Courseiva

AWS Certified Advanced Networking Specialty ANS-C01 (ANS-C01) — Questions 1051–1125

1621 questions total · 22pages · All types, answers revealed

Take a mock examExam hub
Page 14

Page 15 of 22

Page 16
1051
MCQeasy

A company is deploying a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB is internet-facing and receives traffic from clients. The company wants to improve security by adding an additional layer of protection against common web exploits like SQL injection and cross-site scripting. Which AWS service should they use?

A.AWS Firewall Manager
B.AWS WAF
C.AWS Shield Advanced
D.Network ACLs
AnswerB

Web application firewall that filters SQL injection and XSS.

Why this answer

AWS WAF (Web Application Firewall) is the correct service because it is specifically designed to protect web applications from common exploits such as SQL injection and cross-site scripting (XSS). It integrates directly with an Application Load Balancer (ALB) to inspect HTTP/HTTPS requests and apply customizable rules to block malicious traffic before it reaches the EC2 instances.

Exam trap

The trap here is that candidates often confuse AWS WAF with AWS Shield Advanced, mistakenly thinking Shield Advanced covers application-layer exploits, when in fact Shield Advanced focuses on volumetric DDoS protection and WAF handles Layer 7 threats like SQL injection and XSS.

How to eliminate wrong answers

Option A is wrong because AWS Firewall Manager is a centralized policy management service that helps manage AWS WAF, AWS Shield Advanced, and VPC security groups across accounts, but it does not itself inspect web traffic or block application-layer attacks. Option C is wrong because AWS Shield Advanced provides protection against Distributed Denial of Service (DDoS) attacks at the network and transport layers, not against application-layer exploits like SQL injection or XSS. Option D is wrong because Network ACLs are stateless packet filters that operate at the subnet level (Layer 3/4) and cannot inspect application-layer payloads or block specific HTTP request patterns.

Full explanation →
1052
MCQhard

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. The on-premises network uses BGP to advertise routes to the VPC. The company wants to extend this connectivity to a second VPC in the same region without creating additional Direct Connect connections. Which solution should be used?

A.Create a second Direct Connect private VIF for the second VPC.
B.Set up a Site-to-Site VPN from the on-premises network to the second VPC.
C.Create a VPC peering connection between the two VPCs.
D.Use a transit gateway and attach both VPCs and the Direct Connect private VIF.
AnswerD

Transit gateway allows multiple VPCs to share Direct Connect.

Why this answer

A transit gateway allows you to centrally connect multiple VPCs and on-premises networks via a single Direct Connect private virtual interface. By attaching both VPCs and the Direct Connect private VIF to the transit gateway, the on-premises network can reach both VPCs without needing additional Direct Connect connections. This solution scales efficiently and supports transitive routing between all attached networks.

Exam trap

The ANS-C01 exam often tests the misconception that a single Direct Connect private VIF can be directly associated with multiple VPCs, but in reality, a private VIF can only be associated with one VPC or one transit gateway, making the transit gateway the correct scaling solution.

How to eliminate wrong answers

Option A is wrong because creating a second Direct Connect private VIF would require an additional virtual interface on the same Direct Connect connection, but the question explicitly states the company wants to avoid creating additional Direct Connect connections; more importantly, a single private VIF can only be associated with one VPC (or one transit gateway) at a time, so this does not solve the need to extend connectivity to a second VPC without extra connections. Option B is wrong because setting up a Site-to-Site VPN introduces a separate, internet-based connection that bypasses the existing Direct Connect, adding latency, complexity, and potential security concerns; it does not leverage the existing Direct Connect private VIF. Option C is wrong because a VPC peering connection only enables direct communication between the two VPCs, but it does not extend the on-premises network’s reachability to the second VPC; on-premises routes are not automatically propagated across a VPC peering connection, so the on-premises network would still be unable to reach the second VPC without additional routing configuration and potential use of a transit gateway or VPN.

Full explanation →
1053
MCQhard

An IAM policy is created and attached to a user. The user reports they cannot stop a production EC2 instance. What is the most likely reason?

A.The EC2 instance does not have the tag Environment=production
B.The policy is missing a region condition
C.The policy is not attached to the user's group
D.The policy does not include ec2:StopInstances
AnswerA

Condition requires the tag.

Why this answer

The IAM policy likely includes a condition key such as ec2:ResourceTag/Environment requiring the instance to have the tag 'Environment=production'. If the instance lacks that tag, the action is denied, even if the user has the permission to stop instances. Options B, C, and D are incorrect because the issue is specifically due to the missing tag, not a region condition, group attachment, or missing action.

Full explanation →
1054
MCQeasy

A company is setting up an AWS Client VPN endpoint for remote access. Users report they can connect to the VPN but cannot access resources in the VPC. The VPN endpoint is associated with a subnet that has a route table with a route to an internet gateway. The security group for the VPN endpoint allows all traffic. What could be the issue?

A.The route table associated with the VPN subnet does not have a route to the VPC CIDR
B.The authorization rules for the VPN endpoint do not include the VPC CIDR
C.The security group for the VPN endpoint does not allow outbound traffic
D.The client CIDR range overlaps with the VPC CIDR
AnswerA

A route to the VPC CIDR via the VPN endpoint's network interface is required.

Why this answer

The VPN endpoint is associated with a subnet, and that subnet's route table must include a route to the VPC CIDR to allow traffic from VPN clients to reach VPC resources. Without this route, packets from VPN clients are dropped because the subnet does not know how to forward them to the VPC. Option A is correct.

Option B is incorrect because authorization rules control user access to specific destinations, but they do not affect routing; if the route is missing, traffic never reaches the VPC regardless of authorization. Option C is incorrect because the security group allows all traffic, so it is not blocking access. Option D is incorrect because while client CIDR overlap could cause issues, users can connect to the VPN, indicating no overlap; the primary issue is the missing route.

Full explanation →
1055
MCQhard

A company has a VPC with a CIDR of 10.0.0.0/16 and uses AWS Direct Connect with a private VIF to connect to on-premises. The on-premises network uses 10.0.0.0/8. The company wants to access an AWS service (e.g., S3) privately from the VPC without using public endpoints. Which solution avoids IP overlap and meets the requirement?

A.Create a NAT gateway in a public subnet and route S3 traffic through it.
B.Create a VPC endpoint for S3 (Gateway type) and use it from the VPC.
C.Use a public virtual interface and access S3 via public endpoints.
D.Add a route in the VPC route table pointing to the Direct Connect virtual interface for the S3 prefix list.
AnswerB

VPC endpoint provides private access without overlapping IPs.

Why this answer

A Gateway VPC Endpoint for S3 allows private access to S3 from within the VPC without traversing the internet or requiring public IPs. It avoids IP overlap because the endpoint uses prefix lists and route table entries within the VPC's 10.0.0.0/16 range, and does not involve the on-premises 10.0.0.0/8 network. The Direct Connect private VIF is not used for S3 traffic, so the overlapping CIDR is irrelevant.

Exam trap

The trap here is that candidates assume a private VIF can be used to reach AWS services privately, but they overlook the IP overlap between the VPC and on-premises networks, which breaks routing and makes Gateway VPC Endpoints the only viable solution.

How to eliminate wrong answers

Option A is wrong because a NAT gateway requires a public subnet and routes traffic through the internet, which does not meet the requirement of private access without public endpoints. Option C is wrong because a public virtual interface accesses S3 via public endpoints over the internet, violating the private access requirement. Option D is wrong because adding a route to the Direct Connect private VIF for the S3 prefix list would attempt to route S3 traffic over the private VIF, but the on-premises network uses 10.0.0.0/8, which overlaps with the VPC's 10.0.0.0/16, causing routing conflicts and preventing proper connectivity.

Full explanation →
1056
Multi-Selectmedium

A company is using AWS Transit Gateway to connect multiple VPCs and an on-premises network via Direct Connect. They notice that traffic between VPCs is being dropped intermittently. Which TWO actions should the engineer take to diagnose the issue? (Choose two.)

Select 2 answers
A.Monitor the Transit Gateway's CloudWatch metrics for packets dropped due to route table limits
B.Review the security group rules on the Transit Gateway
C.Enable VPC Flow Logs on the VPCs
D.Check if the VPC CIDRs are overlapping
E.Create a VPN connection for backup
AnswersA, C

Correct. Monitoring Transit Gateway CloudWatch metrics can show packets dropped due to route table limits or throttling.

Why this answer

Monitoring Transit Gateway CloudWatch metrics for dropped packets can identify route table limits or throttling issues. Option C is correct because enabling VPC Flow Logs helps analyze traffic patterns and identify dropped packets. Option B is incorrect because security groups do not apply to Transit Gateway; they apply to ENIs.

Option D is incorrect because overlapping VPC CIDRs can be handled with proper routing and do not cause intermittent drops by themselves. Option E is incorrect because creating a VPN connection is a solution, not a diagnostic step.

Full explanation →
1057
MCQmedium

A company has a VPC with a CIDR of 172.16.0.0/16. The VPC has two subnets: subnet A (172.16.1.0/24) and subnet B (172.16.2.0/24). The company launches an EC2 instance in subnet A with a private IP of 172.16.1.10 and a public IP. The instance's security group allows inbound SSH from 0.0.0.0/0. The subnet A's route table has a route to an internet gateway (IGW) for 0.0.0.0/0. The network engineer can SSH into the instance from the internet. The company then attaches a second network interface (eth1) to the instance with an IP from subnet B (172.16.2.20). The engineer wants to use this interface for additional management traffic. After attaching, the engineer can no longer SSH into the instance via the original public IP. What is the MOST likely cause?

A.The operating system's routing table now uses eth1 as the default gateway, causing asymmetric routing.
B.The route table for subnet B does not have a route to the IGW.
C.The security group for eth1 blocks inbound SSH.
D.The internet gateway is not attached to subnet B.
AnswerA

Asymmetric routing can cause connection issues.

Why this answer

When a second ENI (eth1) is attached to an EC2 instance, the operating system may reassign the default gateway route to the new interface, especially if the new interface receives a default route via DHCP. This causes traffic from the instance to egress via eth1 instead of eth0, while inbound traffic still arrives via the original public IP on eth0. This asymmetric routing breaks the SSH session because the response packets are sent out through eth1, which is in a different subnet and does not have the same public IP, so they are dropped.

Option A correctly identifies this issue. Option D is incorrect because the IGW is attached to the VPC, not to individual subnets. Options B and C are not the most likely cause given the scenario.

Full explanation →
1058
MCQmedium

A company is deploying a critical application across multiple Availability Zones (AZs) in a single AWS region. The application requires a highly available network layer that can automatically detect and reroute traffic away from failed endpoints. Which AWS service should be used to meet this requirement?

A.Network Load Balancer (NLB)
B.AWS Global Accelerator
C.Application Load Balancer (ALB)
D.NAT gateway
AnswerA

NLB provides high availability and automatic rerouting at Layer 4.

Why this answer

A Network Load Balancer (NLB) operates at Layer 4 (TCP/UDP) and is designed to handle millions of requests per second with extremely low latency. It performs health checks on targets (e.g., EC2 instances) in each Availability Zone and automatically reroutes traffic away from unhealthy endpoints, providing the required high availability and automatic failover across AZs.

Exam trap

The trap here is that candidates often confuse the Layer 4 NLB with the Layer 7 ALB, or mistakenly think Global Accelerator provides the same automatic failover at the network layer, when in fact Global Accelerator is a traffic optimization service that requires a separate load balancer for endpoint health checking.

How to eliminate wrong answers

Option B is wrong because AWS Global Accelerator improves performance by directing traffic to the optimal endpoint over the AWS global network, but it does not itself perform health-check-based rerouting at the network layer within a single region; it relies on an underlying load balancer or endpoint for that. Option C is wrong because the Application Load Balancer (ALB) operates at Layer 7 (HTTP/HTTPS) and is not the best choice for a purely network-layer (Layer 4) requirement; it introduces unnecessary protocol overhead and is not designed for raw TCP/UDP traffic. Option D is wrong because a NAT gateway provides outbound internet connectivity for instances in private subnets and does not perform load balancing or health-check-based traffic rerouting across endpoints.

Full explanation →
1059
MCQmedium

A company has a VPC peering connection between VPC A (10.0.0.0/16) and VPC B (10.1.0.0/16). Both VPCs have subnets with EC2 instances. The security groups allow all traffic between the instances. The instances in VPC A can ping the instances in VPC B, but cannot initiate TCP connections to a web server running on port 443 in VPC B. What is the most likely cause?

A.The VPC peering connection does not support TCP traffic.
B.The DNS resolution settings for the VPC peering are not enabled.
C.The security group for the web server in VPC B does not allow inbound traffic from VPC A on TCP port 443.
D.The network ACL in VPC B is blocking inbound TCP traffic on port 443.
AnswerC

Security groups are stateful; if inbound rule missing, TCP connections are denied while ICMP might be allowed.

Why this answer

The security group for the web server in VPC B must explicitly allow inbound traffic from VPC A on TCP port 443. Even though ICMP (ping) works because security groups by default allow all outbound traffic and ICMP may be permitted, TCP connections require an explicit inbound rule. Option A is incorrect because VPC peering supports TCP traffic.

Option B is incorrect because DNS resolution settings are not required for direct TCP connections over VPC peering. Option D is incorrect because network ACLs are stateless and would block both ICMP and TCP if misconfigured; since ping works, a NACL issue is unlikely.

Full explanation →
1060
MCQhard

A company uses AWS Certificate Manager (ACM) to issue a public SSL/TLS certificate for a domain hosted on Route 53. The certificate is used by an Application Load Balancer. After renewal, the ALB continues to serve the old certificate. What is the most likely cause?

A.The certificate was not imported into ACM correctly.
B.The ALB listener is not configured to use the new certificate.
C.The certificate is a private certificate and cannot be used with an ALB.
D.DNS validation failed during renewal.
AnswerD

Correct. DNS validation failure during renewal prevents the certificate from being renewed, causing the ALB to continue using the old certificate.

Why this answer

The most likely cause is that DNS validation failed during renewal. ACM attempts to automatically renew public certificates using DNS validation when the domain is in Route 53. If the DNS validation fails (e.g., due to incorrect CNAME record or permissions), the certificate will not be renewed, and the ALB will continue to serve the old certificate.

Option B is incorrect because ACM automatically redeploys renewed public certificates to associated resources such as ALB listeners; no manual update is required. Option A is incorrect because ACM handles renewal and does not require import. Option C is incorrect because the certificate is public, not private.

Full explanation →
1061
MCQmedium

A company needs to connect its on-premises data center to AWS using AWS Direct Connect. The company has two redundant connections and wants to use BGP as the routing protocol. Which BGP attribute should be manipulated to influence outbound traffic from AWS to the on-premises network?

A.Set the Local Preference attribute on routes received from AWS.
B.Prepend AS_PATH on routes advertised to AWS.
C.Set the MED attribute on routes advertised to AWS.
D.Apply a BGP community tag to routes received from AWS.
AnswerB

AS_PATH prepend makes a path less preferred for outbound traffic from AWS.

Why this answer

To influence outbound traffic from AWS to the on-premises network, you must make the on-premises routes less attractive to AWS. Prepend AS_PATH on routes advertised to AWS increases the AS path length, making those routes less preferred by AWS's BGP best-path selection, thus steering traffic away from that Direct Connect virtual interface.

Exam trap

The trap here is confusing inbound vs. outbound traffic manipulation: candidates often pick Local Preference (Option A) because it is a common attribute for influencing path selection, but it only affects traffic entering the local AS, not traffic leaving AWS.

How to eliminate wrong answers

Option A is wrong because Local Preference is an inbound BGP attribute used to influence traffic entering an AS, not outbound traffic from AWS; it is set on routes received from a peer to affect local routing decisions. Option C is wrong because MED (Multi-Exit Discriminator) is an outbound attribute used to influence inbound traffic to an AS, not outbound traffic from AWS; it is advertised to a neighbor to suggest a preferred entry point. Option D is wrong because BGP community tags are used for tagging and policy enforcement (e.g., route filtering or preference marking) but do not directly influence BGP best-path selection for outbound traffic; they require additional configuration on the receiving side to have any effect.

Full explanation →
1062
MCQmedium

A company has a VPC with a CIDR block of 10.0.0.0/16 and needs to connect to a partner's VPC with CIDR 10.0.0.0/16. The VPCs are in the same Region. What is the best solution?

A.Use an AWS Site-to-Site VPN connection
B.Establish VPC peering between the two VPCs
C.Use an AWS Transit Gateway with a transit gateway attachment and configure NAT on the transit gateway to translate IPs
D.Use an AWS Direct Connect private virtual interface
AnswerC

Transit Gateway can perform NAT to resolve overlapping CIDRs.

Why this answer

When two VPCs have overlapping CIDR blocks (both 10.0.0.0/16), VPC peering and Direct Connect cannot resolve the IP conflict, as they require non-overlapping address spaces. An AWS Transit Gateway with NAT attachments can translate IP addresses at the transit gateway level, allowing traffic to flow between overlapping VPCs by mapping source/destination IPs to non-conflicting ranges. This solution provides a scalable, managed way to handle overlapping CIDRs without complex manual routing.

Exam trap

The ANS-C01 exam often tests the misconception that VPC peering or VPN can handle overlapping CIDRs by simply adding routes, but the trap is that overlapping IPs cause routing ambiguity and packet loss, requiring NAT at the transit gateway or a middlebox appliance to resolve the conflict.

How to eliminate wrong answers

Option A is wrong because an AWS Site-to-Site VPN connection also requires non-overlapping CIDR blocks for proper routing; overlapping IPs would cause routing conflicts and asymmetric traffic, as VPN tunnels rely on static routes that cannot differentiate between identical subnets. Option B is wrong because VPC peering requires that the VPC CIDR blocks do not overlap; with both VPCs using 10.0.0.0/16, peering is impossible as the route tables would have duplicate entries, leading to ambiguous routing. Option D is wrong because an AWS Direct Connect private virtual interface connects on-premises networks to a VPC, not between two VPCs, and it also cannot resolve overlapping CIDR conflicts between VPCs.

Full explanation →
1063
MCQmedium

A company is using AWS Client VPN to allow remote employees to access resources in a VPC. The security team wants to enforce multi-factor authentication (MFA) for all VPN connections. Which configuration should be used?

A.Attach a security group to the Client VPN endpoint that only allows MFA-authenticated traffic
B.Use AWS Managed Microsoft AD for authentication
C.Use mutual authentication with client certificates
D.Use SAML-based federation with an identity provider that requires MFA
AnswerD

SAML federation allows integration with an IdP that can enforce MFA.

Why this answer

AWS Client VPN supports SAML-based federation with an identity provider (IdP) that requires MFA, making option D correct. Option A is incorrect because security groups do not enforce authentication, let alone MFA. Option B is incorrect because using AWS Managed Microsoft AD alone does not enforce MFA; MFA would require additional configuration such as AWS AD Connector or a third-party MFA solution.

Option C is incorrect because mutual authentication with client certificates verifies the client's identity but does not enforce MFA.

Full explanation →
1064
MCQhard

Refer to the exhibit. A company has attached this bucket policy to an S3 bucket. An EC2 instance in VPC vpc-12345 is trying to access the bucket but is getting access denied. The EC2 instance has a public IP of 198.51.100.10. What is the MOST likely reason?

A.The policy does not have an explicit allow for the instance's IP
B.The EC2 instance's source IP is not in the allowed IP range
C.Both conditions must be met for access
D.The EC2 instance does not have the s3:GetObject permission
AnswerB

The instance has a different public IP; the IP condition is not met, and the VPC condition only applies if accessed via VPC endpoint.

Why this answer

The policy has two allow statements: one for source IP range and one for source VPC. The EC2 instance's source IP (198.51.100.10) is not in the allowed IP range (203.0.113.0/24). The second statement allows requests from the VPC, but the condition aws:SourceVpc is only present when the request comes through a VPC endpoint (Gateway or Interface endpoint).

If the EC2 instance accesses S3 via the internet (public IP), the aws:SourceVpc condition is not satisfied, so the second statement does not apply. The first statement does not allow the IP, resulting in implicit deny. Option A is wrong because the policy allows GetObject.

Option C is wrong because the policy does not require both conditions. Option D is wrong because there is no explicit deny.

Full explanation →
1065
MCQeasy

A network engineer created the CloudFormation stack shown. After creation, an EC2 instance launched in PublicSubnet does not have a public IP address. What is the most likely reason?

A.The VPC does not have an Internet Gateway attached
B.The subnet does not have an Internet Gateway attached
C.The subnet's route table does not have a route to a NAT Gateway
D.The instance type does not support public IP addresses
AnswerA

Without an Internet Gateway, instances cannot be assigned public IPs or reach the internet.

Why this answer

An EC2 instance in a public subnet requires an Internet Gateway (IGW) attached to the VPC to receive a public IP address. Without an IGW, the instance cannot be assigned a public IP or communicate with the internet, even if the subnet is configured to auto-assign public IPs. The CloudFormation stack likely omitted the IGW resource or its attachment to the VPC, leaving the VPC isolated.

Exam trap

The ANS-C01 exam often tests the misconception that a NAT Gateway is required for public IP assignment, but the correct requirement is an Internet Gateway attached to the VPC with a route in the subnet's route table.

How to eliminate wrong answers

Option B is wrong because an Internet Gateway is attached to the VPC, not to a subnet; subnets are associated with route tables that direct traffic to the IGW, but the IGW itself is a VPC-level resource. Option C is wrong because a NAT Gateway is used for private subnets to initiate outbound internet traffic, not for public subnets; a public subnet requires a route to an IGW (0.0.0.0/0 -> IGW) for public IP assignment and inbound internet access. Option D is wrong because all EC2 instance types support public IP addresses when launched in a subnet with the appropriate settings and an IGW attached; the instance type does not restrict public IP assignment.

Full explanation →
1066
MCQhard

A company is deploying a global application with users in North America and Europe. The application runs on EC2 instances in us-east-1 and eu-west-1. To reduce latency, the company wants to route users to the nearest region and provide automatic failover. Which combination of AWS services should be used?

A.Amazon CloudFront with origins in each region.
B.AWS Global Accelerator with endpoint groups in each region.
C.Amazon Route 53 with geolocation routing and health checks.
D.Amazon Route 53 with latency-based routing and health checks.
AnswerD

Latency routing directs users to the lowest-latency region, health checks provide failover.

Why this answer

Amazon Route 53 latency-based routing directs users to the region with the lowest latency, automatically routing traffic to the nearest region. Combined with health checks, if an endpoint fails, Route 53 automatically fails over to the next lowest-latency healthy endpoint, meeting both the latency reduction and automatic failover requirements.

Exam trap

AWS often tests the distinction between geolocation routing (which uses static geographic mapping) and latency-based routing (which uses dynamic network performance data), and candidates mistakenly choose geolocation routing because they think 'nearest region' means geographic proximity rather than network latency.

How to eliminate wrong answers

Option A is wrong because Amazon CloudFront is a content delivery network (CDN) that caches content at edge locations; it does not provide active-active routing or automatic failover between regional origins based on user proximity for dynamic application traffic—it primarily accelerates static and dynamic content delivery via edge caching, not regional routing with health-check-based failover. Option B is wrong because AWS Global Accelerator uses endpoint groups to route traffic to the nearest region via Anycast IPs, but it does not natively support automatic failover between endpoint groups based on health checks—failover requires manual intervention or additional automation, and Global Accelerator is designed for TCP/UDP traffic optimization, not DNS-level routing with health-check-driven failover. Option C is wrong because Amazon Route 53 geolocation routing routes traffic based on the user's geographic location, not latency; it does not automatically fail over to the next nearest region if the primary region is unhealthy—geolocation routing requires explicit failover rules (e.g., failover routing) and does not dynamically adjust to latency changes.

Full explanation →
1067
MCQeasy

A company wants to ensure that traffic between Amazon EC2 instances in the same VPC but different subnets is inspected by a network security appliance. The appliance is deployed in a separate security VPC. Which AWS service should be used to route traffic through the security VPC?

A.AWS Transit Gateway
B.VPC Peering
C.VPC Endpoint
D.Network Load Balancer
AnswerA

Transit Gateway can route traffic between VPCs with route tables enabling inspection.

Why this answer

AWS Transit Gateway acts as a hub-and-spoke router that can interconnect multiple VPCs, including a security VPC, and centrally route traffic between them. By attaching both the workload VPC and the security VPC to a Transit Gateway, you can configure route tables to force all inter-subnet traffic (or inter-VPC traffic) through the network security appliance in the security VPC. This enables inspection without requiring a full mesh of VPC peering connections or complex routing.

Exam trap

The trap here is that candidates often confuse VPC Peering with transitive routing, assuming that multiple peering connections can chain traffic through a middle VPC, but AWS explicitly prohibits transitive routing through VPC peering.

How to eliminate wrong answers

Option B (VPC Peering) is wrong because VPC peering creates a direct, one-to-one connection between two VPCs and does not support transitive routing; you cannot route traffic from one VPC through a peered VPC to another VPC or subnet. Option C (VPC Endpoint) is wrong because VPC endpoints are used to privately connect to AWS services (e.g., S3, DynamoDB) via PrivateLink, not to route traffic between EC2 instances in different subnets through a security appliance. Option D (Network Load Balancer) is wrong because an NLB distributes incoming traffic to targets (e.g., EC2 instances) and does not perform routing or forwarding of traffic between subnets within a VPC; it operates at Layer 4 and cannot inspect or redirect traffic based on routing policies.

Full explanation →
1068
MCQmedium

A security engineer needs to audit all API calls made in an AWS account for compliance. The engineer wants to capture the source IP address and the user agent for each call. Which AWS service should be used?

A.AWS Config
B.AWS CloudTrail
C.Amazon CloudWatch Logs
D.VPC Flow Logs
AnswerB

CloudTrail logs API calls with source IP and user agent.

Why this answer

AWS CloudTrail records API calls and includes source IP and user agent, making it the correct service for auditing API calls. Option A (AWS Config) is incorrect because it records resource changes, not API calls. Option C (Amazon CloudWatch Logs) is incorrect because it stores logs but does not capture API calls directly.

Option D (VPC Flow Logs) is incorrect because it captures network traffic, not API calls.

Full explanation →
1069
MCQhard

A global e-commerce company uses AWS CloudFront to distribute content. They have an origin behind an Application Load Balancer (ALB) in a VPC. The ALB is internet-facing and has a security group that allows inbound HTTPS traffic from CloudFront's IP ranges. Users in some regions report slow loading times. The company wants to reduce latency and improve performance. They are considering using Lambda@Edge and origin failover. However, they also notice that the ALB is receiving traffic directly from some IPs that are not CloudFront IPs, causing unnecessary load. What should a network engineer do to restrict access to the ALB to only CloudFront?

A.Update the ALB security group to allow inbound HTTPS only from the CloudFront managed prefix list
B.Use AWS WAF to block requests that do not come from CloudFront IPs
C.Configure the ALB to require a custom header (e.g., X-Origin-Verify) and validate it in the origin
D.Set up a VPC endpoint for CloudFront to route traffic privately
AnswerA

This restricts access to CloudFront IPs only.

Why this answer

The best practice is to restrict the ALB security group to the CloudFront managed prefix list (com.amazonaws.global.cloudfront.origin-facing). This dynamically allows only CloudFront IPs and automatically updates when CloudFront IPs change. Option C (custom header) is a good additional measure but not sufficient alone because attackers can mimic headers.

Option B (AWS WAF) can help block non-CloudFront traffic but is not the primary method and adds complexity. Option D (VPC endpoint) is not applicable because CloudFront does not use VPC endpoints; it communicates over the internet. Therefore, Option A is correct.

Full explanation →
1070
MCQhard

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network team notices that traffic to a particular EC2 instance is taking a suboptimal path that goes through the internet instead of Direct Connect. The EC2 instance has both a private IP and a public IP. The on-premises router is advertising the VPC's CIDR block over BGP. What is the most likely cause?

A.The private VIF is not configured to route the VPC CIDR.
B.The security group on the EC2 instance is blocking traffic from the on-premises IP range.
C.The on-premises router is not advertising the VPC CIDR to the Direct Connect router.
D.The on-premises DNS is resolving the EC2 instance's public IP address instead of its private IP address.
AnswerD

When using Direct Connect, you should use private IP addresses to ensure traffic stays on the private network.

Why this answer

The on-premises DNS is resolving the EC2 instance's public IP address instead of its private IP address. When the on-premises router advertises the VPC CIDR over BGP, traffic destined for the VPC should use Direct Connect. However, if DNS returns the public IP, the on-premises hosts will send traffic to the internet (via the public IP) rather than through the private VIF, causing a suboptimal path.

This is a common misconfiguration where DNS resolution does not account for private connectivity.

Exam trap

The trap here is that candidates often focus on BGP routing issues (like option C) or security group misconfigurations (option B), but the real cause is a DNS resolution problem that diverts traffic to the public IP, bypassing the Direct Connect path entirely.

How to eliminate wrong answers

Option A is wrong because a private VIF inherently routes traffic for the VPC CIDR once the VIF is attached to the VPC and the on-premises router advertises the VPC CIDR; no additional routing configuration is required on the VIF itself. Option B is wrong because security groups filter traffic at the instance level based on IP addresses, but they do not influence the path the traffic takes; the suboptimal path occurs before the traffic reaches the security group. Option C is wrong because the question states the on-premises router is advertising the VPC CIDR over BGP, so this option directly contradicts the given information.

Full explanation →
1071
MCQmedium

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to two on-premises locations via AWS Direct Connect. Each Direct Connect connection uses a private VIF. The company wants to use BGP to exchange routes. The on-premises routers advertise the same prefix 10.0.0.0/8 for both connections. How should the network engineer configure the VPC route tables to ensure traffic is load balanced across both Direct Connect connections?

A.Create a VPN connection over the Direct Connect and use BGP with different metrics.
B.Create two separate route tables and associate each with half the subnets.
C.Use AWS Transit Gateway with equal cost multipath routing.
D.Allow BGP to install both routes; AWS will automatically load balance across them using ECMP.
AnswerD

When identical routes are learned from two Direct Connect connections, AWS uses ECMP.

Why this answer

AWS Direct Connect private VIFs support BGP route exchange, and when two separate connections advertise the same prefix (10.0.0.0/8), BGP installs both routes in the VPC route table. AWS automatically performs Equal-Cost Multi-Path (ECMP) routing across the two Direct Connect connections, load-balancing traffic without additional configuration. This behavior is inherent to how AWS handles multiple BGP-learned routes with identical prefixes and metrics.

Exam trap

The trap here is that candidates often assume AWS requires Transit Gateway or VPN overlay to achieve load balancing, but AWS natively supports ECMP across multiple Direct Connect private VIFs attached to the same VPC, as long as the BGP-advertised prefixes are identical and the routes are installed in the same route table.

How to eliminate wrong answers

Option A is wrong because creating a VPN over Direct Connect adds unnecessary complexity and does not enable ECMP; BGP metrics (MED, AS-path) are not used by AWS to influence load balancing across separate Direct Connect connections. Option B is wrong because splitting subnets into separate route tables does not load-balance traffic across both connections; each subnet would still use a single route for the 10.0.0.0/8 prefix, failing to distribute traffic. Option C is wrong because AWS Transit Gateway does support ECMP, but it is not required for this scenario; the VPC itself can perform ECMP across two Direct Connect private VIFs without Transit Gateway, making this an over-engineered solution.

Full explanation →
1072
Multi-Selectmedium

A company has a VPC with multiple subnets. They want to use VPC Flow Logs to capture network traffic metadata for troubleshooting. Which TWO of the following are valid destinations for VPC Flow Logs? (Select TWO.)

Select 2 answers
A.Amazon CloudWatch Logs log group
B.Amazon Kinesis Data Firehose delivery stream
C.AWS Lambda function
D.Amazon Simple Queue Service (SQS) queue
E.Amazon S3 bucket
AnswersA, E

CloudWatch Logs is a supported destination for VPC Flow Logs.

Why this answer

Amazon VPC Flow Logs can publish flow log data directly to an Amazon CloudWatch Logs log group. This is a native integration that allows you to store, monitor, and access flow log records using the CloudWatch Logs agent and API, enabling real-time analysis and metric filtering.

Exam trap

The ANS-C01 exam often tests that candidates confuse supported destinations (CloudWatch Logs and S3) with downstream processing services like Kinesis, Lambda, or SQS, which are not valid direct targets for VPC Flow Logs.

Full explanation →
1073
MCQmedium

A company has a VPC with private subnets that use a NAT gateway for outbound internet access. The NAT gateway is in a public subnet with an Elastic IP. Users report that some applications are failing to connect to external services. Network engineers confirm that the NAT gateway is in the 'available' state and the route tables have a default route (0.0.0.0/0) pointing to the NAT gateway. What is the most likely cause?

A.The security group for the private instances is blocking outbound traffic.
B.The network ACL for the public subnet is blocking inbound traffic on ephemeral ports.
C.The NAT gateway has reached its connection limit.
D.The route table for the private subnets is missing a route to the internet gateway.
AnswerB

NACL must allow inbound traffic from the internet on ephemeral ports (1024-65535) for return traffic.

Why this answer

The network ACL for the public subnet is blocking inbound traffic on ephemeral ports. When a private instance initiates outbound traffic through the NAT gateway, the NAT gateway sends the traffic to the internet and expects return traffic on high-numbered ephemeral ports (1024–65535). If the public subnet's network ACL blocks inbound traffic on these ports, the return traffic cannot reach the NAT gateway, causing asymmetric routing and connection failures.

The NAT gateway itself is available and the route tables are correctly configured, so the issue lies in the stateful nature of security groups versus the stateless nature of network ACLs.

Exam trap

The ANS-C01 exam often tests the distinction between stateful security groups and stateless network ACLs, and the trap here is that candidates assume the NAT gateway's availability and correct route tables guarantee connectivity, overlooking the need for explicit inbound ephemeral port rules in the public subnet's network ACL.

How to eliminate wrong answers

Option A is wrong because security groups are stateful; if outbound traffic is allowed from the private instances, the corresponding return traffic is automatically permitted regardless of inbound rules. Option C is wrong because the NAT gateway connection limit (typically 55,000 concurrent connections per IP) is rarely reached in normal scenarios, and the question provides no evidence of high connection counts. Option D is wrong because the route table for the private subnets correctly has a default route (0.0.0.0/0) pointing to the NAT gateway, and the NAT gateway itself resides in a public subnet with a route to the internet gateway; the private subnets do not need a direct route to the internet gateway.

Full explanation →
1074
MCQmedium

Refer to the exhibit. A network engineer is creating an IAM policy to allow a user to manage VPC Peering connections. The user reports that they cannot delete a VPC Peering connection. What should the engineer add to the policy?

A.ec2:DeleteVpcPeeringConnection
B.ec2:DescribeVpcPeeringConnectionRouteTables
C.ec2:ModifyVpcPeeringConnectionOptions
D.ec2:RejectVpcPeeringConnection
AnswerA

This action allows deleting peering connections.

Why this answer

Ec2:DeleteVpcPeeringConnection. The user cannot delete a VPC peering connection because the policy does not include this action. Option B, ec2:DescribeVpcPeeringConnectionRouteTables, is not a valid action and does not relate to deletion.

Option C, ec2:ModifyVpcPeeringConnectionOptions, is for modifying options, not deletion. Option D, ec2:RejectVpcPeeringConnection, is for rejecting pending connections, not deleting an existing one. Therefore, adding ec2:DeleteVpcPeeringConnection to the policy will resolve the issue.

Full explanation →
1075
MCQhard

A company uses AWS Direct Connect with a public VIF to access Amazon S3. They notice that traffic to S3 is taking a suboptimal path (going through the internet) instead of the Direct Connect connection. The VPC has a route table with a route for S3 prefix list via the virtual private gateway. What is the most likely cause?

A.The VPC does not have a VPC endpoint for S3
B.The public VIF is not associated with the correct Direct Connect gateway
C.The on-premises router is not advertising the S3 prefix list via BGP over the public VIF
D.The route table in the VPC does not have a route to the S3 prefix list via the virtual private gateway
AnswerC

S3 prefix must be advertised to route traffic over Direct Connect.

Why this answer

For traffic to use the Direct Connect public VIF, the on-premises router must advertise the specific prefixes (e.g., S3 prefix list) via BGP over the public VIF. Without this advertisement, the on-premises router will not have a route pointing to the Direct Connect link for S3 traffic, causing it to fall back to the internet path. The VPC route table already has a route for the S3 prefix list via the virtual private gateway, so the issue lies in the BGP advertisement from the on-premises side.

Exam trap

The trap here is that candidates often assume the VPC route table configuration is sufficient, but they overlook that the on-premises router must also advertise the destination prefixes via BGP over the public VIF for traffic to use the Direct Connect path.

How to eliminate wrong answers

Option A is wrong because a VPC endpoint for S3 is not required for accessing S3 over a Direct Connect public VIF; the public VIF provides direct connectivity to AWS public services without needing a VPC endpoint. Option B is wrong because a public VIF is not associated with a Direct Connect gateway; Direct Connect gateways are used for private VIFs and transit VIFs, not public VIFs. Option D is wrong because the question explicitly states that the VPC route table already has a route for the S3 prefix list via the virtual private gateway, so the route is present.

Full explanation →
1076
MCQeasy

A company wants to allow its employees to securely access internal web applications hosted in a VPC without using a VPN. The solution must authenticate users against the company's Active Directory and apply fine-grained access controls. Which AWS service should be used?

A.AWS Single Sign-On (SSO)
B.AWS Verified Access
C.AWS Client VPN
D.Application Load Balancer with OIDC authentication
AnswerB

Provides secure access without VPN, integrates with AD.

Why this answer

AWS Verified Access is the correct service because it provides secure access to corporate applications hosted in a VPC without requiring a VPN, and it integrates with identity providers such as Active Directory for authentication and fine-grained access control. Option A (AWS SSO) is designed for federating access to AWS accounts and applications, not for securing access to internal VPC-based applications without a VPN. Option C (AWS Client VPN) requires VPN client software and a VPN connection, which does not meet the requirement of not using a VPN.

Option D (Application Load Balancer with OIDC authentication) can authenticate users but typically requires the ALB to be publicly accessible or connected via VPN, and it does not provide the same purpose-built zero-trust access capabilities as Verified Access.

Full explanation →
1077
Multi-Selecthard

A company is using AWS Direct Connect to connect its on-premises network to a VPC via a private virtual interface (VIF) attached to a virtual private gateway (VGW). The company wants to add redundant connectivity using a second Direct Connect connection from a different provider. The network team proposes using a Direct Connect gateway (DXGW) with two private VIFs from different connections, each attached to the DXGW. The DXGW will be associated with the VGW. Which THREE steps are required to complete this configuration? (Choose three.)

Select 3 answers
A.Add routes to the VPC subnets' route tables pointing to the Direct Connect gateway.
B.Associate both private virtual interfaces with the same Direct Connect gateway.
C.Associate the Direct Connect gateway with the virtual private gateway.
D.Advertise the on-premises prefixes over both BGP sessions to enable active-active or failover.
E.Create a separate virtual private gateway for each Direct Connect connection.
AnswersB, C, D

Both VIFs connect to the same DXGW for redundancy.

Why this answer

To implement redundant Direct Connect connectivity using a Direct Connect gateway (DXGW), the correct steps are: associate both private virtual interfaces (VIFs) with the same DXGW (B), associate the DXGW with the virtual private gateway (VGW) (C), and advertise the on-premises prefixes over both BGP sessions to enable active-active or failover (D). Option A is incorrect because route tables in VPC subnets must point to the VGW, not the DXGW directly. Option E is incorrect because only one VGW is needed per VPC; separate VGWs would not provide the desired redundancy and would complicate routing.

Full explanation →
1078
MCQhard

A company has a VPC with multiple security groups. An EC2 instance in security group A needs to communicate with an RDS instance in security group B on port 3306. The security team wants to minimize exposure. What should the inbound rule in security group B be?

A.Allow inbound TCP 3306 from the CIDR block of the subnet where the EC2 instance resides
B.Allow inbound TCP 3306 from 0.0.0.0/0
C.Allow inbound TCP 3306 from the private IP address of the EC2 instance
D.Allow inbound TCP 3306 from security group A
AnswerD

Precise and secure.

Why this answer

Referencing security group A as the source allows inbound traffic on port 3306 from any instance associated with security group A, which is the most specific and secure method. This approach automatically adapts if instances in security group A change IP addresses. Option A is wrong because it allows traffic from any instance in the specified subnet, not just those that need to communicate.

Option B is wrong because it allows traffic from all IP addresses, violating the principle of least privilege. Option C is wrong because it ties the rule to a single instance's IP address, which can change and requires updates if the instance is replaced.

Full explanation →
1079
MCQeasy

A company wants to provide internet access to instances in a private subnet while ensuring that traffic is logged and inspected. The solution must be highly available within a single AWS Region. Which approach should the company use?

A.Deploy a NAT Gateway in each Availability Zone and configure the private subnet route tables to point to the NAT Gateway in the same AZ. Use Gateway Load Balancer endpoint for traffic inspection.
B.Launch a NAT instance in a public subnet and configure it as the default route for the private subnet.
C.Create a VPC endpoint for the internet and attach it to the private subnet.
D.Attach an Internet Gateway to the VPC and add a default route to it in the private subnet's route table.
AnswerA

NAT Gateways are highly available per AZ, and using one per AZ ensures availability. Gateway Load Balancer can inspect traffic.

Why this answer

It combines NAT Gateways (one per AZ) for highly available outbound internet access from private subnets with a Gateway Load Balancer endpoint for traffic inspection. NAT Gateways are managed, scale automatically, and are AZ-resilient when deployed in each AZ, while the Gateway Load Balancer endpoint allows traffic to be routed through third-party inspection appliances without disrupting the NAT path. This meets the requirements for high availability within a single Region and ensures all egress traffic is logged and inspected.

Exam trap

The trap here is that candidates often confuse a Gateway Load Balancer endpoint with a VPC Gateway endpoint (for S3/DynamoDB) or assume a single NAT Gateway is sufficient for high availability, overlooking the need for per-AZ deployment and the specific role of the Gateway Load Balancer in traffic inspection.

How to eliminate wrong answers

Option B is wrong because a single NAT instance in a public subnet is a single point of failure, lacks automatic failover, and does not provide the managed high availability required; it also does not inherently support traffic inspection via Gateway Load Balancer. Option C is wrong because a VPC endpoint (e.g., for S3 or DynamoDB) provides private connectivity to specific AWS services, not general internet access, and cannot route traffic to the public internet. Option D is wrong because attaching an Internet Gateway to the VPC and adding a default route to it in a private subnet's route table would make the subnet effectively public, allowing direct internet access without logging or inspection, and violates the requirement for a private subnet.

Full explanation →
1080
Multi-Selecthard

A company is setting up AWS Transit Gateway with multiple VPC attachments and an AWS Direct Connect Gateway. The company wants to control which VPCs can communicate with each other and with the on-premises network. Which TWO actions should the company take to implement this?

Select 2 answers
A.Associate the Direct Connect Gateway with the Transit Gateway.
B.Establish VPC peering connections between VPCs that need to communicate.
C.Use security groups to control traffic between VPCs.
D.Configure Transit Gateway peering attachments for inter-region connectivity.
E.Create separate Transit Gateway route tables for different groups of VPCs.
AnswersA, E

This enables on-premises connectivity through the transit gateway.

Why this answer

To route traffic from on-premises networks through AWS Direct Connect to VPCs attached to a Transit Gateway, the Direct Connect Gateway must be associated with the Transit Gateway. This association creates a dedicated attachment that enables the Transit Gateway to exchange routes with the Direct Connect Gateway, allowing seamless connectivity between on-premises and VPC resources.

Exam trap

The ANS-C01 exam often tests the misconception that security groups can be used to filter traffic between VPCs at the Transit Gateway level, but security groups only apply to individual EC2 instances or ENIs, not to network transit paths like Transit Gateway attachments.

Full explanation →
1081
MCQhard

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to an on-premises network with CIDR 10.0.0.0/8. The company wants to use AWS Site-to-Site VPN. What configuration change is required to avoid routing conflicts?

A.Create a more specific route in the VPC route table for the on-premises CIDR.
B.Enable route propagation on the VPC route tables.
C.Use a VPN connection with static routes instead of BGP.
D.Change the VPC CIDR to a non-overlapping range, such as 172.16.0.0/16.
AnswerD

Eliminates the overlap.

Why this answer

The VPC CIDR 10.0.0.0/16 is a subset of the on-premises CIDR 10.0.0.0/8. AWS Site-to-Site VPN cannot route traffic correctly when the VPC and on-premises networks have overlapping IP ranges because the VPN connection relies on distinct destination prefixes. The only way to eliminate the conflict is to change the VPC CIDR to a non-overlapping range, such as 172.16.0.0/16, ensuring no IP address overlap between the two networks.

Exam trap

The trap here is that candidates think they can override the conflict with a more specific route or by switching to static routes, but they overlook that the VPC's local route is always more specific than any VPN route for overlapping prefixes, making the conflict unresolvable without changing the VPC CIDR.

How to eliminate wrong answers

Option A is wrong because creating a more specific route (e.g., 10.0.0.0/16) in the VPC route table for the on-premises CIDR would still result in overlapping IP space; the VPC itself uses 10.0.0.0/16, so traffic destined for the on-premises 10.0.0.0/8 would be ambiguous and could be routed locally instead of over the VPN. Option B is wrong because enabling route propagation on VPC route tables only imports routes from the VPN connection (via BGP or static), but it does not resolve the fundamental IP overlap; the VPC and on-premises networks still share the same address space, causing routing conflicts. Option C is wrong because using static routes instead of BGP does not address the overlapping CIDR issue; whether routes are learned dynamically or statically, the VPC and on-premises networks cannot have overlapping IP ranges for the VPN to function correctly.

Full explanation →
1082
Multi-Selectmedium

A company is designing a network security architecture for a multi-tier application. The web tier must be accessible from the internet, but the application and database tiers must not. Which TWO design choices meet these requirements? (Choose two.)

Select 2 answers
A.Use a VPC Gateway Endpoint for the web tier to access the internet.
B.Use a NAT gateway in a public subnet to provide internet access to the app and database tiers for updates.
C.Use a security group on the web tier to allow HTTP/HTTPS from 0.0.0.0/0, and security groups on the app and database tiers that only allow traffic from the web tier security group.
D.Place all tiers in a public subnet with a security group that restricts access to the app and database tiers.
E.Place the web tier in a public subnet with an internet gateway in the route table, and the app and database tiers in private subnets.
AnswersC, E

Security groups provide granular control; web tier allows internet, app and database only accept traffic from web.

Why this answer

The correct answers are C and E. Option C uses security groups to control traffic between tiers: the web tier security group allows HTTP/HTTPS from 0.0.0.0/0, and the app and database tier security groups only allow traffic from the web tier security group. This ensures that the application and database tiers are not directly accessible from the internet.

Option E places the web tier in a public subnet with an internet gateway in its route table, so it can receive inbound traffic from the internet. The app and database tiers are placed in private subnets without a direct route to the internet gateway, so they cannot be accessed from the internet. Option A is incorrect because a VPC Gateway Endpoint is used for private connectivity to AWS services like S3 or DynamoDB, not for internet access.

Option B is incorrect because a NAT gateway provides outbound internet access for private subnets, not inbound internet access to the web tier. Option D is incorrect because placing all tiers in a public subnet exposes the application and database tiers to the internet, even with restrictive security groups, because they would still have a route to the internet gateway.

Full explanation →
1083
MCQmedium

A company is designing a network for a critical application that requires low latency and high throughput between EC2 instances in the same AWS Region. Which network design should the company use?

A.Launch the instances in a Cluster Placement Group.
B.Launch the instances in a Spread Placement Group.
C.Launch the instances as larger instance types with enhanced networking.
D.Launch the instances in different Availability Zones.
AnswerA

Cluster Placement Groups provide low-latency, high-throughput networking.

Why this answer

A Cluster Placement Group is the correct choice because it provides the lowest possible latency and highest throughput between EC2 instances by placing them in a single Availability Zone with non-blocking, high-bandwidth networking. This design is ideal for tightly coupled, high-performance computing (HPC) or latency-sensitive applications that require consistent, low-latency communication within the same AWS Region.

Exam trap

The trap here is that candidates often confuse 'enhanced networking' (Option C) as a standalone solution for low latency, overlooking that placement group optimization is required to achieve the lowest possible latency and highest throughput, even with enhanced networking enabled.

How to eliminate wrong answers

Option B is wrong because a Spread Placement Group spreads instances across distinct hardware racks or Availability Zones to maximize fault tolerance, which increases network latency and reduces throughput due to physical separation, making it unsuitable for low-latency, high-throughput requirements. Option C is wrong because while larger instance types with enhanced networking (e.g., ENA, SR-IOV) improve network performance, they do not guarantee the same low-latency, non-blocking connectivity as a Cluster Placement Group, which also leverages these features but adds the critical placement optimization. Option D is wrong because launching instances in different Availability Zones introduces cross-AZ network latency and bandwidth constraints (e.g., inter-AZ data transfer costs and higher jitter), which directly contradicts the need for low latency and high throughput.

Full explanation →
1084
MCQeasy

A network engineer is setting up an AWS Site-to-Site VPN connection. The customer gateway device is behind a NAT device that performs PAT. The VPN tunnel fails to come up. What is the most likely cause?

A.The tunnel options (DPD, encryption algorithms) must match exactly.
B.Dead peer detection (DPD) is disabled.
C.The VPN connection does not have route propagation enabled.
D.The NAT device is not forwarding UDP 500 and UDP 4500 traffic.
AnswerD

IPsec requires these ports for IKE and NAT traversal.

Why this answer

IPsec requires UDP ports 500 and 4500, which must be forwarded through the NAT device. Option A is incorrect because tunnel options such as DPD and encryption algorithms do not need to match exactly for the tunnel to come up. Option B is incorrect because disabling DPD does not prevent tunnel establishment; it only affects detection of peer failure.

Option C is incorrect because route propagation does not affect the establishment of the VPN tunnel itself; it affects routing of traffic once the tunnel is up.

Full explanation →
1085
Multi-Selecteasy

A security team needs to block outbound traffic from an EC2 instance to known malicious IP addresses while allowing all other outbound traffic. Which THREE steps should be taken? (Choose three.)

Select 3 answers
A.Configure network ACLs to deny outbound traffic to the malicious IPs.
B.Update the VPC route table to send traffic for the malicious IPs to a network firewall appliance.
C.Deploy AWS Network Firewall in the VPC to perform stateful inspection.
D.Create a firewall rule in AWS Network Firewall that denies traffic to the malicious IPs.
E.Modify the security group for the EC2 instance to deny outbound traffic to the malicious IPs.
AnswersB, C, D

Correct: Route traffic to firewall for inspection.

Why this answer

The correct approach to block outbound traffic to known malicious IPs involves a combination of routing and stateful firewall inspection. Option B is correct because updating the VPC route table to send traffic for the malicious IPs to a network firewall appliance (e.g., AWS Network Firewall) enables centralized inspection and blocking. Option C is correct because deploying AWS Network Firewall provides stateful, application-layer inspection that can handle allow/deny rules for specific IPs.

Option D is correct because a firewall rule within AWS Network Firewall can explicitly deny traffic to the malicious IPs. Option A is incorrect because network ACLs are stateless and require individual rules for each IP, making them impractical for dynamic blocklists. Option E is incorrect because security groups support only allow rules, not explicit deny; they cannot block specific IPs outbound.

Full explanation →
1086
MCQmedium

A company wants to restrict access to an S3 bucket so that only requests originating from a specific AWS account can read objects. Which bucket policy condition should be used?

A.aws:Referer
B.aws:PrincipalAccount
C.aws:SourceAccount
D.aws:SourceArn
AnswerC

This condition key is used to restrict access based on the account that owns the resource making the request.

Why this answer

(aws:SourceAccount). The aws:SourceAccount condition key is used in S3 bucket policies to restrict access to requests originating from a specific AWS account. Option A (aws:Referer) is used to restrict based on HTTP referer header, not account.

Option B (aws:PrincipalAccount) is not a valid condition key in S3 policies. Option D (aws:SourceArn) restricts based on the ARN of the source resource, not the account. Therefore, Option C is the correct choice.

Full explanation →
1087
MCQmedium

A company has a Direct Connect connection with a private VIF to a VPC. The network team notices intermittent packet loss on the link. CloudWatch metrics show no errors on the connection. What should the team do next to isolate the issue?

A.Run a traceroute from an on-premises device to an EC2 instance in the VPC.
B.Check the BGP session status on the customer router.
C.Enable VPC Flow Logs on the VPC.
D.Increase the bandwidth of the Direct Connect connection.
AnswerA

Traceroute helps pinpoint where packet loss occurs along the path.

Why this answer

Running a traceroute from an on-premises device to an EC2 instance in the VPC helps identify where packets are being dropped along the path. Option B is incorrect because checking BGP session status only verifies routing adjacency, not packet loss. Option C is incorrect because VPC Flow Logs capture metadata but do not indicate packet loss on the Direct Connect link.

Option D is incorrect because increasing bandwidth does not resolve packet loss; it only adds capacity.

Full explanation →
1088
MCQmedium

A company has an AWS Site-to-Site VPN connection between an on-premises network and a VPC. The VPN uses virtual private gateways and static routes. The network team reports that the VPN tunnel is up, but traffic from the on-premises network cannot reach some EC2 instances in the VPC. The EC2 instances have security groups that allow inbound traffic from the on-premises network. The VPC route table has a route pointing to the virtual private gateway for the on-premises CIDR. The tunnel status shows 'UP' from both sides. What is the MOST likely cause of the connectivity issue?

A.The VPC route table does not have a route for the on-premises subnet that the traffic originates from, but only for a larger CIDR.
B.The VPC has a network ACL that denies inbound traffic from the on-premises CIDR.
C.The customer gateway device is using a different pre-shared key than configured in AWS.
D.The virtual private gateway is not attached to the correct VPC.
AnswerA

If the route is for a different CIDR, traffic may not be routed correctly.

Why this answer

The security group may be allowing traffic from the on-premises CIDR but not from the tunnel endpoint IP. However, the more common issue is that the on-premises network's source IP is being translated or the VPC route table is missing a route for the specific subnet. Option A is a typical cause: if the on-premises CIDR is not exactly matched, the VPC may not route traffic back.

Option C could cause issues if the VPN is not in the main route table. Option D would cause tunnel issues.

Full explanation →
1089
Multi-Selectmedium

A company is designing a Direct Connect solution for high availability. Which of the following are best practices? (Select THREE.)

Select 3 answers
A.Use the same Direct Connect provider for both connections to simplify management.
B.Provision two Direct Connect connections at different locations.
C.Configure Bidirectional Forwarding Detection (BFD) on the virtual interfaces.
D.Use a single Direct Connect connection with multiple virtual interfaces.
E.Use separate BGP sessions for each connection with different AS numbers if needed.
AnswersB, C, E

Diverse locations provide physical redundancy.

Why this answer

Provisioning two Direct Connect connections at different locations ensures physical diversity, which is a fundamental requirement for high availability. If one data center or fiber path fails, the other connection can continue to carry traffic, preventing a single point of failure. This aligns with the AWS Well-Architected Framework's recommendation for redundant network paths.

Exam trap

The trap here is that candidates often confuse logical redundancy (multiple virtual interfaces on one connection) with physical redundancy (multiple connections at different locations), leading them to select Option D as a valid high-availability solution.

Full explanation →
1090
MCQmedium

A company has a VPC with public and private subnets. The public subnet has a NAT Gateway, and the private subnet has EC2 instances that need internet access. The private instances can reach the internet, but cannot access an S3 bucket in the same region using the S3 gateway endpoint. What is the most likely cause?

A.The S3 gateway endpoint is not in the same VPC.
B.The S3 bucket policy does not allow access from the VPC.
C.The NAT Gateway is in a different availability zone than the private instances.
D.The private subnet's route table does not have a route to the S3 gateway endpoint.
AnswerD

Without a route to the endpoint, traffic to S3 goes through the NAT Gateway or is dropped.

Why this answer

For private instances to use a gateway endpoint, the route table for the private subnet must have a route pointing to the S3 endpoint. Additionally, the endpoint's policy must allow the traffic. The NAT Gateway is not used for gateway endpoints.

Full explanation →
1091
MCQhard

A company has a multi-account AWS environment using AWS Transit Gateway. The network team wants to centralize network logging from all accounts into a single account for analysis. Which combination of services should be used to achieve this?

A.AWS CloudTrail and Amazon CloudWatch Logs
B.Amazon Kinesis Data Streams and Amazon Redshift
C.Amazon S3 and Amazon Athena
D.AWS Config and Amazon DynamoDB
AnswerC

VPC Flow Logs can be published to a central S3 bucket, and Athena can query them.

Why this answer

VPC Flow Logs from each account's VPCs can be published to a centralized Amazon S3 bucket using cross-account permissions. Amazon Athena can then be used to query and analyze the flow logs directly from S3 using standard SQL. This approach provides a cost-effective and scalable solution for centralizing network logging across multiple accounts.

Option A is incorrect because AWS CloudTrail logs API activity, not network traffic; CloudWatch Logs can aggregate logs but require additional subscription filters for cross-account. Option B is incorrect because Kinesis Data Streams is designed for real-time streaming and requires additional processing to store and analyze logs, making it less suitable for historical analysis. Option D is incorrect because AWS Config records configuration changes and resource compliance, not network traffic logs.

Full explanation →
1092
MCQmedium

Refer to the exhibit. An EC2 instance in the PrivateSubnet is unable to download patches from the internet. What is the most likely cause?

A.The private subnet is not associated with any route table.
B.The NAT gateway does not support IPv6 traffic.
C.The private subnet does not have MapPublicIpOnLaunch set to true.
D.The PrivateRoute resource references the NAT gateway before it is created.
AnswerD

Missing DependsOn causes a dependency issue.

Why this answer

The PrivateRoute resource references the NAT gateway using a NatGatewayId, but the NAT gateway is defined after the route in the CloudFormation template. Without a DependsOn attribute on the route to ensure the NAT gateway is created first, the route will attempt to reference a non-existent resource, causing a creation failure. This is the most likely cause of the EC2 instance's inability to download patches.

Option A is incorrect because the private subnet is indeed associated with a route table (the PrivateRouteTable). Option B is incorrect because the issue pertains to IPv4 traffic, not IPv6; NAT gateway supports IPv4. Option C is incorrect because MapPublicIpOnLaunch is a setting for public subnets and does not affect internet access via NAT gateway.

Full explanation →
1093
MCQeasy

A startup wants to design a cost-effective network for a new application. They expect low traffic initially but need to handle sudden spikes. They plan to use Amazon EC2 instances behind an Application Load Balancer (ALB) in a single VPC. The application must be highly available within the region. The network engineer has proposed using two public subnets in two Availability Zones for the ALB, and two private subnets for the EC2 instances. The EC2 instances need to access the internet for updates. What is the MOST cost-effective and highly available design?

A.Use a single NAT instance in one public subnet
B.Use a NAT gateway in each public subnet (one per AZ)
C.Use a NAT instance in each public subnet (one per AZ)
D.Use a single NAT gateway in one public subnet
AnswerB

Highly available and managed.

Why this answer

Using a NAT gateway in each Availability Zone provides high availability because each AZ has its own NAT gateway, eliminating a single point of failure. NAT gateways are managed by AWS, reducing operational overhead compared to NAT instances. Option A is wrong because a single NAT instance is a single point of failure.

Option C is wrong because while NAT instances per AZ provide high availability, they require manual management and are less cost-effective than using managed NAT gateways. Option D is wrong because a single NAT gateway is a single point of failure.

Full explanation →
1094
MCQhard

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance is behind a NAT gateway in the public subnet. The security team wants to allow only outbound HTTPS traffic from the instance. Which configuration should be used?

A.Security group on the instance with outbound rule allowing HTTPS
B.VPC gateway endpoint for S3
C.Network ACL on the private subnet with outbound rule allowing HTTPS and inbound rule allowing return traffic
D.Security group on the NAT gateway with outbound rule allowing HTTPS
AnswerA

A security group outbound rule permitting HTTPS only controls traffic at the instance level, but a NAT gateway in the public subnet requires a corresponding inbound security group rule on the NAT gateway itself to allow return traffic from the internet; without this, the NAT gateway drops the response packets, breaking the connection. This option is tempting because security groups are the standard mechanism for restricting instance-level egress, and in a scenario where the instance communicates directly with an internet-facing endpoint without a NAT gateway—such as through an internet gateway with a public IP—this single outbound rule would suffice.

Why this answer

A security group on the EC2 instance with an outbound rule allowing HTTPS (port 443) is the correct configuration. Security groups are stateful, so the outbound rule automatically permits the return traffic, requiring no explicit inbound rule. This ensures only outbound HTTPS is allowed from the instance.

Option C is incorrect because network ACLs are stateless and would require explicit inbound rules for return traffic, but more importantly, NACLs are subnet‑level controls and are not the best practice for restricting traffic from a single instance. Option B is incorrect because VPC gateway endpoints are for private connectivity to AWS services, not for internet access. Option D is incorrect because a security group on the NAT gateway would control the NAT gateway's own traffic, not the instance behind it.

Full explanation →
1095
MCQmedium

A company is designing a VPC with private subnets for databases and public subnets for web servers. They need to allow the web servers to make outbound internet requests for software updates but prevent inbound traffic from the internet. Which configuration should they use?

A.Deploy a NAT Gateway in a public subnet and add a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT Gateway.
B.Deploy a NAT Gateway in the private subnet and route the private subnet traffic through it.
C.Attach an Internet Gateway to the VPC and route the private subnet traffic through it.
D.Deploy a proxy server in the private subnet and configure the web servers to use it.
AnswerA

This allows outbound internet traffic from the private subnet while blocking inbound unsolicited traffic.

Why this answer

Deploying a NAT Gateway in a public subnet allows instances in private subnets to initiate outbound internet traffic (e.g., for software updates) while blocking unsolicited inbound traffic from the internet. Option B is incorrect because a NAT Gateway must be in a public subnet to access the internet. Option C is incorrect because an Internet Gateway allows both inbound and outbound traffic, which would expose the private subnets to inbound internet traffic.

Option D is incorrect because while a proxy server could work, it is more complex and not the simplest or recommended AWS solution.

Full explanation →
1096
Multi-Selectmedium

A company wants to monitor and log all network traffic within a VPC for security analysis. Which THREE services can be used to achieve this?

Select 3 answers
A.VPC Flow Logs
B.Amazon CloudWatch
C.AWS Network Firewall
D.AWS Traffic Mirroring
E.Amazon S3
AnswersA, C, D

VPC Flow Logs capture metadata about IP traffic.

Why this answer

VPC Flow Logs capture IP traffic information for network interfaces in a VPC, enabling monitoring and logging. AWS Network Firewall provides stateful inspection and logs traffic that passes through the firewall. AWS Traffic Mirroring replicates network traffic from an elastic network interface for analysis.

Amazon CloudWatch is a monitoring service that can collect logs but does not directly capture network traffic. Amazon S3 is object storage and cannot capture or log network traffic itself.

Full explanation →
1097
MCQhard

A network engineer has created a VPC endpoint for a VPC endpoint service. The endpoint is 'available' but the application cannot connect to the service using the private DNS name. The engineer checks the Route 53 private hosted zone and finds that no record exists for the endpoint. What is the most likely cause?

A.The VPC endpoint service is not accepting connections
B.The VPC endpoint policy is blocking connectivity
C.The security group for the endpoint does not allow inbound traffic
D.The 'PrivateDnsEnabled' flag is set to false on the VPC endpoint
AnswerD

If private DNS is not enabled, Route 53 does not automatically create records for the endpoint.

Why this answer

When the 'PrivateDnsEnabled' flag is set to false on a VPC endpoint, AWS does not automatically create a Route 53 private hosted zone for the endpoint, so the private DNS name does not resolve. This is the most likely cause given that no DNS record exists. Option D is correct.

Options A, B, and C could cause connectivity issues but would not prevent the DNS record from being created.

Full explanation →
1098
MCQmedium

A company is deploying a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB), a fleet of EC2 instances in an Auto Scaling group across three Availability Zones, and an Amazon RDS for MySQL database. The ALB has a target group that routes traffic to the EC2 instances on TCP port 8080. The security group for the EC2 instances allows inbound traffic from the ALB's security group on port 8080. Users report intermittent connectivity issues to the application. A network engineer reviews the VPC Flow Logs and notices that traffic from the ALB to the EC2 instances is being recorded as 'REJECT' for some requests. What is the most likely cause of this issue?

A.The network ACL associated with the EC2 instances' subnet does not have an outbound rule to allow traffic from the EC2 instances to the ALB on ephemeral ports.
B.The ALB's security group is blocking inbound traffic from the EC2 instances on the response path.
C.The ALB's target group health check is misconfigured, causing the ALB to mark instances as unhealthy and stop sending traffic.
D.The security group on the EC2 instances is stateful and automatically allows return traffic; the issue cannot be security group related.
AnswerA

The network ACL is stateless and must allow return traffic. Missing outbound rules cause REJECT.

Why this answer

The network ACL (NACL) is stateless and must have explicit outbound rules to allow return traffic from the EC2 instances back to the ALB on ephemeral ports. Since the ALB initiates connections to the EC2 instances on TCP port 8080, the return traffic from the EC2 instances uses ephemeral ports (typically 1024-65535) destined for the ALB's source port. Without an outbound rule in the subnet's NACL allowing this traffic, the NACL will reject the response packets, causing intermittent REJECT entries in VPC Flow Logs.

Exam trap

The trap here is that candidates often focus on security groups being stateful and forget that network ACLs are stateless and require explicit rules for return traffic, especially on ephemeral ports.

How to eliminate wrong answers

Option B is wrong because security groups are stateful, meaning if the ALB's security group allows outbound traffic to the EC2 instances, the return traffic from the EC2 instances is automatically allowed regardless of inbound rules. Option C is wrong because a misconfigured health check would cause the ALB to mark instances as unhealthy and stop sending traffic entirely, not cause intermittent REJECT records for traffic that is already being sent. Option D is wrong because while the EC2 instances' security group is stateful and automatically allows return traffic, the issue is with the network ACL (stateless) on the subnet, not the security group.

Full explanation →
1099
Multi-Selectmedium

A company is troubleshooting a slow network connection between two EC2 instances in the same VPC but different Availability Zones. Which TWO tools can be used to measure throughput and diagnose performance issues?

Select 2 answers
A.iperf
B.tcpdump
C.traceroute
D.nslookup
E.ping
AnswersA, C

iperf measures network throughput.

Why this answer

Options A and C are correct. iperf is a tool used to measure network throughput between two hosts. Traceroute diagnoses network path and latency, which can help identify performance bottlenecks. Options B, D, and E are incorrect: tcpdump captures packets but does not measure throughput; nslookup is a DNS lookup tool that does not measure network performance; ping measures latency but not throughput.

Full explanation →
1100
MCQeasy

A network engineer is setting up a Direct Connect connection from an on-premises data center to AWS. The connection uses a private VIF to connect to a VPC via a Direct Connect gateway. The on-premises network is advertising a BGP prefix 10.0.0.0/16, which overlaps with the VPC CIDR 10.0.0.0/16. What is the expected behavior?

A.The VPC will automatically reassign a new CIDR to avoid the conflict.
B.The BGP session will fail to establish due to the prefix conflict.
C.The BGP session will be established, but the overlapping prefix will be ignored and not programmed into the VPC route tables.
D.The on-premises prefix will take precedence and override the VPC route.
AnswerC

AWS does not allow overlapping prefixes to be injected into VPC route tables to prevent routing conflicts.

Why this answer

When a BGP prefix advertised over a Direct Connect private VIF overlaps with the VPC CIDR, the BGP session establishes successfully, but AWS ignores the overlapping prefix and does not install it into the VPC route tables. This is because AWS always prefers the local VPC route over any propagated BGP route for the same prefix, preventing traffic destined for the VPC from being blackholed or misrouted to on-premises.

Exam trap

The trap here is that candidates assume BGP session failure due to prefix overlap, but BGP itself has no mechanism to reject a session based on prefix overlap; the overlap only affects route installation, not session state.

How to eliminate wrong answers

Option A is wrong because AWS does not automatically reassign VPC CIDRs; CIDR changes require manual action and cannot be triggered by a BGP prefix overlap. Option B is wrong because the BGP session establishes normally; the overlap does not affect BGP session establishment or keepalive messages. Option D is wrong because the on-premises prefix does not take precedence; the VPC's local route always has a higher administrative priority than any propagated BGP route, so the on-premises route is ignored.

Full explanation →
1101
MCQmedium

A company is implementing a hybrid network using AWS Direct Connect. They have a virtual private gateway (VGW) attached to their VPC and a Direct Connect gateway (DXGW) with a private virtual interface (VIF) to their on-premises router. They have established a BGP session between the on-premises router and the VGW. The on-premises network can reach EC2 instances in the VPC, but the VPC instances cannot reach on-premises resources. What is the most likely cause?

A.The virtual private gateway is not attached to the VPC
B.The VPC has a VPC endpoint for S3 that is causing a routing conflict
C.The VPC route tables lack a route for the on-premises CIDR pointing to the virtual private gateway
D.The BGP session is not advertising the on-premises CIDR to the VGW
AnswerC

Without a route, VPC instances do not know to send traffic to the VGW for on-premises destinations.

Why this answer

For instances in a VPC to reach on-premises resources over Direct Connect, the VPC route tables must have a route for the on-premises CIDR that points to the virtual private gateway (VGW). Without this route, traffic from the VPC to the on-premises network will not be forwarded to the VGW, even though the BGP session is established and the on-premises side can reach the VPC. Option A is incorrect because the VGW is attached to the VPC (otherwise on-premises could not reach EC2 instances).

Option B is incorrect because a VPC endpoint for S3 does not cause routing conflicts for on-premises traffic. Option D is incorrect because the BGP session is established and the on-premises CIDR is being advertised (otherwise on-premises could not reach the VPC).

Full explanation →
1102
MCQmedium

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the public subnet is configured as a NAT instance. The company wants to replace the NAT instance with a NAT gateway for better availability and maintenance. After creating a NAT gateway in the public subnet and updating the route table of the private subnet, traffic from the private subnet cannot reach the internet. What is the MOST likely cause?

A.The public subnet's route table still points to the NAT instance for internet traffic.
B.The security group attached to the NAT gateway is blocking outbound traffic.
C.The private subnet's route table has a route for 0.0.0.0/0 pointing to the NAT instance instead of the NAT gateway.
D.The NAT gateway does not have an Elastic IP address associated with it.
AnswerD

A NAT gateway requires an Elastic IP for outbound traffic.

Why this answer

A NAT gateway requires an Elastic IP address to function as a gateway for outbound internet traffic. Without an Elastic IP, the NAT gateway cannot perform source network address translation (SNAT), so instances in the private subnet cannot reach the internet. This is the most likely cause given that the route table update was already performed.

Exam trap

The trap here is that candidates may assume a NAT gateway can function without an Elastic IP, similar to a NAT instance, or they may incorrectly focus on route table misconfigurations when the route table was already updated.

How to eliminate wrong answers

Option A is wrong because the public subnet's route table does not affect traffic from the private subnet; the private subnet's route table controls its outbound traffic. Option B is wrong because NAT gateways do not use security groups; they use network ACLs at the subnet level, and security groups are not applicable to NAT gateways. Option C is wrong because the question states the route table was updated to point to the NAT gateway, so a lingering route to the NAT instance would be a configuration error that contradicts the given scenario.

Full explanation →
1103
Multi-Selecthard

A company is migrating a legacy application to AWS. The application uses multicast for service discovery. Which AWS service or feature can be used to support multicast traffic within a VPC?

Select 1 answer
A.AWS Direct Connect with multicast
B.AWS Transit Gateway with multicast domain
C.VPC multicast groups using network interfaces
D.Internet Gateway (IGW)
E.VPC Peering
AnswersB

AWS Transit Gateway multicast domains provide native support for multicast traffic within a VPC, allowing service discovery traffic to be forwarded between VPCs or on-premises networks.

Why this answer

AWS Transit Gateway multicast domains (option B) is the only service that natively supports multicast traffic within a VPC. The other listed options do not support multicast: Direct Connect requires additional on-premises configuration and does not provide VPC-native multicast, VPC multicast groups are not a supported feature, Internet Gateway only handles unicast, and VPC Peering also only supports unicast. Therefore, the correct answer is B.

Exam trap

Candidates often assume that Direct Connect or VPC Peering can support multicast because they handle general IP traffic, but AWS restricts multicast to Transit Gateway multicast domains only.

Full explanation →
1104
Multi-Selectmedium

A company is designing a highly available Direct Connect connection. Which THREE components should be deployed to meet this requirement? (Select THREE.)

Select 3 answers
A.A single BGP session over one of the virtual interfaces.
B.Two Direct Connect connections to two different AWS Direct Connect locations.
C.A VPN connection as a backup to Direct Connect.
D.Two customer routers (or one router with two physical interfaces) connecting to the two Direct Connect connections.
E.Two virtual interfaces (VIFs) configured on the Direct Connect connections.
AnswersB, D, E

Provides physical diversity.

Why this answer

For high availability, you need at least two Direct Connect connections (preferably to different AWS locations), two customer routers (or one router with two interfaces), and two virtual interfaces (VIFs) to provide redundancy. Using BGP with multiple sessions ensures automatic failover.

Full explanation →
1105
MCQhard

A company has a Direct Connect connection with a private VIF to a VPC. They also have a site-to-site VPN as a backup. The on-premises network advertises the same prefix via BGP over both connections. The company wants to prefer the Direct Connect path. What configuration achieves this?

A.Set the Multi-Exit Discriminator (MED) on the VPN advertisement to a lower value.
B.Prepend the AS path on the Direct Connect advertisement to make it longer.
C.Configure the Direct Connect BGP session with a higher local preference (e.g., 200) than the VPN BGP session.
D.Configure the VPN BGP session with a higher local preference than the Direct Connect session.
AnswerC

Higher local preference makes Direct Connect preferred.

Why this answer

Local preference is a BGP attribute used to influence outbound traffic from the local AS. By setting a higher local preference (e.g., 200) on the Direct Connect BGP session, the router will prefer that path over the VPN session (default local preference 100) for the same prefix. This ensures traffic from the VPC to on-premises uses Direct Connect as the primary path.

Exam trap

The ANS-C01 exam often tests the misconception that MED is used for inbound traffic engineering, but here the requirement is to control outbound traffic from the VPC, where local preference is the correct attribute, not MED or AS path prepending.

How to eliminate wrong answers

Option A is wrong because setting a lower MED on the VPN advertisement would make the VPN path more preferred (lower MED is better), which is the opposite of the desired outcome. Option B is wrong because prepending the AS path on the Direct Connect advertisement makes it longer, which reduces its preference (shorter AS path is preferred), so this would steer traffic away from Direct Connect. Option D is wrong because configuring a higher local preference on the VPN BGP session would make the VPN path preferred over Direct Connect, contradicting the requirement to prefer Direct Connect.

Full explanation →
1106
MCQeasy

A company wants to encrypt data in transit between an Application Load Balancer (ALB) and its backend targets. Which AWS service should be used to terminate TLS at the ALB and re-encrypt traffic to the targets?

A.AWS Certificate Manager (ACM)
B.AWS Shield
C.Application Load Balancer with HTTPS listeners
D.AWS WAF
AnswerC

ALB can terminate TLS and re-encrypt to targets.

Why this answer

An ALB can terminate TLS and optionally re-encrypt traffic to targets using HTTPS. Option A is wrong because AWS Certificate Manager provides certificates, not encryption. Option B is wrong because AWS Shield is for DDoS protection.

Option C is correct. Option D is wrong because AWS WAF is a web application firewall.

Full explanation →
1107
MCQmedium

A security team needs to log all rejected traffic to an internet-facing Network Load Balancer (NLB) for compliance. Which configuration should they use?

A.Enable VPC Flow Logs on the NLB subnets
B.Enable AWS CloudTrail for the NLB
C.Enable access logs on an Application Load Balancer in front of the NLB
D.Enable access logs on the NLB
AnswerD

NLB access logs capture information about rejected traffic.

Why this answer

NLB access logs capture information about rejected traffic when enabled. Option A is wrong because VPC Flow Logs do not capture traffic that is rejected by the NLB itself before reaching the target. Option B is wrong because CloudTrail logs API calls, not network traffic.

Option C is wrong because ALB is a different load balancer type and does not apply to NLB.

Full explanation →
1108
MCQhard

A company has a VPC with a CIDR of 10.0.0.0/16. They have set up a VPC peering connection with another VPC (CIDR 172.16.0.0/16). The route tables are configured correctly. However, instances in the first VPC cannot communicate with instances in the peered VPC. The security groups and network ACLs are configured to allow all traffic. What is the most likely cause?

A.The DNS resolution settings for the VPC peering connection are not enabled.
B.The route tables in the VPCs are not propagated to the subnets.
C.The instances do not have ICMP traffic allowed.
D.The VPC CIDR ranges overlap.
AnswerA

When VPC peering is created, DNS resolution must be enabled to allow DNS hostnames to resolve across the peering connection.

Why this answer

The most likely cause is that the VPC peering connection's DNS resolution settings are not enabled. While basic IP connectivity does not require DNS, if instances are using private DNS hostnames (a common default), DNS queries for the peered VPC will fail unless this setting is enabled. Since the route tables are correctly configured, security groups allow all traffic, and CIDR ranges do not overlap, the DNS resolution setting is the only remaining plausible cause from the options.

Exam trap

The ANS-C01 exam often tests the misconception that route tables and security groups are the only requirements for VPC peering communication, while the subtle DNS resolution setting is a common overlooked prerequisite.

How to eliminate wrong answers

Option B is wrong because route tables in VPCs are not 'propagated to subnets' in the context of VPC peering; route tables are associated with subnets, and propagation is a concept for VPN or Direct Connect, not for VPC peering. Option C is wrong because the question states that security groups and network ACLs are configured to allow all traffic, and ICMP is not required for general TCP/UDP communication; the issue is not about ICMP traffic being disallowed. Option D is wrong because the VPC CIDR ranges (10.0.0.0/16 and 172.16.0.0/16) do not overlap; they are from different private IP address ranges, so overlapping CIDRs is not the cause.

Full explanation →
1109
MCQhard

A network engineer is troubleshooting connectivity issues between two VPCs that are peered. The VPCs are in the same region but different accounts. The engineer verifies that the route tables and security group rules are correctly configured. However, instances in VPC A cannot ping instances in VPC B. What is the most likely cause?

A.Network ACLs are not configured to allow inbound ICMP
B.The route tables in VPC A point to a VPN gateway instead of the VPC peering connection
C.Security groups are stateful and block return traffic
D.The VPC peering connection is in the 'failed' state
AnswerB

Correct. The route tables in each VPC must have an entry for the other VPC's CIDR with the VPC peering connection as the target. If the route points to a VPN gateway instead, traffic will not use the peering connection.

Why this answer

For VPC peering to work, each VPC must have routes in their route tables that point to the peering connection as the target for the other VPC's CIDR. If the route table in VPC A points to a VPN gateway instead of the VPC peering connection, traffic will not traverse the peering connection, causing connectivity failure. Option A is incorrect because Network ACLs are stateless and must allow both inbound and outbound ICMP; if they were misconfigured, they could block traffic, but the question states that route tables and security groups are correctly configured, not NACLs.

Option C is incorrect because security groups are stateful and automatically allow return traffic; they would not block return traffic. Option D is incorrect because the VPC peering connection being in 'failed' state would prevent connectivity, but the question implies the connection is established (as the engineer verified route tables and security groups, not the peering state).

Exam trap

A common trap is assuming that security group statefulness automatically allows all traffic; however, statefulness only applies to return traffic, not initial traffic. Another trap is focusing on NACLs instead of route tables for inter-VPC connectivity.

Full explanation →
1110
Multi-Selecteasy

A company has a VPC with a public subnet and a private subnet. They want to allow instances in the private subnet to download patches from the internet. Which THREE components are required? (Select THREE.)

Select 3 answers
A.AWS Direct Connect connection
B.Internet Gateway attached to the VPC
C.Elastic IP address assigned to the NAT Gateway
D.Route in the private subnet's route table pointing 0.0.0.0/0 to the NAT Gateway
E.NAT Gateway deployed in the public subnet
AnswersB, D, E

The NAT Gateway uses the Internet Gateway to reach the internet.

Why this answer

An Internet Gateway (IGW) is required to provide a target in the VPC's route tables for internet-bound traffic. The NAT Gateway must be deployed in a public subnet and assigned an Elastic IP address so that it can route traffic through the IGW to the internet. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway, enabling instances in the private subnet to initiate outbound connections to the internet for patch downloads while remaining inaccessible from the internet.

Exam trap

The ANS-C01 exam often tests the misconception that a NAT Gateway alone in a private subnet can provide internet access, but the NAT Gateway must be deployed in a public subnet with an Internet Gateway attached to the VPC and a default route pointing to the IGW in that public subnet's route table.

Full explanation →
1111
MCQmedium

A company has a Direct Connect connection with a private VIF to a VPC. They also have a Site-to-Site VPN connection to the same VPC as a backup. The on-premises router is advertising the same prefixes over both connections. The company wants to ensure that traffic uses Direct Connect when available and fails over to VPN if Direct Connect goes down. Which configuration should be applied?

A.Set a higher MED value on the Direct Connect BGP advertisements.
B.Disable BGP on the VPN connection to force traffic to Direct Connect.
C.Prepend AS path on the BGP advertisements over the VPN connection to make the path less preferred.
D.Set a higher local preference on the VPN BGP advertisements.
AnswerC

AS path prepending makes the VPN path longer, so Direct Connect path (shorter AS path) is preferred.

Why this answer

To prefer Direct Connect over VPN, adjust BGP attributes on the on-premises router. Prepend AS path on the VPN BGP advertisements to increase the AS path length, making the Direct Connect path shorter and thus preferred. This ensures failover to VPN if Direct Connect fails.

Option A is incorrect because setting higher MED on Direct Connect would make it less preferred, not more. Option B is incorrect because disabling BGP on VPN removes the backup connection entirely. Option D is incorrect because setting higher local preference on VPN BGP advertisements would make VPN preferred, which is the opposite of the desired behavior.

Local preference is typically set on the AWS side, not on-premises.

Full explanation →
1112
MCQeasy

A network engineer needs to troubleshoot high latency between two EC2 instances in the same VPC but in different Availability Zones. Which tool should be used to measure network performance?

A.Use traceroute to identify the path
B.Use ping to test connectivity
C.Use iperf to measure throughput and latency
D.Use netstat to check network statistics
AnswerC

iperf is designed for active network performance measurement.

Why this answer

Iperf is the correct tool because it can measure both throughput and latency between two points, making it ideal for troubleshooting high latency. Traceroute (A) shows the network path but does not measure performance. Ping (B) measures round-trip time but not throughput.

Netstat (D) displays network connections and statistics but does not actively measure performance.

Full explanation →
1113
MCQmedium

A company is designing a VPC with multiple subnets across three Availability Zones. The application requires that all traffic between subnets within the same AZ stay within that AZ to minimize latency and data transfer costs. Which configuration achieves this?

A.Use a single route table for all subnets and add specific routes for each AZ.
B.Use an AWS Transit Gateway with separate attachments for each AZ.
C.Create a VPC peering connection between subnets in the same AZ.
D.Create a route table for each AZ and associate the subnets in that AZ with the route table. Ensure the route tables have only local routes for the VPC CIDR.
AnswerD

Local routing within the same AZ is used.

Why this answer

Each Availability Zone (AZ) has its own route table with only the local VPC CIDR route. This ensures that traffic between subnets in the same AZ uses the VPC's local routing, which stays within the AZ's physical infrastructure, minimizing latency and avoiding cross-AZ data transfer costs. AWS VPC local routes inherently keep traffic within the same AZ when source and destination are in the same AZ, as the underlying network fabric directs traffic locally without traversing AZ boundaries.

Exam trap

The ANS-C01 exam often tests the misconception that a single route table or a centralized service like Transit Gateway can achieve AZ-level traffic isolation, but the key is that local VPC routing inherently stays within the AZ only when the route table is per-AZ and contains only the local VPC CIDR, not when a shared route table or additional network appliances are introduced.

How to eliminate wrong answers

Option A is wrong because using a single route table for all subnets does not isolate traffic per AZ; all subnets share the same routing table, and local routes for the VPC CIDR would still allow cross-AZ traffic, which does not guarantee that traffic stays within the same AZ. Option B is wrong because AWS Transit Gateway attachments are regional and do not provide per-AZ isolation; traffic between subnets in the same AZ would still traverse the Transit Gateway, which is a centralized appliance that introduces additional latency and cross-AZ data transfer costs if attachments span AZs. Option C is wrong because VPC peering connections are between VPCs, not between subnets within the same VPC; subnets in the same VPC already communicate via the VPC's local router, and creating a VPC peering connection between subnets is not possible and would be redundant, adding unnecessary complexity without any benefit for intra-VPC traffic.

Full explanation →
1114
MCQmedium

A network engineer is troubleshooting connectivity issues between an EC2 instance in a VPC and an on-premises server over a Direct Connect connection. The engineer has verified that the VPC route tables, Direct Connect virtual interface, and on-premises routing are correctly configured. Which tool should be used to verify the path MTU and identify fragmentation issues?

A.Use the netstat command
B.Use the ping command with the DF flag set to test MTU
C.Use the nslookup command
D.Use the traceroute command
AnswerB

ping with 'do not fragment' flag can detect MTU issues.

Why this answer

The ping command with the Don't Fragment (DF) flag set (e.g., `ping -M do -s <size>` on Linux) is the correct tool to verify path MTU because it forces the packet not to be fragmented. If the packet size exceeds the MTU of any link along the path, the router will drop the packet and send an ICMP Fragmentation Needed message back, allowing the engineer to pinpoint the maximum supported MTU and identify fragmentation issues.

Exam trap

The trap here is that candidates often choose traceroute (option D) thinking it shows MTU along the path, but traceroute does not set the DF flag or control payload size to test fragmentation; it only measures hop latency and path, not MTU boundaries.

How to eliminate wrong answers

Option A is wrong because netstat displays network connections, routing tables, and interface statistics, but it cannot test path MTU or detect fragmentation. Option C is wrong because nslookup is a DNS resolution tool that queries name servers and has no relevance to MTU or fragmentation testing. Option D is wrong because traceroute shows the hop-by-hop path and latency but does not allow you to set the DF flag or control packet size to specifically test MTU thresholds; it can indicate path changes but not fragmentation boundaries.

Full explanation →
1115
MCQmedium

A company is deploying a multi-tier web application in a VPC. The web tier must be accessible from the internet, while the application tier must only be accessible from the web tier. The database tier must only be accessible from the application tier. Which design best meets these requirements?

A.Place all tiers in public subnets and use security groups to control traffic between tiers.
B.Place the web tier in public subnets with an internet gateway, and the application and database tiers in private subnets. Use security groups to allow traffic from the web tier to the application tier, and from the application tier to the database tier.
C.Place all tiers in the same subnet and use network ACLs to restrict traffic between tiers.
D.Place the web tier in a private subnet and use a NAT gateway for outbound internet access. Place the application and database tiers in public subnets.
AnswerB

Correct design: public subnet with IGW for web, private subnets for app and DB, security groups restrict traffic.

Why this answer

It places the web tier in a public subnet with an Internet Gateway (IGW) for direct internet access, while the application and database tiers reside in private subnets with no direct internet path. Security groups act as stateful virtual firewalls at the instance level, allowing you to specify inbound rules that permit traffic only from the web tier security group to the application tier, and from the application tier security group to the database tier. This layered approach enforces the principle of least privilege and meets the access requirements without exposing the internal tiers to the internet.

Exam trap

The ANS-C01 exam often tests the misconception that security groups alone can secure tiers placed in public subnets, but the trap here is that a public subnet with an Internet Gateway route inherently allows inbound internet traffic unless explicitly blocked by a network ACL, so the application and database tiers must be placed in private subnets to prevent direct internet access.

How to eliminate wrong answers

Option A is wrong because placing all tiers in public subnets exposes the application and database tiers to the internet, violating the requirement that they must only be accessible from the preceding tier; security groups alone cannot prevent direct internet access if the subnets have a route to an Internet Gateway. Option C is wrong because placing all tiers in the same subnet and relying solely on network ACLs (which are stateless and require explicit rules for both inbound and outbound traffic) is overly complex, error-prone, and does not provide the same granular, stateful control as security groups; it also fails to isolate tiers at the subnet level. Option D is wrong because placing the web tier in a private subnet with a NAT gateway prevents direct inbound internet access (the web tier must be accessible from the internet), and placing the application and database tiers in public subnets exposes them unnecessarily, contradicting the requirement for restricted access.

Full explanation →
1116
MCQeasy

A company needs to connect its on-premises network to a VPC using AWS Direct Connect. The company wants to use a single Direct Connect connection to connect to multiple VPCs in the same region. Which configuration should be used?

A.Create a private VIF for each VPC
B.Use a VPN connection to extend the Direct Connect to other VPCs
C.Use a Transit Gateway to connect the Direct Connect to multiple VPCs
D.Create a Direct Connect Gateway and associate it with multiple VPCs
AnswerD

A Direct Connect Gateway can be associated with up to 10 VPCs per region.

Why this answer

A Direct Connect Gateway allows a single Direct Connect connection (via a private virtual interface) to be associated with multiple VPCs in the same region (or across regions). The Direct Connect Gateway acts as a hub, enabling transitive routing between the on-premises network and all associated VPCs without needing separate private VIFs per VPC.

Exam trap

The trap here is that candidates often confuse the role of a Transit Gateway with a Direct Connect Gateway, assuming that a Transit Gateway alone can directly terminate a Direct Connect private VIF, when in fact a Direct Connect Gateway is required as an intermediary to aggregate multiple VPC attachments.

How to eliminate wrong answers

Option A is wrong because creating a private VIF for each VPC would require multiple Direct Connect connections or multiple VLANs on a single connection, which is inefficient and does not scale; a single private VIF can only terminate on a single virtual private gateway or Direct Connect Gateway. Option B is wrong because using a VPN connection to extend Direct Connect to other VPCs adds unnecessary complexity, latency, and bandwidth constraints, and it defeats the purpose of using Direct Connect for low-latency, high-bandwidth connectivity. Option C is wrong because a Transit Gateway can be used to connect multiple VPCs to a Direct Connect connection, but it requires a Direct Connect Gateway attachment to the Transit Gateway; the question asks for the configuration that directly uses a single Direct Connect connection to connect to multiple VPCs, and the Direct Connect Gateway is the native AWS service designed for this purpose, not the Transit Gateway itself.

Full explanation →
1117
MCQhard

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company wants to use a single NAT Gateway for all private subnets to reduce costs, but the NAT Gateway is in a single Availability Zone (AZ). The network architect is concerned about single points of failure. Which design best addresses high availability while still using the minimum number of NAT Gateways?

A.Deploy a single NAT Gateway in one AZ and use a VPN to an on-premises internet gateway as backup.
B.Deploy one NAT Gateway in each AZ that contains private subnets, and update the route tables accordingly.
C.Use a NAT instance in an Auto Scaling group across multiple AZs instead of a NAT Gateway.
D.Create a second VPC with a NAT Gateway and peer the VPCs to share the NAT Gateway.
AnswerB

This ensures each AZ is independent; if one NAT Gateway fails, only that AZ loses internet access.

Why this answer

Deploying one NAT Gateway per Availability Zone (AZ) that contains private subnets ensures that if an AZ fails, the private subnets in other AZs still have internet access via their local NAT Gateway. This design provides high availability while using the minimum number of NAT Gateways necessary to cover all AZs with private subnets, avoiding a single point of failure without over-provisioning.

Exam trap

The trap here is that candidates assume a single NAT Gateway is sufficient for high availability if placed in a multi-AZ setup, but they overlook that NAT Gateway is an AZ-scoped resource and does not automatically fail over to another AZ, so a single NAT Gateway remains a single point of failure.

How to eliminate wrong answers

Option A is wrong because a VPN to an on-premises internet gateway does not provide automatic failover for NAT Gateway traffic; it requires complex routing and does not offer the same level of availability or performance as a second NAT Gateway in another AZ. Option C is wrong because a NAT instance in an Auto Scaling group across multiple AZs introduces management overhead, potential throughput limitations, and does not match the managed service benefits of NAT Gateway (e.g., automatic scaling, high bandwidth, and no maintenance). Option D is wrong because creating a second VPC and using VPC peering to share a NAT Gateway adds unnecessary complexity, latency, and cost, and does not solve the single-AZ failure risk within the original VPC.

Full explanation →
1118
MCQeasy

A company has deployed a VPC with public and private subnets. The private subnets need outbound internet access for software updates. Which service should be used to provide this access without exposing the instances to inbound traffic?

A.Attach an Internet Gateway to the VPC and add a default route to it from the private subnets.
B.Set up a VPN connection to an on-premises network that has internet access.
C.Use a Direct Connect connection to route traffic through an on-premises internet gateway.
D.Deploy a NAT Gateway in a public subnet and add a default route to it from the private subnets.
AnswerD

NAT Gateway provides outbound-only internet access.

Why this answer

A NAT Gateway, deployed in a public subnet with an Elastic IP, allows instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. The private subnet’s route table directs default traffic (0.0.0.0/0) to the NAT Gateway, which performs source network address translation (SNAT) to the gateway’s Elastic IP, enabling outbound-only access.

Exam trap

The trap here is that candidates often confuse an Internet Gateway (which allows bidirectional traffic) with a NAT Gateway (which allows only outbound traffic), leading them to select Option A despite the requirement to block inbound traffic.

How to eliminate wrong answers

Option A is wrong because attaching an Internet Gateway to the VPC and adding a default route from private subnets would directly expose those instances to inbound internet traffic, violating the requirement to prevent inbound access; an Internet Gateway allows bidirectional traffic. Option B is wrong because setting up a VPN connection to an on-premises network that has internet access adds unnecessary complexity and latency, and it does not natively provide outbound-only internet access from the VPC without additional routing and firewall rules. Option C is wrong because using a Direct Connect connection to route traffic through an on-premises internet gateway is an over-engineered solution that introduces dependency on on-premises infrastructure, higher cost, and potential bandwidth bottlenecks; it is not the simplest or most appropriate service for providing outbound-only internet access from private subnets.

Full explanation →
1119
Multi-Selectmedium

A company is designing a VPC with public and private subnets. The private subnets must have outbound internet access for software updates, but must not be directly reachable from the internet. Which two components are required for this design? (Choose two.)

Select 2 answers
A.NAT Gateway in a public subnet
B.Security Group allowing outbound HTTPS
C.Internet Gateway attached to the VPC
D.AWS Site-to-Site VPN connection
E.Route table for private subnets with 0.0.0.0/0 pointing to the NAT Gateway
AnswersA, E

NAT Gateway enables outbound internet access for private instances.

Why this answer

A NAT Gateway in a public subnet (A) provides outbound internet access for instances in private subnets while preventing inbound connections from the internet. A route table for the private subnets with a 0.0.0.0/0 route pointing to the NAT Gateway (E) directs outbound traffic to the NAT Gateway. Option B (Security Group allowing outbound HTTPS) is not a component; security groups control traffic but don't provide routing or internet access.

Option C (Internet Gateway attached to the VPC) is required for public subnets but alone does not enable private subnet outbound access. Option D (Site-to-Site VPN) is for hybrid connectivity, not internet access.

Full explanation →
1120
MCQmedium

An application running on EC2 instances in a VPC needs to access an Amazon S3 bucket to read configuration files. The VPC has an S3 VPC endpoint configured. The instances are in a private subnet and have a security group that allows all outbound traffic. The bucket policy allows access from the VPC endpoint. However, the application fails to access the S3 bucket. What is the most likely cause?

A.The network ACL for the private subnet is blocking outbound HTTPS traffic.
B.The VPC endpoint's route table does not include the subnet's route table, so traffic to S3 is not routed through the endpoint.
C.The security group for the EC2 instances has an outbound rule that blocks HTTPS traffic to S3.
D.The S3 bucket policy does not grant access to the VPC endpoint's ID.
AnswerB

VPC endpoints require route table association to route traffic.

Why this answer

The most likely cause is that the VPC endpoint's route table does not include the subnet's route table, meaning traffic from the private subnet to S3 is not routed through the endpoint. Option B is correct because if the subnet's route table lacks a route for the S3 prefix list pointing to the VPC endpoint, traffic will go via a NAT gateway or internet gateway (if configured) or fail if no such connectivity exists. Option A is incorrect because network ACLs are not mentioned and typically allow outbound HTTPS.

Option C is incorrect since the security group allows all outbound traffic. Option D is incorrect because the bucket policy already permits access from the VPC endpoint.

Full explanation →
1121
MCQmedium

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download patches from the internet. Which configuration will allow this without exposing the instance to inbound internet traffic?

A.Use VPC Gateway Endpoints for S3 and DynamoDB.
B.Attach an Internet Gateway to the VPC and assign a public IP to the instance.
C.Deploy a NAT Gateway in a public subnet and update the private subnet's route table to point default route to the NAT Gateway.
D.Configure a VPN connection from the VPC to an on-premises network that has internet access.
AnswerC

NAT Gateway provides outbound internet access without inbound access.

Why this answer

A NAT Gateway, deployed in a public subnet with an Internet Gateway, allows outbound IPv4 traffic from private subnets to the internet while preventing unsolicited inbound connections. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway, enabling the EC2 instance to download patches without being directly exposed.

Exam trap

The trap here is that candidates often confuse NAT Gateways with NAT Instances or assume that a VPC Gateway Endpoint (Option A) provides general internet access, when in fact it only works for specific AWS services like S3 and DynamoDB.

How to eliminate wrong answers

Option A is wrong because VPC Gateway Endpoints only provide private connectivity to S3 and DynamoDB, not general internet access for downloading patches from arbitrary internet hosts. Option B is wrong because assigning a public IP to the instance and attaching an Internet Gateway would expose the instance to inbound internet traffic, violating the requirement to prevent inbound exposure. Option D is wrong because a VPN connection to an on-premises network with internet access would route traffic through the VPN, but this adds complexity, latency, and dependency on on-premises infrastructure; it is not the standard AWS-native solution for outbound-only internet access.

Full explanation →
1122
MCQmedium

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They want to limit traffic between specific VPCs for security purposes. Which feature should they use?

A.Security groups attached to the Transit Gateway.
B.Transit Gateway route tables.
C.VPC Flow Logs.
D.Network ACLs in each VPC.
AnswerB

Route tables control which attachments can communicate.

Why this answer

Transit Gateway route tables control traffic between attachments by creating separate route tables and associating attachments accordingly, enabling isolation between specific VPCs. Option A is wrong because security groups are not supported on Transit Gateway attachments; they are instance-level. Option C is wrong because VPC Flow Logs are for monitoring traffic, not controlling it.

Option D is wrong because Network ACLs are per-subnet and do not provide centralized control across attachments.

Full explanation →
1123
MCQeasy

A network engineer is troubleshooting connectivity between an EC2 instance in a VPC and an on-premises server connected via AWS Site-to-Site VPN. The ping from the EC2 instance to the on-premises server fails. The VPN tunnel status shows 'UP'. Which configuration should the engineer check first?

A.Ensure the customer gateway device is configured with the correct public IP address
B.Check that the pre-shared key matches on both sides
C.Check the route table associated with the EC2 instance's subnet for a route to the on-premises network
D.Verify that the VPN tunnel is using the correct encryption algorithms
AnswerC

Without a route pointing traffic to the virtual private gateway, the VPN cannot forward packets.

Why this answer

Even when the VPN tunnel is UP, traffic from the EC2 instance to the on-premises server will be dropped if the VPC route table associated with the instance's subnet does not contain a route pointing to the on-premises network via the virtual private gateway (VGW). The ping failure in this scenario is most likely due to missing routing, not tunnel misconfiguration, since the tunnel status is UP.

Exam trap

The ANS-C01 exam often tests the misconception that a UP VPN tunnel guarantees end-to-end connectivity, but the trap here is that routing within the VPC is a separate concern that must be explicitly configured.

How to eliminate wrong answers

Option A is wrong because the customer gateway device's public IP address is used to establish the VPN tunnel; if it were incorrect, the tunnel would not be UP. Option B is wrong because a mismatched pre-shared key would prevent the IKE phase 1 negotiation from completing, causing the tunnel to fail to reach UP status. Option D is wrong because incorrect encryption algorithms would also prevent the tunnel from establishing; the tunnel being UP indicates that both sides have successfully negotiated IPsec parameters.

Full explanation →
1124
MCQhard

A global company is deploying a multi-Region application on AWS. The application requires low-latency access to a shared dataset that is updated frequently in multiple Regions. The company wants to use Amazon Route 53 latency-based routing to direct users to the closest Region. Which data store provides the best combination of low-latency reads and cross-Region consistency for this use case?

A.Amazon S3 with cross-Region replication
B.Amazon Aurora Global Database
C.Amazon ElastiCache for Redis Global Datastore
D.Amazon DynamoDB global tables with eventually consistent reads
AnswerC

Redis Global Datastore provides sub-millisecond reads and cross-Region replication.

Why this answer

Amazon ElastiCache for Redis Global Datastore provides sub-millisecond read latency by serving data from in-memory caches, and it offers cross-Region consistency by replicating writes from a primary Region to read replicas in secondary Regions with minimal lag. This combination meets the requirement for low-latency access to a frequently updated shared dataset across multiple Regions, as it avoids the higher latency of disk-based storage and the eventual consistency delays of other options.

Exam trap

The trap here is that candidates often assume DynamoDB global tables provide strong consistency across Regions, but they only offer eventual consistency for cross-Region reads, while ElastiCache Global Datastore provides stronger consistency with lower latency for frequently updated datasets.

How to eliminate wrong answers

Option A is wrong because Amazon S3 with cross-Region replication provides eventually consistent reads (due to S3's read-after-write consistency only for new objects in the same Region) and higher latency for frequent updates compared to in-memory caching. Option B is wrong because Amazon Aurora Global Database uses asynchronous replication with typical latency of ~1 second, which is too high for frequently updated datasets requiring near-real-time consistency across Regions. Option D is wrong because Amazon DynamoDB global tables with eventually consistent reads do not guarantee cross-Region consistency; writes are replicated asynchronously, and reads may return stale data, which fails the consistency requirement for a frequently updated shared dataset.

Full explanation →
1125
MCQhard

A large e-commerce company is redesigning its global network architecture. They have three VPCs in us-east-1: production (10.0.0.0/16), staging (10.1.0.0/16), and development (10.2.0.0/16). They also have two VPCs in eu-west-1: production (10.10.0.0/16) and staging (10.11.0.0/16). All VPCs are connected via a Transit Gateway with inter-region peering. The company wants to allow the staging VPCs in both regions to communicate with each other for data replication, but no other cross-region traffic should be allowed. Additionally, the production VPC in us-east-1 must be able to send traffic to the production VPC in eu-west-1 for a disaster recovery pilot. The security team has configured Network ACLs and security groups appropriately. However, after implementation, the staging VPCs can communicate, but the production VPCs cannot. A network engineer checks the Transit Gateway route tables and finds that both production VPC attachments are associated with the same route table, which has a static route for the 10.0.0.0/16 and 10.10.0.0/16 prefixes. What is the MOST likely reason for the failure?

A.The security groups in the production VPCs are blocking the traffic
B.The production VPCs are attached to the same Transit Gateway route table, causing asymmetric routing
C.The production VPCs have overlapping CIDR ranges, causing a routing conflict
D.The Transit Gateway route table for the production VPCs does not have a route for the remote production CIDR
AnswerB

If both production VPCs are in the same route table, the route for the remote production CIDR might be incorrectly propagated or cause a loop. They should be in separate route tables to control routing direction.

Why this answer

Transit Gateway route tables propagate routes from VPC attachments. If both production VPCs are in the same route table, the routes for their CIDRs will be propagated. However, if there is a propagated route for the local VPC, it may override the static route or cause a conflict.

The issue is likely that the static routes are being ignored because a more specific or conflicting propagated route exists, or the route table lacks a route for the remote production CIDR if the attachment is not associated correctly. Actually, the most common issue is that the production VPC attachments are in the same route table, but the static route for the remote production CIDR might be pointing to the VPC attachment itself, causing a loop. But the key point: Transit Gateway route tables do not allow overlapping CIDRs.

Since both production VPCs have overlapping CIDRs (10.0.0.0/16 and 10.10.0.0/16 are different), that's not the issue. The issue is likely that the route table has a static route for the remote production CIDR, but the propagation from the local production VPC attachment might be creating a route that is not correct. The best answer is that the production VPC attachments need to be in separate route tables to avoid conflicting routes.

Full explanation →
Page 14

Page 15 of 22

Page 16

All pages

12345678910111213141516171819202122

Practice ANS-C01 by domain

Target a specific domain to shore up weak areas.

Network Management and OperationsNetwork Security, Compliance and GovernanceNetwork DesignNetwork Implementation
See all domains with question counts →