Knowledge + Practice

AWS Certified Advanced Networking Specialty ANS-C01 (ANS-C01) — Questions 976–1050

1621 questions total · 22pages · All types, answers revealed

Take a mock exam Exam hub

Page 14 of 22

976

MCQeasy

A network engineer is troubleshooting an issue where an EC2 instance in a public subnet cannot reach the internet. The instance has a public IP, and the route table has a default route to an internet gateway. What is the most likely cause?

A.The network ACL is blocking outbound traffic

B.The internet gateway is not attached to the VPC

C.The security group does not allow outbound HTTP traffic

D.The instance does not have a public IP

AnswerA

Network ACLs are stateless and must explicitly allow outbound traffic and inbound return traffic.

Why this answer

Even with correct routes, if the subnet's network ACL does not allow outbound traffic, the instance cannot reach the internet. Network ACLs are stateless and must allow both outbound and inbound ephemeral ports.

Full explanation →

977

MCQmedium

A company wants to restrict access to an Amazon S3 bucket so that only traffic from a specific AWS Direct Connect virtual interface (VIF) can access it. Which combination of steps should the company take?

A.Attach an S3 bucket policy that denies access unless the source IP is the public IP address of the Direct Connect VIF.

B.Create a VPC endpoint for S3 with a VPC endpoint policy that allows access only from the VPC, and configure the VPC route table to route S3 traffic through the Direct Connect VIF.

C.Create a network ACL that allows S3 traffic only from the Direct Connect CIDR block and associate it with the VPC subnet connected to the VIF.

D.Configure the Direct Connect VIF with a public IP address and use an S3 bucket policy that allows access only from that IP address.

AnswerB

This ensures that S3 traffic must traverse the VPC endpoint, and the route table forces traffic through the Direct Connect VIF, restricting access to that path.

Why this answer

Option B. To restrict access to an S3 bucket to only traffic from a specific Direct Connect VIF, you can create a VPC endpoint for S3 and attach a VPC endpoint policy that allows access only from the VPC. Then, configure the VPC route table to route traffic destined for S3 through the Direct Connect VIF, ensuring that only traffic coming through that VIF can reach the endpoint.

Option A is incorrect because the Direct Connect VIF does not have a public IP address; it uses private IPs. Option C is incorrect because network ACLs are stateless and cannot enforce path-specific restrictions; also they operate at the subnet level, not for specific services like S3. Option D is incorrect because Direct Connect VIFs do not have public IP addresses; they use private IPs and traffic goes through private virtual interfaces.

Exam trap

A common trap is to think that a bucket policy with an IP address condition can restrict traffic to a Direct Connect VIF, but Direct Connect VIFs use private IPs, not public IPs. Another trap is using network ACLs, which are stateless and cannot restrict based on the source being a specific VIF.

Full explanation →

978

Multi-Selectmedium

Which THREE factors should be considered when designing a highly available AWS Site-to-Site VPN connection?

Select 3 answers

A.Use two VPN tunnels with the same customer gateway IP

B.Enable BGP for dynamic route propagation

C.Use two VPN tunnels each with a different customer gateway IP

D.Use a single VPN tunnel with a static route

E.Configure redundant customer gateways

AnswersB, C, E

BGP provides automatic failover and route propagation.

Why this answer

BGP (Border Gateway Protocol) enables dynamic route propagation across the VPN tunnels, allowing automatic failover and route convergence if one tunnel goes down. This is critical for high availability because it eliminates the need for manual route updates and supports path selection based on BGP attributes, ensuring traffic is rerouted through the remaining healthy tunnel.

Exam trap

AWS often tests the misconception that using two tunnels with the same customer gateway IP (Option A) provides redundancy, but the trap is that this still creates a single point of failure at the customer gateway device itself, whereas true high availability requires separate customer gateway IPs (Option C) and redundant gateways (Option E).

Full explanation →

979

MCQhard

A company runs a multi-tier web application on AWS. The web servers in public subnets need to send traffic to the application servers in private subnets. The application servers must only accept traffic from the web servers. Both tiers are in the same VPC. Which design meets these requirements without introducing a single point of failure or unnecessary complexity?

A.Place the web servers in a public subnet with a security group that allows inbound from 0.0.0.0/0 on port 443. Place the app servers in a private subnet with a security group that allows inbound from the web server security group on the application port.

B.Place the web servers and app servers in the same private subnet behind an internal Network Load Balancer. Route web traffic through the NLB.

C.Place the web servers in a public subnet with an Internet Gateway. Place the app servers in a private subnet with a NAT Gateway for outbound traffic. Use NACLs to allow inbound from the web subnet CIDR.

D.Place the web servers in a public subnet with a NACL allowing inbound on port 443. Place the app servers in a private subnet with a NACL allowing inbound from the web subnet CIDR on the application port.

AnswerA

This is correct because it uses security group references for fine-grained, stateful filtering without introducing a single point of failure.

Why this answer

It uses security group referencing, which allows the app servers' security group to dynamically allow traffic from any instance associated with the web servers' security group, regardless of IP address changes. This design avoids a single point of failure by not introducing any load balancer or gateway, and it minimizes complexity by leveraging native VPC security group behavior within the same VPC.

Exam trap

The trap here is that candidates often overcomplicate the solution by introducing load balancers or NAT gateways, or they incorrectly choose NACLs over security groups, not realizing that security group referencing provides a simpler, more dynamic, and more secure solution without single points of failure.

How to eliminate wrong answers

Option B is wrong because placing both tiers in the same private subnet behind an internal Network Load Balancer introduces a single point of failure (the NLB) and unnecessary complexity, as the requirement can be met with simple security group rules without a load balancer. Option C is wrong because using a NAT Gateway for outbound traffic is irrelevant to the requirement of allowing inbound traffic from web servers to app servers; it also introduces a single point of failure and unnecessary complexity. Option D is wrong because using NACLs to allow inbound from the web subnet CIDR is less secure and less dynamic than security group referencing, and NACLs are stateless, requiring separate rules for return traffic, which adds complexity and potential misconfiguration.

Full explanation →

980

MCQeasy

A company has a VPC with public and private subnets in two Availability Zones. The company hosts a web application on EC2 instances in the private subnets. The application needs to access an S3 bucket. What is the MOST cost-effective and secure way to provide this access?

A.Deploy a NAT Gateway in each public subnet and route traffic from private subnets through it.

B.Use AWS Transit Gateway to route traffic to S3 via a centralized VPN.

C.Attach an Internet Gateway to the VPC and assign public IPs to the EC2 instances.

D.Create a VPC Gateway Endpoint for S3 and attach it to the private subnet route tables.

AnswerD

Cost-effective and secure; no data transfer costs.

Why this answer

A VPC Gateway Endpoint for S3 provides private, secure connectivity to S3 without traversing the public internet, and it incurs no hourly or data processing charges, making it the most cost-effective and secure choice. Traffic stays within the AWS network, and the endpoint is attached to the private subnet route tables, allowing EC2 instances in those subnets to access S3 directly without needing a NAT Gateway or public IPs.

Exam trap

The trap here is that candidates often confuse VPC Gateway Endpoints with Interface Endpoints or assume a NAT Gateway is required for private subnet internet access, overlooking that S3 can be accessed privately and cost-effectively via a Gateway Endpoint without any NAT or internet gateway.

How to eliminate wrong answers

Option A is wrong because deploying a NAT Gateway in each public subnet incurs hourly charges and data processing costs, and it routes traffic through the internet, which is less secure and more expensive than a VPC Gateway Endpoint. Option B is wrong because AWS Transit Gateway is designed for connecting multiple VPCs or on-premises networks, not for providing direct S3 access; using a centralized VPN adds unnecessary complexity, latency, and cost. Option C is wrong because attaching an Internet Gateway and assigning public IPs to EC2 instances exposes them to the public internet, violating security best practices and incurring additional costs for data transfer over the internet.

Full explanation →

981

MCQeasy

A company needs to securely connect multiple VPCs across different AWS Regions using AWS backbone network infrastructure without traversing the public internet. The solution must be managed centrally and support transitive routing between VPCs. Which service should the company use?

A.VPC peering connections in a full mesh.

B.AWS PrivateLink and VPC Endpoints.

C.AWS Transit Gateway with inter-region peering.

D.AWS ClassicLink.

AnswerC

Transit Gateway supports transitive routing across VPCs and regions using inter-region peering.

Why this answer

AWS Transit Gateway with inter-region peering allows you to connect VPCs across different AWS Regions using the AWS global backbone, avoiding the public internet. It provides a central hub for managing connectivity and supports transitive routing between all attached VPCs, which is not possible with VPC peering alone. This makes it the correct choice for a centrally managed, transitive, cross-region solution.

Exam trap

The ANS-C01 exam often tests the misconception that VPC peering can be used in a full mesh to achieve transitive routing, but candidates must remember that VPC peering is non-transitive and requires explicit routing for each pair.

How to eliminate wrong answers

Option A is wrong because VPC peering connections in a full mesh do not support transitive routing; each peering connection is a one-to-one relationship, and traffic cannot hop from one VPC to another through an intermediate VPC. Option B is wrong because AWS PrivateLink and VPC Endpoints are designed for private access to specific services (e.g., SaaS or AWS services) from within a VPC, not for connecting multiple VPCs with transitive routing across regions. Option D is wrong because AWS ClassicLink is a legacy feature for linking EC2-Classic instances to a VPC, and it does not support inter-region connectivity, transitive routing, or central management.

Full explanation →

982

MCQhard

A financial services company is required to encrypt all data at rest and in transit. They have an Amazon S3 bucket with server-side encryption enabled (SSE-S3) and are using HTTPS for all API calls. During an audit, the auditor points out that the bucket policy does not explicitly deny requests that do not use HTTPS. Which of the following should the company add to the bucket policy to enforce HTTPS?

A.{"Effect":"Deny","Principal":"*","Action":"s3:*","Resource":"arn:aws:s3:::bucketname/*","Condition":{"Bool":{"aws:SecureTransport":"true"}}}

B.{"Effect":"Allow","Principal":"*","Action":"s3:*","Resource":"arn:aws:s3:::bucketname/*","Condition":{"Bool":{"aws:SecureTransport":"true"}}}

C.{"Effect":"Deny","Principal":"*","Action":"s3:*","Resource":"arn:aws:s3:::bucketname/*","Condition":{"Bool":{"aws:SecureTransport":"true"}}}

D.{"Effect":"Deny","Principal":"*","Action":"s3:*","Resource":"arn:aws:s3:::bucketname/*","Condition":{"Bool":{"aws:SecureTransport":"false"}}}

AnswerD

This denies requests when SecureTransport is false, effectively requiring HTTPS.

Why this answer

It uses a Deny effect with the condition aws:SecureTransport set to 'false'. This denies any request that is not using HTTPS, effectively enforcing that all requests must be made over HTTPS. Options A and C are incorrect because they deny requests when SecureTransport is 'true', which would block legitimate HTTPS requests.

Option B is incorrect because it uses an Allow effect; while it would allow HTTPS requests, it does not explicitly deny non-HTTPS requests, so non-HTTPS requests could still be allowed if another policy grants access.

Full explanation →

983

Multi-Selecthard

Which THREE of the following are benefits of using AWS Transit Gateway over VPC peering for inter-VPC connectivity? (Choose three.)

Select 3 answers

A.Transitive routing between all attached VPCs

B.Lower latency than VPC peering

C.Support for connecting to on-premises networks via Direct Connect and VPN

D.No additional cost compared to VPC peering

E.Centralized management of network connections

AnswersA, C, E

Transit Gateway supports transitive routing; VPC peering does not.

Why this answer

AWS Transit Gateway enables transitive routing, meaning that traffic can flow between any attached VPCs without needing a full mesh of VPC peering connections. With VPC peering, each pair of VPCs requires a separate peering connection, and transitive routing is not supported — traffic cannot hop from one peered VPC to another. Transit Gateway acts as a hub-and-spoke router, simplifying connectivity and scaling to hundreds of VPCs.

Exam trap

The ANS-C01 exam often tests the misconception that Transit Gateway always reduces latency compared to VPC peering, but in reality, VPC peering can have slightly lower latency because it creates a direct one-to-one connection without an intermediate routing hop.

Full explanation →

984

MCQmedium

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. Network engineers report intermittent connectivity issues between VPC A and the on-premises network. The transit gateway route table shows the on-premises CIDR (10.0.0.0/8) propagated from the VPN attachment. VPC A has a subnet route pointing to the transit gateway for 10.0.0.0/8. Which step should the engineer take FIRST to diagnose the issue?

A.Verify that the VPN tunnel status shows as UP on both sides.

B.Enable VPC Flow Logs on VPC A to verify traffic reaching the transit gateway.

C.In the transit gateway route table, verify that the VPN attachment is correctly associated and that the 10.0.0.0/8 route is propagated and has the correct attachment.

D.Check the security group rules on the EC2 instances in VPC A for outbound traffic.

AnswerC

This directly checks whether the transit gateway is correctly routing traffic to the VPN attachment for the on-premises CIDR.

Why this answer

The first diagnostic step for intermittent connectivity through a transit gateway is to verify the route table configuration. The engineer must confirm that the VPN attachment is correctly associated with the transit gateway route table and that the 10.0.0.0/8 route is propagated from the VPN attachment, as a missing or misassociated route would cause traffic to be dropped even if the VPN tunnel is up.

Exam trap

The trap here is that candidates often jump to checking the VPN tunnel status (Option A) first, assuming the tunnel is the root cause, but the question specifically describes intermittent connectivity that is more likely due to a routing misconfiguration in the transit gateway route table rather than a tunnel flap.

How to eliminate wrong answers

Option A is wrong because verifying the VPN tunnel status is a later step; the tunnel can be UP but traffic may still fail if the transit gateway route table lacks the correct route or association. Option B is wrong because enabling VPC Flow Logs on VPC A would confirm traffic reaching the transit gateway, but it does not diagnose whether the transit gateway is correctly routing the traffic to the VPN attachment, which is the core issue. Option D is wrong because security group rules on EC2 instances control host-level filtering, not the transit gateway routing path; the issue is at the network layer, not the instance firewall.

Full explanation →

985

MCQmedium

A company wants to restrict access to an S3 bucket so that only traffic from a specific AWS account is allowed. Which S3 bucket policy condition key should be used to achieve this?

A.aws:PrincipalAccount

B.aws:Referer

C.aws:SourceAccount

D.aws:SourceArn

AnswerC

aws:SourceAccount ensures only requests from the specified AWS account are allowed.

Why this answer

Using the 'aws:SourceAccount' condition key ensures that only requests originating from the specified AWS account are allowed. Option A is wrong because 'aws:PrincipalAccount' checks the principal's account, not the source account. Option B is wrong because 'aws:Referer' checks the HTTP referer header, not the source account.

Option D is wrong because 'aws:SourceArn' checks the ARN of the source resource, not the account.

Full explanation →

986

MCQhard

A financial services company uses AWS Direct Connect to connect its data center to multiple VPCs via a transit gateway. They need to meet PCI DSS compliance requirements by encrypting all traffic between the data center and AWS. What solution meets this requirement with the least operational overhead?

A.Enable MACsec on the Direct Connect connection.

B.Use TLS for all application traffic between data center and VPC.

C.Use private VIFs without additional encryption.

D.Create an IPsec VPN tunnel over the Direct Connect VIF to encrypt traffic.

AnswerA

MACsec provides Layer 2 encryption with minimal overhead.

Why this answer

MACsec (Option A) is the correct solution because it provides encryption at Layer 2 directly on the Direct Connect connection, ensuring all traffic is encrypted with minimal overhead and no additional configuration. This meets PCI DSS requirements with the least operational overhead. Option B (TLS) only encrypts application-level traffic, not all traffic.

Option C (private VIFs) does not encrypt traffic by default. Option D (IPsec VPN over Direct Connect) adds complexity and operational overhead compared to MACsec.

Full explanation →

987

MCQeasy

A company has a VPC with public and private subnets. They want to allow instances in the private subnet to download software updates from the internet while preventing inbound traffic from the internet. Which AWS service should they use?

A.VPC Peering

B.NAT Gateway

C.Internet Gateway

D.VPN Connection

AnswerB

A NAT Gateway, deployed in a public subnet with an Elastic IP, enables outbound IPv4 traffic from private instances to the internet for software updates while its stateful translation drops any unsolicited inbound return traffic, satisfying the constraint of preventing inbound internet access.

Why this answer

A NAT Gateway allows outbound internet traffic from private subnets while blocking inbound traffic, making it the correct choice. Option A (VPC Peering) is incorrect because it does not provide internet access. Option C (Internet Gateway) is incorrect because it allows inbound traffic from the internet.

Option D (VPN Connection) is incorrect because it typically provides private connectivity to an on-premises network, not direct internet access.

Full explanation →

988

Multi-Selecthard

A company has multiple VPCs connected via a Transit Gateway. They want to implement network segmentation so that only specific VPCs can communicate with each other. Which TWO methods can achieve this? (Choose two.)

Select 2 answers

A.Deploy AWS Network Firewall in a centralized inspection VPC

B.Use Transit Gateway route tables with specific associations and propagations

C.Assign instances to different security groups

D.Configure network ACLs on each subnet

E.Create separate VPC peering connections

AnswersA, B

Network Firewall can filter traffic between VPCs.

Why this answer

AWS Network Firewall can be deployed in a centralized inspection VPC to filter traffic between VPCs attached to a Transit Gateway. By routing inter-VPC traffic through the firewall appliance, you can enforce stateful inspection and allow or deny traffic based on source/destination VPCs, achieving network segmentation.

Exam trap

AWS often tests the misconception that security groups or network ACLs can control inter-VPC traffic across a Transit Gateway, but these constructs are limited to within a single VPC and do not affect transit routing.

Full explanation →

989

MCQmedium

A media company is designing a network for a new AWS environment. They have a VPC with public and private subnets in three Availability Zones. In the private subnets, they run a fleet of Amazon EC2 instances that process video files from an Amazon S3 bucket. The S3 bucket is in the same region. The company wants to ensure that all traffic to S3 stays within the AWS network and does not traverse the internet. They also need to allow the EC2 instances to access the internet for software updates, but only through a centralized NAT gateway. Currently, there is one NAT gateway in AZ1. The network engineer has created a VPC endpoint for S3 (Gateway type) and associated it with the route tables for the private subnets. However, the EC2 instances in AZ2 and AZ3 cannot reach the NAT gateway for internet access. What is the most likely cause?

A.The route table for private subnets now has a more specific route for S3 that overrides the default route to the NAT gateway

B.The VPC endpoint needs to be created in each Availability Zone

C.The NAT gateway is only available in the AZ where it is deployed

D.The S3 VPC endpoint is only accessible from the AZ where it was created

AnswerC

NAT gateway is deployed in a specific AZ but can be used by instances in other AZs if the route table directs traffic to it.

Why this answer

The most likely cause is that the NAT gateway is only available in the AZ where it is deployed because the private subnets in AZ2 and AZ3 likely do not have a default route pointing to the NAT gateway. A NAT gateway is created in a specific AZ, and while it can be accessed from other AZs using cross-AZ routing, the route tables for those subnets must be explicitly configured with a 0.0.0.0/0 route to the NAT gateway. The S3 Gateway Endpoint adds a specific route for S3 traffic, which does not override the default route; therefore, adding the endpoint does not affect internet access.

Option A is incorrect because the endpoint route is more specific for S3, not a default route. Options B and D are false because Gateway Endpoints are regional and do not require per-AZ creation, and NAT gateways can be used cross-AZ with proper routing.

Full explanation →

990

MCQhard

A company has a hybrid network with multiple AWS Direct Connect connections to different VPCs. The on-premises network uses BGP to advertise prefixes to AWS. The network team notices that some on-premises prefixes are not being received by the VPCs. What is the MOST likely cause?

A.The on-premises router is advertising more than 100 prefixes over the BGP session

B.The on-premises router is not using BGP communities

C.The on-premises router is using AS_PATH prepending

D.The on-premises router is not setting the MED attribute

AnswerA

AWS limits the number of prefixes per BGP session to 100 by default. Exceeding this causes rejection.

Why this answer

AWS Direct Connect virtual interfaces have a default limit of 100 allowed prefixes. If the on-premises router advertises more than 100 prefixes, BGP will reject the excess routes, causing some prefixes not to be received. Option B is incorrect because BGP communities are optional tags and not required for prefix advertisement.

Option C is incorrect because AS_PATH prepending influences route preference but does not prevent advertisement. Option D is incorrect because the MED attribute affects path selection, not the ability to advertise prefixes.

Full explanation →

991

MCQeasy

A company wants to monitor network traffic between its EC2 instances and determine which IP addresses are generating the most traffic. Which AWS service should be used to capture and analyze this traffic?

A.AWS Trusted Advisor

B.AWS CloudTrail

C.AWS Config

D.VPC Flow Logs

AnswerD

Flow Logs capture IP traffic metadata.

Why this answer

VPC Flow Logs capture IP traffic information for network interfaces in a VPC, enabling analysis of traffic patterns and identification of high-traffic IP addresses. AWS Trusted Advisor (Option A) provides best-practice checks, not traffic data. AWS CloudTrail (Option B) records API calls, not network traffic.

AWS Config (Option C) tracks resource configuration changes.

Full explanation →

992

MCQhard

A company uses AWS Direct Connect with a private VIF and a virtual private gateway (VGW) to connect its on-premises data center to a VPC. The on-premises network uses BGP to advertise routes to AWS. The VPC has multiple subnets. The company wants to ensure that only traffic destined for the VPC CIDR (10.0.0.0/16) is sent over Direct Connect, and all other traffic uses the internet. However, after configuration, on-premises users can access the internet through the Direct Connect link, which is unintended. What change should be made to restrict traffic?

A.Add a static route in the VPC route table to send all traffic to the internet gateway.

B.Disable route propagation for the private subnet route table.

C.Configure the on-premises router to only accept the VPC CIDR route from AWS and not a default route.

D.Remove the virtual private gateway and use a VPN connection instead.

AnswerC

This prevents the on-premises network from using Direct Connect for internet traffic.

Why this answer

The issue arises because AWS is advertising a default route (0.0.0.0/0) to the on-premises router over BGP via Direct Connect, causing on-premises users to use Direct Connect for internet traffic. To restrict traffic, the on-premises router should be configured to accept only the VPC CIDR (10.0.0.0/16) from AWS and reject any default route. Option C is correct.

Option A is incorrect because adding a static route in the VPC route table does not affect BGP advertisements to on-premises. Option B is incorrect because disabling route propagation affects VPC subnet routing, not the BGP session. Option D is incorrect because removing the virtual private gateway would disconnect the VPC, not solve the issue.

Full explanation →

993

MCQhard

A financial services company is designing a multi-region architecture for disaster recovery. They have a primary VPC in us-east-1 and a standby VPC in us-west-2. Each VPC has its own CIDR block (10.0.0.0/16 and 10.1.0.0/16). They want to use an inter-region VPC peering connection for replication traffic. Which of the following is a required step to establish this peering connection?

A.Ensure the VPC CIDR blocks do not overlap.

B.Create a VPN attachment between the two VPCs using AWS Site-to-Site VPN.

C.The owner of each VPC must accept the peering connection request.

D.Create two separate peering connections, one for each direction of traffic.

AnswerC

Both sides must accept the peering request for it to be active.

Why this answer

Inter-region VPC peering connections require both VPC owners to accept the peering request. In AWS, a VPC peering connection is a one-to-one relationship between two VPCs, and the request must be accepted by the owner of the accepter VPC (in this case, the standby VPC in us-west-2) after the requester VPC (us-east-1) initiates it. This acceptance is a mandatory step for the peering connection to become active, regardless of whether the VPCs are in the same or different regions.

Exam trap

The ANS-C01 exam often tests the misconception that VPC peering is automatically bidirectional or that both owners must initiate separate requests, but in reality, a single request and acceptance creates a bidirectional link, and the trap here is that candidates may think overlapping CIDRs or VPN attachments are required for inter-region peering.

How to eliminate wrong answers

Option A is wrong because non-overlapping CIDR blocks are not a requirement for inter-region VPC peering; they are only required for intra-region peering to avoid routing conflicts, but inter-region peering allows overlapping CIDRs as long as routes are managed carefully (though overlapping CIDRs can cause routing issues in practice, it is not a blocking requirement). Option B is wrong because AWS Site-to-Site VPN is a separate service used for connecting on-premises networks to VPCs or for creating VPN attachments between VPCs via Transit Gateway, but it is not required for VPC peering; VPC peering uses the AWS global network backbone directly without VPN tunnels. Option D is wrong because a single VPC peering connection is bidirectional by design; traffic can flow in both directions once the peering is established and routes are added to both VPC route tables, so two separate connections are unnecessary.

Full explanation →

994

MCQmedium

A company is deploying a multi-tier web application across two AWS Regions with an active-passive failover architecture. The application uses Application Load Balancers (ALBs) in each Region, and traffic must be directed to the active Region using DNS. Which routing policy should be used for the Amazon Route 53 record set to achieve this?

A.Geolocation routing policy

B.Failover routing policy

C.Weighted routing policy

D.Latency routing policy

AnswerB

Failover routing policy is designed for active-passive failover configurations.

Why this answer

The failover routing policy in Amazon Route 53 is designed specifically for active-passive failover architectures. It uses health checks to monitor the primary endpoint (active Region) and automatically routes traffic to the secondary endpoint (passive Region) only when the primary health check fails. This matches the requirement of directing traffic to the active Region using DNS.

Exam trap

The trap here is that candidates often confuse failover routing with latency or weighted routing, assuming that automatic failover can be achieved by simply distributing traffic, but only failover routing policy provides the health-check-driven active-passive behavior required for this architecture.

How to eliminate wrong answers

Option A is wrong because geolocation routing policy routes traffic based on the geographic location of the user, not on the health or availability of endpoints, and it does not provide automatic failover between regions. Option C is wrong because weighted routing policy distributes traffic across multiple endpoints based on assigned weights, but it does not automatically failover to a passive region when the active region becomes unhealthy; it continues sending traffic proportionally regardless of health. Option D is wrong because latency routing policy routes traffic to the region with the lowest latency for the user, which does not guarantee that traffic goes to the designated active region and does not support active-passive failover based on health checks.

Full explanation →

995

MCQmedium

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team needs to inspect all traffic between VPCs and on-premises using a centralized firewall appliance. Which architecture meets this requirement?

A.Deploy AWS Network Firewall in each VPC and route all traffic through it.

B.Connect all VPCs to on-premises via AWS Direct Connect and inspect traffic on-premises.

C.Create VPC peering connections between each VPC and the firewall VPC.

D.Use Transit Gateway with a central inspection VPC that hosts the firewall appliance.

AnswerD

Centralized inspection via Transit Gateway route tables.

Why this answer

A Transit Gateway with a centralized inspection VPC allows routing all traffic through firewall appliances for centralized inspection. Option A is wrong because deploying AWS Network Firewall in each VPC does not centralize inspection; it distributes inspection per VPC. Option B is wrong because connecting all VPCs to on-premises via Direct Connect does not provide centralized inspection within AWS; it sends traffic on-premises, which may not be desired.

Option C is wrong because VPC peering does not support transitive routing, making it unsuitable for centralized inspection across many VPCs.

Full explanation →

996

MCQmedium

A company has deployed a VPC with a public subnet and a private subnet in each of two Availability Zones. They have an Application Load Balancer (ALB) in the public subnets and EC2 instances in the private subnets. The EC2 instances need to access an external API over HTTPS. What is the MOST secure way to provide this access?

A.Deploy a NAT Gateway in each public subnet and add a default route in the private subnet route tables pointing to the NAT Gateway.

B.Create a VPC endpoint for the external API service.

C.Assign public IP addresses to the EC2 instances and allow outbound traffic in the security group.

D.Set up a VPN connection to an on-premises network that has internet access.

AnswerA

NAT Gateway provides outbound-only internet access securely.

Why this answer

A NAT Gateway in each public subnet provides a managed, highly available path for EC2 instances in private subnets to initiate outbound HTTPS connections to the internet while preventing inbound connections from reaching them. Adding a default route (0.0.0.0/0) in the private subnet route tables pointing to the NAT Gateway ensures traffic destined for the external API is forwarded through the NAT Gateway, which performs source network address translation (SNAT) using its Elastic IP. This is the most secure method because it avoids exposing the EC2 instances directly to the internet and leverages AWS-managed infrastructure for scalability and fault tolerance.

Exam trap

The trap here is that candidates often confuse VPC endpoints (PrivateLink) with NAT Gateways, assuming a VPC endpoint can be used for any external API, but VPC endpoints only work for services that explicitly support AWS PrivateLink or are AWS services, not arbitrary public HTTPS APIs.

How to eliminate wrong answers

Option B is wrong because a VPC endpoint (typically an interface or Gateway Load Balancer endpoint) is used for private connectivity to AWS services (e.g., S3, DynamoDB) or supported third-party services via AWS PrivateLink, not for accessing an arbitrary external API over the public internet; the external API would need to be hosted behind a Network Load Balancer with a VPC endpoint service, which is not stated. Option C is wrong because assigning public IP addresses to EC2 instances and allowing outbound traffic in the security group exposes the instances to the internet, increasing the attack surface and violating the principle of least privilege; it also requires managing public IPs and security group rules for outbound-only access, which is less secure than using a NAT Gateway. Option D is wrong because setting up a VPN connection to an on-premises network that has internet access adds unnecessary complexity, latency, and cost; it does not directly solve the requirement for EC2 instances in a VPC to access an external API over HTTPS, and the on-premises network becomes a single point of failure or bottleneck.

Full explanation →

997

Multi-Selecthard

A company is deploying a multi-tier application across two Availability Zones. The web tier must be highly available and scale based on traffic. The application load balancer (ALB) is internet-facing. Which TWO configurations are required to ensure the ALB can route traffic to the web instances across both AZs?

Select 2 answers

A.Register the ALB with subnets in at least two Availability Zones.

B.Configure the VPC route tables to allow cross-AZ traffic.

C.Create a target group that includes instances from both Availability Zones.

D.Assign a security group that allows traffic from both AZs.

E.Place the ALB in a single subnet for simplicity and attach multiple ENIs.

AnswersA, C

ALB requires multiple AZs for HA.

Why this answer

Options A and C are correct. The ALB must be associated with subnets in at least two Availability Zones to achieve high availability. Additionally, the target group must contain instances from both AZs to allow the ALB to route traffic across zones.

Option B is incorrect because VPC route tables already allow cross-AZ traffic by default; no special configuration is needed. Option D is incorrect because security groups are applied to instances, not to AZs, and ALBs use security groups to control inbound traffic. Option E is incorrect because placing the ALB in a single subnet would limit its availability to one AZ, defeating high availability.

Full explanation →

998

Multi-Selectmedium

A company is designing a security group configuration for a three-tier application. The web servers must be accessible from the internet on ports 80 and 443. The application servers must only communicate with the web servers on port 8080. The database servers must only communicate with the application servers on port 3306. Which TWO of the following are best practices for implementing this with security groups? (Choose TWO.)

Select 2 answers

A.Use the security group ID of the web tier as the source in the app tier inbound rule.

B.Use the CIDR block of the subnet for the source security group rules.

C.Use network ACLs to enforce rules at the subnet level instead of security groups.

D.Use the security group ID of the app tier as the source in the database tier inbound rule.

E.Assign the same security group to all instances to simplify management.

AnswersA, D

Restricts inbound traffic to only resources with the web security group.

Why this answer

Options A and D are correct. Using security group IDs as source in inbound rules ensures that only instances with the specified security group can communicate, providing fine-grained control. Option A allows web servers to communicate with app servers on port 8080.

Option D allows app servers to communicate with database servers on port 3306. Option B is incorrect because using CIDR blocks is less secure and less granular than using security group IDs. Option C is incorrect because network ACLs are stateless and operate at the subnet level, not at the instance level; security groups are more appropriate for this requirement.

Option E is incorrect because assigning the same security group to all instances would allow all instances to communicate with each other, violating the principle of least privilege.

Full explanation →

999

MCQeasy

A company is using AWS Global Accelerator to improve performance for a web application hosted in two AWS Regions. The application uses an Application Load Balancer (ALB) in each region. The company wants to ensure that traffic is directed to the closest healthy endpoint. Which routing configuration should be used?

A.Global Accelerator endpoint groups with health checks and traffic dials

B.Global Accelerator with weighted endpoint groups

C.Route 53 latency-based routing with health checks

D.Route 53 geolocation routing with Global Accelerator

AnswerA

Global Accelerator automatically routes to the closest healthy endpoint.

Why this answer

Global Accelerator uses anycast IPs to route traffic to the closest healthy endpoint based on latency and health checks. Endpoint groups contain regional endpoints (e.g., ALBs), and health checks ensure only healthy endpoints receive traffic. Traffic dials allow controlling the proportion of traffic sent to each region but are optional.

Option B is incorrect because Global Accelerator does not use weighted routing; it uses latency-based routing. Option C is incorrect because Route 53 latency-based routing is a separate service and not the routing configuration for Global Accelerator; Global Accelerator itself handles proximity. Option D is incorrect because Route 53 geolocation routing is not used with Global Accelerator; Global Accelerator automatically routes to the nearest healthy endpoint without geolocation.

Full explanation →

1000

MCQmedium

A company is deploying an application that requires low-latency communication between EC2 instances in two different AWS Regions. The application traffic is latency-sensitive and the company wants to minimize jitter. Which network design provides the lowest and most consistent latency?

A.Create a VPC peering connection between the two VPCs and route traffic through the peering connection.

B.Use internet gateways and route traffic over the public internet between the instances.

C.Use a Site-to-Site VPN connection between the two VPCs over the internet.

D.Deploy an AWS Global Accelerator with endpoints in both Regions and use the accelerator's static IP addresses for communication.

AnswerD

Global Accelerator uses the AWS global network to route traffic over optimized paths, reducing latency and jitter.

Why this answer

AWS Global Accelerator uses the AWS global network and Anycast static IP addresses to route traffic over optimized paths, providing lower and more consistent latency than VPC peering, internet transit, or VPNs. It minimizes jitter by avoiding the public internet and leveraging AWS's internal backbone, which is ideal for latency-sensitive inter-Region communication.

Exam trap

The trap here is that candidates assume VPC peering (Option A) is the best for inter-Region traffic because it's private, but they overlook that Global Accelerator provides superior latency consistency by using anycast and AWS's optimized backbone, while VPC peering still routes through the AWS global network without traffic engineering for jitter reduction.

How to eliminate wrong answers

Option A is wrong because VPC peering does not support inter-Region traffic with low jitter; it relies on the AWS global network but lacks the traffic engineering and endpoint optimization of Global Accelerator, and it does not provide static anycast IPs for consistent routing. Option B is wrong because routing over the public internet introduces variable latency and jitter due to ISP hops, congestion, and BGP path fluctuations, making it unsuitable for latency-sensitive applications. Option C is wrong because a Site-to-Site VPN over the internet adds encryption overhead and traverses the public internet, increasing latency and jitter compared to AWS's private network path.

Full explanation →

1001

Multi-Selectmedium

A company is building a serverless application using Amazon API Gateway, AWS Lambda, and Amazon DynamoDB. The security team requires that all API requests are authenticated and authorized, and that the Lambda function has only the necessary permissions to access DynamoDB. Which THREE steps should be taken?

Select 3 answers

A.Place the Lambda function inside a VPC and use a VPC endpoint for DynamoDB.

B.Configure API Gateway to use an Amazon Cognito user pool or a Lambda authorizer for authentication.

C.Use API keys in API Gateway to authenticate requests.

D.Create an IAM role for the Lambda function with a policy that allows only the required DynamoDB actions.

E.Attach a resource-based policy to the DynamoDB table that allows access only from the Lambda function's IAM role.

AnswersB, D, E

Provides authentication.

Why this answer

The correct steps are B, D, and E. Option B ensures authentication via Amazon Cognito user pools or Lambda authorizers. Option D grants the Lambda function least-privilege access to DynamoDB using an IAM role.

Option E uses a resource-based policy on the DynamoDB table to restrict access to only the Lambda function's IAM role. Option A is incorrect because placing the Lambda function in a VPC is not required for security; it can access DynamoDB over the internet. Option C is incorrect because API keys are for usage plans and rate limiting, not for authentication.

Full explanation →

1002

Multi-Selectmedium

Which TWO of the following are valid methods to connect multiple VPCs together in a hub-and-spoke topology while maintaining centralized control? (Choose two.)

Select 2 answers

A.Create a VPN connection between each VPC and a central VPN appliance.

B.Establish VPC peering connections in a full mesh and manage routes centrally.

C.Use Direct Connect to connect VPCs.

D.Use an AWS Transit Gateway with a central VPC as the hub.

E.Use VPC Gateway Endpoints to connect VPCs.

AnswersB, D

Possible but less scalable than Transit Gateway.

Why this answer

VPC peering connections can be arranged in a full mesh, and by centrally managing route tables (e.g., using a centralized route management tool or a central VPC with route propagation), you can enforce a hub-and-spoke routing pattern. Option D is correct because AWS Transit Gateway inherently supports hub-and-spoke topologies by attaching multiple VPCs to a single gateway, which acts as the hub, and allows centralized control over routing and security policies.

Exam trap

The trap here is that candidates often confuse VPC peering as inherently non-hub-and-spoke, but the question allows for a full mesh of peering connections with centralized route management, which technically satisfies the requirement, while Direct Connect and Gateway Endpoints are frequently misapplied as VPC-to-VPC connectivity solutions.

Full explanation →

1003

MCQhard

A security engineer is troubleshooting connectivity issues between two VPCs connected via a VPC Peering connection. The VPCs are in different accounts. The security groups in both VPCs allow traffic between the CIDRs. The route tables have the appropriate entries. However, instances in VPC A cannot communicate with instances in VPC B. What is the most likely cause?

A.The VPC Peering connection does not support transitive routing through an intermediate VPC or on-premises network.

B.The VPC Peering connection requires an IAM role to be assumed for cross-account communication.

C.The security group in VPC A does not allow inbound traffic from VPC B's CIDR.

D.The network ACL in VPC A does not allow return traffic from VPC B.

AnswerA

VPC Peering is non-transitive; if there is a VPN or another VPC in the path, traffic will be dropped.

Why this answer

VPC Peering connections do not support transitive routing. If traffic must pass through an intermediate VPC or on-premises network, the peering connection alone cannot route it. Option B is incorrect because VPC Peering does not require an IAM role for cross-account communication; instead, the accepter must accept the request and route tables must be updated.

Option C is incorrect because security groups are stateful and automatically allow return traffic, and the scenario states security groups allow traffic between CIDRs. Option D is incorrect because the issue is not about NACLs; if NACLs were blocking traffic, the problem would likely be related to stateless filtering, but the question focuses on security groups and routing.

Full explanation →

1004

Multi-Selectmedium

A company is designing a VPC with a public subnet and a private subnet. The private subnet hosts an RDS database, and the public subnet hosts a web server. The web server needs to access the database. Which TWO of the following are required to allow the web server to connect to the database?

Select 2 answers

A.An inbound rule in the database's security group that allows traffic from the web server's private IP address.

B.An inbound rule in the database's security group that references the web server's security group.

C.An internet gateway attached to the VPC.

D.A route table associated with the private subnet that includes a route to the public subnet's CIDR block via the local route.

E.A NAT gateway in the public subnet.

AnswersB, D

Allows traffic from any instance with that SG.

Why this answer

Security group rules can reference other security groups as a source, allowing traffic from any instance associated with the referenced security group (the web server's security group) without needing to specify individual IP addresses. This is the recommended AWS best practice for inter-instance communication within a VPC, as it dynamically adapts to changes in the web server's IP or scaling events.

Exam trap

The ANS-C01 exam often tests the misconception that a NAT gateway or internet gateway is required for any cross-subnet communication, but the trap here is that traffic between subnets within the same VPC uses the local route and does not require any gateway.

Full explanation →

1005

Multi-Selectmedium

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The network team needs to monitor the Direct Connect connection for performance issues and receive alerts when latency exceeds a certain threshold. Which TWO actions should the team take to meet these requirements? (Choose TWO.)

Select 2 answers

A.Create a CloudWatch alarm on the Direct Connect latency metric to send notifications when latency exceeds the threshold.

B.Subscribe to AWS Health Dashboard events for Direct Connect.

C.Enable CloudWatch metrics on the Direct Connect virtual interface to monitor latency.

D.Enable VPC Flow Logs to capture traffic patterns and latency.

E.Configure a VPN CloudWatch metric to monitor the Direct Connect connection.

AnswersA, C

CloudWatch alarms can be set on latency metrics to trigger notifications.

Why this answer

AWS Direct Connect provides a built-in 'Latency' metric in CloudWatch that measures the round-trip time between the Direct Connect location and the AWS region. By creating a CloudWatch alarm on this metric, the team can trigger an SNS notification when latency exceeds a defined threshold, enabling proactive monitoring of performance issues.

Exam trap

The trap here is that candidates confuse VPC Flow Logs (which capture traffic metadata) with performance monitoring tools, or assume that AWS Health Dashboard provides real-time latency metrics, when in fact only the Direct Connect latency metric in CloudWatch directly measures and alerts on latency.

Full explanation →

1006

MCQmedium

A company is using AWS CloudFormation to deploy a multi-tier application. The template includes an Amazon VPC with public and private subnets, NAT gateways, and route tables. After deployment, the EC2 instances in the private subnet cannot access the internet. The NAT gateway is in a public subnet with an Internet Gateway attached. What is the most likely cause?

A.The route table of the private subnet does not have a default route pointing to the NAT Gateway

B.The Internet Gateway is not attached to the VPC

C.The security group of the EC2 instances blocks outbound traffic to the internet

D.The network ACL of the private subnet blocks outbound traffic

AnswerA

Without a route to the NAT Gateway, traffic to the internet fails.

Why this answer

The most likely cause is that the route table of the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT Gateway. For EC2 instances in a private subnet to access the internet, the private subnet's route table must contain a route that directs internet-bound traffic to the NAT Gateway. Option B is incorrect because the Internet Gateway is already attached to the VPC as stated.

Option C is incorrect because security groups are stateful and by default allow all outbound traffic; the question does not indicate any security group changes. Option D is incorrect because network ACLs are stateless and by default allow all outbound traffic; the scenario does not mention any NACL modifications.

Full explanation →

1007

MCQeasy

A company has deployed an application in a VPC with public and private subnets across two Availability Zones. The application uses an Application Load Balancer (ALB) in the public subnets to distribute traffic to EC2 instances in the private subnets. The company wants to use AWS WAF to protect against SQL injection attacks. Where should the AWS WAF web ACL be associated?

A.The Application Load Balancer.

B.Amazon Route 53 hosted zone.

C.The security group of the EC2 instances.

D.The VPC internet gateway.

AnswerA

The Application Load Balancer. [CORRECT]

Why this answer

AWS WAF is a web application firewall that protects web resources from common exploits like SQL injection. It integrates directly with Application Load Balancers (ALBs) by allowing you to associate a web ACL with the ALB, which inspects HTTP/HTTPS traffic before it reaches the backend EC2 instances. This is the only supported integration point among the options for protecting application-layer traffic in this architecture.

Exam trap

The trap here is that candidates often confuse security groups (layer 4 filtering) with web application firewalls (layer 7 inspection), leading them to incorrectly select the security group option, even though security groups cannot inspect application-layer payloads like SQL injection strings.

How to eliminate wrong answers

Option B is wrong because Amazon Route 53 is a DNS service that resolves domain names to IP addresses; it does not process HTTP/HTTPS traffic and cannot inspect payloads for SQL injection attacks. Option C is wrong because security groups are stateful firewalls that filter traffic at the network and transport layer (IP addresses, ports, protocols); they cannot inspect application-layer content like SQL injection patterns. Option D is wrong because an internet gateway is a horizontally scaled, redundant VPC component that allows communication between the VPC and the internet at the network layer; it has no capability to perform deep packet inspection or apply WAF rules.

Full explanation →

1008

MCQhard

A company is designing a network for a real-time gaming application that requires extremely low latency between players. The application will be deployed on EC2 instances in multiple AWS regions. Which AWS service provides the best latency performance by using the AWS global network and anycast IPs?

A.AWS Direct Connect

B.AWS Global Accelerator

C.Amazon CloudFront

D.Amazon Route 53 Latency Routing

AnswerB

Uses anycast IPs and AWS global network for low latency.

Why this answer

AWS Global Accelerator uses the AWS global network and anycast IPs to route traffic to the optimal edge location, then over the AWS backbone to the nearest healthy endpoint. This minimizes internet hops and latency, making it ideal for real-time gaming applications that require consistent low latency across multiple regions.

Exam trap

The trap here is that candidates often confuse CloudFront's edge caching with Global Accelerator's network path optimization, but CloudFront does not use anycast IPs for dynamic traffic routing and cannot provide the same low-latency performance for real-time applications that require direct connections to backend servers.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect provides a dedicated private connection from on-premises to AWS, but it does not use anycast IPs or optimize routing between multiple AWS regions for end-user traffic; it is designed for hybrid connectivity, not global latency optimization. Option C is wrong because Amazon CloudFront is a content delivery network (CDN) that caches static and dynamic content at edge locations, but it does not use anycast IPs for TCP/UDP traffic optimization and is not designed to reduce latency for real-time gaming traffic that requires dynamic routing to the nearest application endpoint. Option D is wrong because Amazon Route 53 Latency Routing directs DNS queries to the region with the lowest latency, but it operates at the DNS level and does not use anycast IPs; it cannot provide sub-second failover or optimize the network path after the initial connection, and DNS caching can cause stale routing decisions.

Full explanation →

1009

MCQeasy

A company wants to centrally manage firewall rules across multiple VPCs in different AWS accounts. Which AWS service should they use?

A.AWS Network Firewall with AWS Firewall Manager

B.Security Groups

C.AWS WAF

D.Network ACLs

AnswerA

AWS Network Firewall provides centralized management through Firewall Manager.

Why this answer

AWS Network Firewall can be centrally managed using AWS Firewall Manager, which provides a single pane of glass to apply firewall rules across multiple VPCs and accounts. Option B is wrong because Security Groups are per-VPC and not centrally managed. Option C is wrong because AWS WAF is for web application layer protection, not network firewall.

Option D is wrong because Network ACLs are per-subnet and cannot be centrally managed across accounts.

Full explanation →

1010

Multi-Selecteasy

Which TWO of the following are valid methods to provide outbound internet access to instances in a private subnet?

Select 2 answers

A.Use a VPC endpoint for internet access

B.Attach an internet gateway directly to the private subnet

C.Deploy a NAT instance in a public subnet and configure routing

D.Deploy a NAT gateway in a public subnet and add a route to it from the private subnet

E.Use a VPN connection to the internet

AnswersC, D

NAT instance is a legacy but valid method.

Why this answer

The correct answers are C and D. A NAT instance (C) or a NAT gateway (D) deployed in a public subnet with a default route pointing to them from the private subnet provides outbound internet access while keeping instances private. Option A is incorrect because VPC endpoints only provide private access to AWS services, not general internet.

Option B is incorrect because an internet gateway is attached to the VPC, not directly to a subnet, and instances in private subnets cannot use it without a NAT device. Option E is incorrect because a VPN connection is for private connectivity to on-premises networks, not internet access.

Full explanation →

1011

MCQhard

A company has a VPC with CIDR 10.0.0.0/16. They have two Availability Zones (us-east-1a and us-east-1b). In each AZ, there is a public subnet (10.0.1.0/24 and 10.0.2.0/24) and a private subnet (10.0.3.0/24 and 10.0.4.0/24). A NAT Gateway is deployed in the public subnet of us-east-1a. The private route tables for both private subnets have a default route pointing to the NAT Gateway. An application team has deployed EC2 instances in the private subnets. They report that instances in us-east-1b cannot access the internet, while instances in us-east-1a can. The NAT Gateway is healthy and has an Elastic IP attached. The route tables for the public subnets have a default route to the Internet Gateway. What is the most likely cause of the issue?

A.The NAT Gateway is deployed in a private subnet

B.The route table for the public subnet in us-east-1b does not have a default route to the Internet Gateway

C.The NAT Gateway has reached the maximum number of concurrent connections

D.The NAT Gateway is in a different Availability Zone than the private subnet instances, causing cross-AZ data transfer charges

AnswerC

Correct. NAT Gateway connection limits can prevent new connections, causing internet access failures for instances that have not already established a session.

Why this answer

The most likely cause is that the NAT Gateway has reached its maximum number of concurrent connections. When connection limits are exceeded, new outbound connections from instances in any private subnet may fail, leading to internet access issues. This explains why instances in us-east-1a (which may have established connections earlier) can still access the internet, while instances in us-east-1b cannot.

Option A is incorrect because the NAT Gateway is correctly placed in a public subnet. Option B is incorrect because the route table of the public subnet in us-east-1b does not affect traffic from private instances; they route directly to the NAT Gateway in us-east-1a. Option D is incorrect because cross-AZ data transfer charges are a cost concern and do not block network traffic.

Therefore, the most plausible technical cause is option C.

Exam trap

Candidates often assume a NAT Gateway in one AZ can serve private instances in another AZ without any issues, but cross-AZ data transfer charges apply, which can be a concern for cost, but not connectivity.

Full explanation →

1012

MCQmedium

A company is using AWS Direct Connect with a private virtual interface (VIF) to connect its on-premises data center to a VPC. The VPC has a virtual private gateway (VGW) attached. The company has recently added a second VPC and wants to use the same Direct Connect connection to access both VPCs. The network engineer proposes using a Direct Connect gateway (DXGW) with two private VIFs, one for each VPC. However, the engineer wants to minimize complexity and cost. Which configuration should the engineer use to allow both VPCs to use the same Direct Connect connection?

A.Create a Direct Connect gateway and associate it with the private VIF. Then associate both VPCs' virtual private gateways with the Direct Connect gateway.

B.Create a private VIF for each VPC on the same Direct Connect connection.

C.Create a public virtual interface on the Direct Connect connection and attach both VPCs to it.

D.Create a single private VIF and attach both VPCs directly to it.

AnswerA

DXGW allows one VIF to reach multiple VPCs.

Why this answer

A Direct Connect gateway (DXGW) can be associated with a single private virtual interface (VIF) and then attached to multiple virtual private gateways (VGWs) in different VPCs, allowing both VPCs to use the same Direct Connect connection with minimal complexity and cost. Option B is incorrect because it requires creating two private VIFs, increasing cost and complexity. Option C is incorrect because a public VIF is used for accessing public AWS services, not for connecting to VPCs.

Option D is incorrect because a single private VIF cannot be directly attached to multiple VPCs; a DXGW is needed to aggregate the connections.

Full explanation →

1013

MCQhard

A company is designing a hybrid network using AWS Direct Connect with multiple VPCs in the same region. They need to ensure that traffic between on-premises and VPCs is encrypted and that VPC-to-VPC traffic does not traverse the internet. Which solution meets these requirements?

A.Use a single Direct Connect connection with multiple virtual interfaces and enable encryption on the physical connection.

B.Use AWS Transit Gateway with an IPsec VPN over Direct Connect using a virtual private gateway on each VPC, and configure Transit Gateway route tables.

C.Use AWS Transit Gateway with Direct Connect Gateway and enable encryption on the Transit Gateway attachments.

D.Set up a VPN connection over the internet between on-premises and each VPC, and use VPC Peering for VPC-to-VPC traffic.

AnswerB

Correct: IPsec provides encryption; Transit Gateway enables VPC-to-VPC.

Why this answer

It uses AWS Transit Gateway to centrally route traffic between on-premises and multiple VPCs, and an IPsec VPN over Direct Connect provides encryption for traffic between on-premises and VPCs. The Transit Gateway route tables ensure VPC-to-VPC traffic stays within the AWS network without traversing the internet, meeting both requirements.

Exam trap

The trap here is that candidates often assume Direct Connect provides encryption by default or that Transit Gateway attachments can be encrypted natively, but neither is true—encryption requires an overlay like IPsec VPN.

How to eliminate wrong answers

Option A is wrong because a single Direct Connect connection with multiple virtual interfaces does not inherently encrypt traffic; encryption must be applied at the application or IPsec layer, and the physical connection alone does not provide encryption. Option C is wrong because Direct Connect Gateway attachments do not natively support encryption; Transit Gateway attachments over Direct Connect are not encrypted unless an IPsec VPN is overlaid, and enabling encryption on attachments is not a supported feature. Option D is wrong because using a VPN over the internet for on-premises connectivity violates the requirement to avoid internet transit, and VPC Peering does not provide centralized routing or encryption for VPC-to-VPC traffic, though it avoids the internet.

Full explanation →

1014

MCQhard

A company needs to meet compliance requirements that mandate encryption of all data in transit between EC2 instances in the same VPC. The instances are in different subnets and communicate using TCP port 443. Which solution should a network engineer implement?

A.Configure the application to use TLS for communication.

B.Enable VPC Flow Logs to monitor for unencrypted traffic.

C.Use AWS Certificate Manager (ACM) to provision certificates and enable encryption automatically.

D.Deploy a VPN connection between the instances.

AnswerA

This ensures encryption in transit as required.

Why this answer

Configuring the application to use TLS ensures end-to-end encryption of data in transit between EC2 instances, meeting the compliance requirement. Option B is incorrect because VPC Flow Logs only capture metadata about traffic (e.g., IP addresses, ports, protocols) and do not encrypt the data itself. Option C is incorrect because AWS Certificate Manager (ACM) provisions certificates but does not automatically encrypt traffic; the application must use those certificates within a TLS configuration.

Option D is incorrect because deploying a VPN connection between instances within the same VPC adds unnecessary complexity and does not automatically encrypt application-layer traffic.

Full explanation →

1015

Multi-Selecthard

A company has a VPC with a CIDR of 10.0.0.0/16. They have two subnets: subnet A (10.0.1.0/24) and subnet B (10.0.2.0/24). They have an AWS Network Firewall deployed in a firewall subnet. They want to inspect all traffic between subnet A and subnet B. Which TWO actions are required? (Choose two.)

Select 2 answers

A.Attach a transit gateway to the VPC and route traffic through it.

B.Configure the Network Firewall rule group to allow the desired traffic between subnets.

C.Add a route in subnet A's route table that sends traffic to subnet B via the Network Firewall endpoint's elastic network interface.

D.Create a VPC peering connection between subnet A and subnet B.

E.Create a security group rule that allows traffic between subnet A and subnet B.

AnswersB, C

The firewall must have rules to allow the traffic after routing it through.

Why this answer

To inspect traffic between subnet A and subnet B, the traffic must be routed through the Network Firewall endpoint. This is achieved by adding a route in subnet A's route table that points to the firewall endpoint's elastic network interface (ENI) for the destination subnet B (10.0.2.0/24), and similarly for subnet B's route table for subnet A (10.0.1.0/24). Additionally, the Network Firewall rule groups must be configured to allow the desired traffic; otherwise, the firewall will block it by default.

Options A, D, and E are incorrect: A (transit gateway) is not needed because both subnets are in the same VPC; D (VPC peering) is unnecessary for intra-VPC traffic; E (security group rule) does not route traffic—security groups are applied at the instance level, not to control traffic between subnets.

Full explanation →

1016

MCQhard

A company has a VPC with multiple subnets and uses AWS Network Firewall to inspect traffic. The security team notices that traffic to a specific IP (10.0.0.10) is being dropped unexpectedly. The firewall policy has a stateful rule group that allows all traffic. What is the MOST likely cause?

A.The stateful rule group has an implicit deny for that IP

B.AWS Shield Advanced is blocking the traffic

C.The stateless default action is set to drop

D.The subnet's route table does not have a route to the firewall endpoint

AnswerC

Stateless rules are evaluated first; if default action is drop, traffic is dropped regardless of stateful rules.

Why this answer

Network Firewall evaluates stateless rules first, and a stateless default drop action would drop traffic before stateful rules are considered. Option A is wrong because stateful rules allow all. Option B is wrong because route table directs traffic to firewall.

Option D is wrong because AWS Shield is for DDoS protection.

Full explanation →

1017

MCQhard

A media company is designing a global streaming platform using AWS. They have a primary workload in us-east-1 (VPC A, 10.0.0.0/16) and a secondary workload in eu-west-1 (VPC B, 10.1.0.0/16). They need to replicate data between these VPCs with low latency and high throughput, and also allow their on-premises data center (10.2.0.0/16) in us-east-2 to communicate with both VPCs. The on-premises network is connected to AWS via two Direct Connect connections terminating in us-east-1 and eu-west-1. The company uses a Transit Gateway in each region, with inter-region peering between the Transit Gateways. The on-premises network has BGP advertisements for 10.2.0.0/16. The routing is set up such that the on-premises network can reach both VPCs via the Direct Connect connections. However, the VPCs cannot reach each other's CIDRs. The network engineer checks the Transit Gateway route tables and sees that the inter-region peering attachment is associated with the appropriate route tables, and static routes for the remote VPC CIDRs are present. What is the MOST likely cause of the problem?

A.The inter-region peering attachment is not in the same route table as the VPC attachments

B.The VPC CIDRs overlap with each other

C.The static routes for the remote VPC CIDRs are pointing to the Direct Connect attachment instead of the inter-region peering attachment

D.The on-premises network is advertising a default route that is being preferred

AnswerC

This would cause traffic to be sent to on-premises, which cannot route between regions, causing blackhole.

Why this answer

In a Transit Gateway inter-region peering, you need to add static routes in both directions to point to the peering attachment. The engineer confirmed static routes are present, so that might not be the issue. However, a common misconfiguration is that the on-premises network's route propagation via Direct Connect may be causing the Transit Gateway to prefer the on-premises path (which may not have connectivity between regions) over the inter-region peering.

But the VPCs cannot reach each other's CIDRs, so the issue is likely that the route tables for the VPC attachments do not have the routes for the remote VPC CIDRs pointing to the inter-region peering attachment. Alternatively, the inter-region peering attachment might not be in the correct route table. The most likely issue is that the Transit Gateway route tables for the VPCs do not include routes for the remote VPC CIDRs via the peering attachment.

Since the engineer says they are present, the issue might be that the propagation from the Direct Connect attachment is overriding the static route with a less preferred route or causing a conflict. Actually, the most common problem is that the static routes for the inter-region CIDRs are pointing to the wrong attachment (e.g., the Direct Connect attachment instead of the peering attachment).

Full explanation →

1018

Multi-Selectmedium

A network engineer is configuring a site-to-site VPN connection between an on-premises network and AWS. The VPN tunnel is established, but traffic is not flowing. Which THREE components should the engineer check?

Select 3 answers

A.Security group rules on the VPC resources to allow inbound traffic from on-premises

B.On-premises firewall rules to allow IPsec traffic

C.Network ACLs for the subnet to allow return traffic

D.Internet Gateway attachment to the VPC

E.VPC route table for a route to the on-premises CIDR pointing to the virtual private gateway

AnswersA, B, E

Security groups control traffic flow.

Why this answer

Options A, B, and E are correct. Security group rules must allow inbound traffic from the on-premises network (A). On-premises firewall rules must permit IPsec traffic (B).

The VPC route table must have a route to the on-premises CIDR pointing to the virtual private gateway (E). Option C is incorrect because Network ACLs are stateless and require explicit inbound rules for return traffic; however, they are not the primary components to check when troubleshooting a site-to-site VPN that is established but not passing traffic. Option D is incorrect because an Internet Gateway is not used for VPN traffic; VPN traffic goes through the virtual private gateway.

Full explanation →

1019

MCQeasy

A company is deploying a VPC with public and private subnets in two Availability Zones. The workloads in the private subnets need to access the internet for software updates. What is the MOST secure way to provide this internet access?

A.Deploy a NAT gateway in a public subnet and update the private subnets' route table to point default traffic to the NAT gateway.

B.Set up a VPN connection to an on-premises network with internet access.

C.Use a transit gateway with a VPC attachment and route internet traffic through a centralized inspection VPC.

D.Attach an internet gateway to the VPC and route the private subnets' traffic to it.

AnswerA

NAT gateway allows outbound internet access while blocking unsolicited inbound traffic.

Why this answer

A NAT gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing any unsolicited inbound traffic from the internet. This is the most secure and AWS-recommended method because it uses Source Network Address Translation (SNAT) to mask private IPs behind the NAT gateway's Elastic IP, and it requires only a route table update in the private subnets to direct default traffic (0.0.0.0/0) to the NAT gateway.

Exam trap

The ANS-C01 exam often tests the misconception that an internet gateway can be used directly for private subnets, but the trap here is that private subnets must never have a default route pointing to an internet gateway because that would make instances publicly routable; instead, a NAT gateway or NAT instance is required to provide outbound-only internet access.

How to eliminate wrong answers

Option B is wrong because a VPN connection to an on-premises network with internet access introduces unnecessary complexity, latency, and a single point of failure; it also violates the principle of least privilege by routing all internet-bound traffic through a potentially less secure on-premises environment, and it does not leverage AWS-native services for direct internet access. Option C is wrong because using a transit gateway with a centralized inspection VPC is over-engineered for simple internet access; it adds cost, complexity, and potential bottlenecks, and is typically used for advanced traffic inspection or inter-VPC routing, not for basic outbound internet connectivity from private subnets. Option D is wrong because attaching an internet gateway directly to the VPC and routing private subnet traffic to it would expose private instances to the internet without NAT, making them directly reachable from the internet if they have public IPs, which defeats the purpose of private subnets and creates a severe security risk.

Full explanation →

1020

MCQmedium

A company wants to monitor network traffic between two VPCs that are peered. Which AWS feature can capture IP traffic information for analysis?

A.AWS X-Ray

B.AWS Config

C.VPC Flow Logs

D.AWS CloudTrail

AnswerC

Network traffic logs.

Why this answer

VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including traffic between peered VPCs. They log metadata such as source/destination IPs, ports, protocols, and packet accept/reject decisions, which can be published to CloudWatch Logs or Amazon S3 for analysis. This makes them the correct choice for monitoring network traffic between two peered VPCs.

Exam trap

The trap here is that candidates confuse AWS CloudTrail (which logs API calls) with VPC Flow Logs (which logs network traffic), leading them to select CloudTrail when the question specifically asks about IP traffic information for analysis.

How to eliminate wrong answers

Option A is wrong because AWS X-Ray is designed for tracing application requests and debugging distributed applications, not for capturing IP-level network traffic metadata. Option B is wrong because AWS Config is a resource inventory and compliance service that tracks configuration changes to AWS resources, not network packet or flow data. Option D is wrong because AWS CloudTrail records API calls and management events for governance and auditing, not the IP traffic flowing across network interfaces or VPC peering connections.

Full explanation →

1021

MCQhard

A company wants to centrally manage and enforce VPC security group rules across multiple accounts in AWS Organizations. Which AWS service should be used?

A.AWS Config

B.AWS CloudFormation StackSets

C.AWS Firewall Manager

D.IAM Policies

AnswerC

AWS Firewall Manager allows central creation and enforcement of security group rules across all accounts in an organization, making it the correct choice.

Why this answer

AWS Firewall Manager is the correct service for centrally managing and enforcing VPC security group rules across multiple accounts in AWS Organizations. It provides centralized security policy management, allowing you to define common security group rules and automatically apply them to new and existing accounts. AWS Config (Option A) is primarily for compliance auditing and resource configuration history, not enforcement.

AWS CloudFormation StackSets (Option B) can deploy resources across accounts but does not provide ongoing enforcement of security policies. IAM Policies (Option D) control permissions, not security group configurations.

Full explanation →

1022

MCQhard

A company is using AWS Direct Connect with a private VIF to connect to a VPC. The on-premises network team reports that they can ping the VPC's private IP addresses but cannot establish TCP connections to an EC2 instance's private IP. The security groups and NACLs are configured to allow the traffic. What is the most likely cause of this issue?

A.The EC2 instance's operating system firewall is blocking TCP traffic

B.The Direct Connect virtual interface is in a down state

C.The on-premises firewall is blocking ICMP but not TCP

D.The VPC route table is missing a route for the on-premises CIDR

AnswerA

OS firewall can block TCP while allowing ICMP.

Why this answer

Since ICMP echo requests (pings) are working but TCP connections fail, the issue lies at Layer 4 or above. The EC2 instance's operating system firewall (e.g., iptables, Windows Firewall) can be configured to allow ICMP while blocking inbound TCP, which matches the reported symptoms. Security groups and NACLs are correctly configured, so they are not the cause.

Option A is correct. Option B is incorrect because a down VIF would block all traffic, including pings. Option C is the opposite—if the on-premises firewall were blocking ICMP, pings would fail.

Option D is incorrect because a missing route would break all traffic, not just TCP.

Full explanation →

1023

Multi-Selectmedium

A company is designing a hybrid network using AWS Direct Connect and VPN backup. The company wants to ensure that traffic always uses Direct Connect when it is available. Which TWO configurations should be implemented? (Choose TWO.)

Select 2 answers

A.Use AS_PATH prepending on the VPN BGP session to make the VPN path less preferred.

B.Advertise more specific prefixes over Direct Connect and less specific prefixes over VPN.

C.Disable BGP on the VPN connection to force traffic to Direct Connect.

D.Set a lower MED value on the Direct Connect BGP session.

E.Advertise the same prefixes over both connections with the same AS_PATH length.

AnswersA, B

Longer AS_PATH is less preferred.

Why this answer

AS_PATH prepending on the VPN BGP session increases the AS_PATH length for routes advertised over the VPN, making them less preferred compared to the same routes learned over Direct Connect with a shorter AS_PATH. BGP selects the path with the shortest AS_PATH length, so traffic will use Direct Connect when it is available. This is a standard technique for influencing outbound traffic path selection in a hybrid network.

Exam trap

AWS often tests the distinction between outbound and inbound traffic manipulation; the trap here is that candidates may incorrectly apply MED (which influences inbound traffic) or think disabling BGP is acceptable, when the correct approach for outbound traffic preference is to manipulate AS_PATH length or local preference.

Full explanation →

1024

MCQmedium

A company is using AWS Direct Connect with a public virtual interface to access Amazon S3. The on-premises network has a firewall that only allows traffic to specific IP prefixes. What is the best practice to ensure connectivity while maintaining security?

A.Allow all traffic to the AWS region's IP range.

B.Set up a Site-to-Site VPN tunnel over Direct Connect.

C.Use a private virtual interface and connect through a VPC endpoint.

D.Use the S3 IP prefix list from AWS to create firewall rules.

AnswerD

Prefix lists provide specific S3 IP addresses.

Why this answer

AWS publishes managed prefix lists for each service, including Amazon S3, which contain the specific IP prefixes used by S3 in each region. By using these prefix lists in firewall rules, you can allow only the necessary S3 traffic while maintaining strict security, rather than permitting the entire region's IP range. This approach aligns with the principle of least privilege and ensures connectivity over the public VIF without exposing on-premises networks to unnecessary traffic.

Exam trap

The ANS-C01 exam often tests the misconception that a private VIF or VPN is required for secure access to AWS services, when in fact a public VIF with service-specific prefix lists provides a secure and simpler solution for accessing public services like S3.

How to eliminate wrong answers

Option A is wrong because allowing all traffic to the AWS region's IP range is overly permissive and violates security best practices by permitting traffic to services other than S3, increasing the attack surface. Option B is wrong because setting up a Site-to-Site VPN tunnel over Direct Connect is unnecessary for accessing S3 via a public VIF; it adds complexity and cost without improving security, as S3 traffic is already encrypted via HTTPS and the public VIF provides direct connectivity. Option C is wrong because a private virtual interface requires a VPC endpoint (e.g., Gateway Endpoint for S3) and is designed for private connectivity within a VPC, not for direct on-premises access to S3 over a public VIF; it would require additional routing and VPC configuration, making it less straightforward for this use case.

Full explanation →

1025

MCQhard

A media company streams live video to viewers worldwide. The application runs on EC2 instances behind an Application Load Balancer in two AWS regions, us-east-1 and eu-west-1. The company uses Amazon CloudFront as a CDN with origins pointing to both regional ALBs. The network team recently deployed AWS Global Accelerator to improve performance by directing traffic to the nearest healthy endpoint. However, after enabling Global Accelerator, viewers in Europe report buffering issues, while viewers in the US have no issues. The team has verified that the Global Accelerator endpoints are healthy and the ALBs are functioning correctly. The application uses a custom domain name. The DNS is managed by Route 53. What is the most likely cause of the buffering issues for European viewers?

A.Global Accelerator is directing European traffic to the us-east-1 endpoint due to endpoint weight misconfiguration.

B.The Route 53 DNS record is not pointing to Global Accelerator but to CloudFront, bypassing Global Accelerator.

C.CloudFront is caching content from the us-east-1 origin only, causing high latency for European viewers.

D.The eu-west-1 ALB is not configured to accept traffic from Global Accelerator IPs.

AnswerA

If weights are not set to distribute traffic, all traffic may go to one region.

Why this answer

Global Accelerator provides static IP addresses that are anycast from edge locations. If viewers' DNS queries resolve to the Global Accelerator DNS name, they get IPs that may route to the us-east-1 endpoint if the eu-west-1 endpoint is not properly configured or weighted, causing high latency. The most common issue is that the DNS resolution for the custom domain points to Global Accelerator, but the routing within Global Accelerator may not be directing European traffic to the eu-west-1 endpoint if the endpoint weights are misconfigured or if one endpoint is unhealthy.

Option B is wrong because CloudFront origins are separate; Global Accelerator is used instead of CloudFront? Actually, they use both, but the issue is after enabling Global Accelerator. Option C is wrong because CloudFront would not cause issues when Global Accelerator is used. Option D is wrong because the application is not on-premises.

Full explanation →

1026

MCQmedium

A company is using AWS Transit Gateway to interconnect multiple VPCs and on-premises networks. They need to ensure that traffic between VPCs is encrypted in transit. They also want to minimize changes to existing VPC route tables. Which solution should they use?

A.Use a transit VPC architecture with EC2-based VPN appliances in a security VPC that encrypt traffic between VPCs.

B.Enable Transit Gateway VPN attachments between each VPC and the Transit Gateway with IPsec VPN.

C.Use AWS Network Firewall to inspect and encrypt traffic between VPCs.

D.Implement VPC peering with encryption enabled.

AnswerA

EC2 VPN appliances (e.g., using IPsec) can be deployed in a security VPC to encrypt traffic between VPCs. Traffic is routed through the Transit Gateway to the security VPC, then encrypted and forwarded.

Full explanation →

1027

Multi-Selectmedium

A company is designing a multi-region active-active application using Application Load Balancers (ALBs) and AWS Global Accelerator. Which TWO configurations are required to route traffic to the correct regional endpoint based on the client's location?

Select 2 answers

A.Define endpoint groups in Global Accelerator for each region.

B.Enable AWS Shield Advanced on the ALBs.

C.Create an AWS Global Accelerator accelerator with endpoints in both regions.

D.Configure cross-region load balancing in the ALB target groups.

E.Configure Amazon Route 53 latency-based routing to the ALBs.

AnswersA, C

Endpoint groups specify the regional endpoints and traffic distribution.

Why this answer

Endpoint groups in AWS Global Accelerator define the regional endpoints (such as ALBs) and allow you to control traffic routing based on the client's source location. Global Accelerator uses the Anycast IP addresses and the AWS global network to direct traffic to the nearest endpoint group, providing performance-based routing without relying on DNS.

Exam trap

The trap here is that candidates often confuse DNS-based routing (Route 53 latency routing) with Global Accelerator's Anycast-based routing, assuming both achieve the same result, but Global Accelerator provides faster failover and more consistent performance by avoiding DNS caching and using the AWS backbone.

Full explanation →

1028

MCQhard

A company uses AWS Direct Connect and VPN as backup. They have a Transit Gateway with multiple VPC attachments. The network engineer wants to ensure that traffic uses Direct Connect when available and fails over to VPN. Which configuration should be applied?

A.Set a higher MED value on the VPN BGP advertisements.

B.Prepend AS_PATH on the VPN BGP advertisements to make them less preferred.

C.Apply BGP community tags from Direct Connect to set a higher local preference.

D.Configure BFD on both Direct Connect and VPN interfaces.

AnswerC

AWS uses BGP community tags to influence local preference.

Why this answer

AWS Direct Connect can apply BGP community tags that allow you to set a higher local preference for routes learned via Direct Connect compared to VPN routes. This ensures traffic prefers Direct Connect when available. Option A is incorrect because MED is used for influencing inbound route selection from multiple AS paths, not for preferring Direct Connect over VPN.

Option B is incorrect because AS_PATH prepending affects how routes are advertised to neighbors, not how they are preferred locally. Option D is incorrect because BFD (Bidirectional Forwarding Detection) provides fast failure detection but does not influence route preference; it would be used in conjunction with routing policies, not as a standalone solution.

Full explanation →

1029

MCQhard

A company is designing a highly available architecture for a web application using an Application Load Balancer (ALB) across multiple Availability Zones. The ALB is internet-facing and uses TLS termination. The application requires that client IP addresses be preserved in the backend logs. The backend instances are in private subnets behind the ALB. Which configuration will ensure client IP addresses are preserved without additional overhead?

A.Attach a VPC Endpoint to the ALB to capture client IP

B.Enable Proxy Protocol v2 on the target group

C.Replace the ALB with a Network Load Balancer (NLB)

D.Configure the ALB to pass the X-Forwarded-For header and ensure backend logs parse it

AnswerD

Correct; ALB automatically adds X-Forwarded-For header, and backend can log that to capture client IP.

Why this answer

The ALB automatically adds the X-Forwarded-For header to HTTP requests, containing the original client IP address. Since the backend instances are in private subnets and receive traffic from the ALB's private IPs, parsing this header in the backend logs is the standard, zero-overhead method to preserve client IPs for HTTP/HTTPS traffic with TLS termination.

Exam trap

The trap here is that candidates confuse Proxy Protocol v2 (an NLB feature) with the ALB's X-Forwarded-For mechanism, or assume that preserving client IPs requires a complex solution like a VPC Endpoint or replacing the load balancer, when the ALB already handles it natively for HTTP traffic.

How to eliminate wrong answers

Option A is wrong because a VPC Endpoint is used for private connectivity to AWS services (e.g., S3, DynamoDB) and does not capture or forward client IPs to an ALB. Option B is wrong because Proxy Protocol v2 is a feature of Network Load Balancers (NLBs) and Network Load Balancer target groups, not Application Load Balancers; enabling it on an ALB target group is unsupported and would cause configuration errors. Option C is wrong because replacing the ALB with an NLB would require additional overhead to handle TLS termination (NLBs do not terminate TLS natively) and would lose HTTP-specific features like path-based routing and the X-Forwarded-For header, which is the simplest solution for preserving client IPs in an HTTP application.

Full explanation →

1030

MCQeasy

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team wants to monitor the amount of data transferred between VPCs for cost allocation. Which AWS feature should they use?

A.CloudWatch Metrics for Transit Gateway.

B.VPC Flow Logs for each VPC.

C.AWS Config rules.

D.AWS CloudTrail logs.

AnswerB

Flow Logs capture individual flow data including byte counts.

Why this answer

VPC Flow Logs can be published to CloudWatch Logs or S3 and provide network traffic logs that include source/destination IP, ports, and byte counts, which can be used for cost allocation. Option A is wrong because CloudWatch Metrics for Transit Gateway only show aggregate metrics like bytes in/out per attachment, not per-flow. Option C is wrong because AWS Config records resource configuration changes, not traffic.

Option D is wrong because CloudTrail records API calls.

Full explanation →

1031

MCQhard

A company has deployed a web application behind an Application Load Balancer (ALB) in a VPC. The ALB is in public subnets, and the web servers are in private subnets. The ALB is configured with a target group pointing to the web servers. Users report intermittent 503 errors. The web servers are healthy according to the target group health checks. What is the most likely cause?

A.The ALB subnets do not have a route to an internet gateway

B.The target group health check interval is too long

C.The ALB is configured as internal instead of internet-facing

D.Cross-zone load balancing is disabled

AnswerA

Without a route to an internet gateway, the ALB cannot respond to client requests, causing 503 errors.

Why this answer

An internet-facing ALB must be deployed in public subnets that have a route to an internet gateway. Since the web servers are healthy but users get intermittent 503 errors, the issue is likely that the ALB's subnets lack a route to an internet gateway, preventing the ALB from sending responses to clients. Option B is wrong because a long health check interval would not cause 503 errors if the targets are healthy.

Option C is wrong because the ALB is described as being in public subnets and should be internet-facing; if it were internal, it would not receive internet traffic. Option D is wrong because cross-zone load balancing being disabled affects traffic distribution but does not cause intermittent 503 errors when targets are healthy.

Full explanation →

1032

MCQhard

A large e-commerce company operates a multi-tier application across multiple AWS accounts. The web tier is in a VPC (10.0.0.0/16) in Account A, and the application tier is in a separate VPC (10.1.0.0/16) in Account B. Both VPCs are connected via a VPC peering connection. The application tier uses an NLB to distribute traffic to EC2 instances in private subnets. The web tier sends traffic to the NLB's private IP address. Recently, the company migrated the application tier to use AWS PrivateLink instead of the VPC peering connection, creating a VPC endpoint service in Account B and an interface VPC endpoint in Account A. After the migration, the web tier cannot connect to the application tier. The security groups and NACLs allow the traffic. Which of the following is the MOST likely cause of the connectivity issue?

A.The web tier instances are using the private IP address of the Network Load Balancer instead of the VPC endpoint DNS name or private IP addresses.

B.The route tables in Account A's VPC do not have a route to the VPC endpoint service in Account B.

C.The VPC endpoint in Account A requires an Internet Gateway (IGW) to route traffic to the VPC endpoint service in Account B.

D.The Network Load Balancer in Account B is not configured to support TCP traffic.

AnswerA

Correct; after migrating to PrivateLink, the web tier should use the VPC endpoint's DNS name or its assigned private IPs, not the NLB's IP directly.

Why this answer

After migrating from VPC peering to AWS PrivateLink, the web tier instances must use the VPC endpoint's DNS name or its private IP addresses to connect to the application tier. The VPC endpoint provides a different set of IP addresses (from the subnet in Account A) than the NLB's private IP, which remains in Account B. Since the web tier continues to send traffic to the NLB's private IP, the packets are not routed through the VPC endpoint, causing connectivity failure because the VPC peering connection is no longer available.

Exam trap

The trap here is that candidates assume PrivateLink transparently forwards traffic to the original NLB IP, but in reality the consumer must use the endpoint's DNS name or IP, not the service's original IP.

How to eliminate wrong answers

Option B is wrong because VPC endpoints do not require route table entries; traffic to the endpoint service is routed via the endpoint's elastic network interface in the subnet, not through route tables. Option C is wrong because interface VPC endpoints do not require an Internet Gateway; they use private IP addresses within the VPC and communicate over the AWS network without internet access. Option D is wrong because Network Load Balancers support TCP traffic by default; the issue is not about protocol support but about the destination IP address used by the web tier.

Full explanation →

1033

Multi-Selectmedium

A network engineer is troubleshooting a connectivity issue between two VPCs (VPC-A and VPC-B) that are connected via a VPC peering connection. The engineer has verified that the route tables in both VPCs have the appropriate routes. However, instances in VPC-A cannot ping instances in VPC-B. Which TWO actions should the engineer take to resolve this issue? (Choose two.)

Select 2 answers

A.Add a route in VPC-A's route table pointing to the VPC peering connection for the CIDR of VPC-B.

B.Enable DNS resolution for the VPC peering connection.

C.Verify that the network ACLs in VPC-B allow inbound ICMP traffic from VPC-A.

D.Verify that the security groups of the instances in VPC-B allow inbound ICMP traffic from the CIDR of VPC-A.

E.Configure a transit gateway to route traffic between the two VPCs.

AnswersC, D

Network ACLs are stateless and must allow both inbound and outbound traffic; if ICMP is denied, pings will fail.

Why this answer

Network ACLs are stateless firewalls that control inbound and outbound traffic at the subnet level. Even if the route tables are correctly configured, a network ACL in VPC-B that denies inbound ICMP traffic from VPC-A's CIDR will block ping requests. Option D is correct because security groups are stateful and must explicitly allow inbound ICMP traffic from VPC-A's CIDR; without this rule, the instances in VPC-B will drop the ping requests.

Exam trap

AWS often tests the distinction between stateless network ACLs and stateful security groups, and candidates mistakenly assume that correct route tables alone guarantee connectivity, overlooking the need to verify both firewall layers for the specific protocol (ICMP).

Full explanation →

1034

MCQmedium

A company uses AWS Certificate Manager (ACM) to issue certificates for a fleet of Application Load Balancers. The security team requires that only specific IAM roles can request, renew, or delete ACM certificates. Which policy type should be used to enforce this?

A.AWS managed policies such as AWSCertificateManagerFullAccess

B.Service control policies (SCPs) in AWS Organizations

C.IAM identity-based policies attached to the IAM roles

D.Resource-based policies attached to the ACM certificates

AnswerC

IAM policies control access to ACM actions.

Why this answer

ACM access is controlled via IAM identity-based policies attached to IAM roles, which allow specifying which roles can request, renew, or delete certificates. Option A is incorrect because AWS managed policies are a type of IAM policy, but the question asks for the policy type used to enforce access for specific IAM roles, and AWS managed policies can be used but are not the only type; however, the key point is that identity-based policies are the mechanism. Option B is incorrect because service control policies (SCPs) apply to all accounts in an AWS Organization and cannot target specific IAM roles within an account.

Option D is incorrect because ACM does not support resource-based policies; only IAM policies can be used to control access to certificates.

Full explanation →

1035

Multi-Selectmedium

A network engineer is troubleshooting network connectivity issues in a VPC. The engineer suspects that the network ACL is blocking traffic. Which TWO actions should the engineer take to verify this?

Select 2 answers

A.Review the inbound and outbound rules of the network ACL.

B.Check the security group rules for the affected instances.

C.Use AWS CloudTrail to view network traffic logs.

D.Enable VPC Flow Logs and filter for 'ACCEPT' or 'REJECT' status.

E.Test connectivity using AWS Direct Connect.

AnswersA, D

NACL rules explicitly allow or deny traffic.

Why this answer

Options A and D are correct because reviewing the inbound and outbound rules of the network ACL allows the engineer to check if traffic is explicitly blocked by the ACL, and enabling VPC Flow Logs with 'ACCEPT' or 'REJECT' status provides insight into whether the ACL is actually blocking the traffic. Option B is incorrect because security groups are stateful and work at the instance level, not at the subnet level like NACLs. Option C is incorrect because AWS CloudTrail records API activity, not network traffic.

Option E is incorrect because AWS Direct Connect establishes a dedicated network connection but does not help verify if a NACL is blocking traffic.

Full explanation →

1036

MCQmedium

A company has a VPC with public and private subnets in three Availability Zones. An internet-facing Network Load Balancer (NLB) is deployed in the public subnets, and a fleet of EC2 instances is in the private subnets. The application logs show intermittent connection timeouts. The security group for the EC2 instances allows traffic from the NLB's security group. What is the MOST likely cause?

A.Cross-zone load balancing is disabled on the NLB.

B.The EC2 instances' security group allows traffic from the NLB's security group, but the NLB preserves client IP, so the security group must allow client IPs directly.

C.The NLB's security group is not allowing traffic from the EC2 instances.

D.The network ACLs in the private subnets are blocking return traffic.

AnswerB

NLB preserves source IP; security group references to NLB's security group only work for traffic that originates from NLB's private IPs, but NLB sends client IPs.

Why this answer

When an NLB is configured with `preserve_client_ip` enabled (the default for internet-facing NLBs), the source IP of incoming packets is the actual client IP, not the NLB's private IP. Therefore, the EC2 instances' security group must allow traffic from the client IPs, not from the NLB's security group. Since the security group only allows traffic from the NLB's security group, packets from client IPs are dropped, causing intermittent connection timeouts.

Exam trap

The ANS-C01 exam often tests the misconception that an NLB's security group can be used as a source in backend instance security groups, similar to an ALB, but the NLB's preserve_client_ip feature breaks that assumption.

How to eliminate wrong answers

Option A is wrong because cross-zone load balancing affects traffic distribution across AZs, not security filtering; disabling it would cause uneven load but not connection timeouts due to security group rules. Option C is wrong because the NLB's security group controls inbound traffic to the NLB, not outbound return traffic from EC2 instances; the issue is with the EC2 security group inbound rules. Option D is wrong because network ACLs are stateless and must allow both inbound and outbound traffic; if they were blocking return traffic, the timeouts would be consistent, not intermittent, and the question states the security group is the configured filter.

Full explanation →

1037

MCQhard

A company is using CloudFormation to deploy a VPC. The private subnet route table has a route to a NAT gateway. However, instances in the private subnet cannot access the internet. The NAT gateway is in a public subnet and has an attached Elastic IP. What is the most likely issue?

A.The public subnet does not have a route to the internet gateway.

B.The private subnet route table does not have a route to the NAT gateway.

C.The NAT gateway is not in the same subnet as the private instances.

D.The NAT gateway's security group is blocking traffic from the private subnet.

AnswerD

NAT gateway security groups can block traffic.

Why this answer

The NAT gateway has a security group that by default denies all inbound traffic. For instances in the private subnet to send traffic to the internet, the NAT gateway's security group must allow inbound traffic from the private subnet's CIDR (or from the private subnet's network ACLs) and allow outbound traffic to the internet. Option D is correct because this is the most likely issue: the security group is blocking traffic.

Option A is incorrect because the public subnet route to the IGW is presumptively configured correctly for the NAT gateway to reach the internet. Option B is incorrect because the route to the NAT gateway is present in the private route table. Option C is incorrect because the NAT gateway does not need to be in the same subnet as the private instances; it must be in a public subnet.

Full explanation →

1038

MCQhard

A company has a multi-VPC architecture using AWS Transit Gateway (TGW). They have a central inspection VPC with a Gateway Load Balancer (GWLB) and third-party firewall appliances. All other VPCs are attached to the TGW and have route tables that send traffic to the inspection VPC for inspection. Recently, the network team deployed a new VPC (VPC-D) and attached it to the TGW. They configured the VPC-D route table to send all inter-VPC traffic to the TGW. However, traffic from VPC-D to other VPCs is not being inspected. The team confirmed that the firewall appliances are healthy and the GWLB is correctly configured. Which action should the network team take to ensure traffic from VPC-D is inspected?

A.Enable route propagation on VPC-D's TGW attachment.

B.Add a route in VPC-D's subnet route tables pointing to the TGW for all traffic.

C.Create a new TGW route table and associate all VPC attachments to it.

D.Associate VPC-D's TGW attachment with the correct TGW route table that routes traffic to the inspection VPC.

AnswerD

This ensures TGW forwards traffic from VPC-D through the inspection VPC.

Why this answer

Each VPC attached to a Transit Gateway is associated with a specific TGW route table. This route table controls how traffic from that VPC is forwarded to other attachments. For traffic from VPC-D to be inspected, the TGW route table associated with VPC-D's attachment must include routes that direct traffic to the inspection VPC's attachment (where the Gateway Load Balancer and firewall appliances reside).

Simply attaching VPC-D does not automatically associate it with the correct route table; the network team must explicitly associate VPC-D's attachment with the existing route table that routes traffic to the inspection VPC. Option D correctly describes this action.

Full explanation →

1039

MCQeasy

A company is using AWS CloudHSM to store sensitive encryption keys. Which of the following is a security best practice for managing the HSM?

A.Disable two-factor authentication for the HSM to simplify management.

B.Use AWS KMS to automatically rotate the CloudHSM partition password.

C.Store the CloudHSM security officer (CO) password in AWS Secrets Manager.

D.Allow AWS to manage the CloudHSM cluster by granting AWS support access.

AnswerC

Best practice to protect the CO password.

Why this answer

Storing the CloudHSM security officer (CO) password in AWS Secrets Manager is a security best practice. Secrets Manager provides secure storage, automatic rotation, and fine-grained access control for sensitive credentials, reducing the risk of exposure. Option A is incorrect because disabling two-factor authentication would weaken the security posture of the HSM.

Option B is incorrect because AWS KMS cannot rotate CloudHSM partition passwords; KMS manages encryption keys, not HSM passwords. Option D is incorrect because granting AWS support access would compromise the customer-managed security model of CloudHSM, where only the customer controls the HSM cluster.

Full explanation →

1040

Multi-Selecthard

Which TWO of the following are required to establish a BGP session over a Direct Connect private virtual interface? (Choose TWO.)

Select 2 answers

A.A VLAN ID

B.A public IP address for the BGP peer

C.A Direct Connect gateway

D.BGP session with a customer router and AWS router

E.A VPN connection to the VPC

AnswersA, D

Each virtual interface is associated with a VLAN.

Why this answer

A VLAN ID is required because a Direct Connect private virtual interface operates over a single 802.1Q VLAN trunk. The VLAN ID uniquely identifies the virtual interface on the Direct Connect connection, allowing multiple virtual interfaces to share the same physical link. Without a VLAN ID, the Layer 2 encapsulation cannot be established, and the BGP session cannot form.

Exam trap

The ANS-C01 exam often tests the misconception that a Direct Connect gateway is mandatory for any Direct Connect setup, but it is only needed when connecting to multiple VPCs or using a transit gateway; a single VPC can use a virtual private gateway directly without a Direct Connect gateway.

Full explanation →

1041

Multi-Selecteasy

A company is using AWS CloudWatch to monitor network metrics. They want to create a dashboard that shows the total number of bytes sent and received by all EC2 instances in a specific VPC. Which two metrics should they use? (Choose TWO.)

Select 2 answers

A.TotalNetworkBytes

B.NetworkPacketsOut

C.NetworkOut

D.NetworkPacketsIn

E.NetworkIn

AnswersC, E

Bytes sent.

Why this answer

The question asks for metrics that measure total bytes sent and received. AWS CloudWatch provides `NetworkIn` (bytes received) and `NetworkOut` (bytes sent) for EC2 instances. These are the only two metrics that directly measure bytes.

The option `NetworkPacketsIn` and `NetworkPacketsOut` measure packets, not bytes, and `TotalNetworkBytes` is not a valid CloudWatch metric. Therefore, the correct answers are NetworkOut and NetworkIn.

Full explanation →

1042

MCQhard

A company has a Direct Connect connection with a private VIF attached to a Direct Connect Gateway. The company wants to connect to multiple VPCs in the same AWS Region. What is the MOST cost-effective and scalable design?

A.Provision multiple private VIFs, each connected to a different VPC.

B.Create a Direct Connect Gateway and associate each VPC's Virtual Private Gateway to it using a private VIF.

C.Create a Transit Gateway, attach it to the Direct Connect Gateway using a Transit VIF, and attach each VPC to the Transit Gateway.

D.Use a private VIF to connect to a Virtual Private Gateway in one VPC and use VPC Peering to reach other VPCs.

AnswerC

This is scalable and cost-effective.

Why this answer

It uses a Transit Gateway (TGW) to interconnect multiple VPCs and a Direct Connect Gateway (DXGW) via a Transit VIF, which is the most cost-effective and scalable design. The Transit VIF allows a single Direct Connect connection to be shared across many VPCs through the TGW, avoiding the need for multiple private VIFs or complex peering arrangements. This design scales to hundreds of VPCs and reduces operational overhead by centralizing routing.

Exam trap

AWS often tests the misconception that a Direct Connect Gateway alone can provide transitive routing between VPCs, but in reality, a Direct Connect Gateway only connects VPCs to on-premises networks, not VPCs to each other, which is why a Transit Gateway is needed for inter-VPC connectivity.

How to eliminate wrong answers

Option A is wrong because provisioning multiple private VIFs for each VPC is not cost-effective (each VIF incurs separate port and data transfer charges) and does not scale well beyond a few VPCs. Option B is wrong because a Direct Connect Gateway can associate multiple Virtual Private Gateways (VGWs) via a single private VIF, but this design requires each VPC to have its own VGW and does not provide transitive routing between VPCs; it only connects each VPC to the on-premises network, not to each other. Option D is wrong because using VPC Peering to connect other VPCs creates a non-transitive, point-to-point mesh that does not scale (each peering connection is a separate relationship) and introduces complex routing and bandwidth limitations, while still relying on a single VPC as a hub.

Full explanation →

1043

MCQhard

A company uses AWS Direct Connect with a public VIF to access Amazon S3. The network team notices that the latency to S3 increases significantly during peak hours. They have tested the connection and confirmed that the physical link is not saturated. The company uses a single Direct Connect connection. The S3 traffic is routed over the public VIF. The team wants to improve performance without adding a new Direct Connect connection. Which action should the team take to reduce latency?

A.Use an AWS Site-to-Site VPN connection over the Direct Connect to access S3 via private IP.

B.Add a second Direct Connect connection to load balance traffic.

C.Configure the Direct Connect public VIF to use a different AWS region closer to the on-premises location.

D.Create an S3 Gateway Endpoint in the VPC and route S3 traffic through a private VIF attached to the VPC.

AnswerD

Gateway Endpoint keeps traffic within AWS and reduces latency compared to public VIF.

Why this answer

Using a Direct Connect gateway allows you to connect to multiple VPCs and also to AWS public services via a private VIF. However, for S3, you can use a private VIF with a VPC interface endpoint (Gateway Endpoint for S3) to keep traffic within the AWS network and avoid internet transit. This reduces latency because traffic goes from Direct Connect to the VPC and then to S3 via the gateway endpoint.

Option B (adding VPN) adds IPSec overhead. Option C uses a different AWS region, which may increase latency. Option D (adding a second Direct Connect) is not allowed per the question.

Full explanation →

1044

Matchingmedium

Match each VPN term to its correct description in the context of AWS Site-to-Site VPN.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

VPN concentrator on the AWS side attached to a VPC

VPN device on the on-premises side

Encrypted IPsec connection between VGW and CGW

Secret key used to authenticate the VPN tunnel endpoints

Dynamic routing protocol used to exchange routes over VPN tunnels

Why these pairings

The correct matches are: VPN Connection → logical connection, VPN Tunnel → encrypted tunnel, Transit Gateway → central hub. Common confusions involve swapping the definitions of Virtual Private Gateway (AWS-side) and Customer Gateway (customer-side).

Full explanation →

1045

MCQeasy

A company is using AWS Direct Connect with a private VIF to access their VPC. Users report intermittent connectivity issues. You check the Direct Connect console and see that the virtual interface state is 'down'. What is the MOST likely cause?

A.AWS Site-to-Site VPN is not established.

B.MACsec encryption is misconfigured on the customer router.

C.BGP session between the customer router and AWS is down.

D.Jumbo frames are enabled on the VIF but not supported by the customer router.

AnswerC

A private VIF requires an active BGP session; if BGP is down, the VIF state becomes down.

Why this answer

A private VIF relies on a BGP session between the customer router and the AWS Direct Connect router to exchange routes and maintain the virtual interface state. When the BGP session goes down, the VIF state transitions to 'down' because no routing information is being exchanged, causing connectivity loss. This is the most direct and common cause of a VIF being in the 'down' state.

Exam trap

The trap here is that candidates often assume a VIF 'down' state is caused by physical or Layer 1 issues (like MACsec or jumbo frames), but the VIF state is directly tied to the BGP session status, not the underlying physical link.

How to eliminate wrong answers

Option A is wrong because AWS Site-to-Site VPN is a separate connectivity option and is not required for a Direct Connect private VIF to function; the VIF state is independent of any VPN. Option B is wrong because MACsec encryption, when misconfigured, would cause link-level encryption failures but would not directly cause the BGP session or VIF state to go down; the VIF would remain 'up' at the Layer 1/2 level. Option D is wrong because jumbo frame misconfiguration would cause packet loss or MTU issues but would not bring the BGP session or VIF state down; the VIF would still show as 'up' if the BGP session is established.

Full explanation →

1046

MCQhard

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to initiate outbound connections to the internet. The company has a NAT gateway in the public subnet. The NAT gateway has an Elastic IP. The private subnet route table has a default route pointing to the NAT gateway. However, the EC2 instance cannot reach the internet. What is the most likely cause?

A.The security group of the EC2 instance blocks outbound traffic.

B.The route table in the public subnet does not have a default route to the internet gateway.

C.The network ACL of the private subnet blocks inbound traffic from the NAT gateway.

D.The NAT gateway's Elastic IP is not allowed by the destination's firewall.

AnswerD

Destination may block the public IP.

Why this answer

The NAT gateway's Elastic IP is a public IP address that the destination server sees as the source of the outbound traffic. If the destination's firewall (e.g., a security appliance or an internet-based service) explicitly blocks traffic from that Elastic IP, the EC2 instance will be unable to reach the internet, even though the VPC routing and NAT configuration are correct. This is a common scenario when the destination uses IP-based allowlists or blacklists.

Exam trap

The ANS-C01 exam often tests the misconception that NAT gateway or internet gateway configuration is the sole cause of connectivity failures, while in reality, external firewalls or destination-side IP filtering can independently block traffic even when all AWS-side networking is correctly configured.

How to eliminate wrong answers

Option A is wrong because security groups are stateful; if the EC2 instance initiates outbound traffic, the security group automatically allows the return traffic, and by default, security groups allow all outbound traffic unless explicitly modified. Option B is wrong because the public subnet's route table does not need a default route to the internet gateway for the private instance's outbound traffic; the NAT gateway in the public subnet handles the translation, and the public subnet's route table only affects traffic originating from the public subnet itself. Option C is wrong because network ACLs are stateless and must allow both inbound and outbound traffic separately; however, the private subnet's network ACL would need to allow outbound traffic to the NAT gateway (and the corresponding ephemeral ports for return traffic), not inbound from the NAT gateway, and the question states the instance cannot reach the internet, implying the outbound direction is blocked, not inbound.

Full explanation →

1047

MCQmedium

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that no EC2 instance in any account can be launched with a public IP address unless it is in a specific VPC. Which solution will meet this requirement?

A.Create a service control policy (SCP) that denies ec2:RunInstances if the request includes an association with a public IP address, unless the VPC is the allowed one.

B.Create an IAM policy that denies ec2:RunInstances if the subnet is not in the allowed VPC, and attach it to all IAM users.

C.Enable AWS CloudTrail and create a CloudWatch Events rule to stop any instance with a public IP.

D.Use AWS Config rules to detect non-compliant instances and automatically terminate them.

AnswerA

Correct: SCPs can enforce restrictions across all accounts in the organization.

Why this answer

An SCP applied at the root OU can deny ec2:RunInstances when the request includes a public IP address, using the ec2:AssociatePublicIpAddress condition key, and can further limit based on VPC using conditions like ec2:Vpc. This centrally prevents non-compliant EC2 launches across all accounts. Option B is incorrect because IAM policies must be attached to each user/role individually and do not scale across accounts; SCPs are designed for this purpose.

Option C is incorrect because AWS Config can detect non-compliant instances but cannot prevent the initial launch. Option D is incorrect because CloudWatch Events can trigger actions after launch but does not prevent the launch itself.

Full explanation →

1048

MCQhard

A company has a VPC with a CIDR of 10.0.0.0/16. They need to peer with another VPC that has a CIDR of 10.0.0.0/24. What will happen?

A.The peering connection will be established, but only the first VPC's CIDR will be used.

B.The peering connection will be established, but routes with overlapping CIDRs will not be added automatically.

C.The peering connection will fail because the CIDRs overlap.

D.The peering connection will be established, and the overlapping CIDRs will be ignored.

AnswerC

VPC Peering requires non-overlapping IP address ranges.

Why this answer

AWS VPC peering requires that the CIDR blocks of the two VPCs do not overlap. When both VPCs use the same IP range (10.0.0.0/16 and 10.0.0.0/24), the peering connection request will fail because overlapping CIDRs create routing ambiguity and are not supported by the VPC peering service. This is a hard limit enforced at the time of peering creation, not during route table configuration.

Exam trap

The ANS-C01 exam often tests the misconception that overlapping CIDRs are allowed in VPC peering but simply cause routing issues later, when in fact the peering creation itself is blocked by the AWS API.

How to eliminate wrong answers

Option A is wrong because the peering connection will not be established at all; AWS does not allow overlapping CIDRs to proceed with peering, so no CIDR is 'used'. Option B is wrong because the peering connection fails before any route tables are modified; automatic route propagation never occurs for overlapping CIDRs. Option D is wrong because overlapping CIDRs are not ignored; the peering request is rejected outright by the AWS API with an error indicating the conflict.

Full explanation →

1049

MCQhard

A company has a requirement to audit all network traffic leaving a VPC. The traffic includes traffic to the internet, to on-premises via VPN, and to other VPCs via Transit Gateway. Which AWS service can capture and log all outbound traffic for compliance analysis?

A.VPC Traffic Mirroring

B.VPC Flow Logs

C.AWS CloudTrail

D.Amazon GuardDuty

AnswerA

Traffic Mirroring copies network traffic for analysis and compliance.

Why this answer

(VPC Traffic Mirroring) is correct because it captures and copies all outbound network traffic, including full packets, for compliance analysis. Option B (VPC Flow Logs) is incorrect because it only logs metadata (e.g., IP addresses, ports, protocols) but not the full packet content. Option C (AWS CloudTrail) is incorrect because it logs API calls and management events, not network traffic.

Option D (Amazon GuardDuty) is incorrect because it is a threat detection service that analyzes traffic for anomalies, but it does not log all traffic for auditing purposes.

Full explanation →

1050

MCQmedium

A company has a VPC with public and private subnets in two Availability Zones. An Application Load Balancer in the public subnets distributes traffic to EC2 instances in the private subnets. The security group for the EC2 instances allows inbound traffic from the ALB security group. Users report intermittent timeouts. What is the most likely cause?

A.The security group for the ALB does not allow inbound traffic from the internet.

B.The ALB is not associated with an internet gateway.

C.The network ACL for the private subnets is blocking inbound traffic from the ALB subnets.

D.Cross-zone load balancing is disabled on the ALB.

AnswerC

Correct. Network ACLs are stateless and must allow both inbound and outbound ephemeral port traffic. A missing inbound rule for ephemeral ports from ALB subnets will cause intermittent timeouts as some connections succeed and others fail.

Why this answer

Intermittent timeouts are often caused by network ACL rules that block ephemeral ports used for return traffic. The ALB initiates connections to EC2 instances on random ephemeral ports (1024-65535). If the private subnet's network ACL denies inbound traffic on these ports from the ALB subnets, connections will fail intermittently.

In contrast, a missing inbound rule on the ALB security group would result in consistent failures, not intermittent ones.

Exam trap

Candidates often overlook that network ACLs are stateless and must allow ephemeral ports for return traffic. A missing rule for high ports (1024-65535) causes intermittent failures, not a complete outage.

How to eliminate wrong answers

Option B is wrong because an ALB in a public subnet is automatically associated with an internet gateway via the subnet's route table; no explicit association is required. Option C is wrong because network ACLs are stateless and, by default, allow all inbound and outbound traffic; even if modified, the ALB's traffic originates from its own subnets, and the private subnet's NACL would need to explicitly deny traffic from the ALB subnet CIDR, which is unlikely to cause intermittent timeouts. Option D is wrong because cross-zone load balancing is enabled by default on ALBs, and disabling it would cause uneven traffic distribution but not intermittent timeouts; all targets would still be reachable within their own zone.

Full explanation →

Page 14 of 22

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

Practice ANS-C01 by domain

Target a specific domain to shore up weak areas.

Network Management and Operations Network Security, Compliance and Governance Network Design Network Implementation

See all domains with question counts →