route 53) only resolves names and requires a separate mechanism like App Mesh or mTLS to encrypt traffic in transit.

How to eliminate wrong answers

Option B is wrong because using an Application Load Balancer for each service introduces unnecessary complexity and cost, and ALBs operate at the application layer (HTTP/HTTPS), which does not provide encryption for all inter-service traffic (e.g., gRPC or TCP-based services) and does not natively provide service discovery by name without additional DNS integration. Option C is wrong because VPC peering connects entire VPCs, not individual services, and does not provide service discovery or encryption; it only enables network-layer connectivity between VPCs. Option D is wrong because Amazon Route 53 private hosted zones can provide DNS-based service discovery, but they do not encrypt traffic; encryption at the application layer must be implemented separately by the application code, which violates the requirement for transparent encryption in transit.

Full explanation →

975

MCQmedium

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance is behind a NAT Gateway in the public subnet. The download is failing. Which configuration should the network engineer check FIRST?

A.The network ACL for the private subnet allows inbound HTTP/HTTPS traffic.

B.The EC2 instance has a public IP address assigned.

C.The Internet Gateway is attached to the private subnet.

D.The route table associated with the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway.

AnswerD

Correct: Without this route, traffic cannot reach the NAT Gateway.

Why this answer

For an EC2 instance in a private subnet to reach the internet via a NAT Gateway, the private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway. Without this route, traffic from the instance destined for the internet has no path to the NAT Gateway, causing the download to fail.

Exam trap

AWS often tests the misconception that a private instance needs a public IP or that NACLs are the primary cause of outbound internet failures, when in fact the missing default route to the NAT Gateway is the most common misconfiguration.

How to eliminate wrong answers

Option A is wrong because network ACLs are stateless and must allow both inbound and outbound traffic; however, the default NACL already allows all traffic, and the failure is more likely due to routing, not ACLs. Option B is wrong because an EC2 instance in a private subnet does not need a public IP address to access the internet through a NAT Gateway; the NAT Gateway itself uses an Elastic IP, and the instance uses the NAT's public IP for outbound traffic. Option C is wrong because an Internet Gateway is attached to the VPC, not to a subnet, and it is used by public subnets; private subnets route through the NAT Gateway, not directly through the Internet Gateway.

Full explanation →

Page 13 of 22

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

Practice ANS-C01 by domain

Target a specific domain to shore up weak areas.

Network Management and Operations Network Security, Compliance and Governance Network Design Network Implementation

See all domains with question counts →