Knowledge + Practice

AWS Certified Advanced Networking Specialty ANS-C01 (ANS-C01) — Questions 1126–1200

1621 questions total · 22pages · All types, answers revealed

Take a mock exam Exam hub

Page 16 of 22

1126

MCQmedium

A company is designing a multi-Region application with an Application Load Balancer (ALB) in each Region fronting an Auto Scaling group of EC2 instances. The application must be accessible via a single DNS name, and traffic should be routed to the closest healthy Region using a latency-based routing policy. Which AWS service should be used as the DNS endpoint to achieve this?

A.Amazon Route 53

B.Amazon CloudFront

C.AWS Global Accelerator

D.AWS Network Load Balancer

AnswerA

Route 53 latency-based routing sends traffic to the AWS endpoint with the lowest latency.

Why this answer

Amazon Route 53 is the correct choice because it supports latency-based routing policies, which direct traffic to the AWS Region that provides the lowest latency for the end user. By configuring a single DNS name with latency records pointing to the ALB endpoints in each Region, Route 53 can automatically route requests to the closest healthy Region, meeting the requirement for a single DNS name and latency-based routing.

Exam trap

The ANS-C01 exam often tests the distinction between DNS-based routing (Route 53) and network-layer traffic steering (Global Accelerator), where candidates mistakenly choose Global Accelerator because they think of 'lowest latency' as a network-layer feature, but the question specifically requires a single DNS name with latency-based routing policy, which is a Route 53 feature.

How to eliminate wrong answers

Option B (Amazon CloudFront) is wrong because CloudFront is a content delivery network (CDN) that caches content at edge locations and uses DNS to route to the nearest edge, not to the closest healthy Region via latency-based routing; it does not provide a latency-based routing policy for regional ALBs. Option C (AWS Global Accelerator) is wrong because it uses Anycast IP addresses and the AWS global network to route traffic to the optimal endpoint, but it does not use a DNS-based latency routing policy; it operates at the network layer (Layer 3/4) and requires a static IP, not a single DNS name with latency records. Option D (AWS Network Load Balancer) is wrong because it is a regional load balancer that operates at Layer 4 and does not provide DNS-based routing policies or multi-Region traffic steering; it cannot route traffic to the closest healthy Region based on latency.

Full explanation →

1127

MCQhard

A company has an AWS Direct Connect connection with a private VIF to a VPC. The VPC has multiple subnets across two Availability Zones. The company wants to use the Direct Connect connection as the primary path for all traffic from on-premises to the VPC, and use a Site-to-Site VPN as a backup. The on-premises router is configured to advertise a default route via BGP over the Direct Connect, and the VPN also advertises a default route. Which configuration ensures that the Direct Connect path is preferred over the VPN?

A.Disable route propagation from the VPN in the VPC route tables to ensure Direct Connect routes take precedence.

B.Set a higher local preference on the Direct Connect BGP session on the on-premises router.

C.Decrease the Multi-Exit Discriminator (MED) value on the Direct Connect BGP advertisements from AWS.

D.Configure AS_PATH prepending on the VPN BGP advertisements from the on-premises router to make the VPN path longer.

AnswerD

Longer AS_PATH makes the route less preferred.

Why this answer

AS_PATH prepending increases the AS path length for routes advertised over the VPN, making them less preferred compared to the Direct Connect routes when both paths advertise a default route. BGP selects the path with the shortest AS_PATH length when all other attributes are equal, so prepending on the VPN ensures Direct Connect is the primary path.

Exam trap

The trap here is that candidates often confuse local preference (which influences outbound traffic from on-premises) with AS_PATH prepending (which influences inbound traffic to the VPC), and they may incorrectly assume that disabling route propagation or adjusting MED is the correct way to prioritize Direct Connect over VPN.

How to eliminate wrong answers

Option A is wrong because disabling route propagation from the VPN in the VPC route tables would remove the VPN routes entirely, eliminating the backup path rather than just influencing path preference. Option B is wrong because local preference is an inbound BGP attribute typically set on the router receiving the routes (in this case, the on-premises router), and setting a higher local preference on the Direct Connect session would affect outbound traffic from on-premises, not inbound traffic to the VPC; the question asks about traffic from on-premises to the VPC, where AWS-side path selection is based on BGP attributes like AS_PATH and MED. Option C is wrong because decreasing the MED value on Direct Connect advertisements from AWS would make the Direct Connect path more preferred for traffic entering AWS, but MED is a metric that compares paths from the same neighboring AS; since Direct Connect and VPN are different AS paths, MED is not the primary tiebreaker, and the default route from VPN would still be compared using AS_PATH length.

Full explanation →

1128

MCQmedium

A company is setting up a new AWS environment for a project. The network architect decides to use a hub-and-spoke model with a central inspection VPC for east-west traffic inspection. The inspection VPC (VPC-Hub) contains a firewall appliance that inspects traffic between spoke VPCs. All VPCs are attached to an AWS Transit Gateway. The architect creates a route table in the Transit Gateway for the inspection VPC and another route table for the spoke VPCs. The inspection VPC route table has a default route (0.0.0.0/0) pointing to the firewall appliance. The spoke VPCs have route tables that point to the inspection VPC for traffic to other spoke VPCs. The firewall appliance is configured to forward traffic after inspection. However, traffic between spoke VPCs is not being routed through the inspection VPC. Which configuration change should the architect make to ensure traffic between spoke VPCs is inspected?

A.Use VPC Peering between the spoke VPCs instead of Transit Gateway

B.Create a static route in the inspection VPC route table for each spoke VPC CIDR

C.Remove the default route from the spoke VPC route tables

D.Enable route propagation on the inspection VPC attachment for the inspection route table

AnswerD

Correct; propagation allows the inspection VPC to learn the spoke CIDRs.

Why this answer

The inspection VPC route table needs to learn the spoke VPC CIDRs dynamically via route propagation from the Transit Gateway attachment. Without propagation, the inspection VPC route table only has a default route pointing to the firewall appliance, but no specific routes for the spoke VPCs. When the firewall appliance forwards traffic after inspection, it needs to know how to reach the destination spoke VPC; enabling route propagation on the inspection VPC attachment for the inspection route table allows the Transit Gateway to inject the spoke VPC routes into that route table, enabling proper return traffic flow.

Exam trap

The trap here is that candidates often focus on the spoke VPC route tables (thinking they need to remove the default route or add static routes) instead of recognizing that the inspection VPC route table must have routes to the spoke VPCs via route propagation to allow the firewall to forward inspected traffic back to the Transit Gateway.

How to eliminate wrong answers

Option A is wrong because using VPC Peering instead of Transit Gateway would bypass the central inspection VPC entirely, defeating the purpose of the hub-and-spoke model for east-west traffic inspection. Option B is wrong because creating a static route in the inspection VPC route table for each spoke VPC CIDR is unnecessary and less scalable; the Transit Gateway can dynamically propagate routes, and static routes would require manual updates as spoke VPCs change. Option C is wrong because removing the default route from the spoke VPC route tables would break all outbound traffic from the spoke VPCs, not just inter-spoke traffic; the default route is needed for internet-bound traffic or other destinations, and the issue is about the inspection VPC route table lacking spoke routes, not the spoke route tables.

Full explanation →

1129

Multi-Selecthard

A company is using AWS Direct Connect to connect on-premises to AWS. The security team wants to encrypt all traffic traversing the Direct Connect link. Which TWO options can achieve this?

Select 2 answers

A.Establish an IPsec VPN tunnel over the Direct Connect virtual interface

B.Enable MACsec on the Direct Connect dedicated connection

C.Use TLS on all applications

D.Use VPC gateway endpoints for S3

E.Rely on Direct Connect's physical security

AnswersA, B

Establishing an IPsec VPN over a Direct Connect virtual interface encrypts all traffic at Layer 3, ensuring confidentiality across the link.

Why this answer

You can establish an IPsec VPN tunnel over a Direct Connect virtual interface to encrypt traffic at Layer 3. Option B is correct because MACsec (802.1ae) provides encryption at Layer 2 for dedicated connections. Option C is incorrect because TLS only encrypts specific application traffic, not all traffic traversing the link.

Option D is incorrect because VPC gateway endpoints are used for private connectivity to S3 and DynamoDB, but they do not encrypt data across the Direct Connect link itself. Option E is incorrect because physical security does not provide encryption of data in transit.

Full explanation →

1130

MCQhard

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. They need to connect their on-premises data center to AWS using AWS Direct Connect. The data center uses RFC 1918 addresses from the 10.0.0.0/8 range, overlapping with the VPC CIDR. The company cannot change the on-premises IP addresses. Which design allows connectivity without IP conflicts?

A.Configure Direct Connect Gateway with network address translation

B.Use AWS Transit Gateway with route table separation

C.Deploy a Private NAT Gateway in the VPC and configure routes to send on-premises traffic through it

D.Set up VPC Peering between the VPC and on-premises network over Direct Connect

AnswerC

Private NAT Gateway translates VPC IPs to a different range, allowing communication with overlapping on-premises addresses.

Why this answer

A Private NAT Gateway in the VPC allows the on-premises network to reach the VPC by translating overlapping IP addresses. Since the on-premises network uses the same 10.0.0.0/8 range as the VPC's 10.0.0.0/16 CIDR, traffic from the data center to the VPC must be source NATed to a non-overlapping IP range. The Private NAT Gateway performs this translation, enabling bidirectional communication without IP conflicts.

Exam trap

The ANS-C01 exam often tests the misconception that a Direct Connect Gateway or Transit Gateway can resolve IP overlaps, but these services only route traffic and do not perform NAT, making a Private NAT Gateway the only correct solution for overlapping CIDRs.

How to eliminate wrong answers

Option A is wrong because a Direct Connect Gateway does not perform NAT; it is a transit hub for connecting multiple VPCs and on-premises networks via Direct Connect, but it cannot translate overlapping IP addresses. Option B is wrong because AWS Transit Gateway with route table separation can isolate traffic between different networks, but it does not resolve IP address overlap; overlapping CIDRs would still cause routing conflicts. Option D is wrong because VPC Peering is used to connect two VPCs, not an on-premises network, and it does not support Direct Connect; additionally, it cannot handle overlapping IP addresses.

Full explanation →

1131

Multi-Selectmedium

A network engineer is troubleshooting high latency on a Direct Connect connection. Which TWO actions should the engineer take to diagnose the issue?

Select 2 answers

A.Check the BGP session status

B.Enable VPC Flow Logs on the VPC

C.Run a continuous 'mtr' from on-premises to an AWS resource

D.Review CloudWatch metrics for the Direct Connect virtual interface

E.Run a traceroute from on-premises to an AWS IP address

AnswersC, D

Identifies latency at each hop.

Why this answer

Running a continuous 'mtr' from on-premises to an AWS resource (C) can identify latency and packet loss along each hop, including the Direct Connect connection. Reviewing CloudWatch metrics for the Direct Connect virtual interface (D) provides latency, packet loss, and throughput statistics. Option A is incorrect because BGP session status only indicates whether the routing session is established, not the latency.

Option B is incorrect because VPC Flow Logs show traffic metadata, not latency. Option E is incorrect because traceroute may be blocked by ICMP filtering and is less reliable than 'mtr' for measuring latency over Direct Connect.

Full explanation →

1132

Multi-Selectmedium

A company is designing a hybrid network using AWS Direct Connect. The company wants to use the same Direct Connect connection to access both VPC resources and public AWS services (such as S3 and DynamoDB) from its on-premises network. Which THREE components are required to meet this goal? (Choose three.)

Select 3 answers

A.AWS Transit Gateway

B.Private virtual interface (VIF)

C.Direct Connect Gateway

D.AWS Site-to-Site VPN connection

E.Public virtual interface (VIF)

AnswersB, C, E

Correct; private VIF connects to VPCs.

Why this answer

A private virtual interface (VIF) is required to connect your on-premises network to a VPC via Direct Connect. However, to also access public AWS services like S3 and DynamoDB over the same Direct Connect connection, you need a public VIF (Option E) for public endpoint connectivity and a Direct Connect Gateway (Option C) to enable transitive routing between the private VIF and multiple VPCs or to simplify the architecture. Together, these three components allow a single Direct Connect connection to serve both private VPC resources and public AWS services.

Exam trap

The trap here is that candidates often think a Transit Gateway is required for multi-VPC or hybrid access, but for a single Direct Connect connection to access both VPCs and public services, the essential components are the private VIF, public VIF, and Direct Connect Gateway, not the Transit Gateway.

Full explanation →

1133

MCQhard

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to establish a site-to-site VPN connection to an on-premises network with a CIDR of 192.168.0.0/16. The VPN tunnel is up, but traffic from the VPC to on-premises is not flowing. Which of the following is the most likely cause?

A.The security groups do not allow outbound traffic.

B.The NACLs are blocking outbound traffic.

C.The VPC route table does not have a route for 192.168.0.0/16 pointing to the virtual private gateway.

D.The VPN connection is in the wrong AWS region.

AnswerC

Missing route prevents traffic from leaving VPC.

Why this answer

For traffic from a VPC to an on-premises network over a site-to-site VPN, the VPC route table must contain a route for the on-premises CIDR (192.168.0.0/16) pointing to the virtual private gateway (VGW). Without this route, the VPC has no path to forward packets destined for 192.168.0.0/16, even though the VPN tunnel is up. Security groups and NACLs are stateful or stateless filters, but they do not create routing paths.

Exam trap

The trap here is that candidates often confuse routing with security filtering (security groups or NACLs) and assume the tunnel being up guarantees traffic flow, but AWS requires explicit route table entries to direct traffic to the virtual private gateway.

How to eliminate wrong answers

Option A is wrong because security groups are stateful and automatically allow outbound traffic for established connections; they do not block outbound traffic unless explicitly denied, and the default security group allows all outbound traffic. Option B is wrong because NACLs are stateless and can block traffic, but the question states the VPN tunnel is up and the issue is routing, not filtering; NACLs would affect both directions if misconfigured, but the primary missing element is a route. Option D is wrong because a VPN connection is regional and must be in the same region as the VPC; if it were in the wrong region, the VPN tunnel would not establish at all, but the tunnel is up, so region mismatch is not the cause.

Full explanation →

1134

MCQhard

A financial company has a multi-account AWS environment using AWS Organizations. They have deployed a centralized inspection VPC with a third-party firewall appliance. All VPCs are attached to a Transit Gateway. The security team wants to ensure that all traffic between VPCs is inspected by the firewall. The firewall is deployed in an Auto Scaling group behind a Network Load Balancer (NLB). What is the BEST way to route traffic to the firewall?

A.Use a Gateway Load Balancer (GWLB) endpoint in each VPC to route traffic to the firewall.

B.Use VPC peering between each VPC and the inspection VPC.

C.Deploy a firewall appliance in each VPC and route traffic locally.

D.Create a Transit Gateway attachment in the inspection VPC and point the NLB as the target. Route traffic through the Transit Gateway route tables to the inspection VPC.

AnswerD

ECMP distributes traffic across firewall instances.

Why this answer

The best approach. By creating a Transit Gateway attachment in the inspection VPC and configuring the Network Load Balancer (NLB) as the target, all inter-VPC traffic can be routed through the firewall via Transit Gateway route tables. This ensures centralized inspection without introducing complexity.

Option A is incorrect because a Gateway Load Balancer (GWLB) is not needed here; the NLB already provides load balancing for the firewall instances. Option B is incorrect because VPC peering bypasses the Transit Gateway, defeating centralized inspection. Option C is incorrect because deploying a firewall in each VPC is not centralized and increases management overhead.

Full explanation →

1135

Multi-Selectmedium

Which TWO of the following are valid methods to connect multiple VPCs in the same AWS Region? (Choose TWO.)

Select 2 answers

A.Internet gateway

B.AWS Site-to-Site VPN

C.VPC peering

D.AWS Transit Gateway

E.AWS Direct Connect

AnswersC, D

Direct connection between two VPCs.

Why this answer

VPC peering is a valid method to connect multiple VPCs in the same AWS Region. It uses the AWS global network to privately route traffic between VPCs using IPv4 or IPv6 addresses, with no single point of failure or bandwidth bottleneck. Each VPC peering connection is a one-to-one relationship, so to connect multiple VPCs, you must create a mesh of peering connections.

Exam trap

The ANS-C01 exam often tests the misconception that an internet gateway or Site-to-Site VPN can be used for VPC-to-VPC connectivity, but these services are specifically for internet or on-premises access, not for inter-VPC routing within the same Region.

Full explanation →

1136

Multi-Selecthard

A company has a VPC with multiple subnets and is using Network Access Analyzer to identify unintended network access. It reports that an EC2 instance in a private subnet has a route to an internet gateway. Which two actions should be taken to remediate this?

Select 2 answers

A.Ensure the EC2 instance does not have a public IP address

B.Remove the route to the internet gateway from the subnet's route table

C.Assign a public IP address to the instance

D.Update the security group to deny outbound traffic to 0.0.0.0/0

E.Attach a NAT gateway to the private subnet

AnswersA, B

Without a public IP, internet traffic is not possible even with route.

Why this answer

The Network Access Analyzer report indicates that the EC2 instance in a private subnet has an unintended route to an internet gateway. To remediate this, two actions are needed: (1) Remove the route to the internet gateway from the subnet's route table, which eliminates the direct path to the internet. (2) Ensure the EC2 instance does not have a public IP address, because even without a route, a public IP could allow direct internet access via the internet gateway. Option A directly addresses the public IP, and option B fixes the route table.

Options C (assigning a public IP) would worsen the issue. Option D (updating security group to deny outbound 0.0.0.0/0) does not affect routing and would not remove the internet gateway route. Option E (attaching a NAT gateway) would add another internet route, not remove the existing one.

Full explanation →

1137

MCQmedium

A company has deployed a web application behind an Application Load Balancer (ALB) in a VPC. The security team wants to block a list of known malicious IP addresses from accessing the application. Which service should they use to implement this protection?

A.Network ACLs on the ALB subnet with deny rules

B.AWS WAF with an IP set rule that blocks the malicious IPs

C.AWS Shield Advanced with automatic IP blocking

D.Security Groups for the ALB with deny rules

AnswerB

WAF integrates with ALB and can block IPs.

Why this answer

AWS WAF is a web application firewall that can inspect HTTP/S traffic and block requests based on conditions such as IP addresses. By creating an IP set containing the malicious IPs and associating it with a web ACL on the ALB, the security team can block those IPs at the application layer. This is more granular and efficient than network-level controls.

Option A (Network ACLs) are stateless and operate at the subnet level, not designed for application-layer filtering, and would require managing deny rules that conflict with the default allow. Option C (AWS Shield Advanced) provides DDoS protection and cost protection, but does not offer granular IP blocking based on a custom list. Option D (Security Groups) are stateful firewalls that only support allow rules; they cannot deny specific IP addresses.

Full explanation →

1138

MCQhard

A company is designing a network for a critical application that requires low latency between EC2 instances. The instances are in the same AWS Region but different Availability Zones. Which configuration will provide the lowest latency?

A.Use an Application Load Balancer to distribute traffic

B.Launch instances in the same placement group within a single Availability Zone

C.Use Direct Connect to connect the VPCs

D.Use VPC peering to connect the VPCs

AnswerB

Placement groups provide low latency by placing instances close together.

Why this answer

Placing EC2 instances within the same placement group in a single Availability Zone ensures they are in close physical proximity, often on the same rack or within the same cluster, which minimizes network hops and achieves the lowest possible latency (typically under 1 ms). This configuration is specifically designed for low-latency, high-throughput workloads like HPC or real-time data processing.

Exam trap

The trap here is that candidates often assume inter-AZ latency is negligible or that services like ALB or VPC peering are designed for low-latency scenarios, but the question specifically asks for the lowest latency, which requires physical co-location within a single AZ using a placement group.

How to eliminate wrong answers

Option A is wrong because an Application Load Balancer operates at Layer 7 and introduces additional network hops and processing overhead, which increases latency compared to direct instance-to-instance communication. Option C is wrong because Direct Connect is a dedicated network connection between on-premises and AWS, not between VPCs or instances within the same Region, and it does not reduce inter-AZ latency. Option D is wrong because VPC peering connects VPCs across different networks and does not optimize physical proximity; instances in different VPCs still communicate over the AWS backbone, which has higher latency than instances in the same placement group.

Full explanation →

1139

Multi-Selectmedium

A company is designing a network security architecture for a multi-account environment using AWS Organizations. The security team needs to enforce that all VPCs use a specific set of security group rules for inbound SSH access. Which TWO steps should the team take? (Choose two.)

Select 2 answers

A.Use AWS Config rules to detect non-compliant security groups and trigger automatic remediation.

B.Enable AWS CloudTrail to log all security group changes and send alerts.

C.Enable Amazon GuardDuty to monitor for malicious traffic.

D.Use a service control policy (SCP) to deny the ec2:AuthorizeSecurityGroupIngress action if the rule does not comply with the standard.

E.Create an IAM role in each account that only allows creation of compliant security groups.

AnswersA, D

Config can detect and remediate.

Why this answer

SCPs can deny the ec2:AuthorizeSecurityGroupIngress action if the rule does not comply with the standard, enforcing compliance at the organization level (Option D). AWS Config rules can detect non-compliant security groups and trigger automatic remediation via AWS Systems Manager Automation (Option A). Option B is incorrect because CloudTrail logs but does not enforce.

Option C is incorrect because GuardDuty monitors for threats, not compliance. Option E is incorrect because IAM roles per account are not centralized and do not enforce across accounts.

Full explanation →

1140

MCQeasy

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC are allowed. Which policy should they use?

A.Create an IAM policy that restricts access to the VPC and attach it to all users.

B.Attach a security group to the S3 bucket that allows traffic from the VPC.

C.Add a bucket policy with a condition that requires aws:SourceVpc to be the VPC ID.

D.Create a VPC Endpoint policy that allows access only from the VPC.

AnswerC

This condition ensures requests originate from the specified VPC.

Why this answer

S3 bucket policies can use the aws:SourceVpc condition key to restrict access to requests originating from a specific VPC. Option A is wrong because IAM policies are attached to users, roles, or groups, not to the bucket itself, and they cannot restrict based on VPC directly. Option B is wrong because security groups cannot be attached to S3 buckets; they are used for EC2 instances and other resources.

Option D is wrong because a VPC Endpoint policy controls what actions are allowed through the endpoint, but it does not restrict access based on the source VPC; the bucket policy is required for that.

Full explanation →

1141

MCQeasy

A company has deployed a web application in a VPC with public subnets for the web servers and private subnets for the database servers. The web servers need to access the internet for software updates. The network engineer configured a NAT Gateway in the public subnet and added a route in the private subnet route table pointing 0.0.0.0/0 to the NAT Gateway. However, the web servers cannot reach the internet. What is the most likely cause?

A.The private subnet route table does not have a route to the NAT Gateway for 0.0.0.0/0.

B.The security group of the web servers is blocking outbound traffic to the internet.

C.The web servers are in a public subnet, but the route table for the public subnet points 0.0.0.0/0 to the NAT Gateway instead of the Internet Gateway.

D.The NAT Gateway does not have a route to the Internet Gateway in its route table.

AnswerC

Public subnets should route internet traffic to an Internet Gateway, not a NAT Gateway. The NAT Gateway is for private subnets.

Why this answer

The web servers are deployed in a public subnet, which requires a route table entry pointing 0.0.0.0/0 to an Internet Gateway (IGW) for direct internet access. Instead, the engineer configured the route to point to a NAT Gateway, which is intended for private subnets. A public subnet must have a direct IGW route; using a NAT Gateway in a public subnet breaks outbound connectivity because the NAT Gateway itself relies on the IGW for internet access, but the web servers' traffic is sent to the NAT Gateway instead of the IGW, causing a routing loop or failure.

Exam trap

The trap here is that candidates often confuse the purpose of a NAT Gateway (for private subnets) with an Internet Gateway (for public subnets), and assume that placing a NAT Gateway in a public subnet automatically provides internet access to instances in that subnet, when in fact the route table must point to the IGW for public subnets.

How to eliminate wrong answers

Option A is wrong because the private subnet route table does have a route to the NAT Gateway for 0.0.0.0/0 as stated in the scenario, so this is not the issue. Option B is wrong because security groups are stateful and by default allow all outbound traffic; unless explicitly modified to block outbound traffic, they would not prevent internet access. Option D is wrong because a NAT Gateway does not have its own route table; it is an AWS-managed service that uses an Elastic IP and relies on the route table of the subnet it resides in to route traffic to the Internet Gateway, but the problem is with the web servers' subnet route table, not the NAT Gateway's.

Full explanation →

1142

MCQmedium

A company has a Direct Connect connection with a public VIF to access AWS public services. They notice that traffic to Amazon S3 is taking a suboptimal path via the internet instead of the Direct Connect. What is the MOST likely cause?

A.The BGP session for the public VIF is not advertising the S3 prefixes

B.The public VIF is in a 'DOWN' state

C.The on-premises router does not have a route for the S3 CIDR ranges pointing to the Direct Connect

D.The virtual private gateway is not attached to the VPC

AnswerC

Need to route S3 traffic over Direct Connect.

Why this answer

The most likely cause is that the on-premises router does not have a route for the S3 CIDR ranges pointing to the Direct Connect interface. Even though the public VIF is established and BGP is advertising the appropriate prefixes, the on-premises router must have a specific route directing S3 traffic to the Direct Connect. Without this route, traffic will take the default path via the internet.

Option A is incorrect because BGP for public VIFs does advertise prefixes, including S3. Option B is incorrect because a 'DOWN' state would prevent all traffic, not just suboptimal routing. Option D is incorrect because a virtual private gateway is not used with a public VIF.

Full explanation →

1143

MCQmedium

Refer to the exhibit. A network engineer runs the above command and sees this network ACL configuration. The subnet associated with this ACL contains an EC2 instance that is failing to receive inbound HTTP traffic (TCP 80) from the internet. What is the MOST likely cause?

A.The inbound deny rule is associated with the wrong subnet

B.The inbound deny rule for TCP (port range) blocks all TCP traffic

C.The outbound rule does not allow return traffic

D.The inbound allow rule is not wide enough

AnswerB

Rule number 100 denies TCP traffic (protocol 6) from 0.0.0.0/0, which includes HTTP (TCP 80). The rule is evaluated before the allow rule.

Why this answer

The inbound deny rule (Rule 100) for TCP (Protocol 6) from 0.0.0.0/0 denies all TCP traffic, including HTTP on port 80. Network ACLs evaluate rules in ascending order, so this deny rule is evaluated before any allow rules. Even though Rule 200 allows all traffic, the deny rule takes precedence because it comes first.

Therefore, inbound HTTP traffic from the internet is blocked. Option A is incorrect because the subnet association does not affect the rule order; the deny rule applies to the subnet. Option C is incorrect because the outbound rule allows all traffic, so return traffic is not the issue.

Option D is incorrect because the allow rule is wide enough (all traffic), but it is evaluated after the deny rule.

Full explanation →

1144

Matchingmedium

Match each AWS networking feature to its use case for hybrid connectivity.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Central hub connecting multiple VPCs and on-premises networks

Connect multiple VPCs across regions to a single Direct Connect

Hub-and-spoke VPN topology between multiple on-premises sites

Managed OpenVPN-based service for remote users

Private access to S3 and DynamoDB without internet gateway

Why these pairings

Correct matches: Direct Connect = dedicated private connection; Site-to-Site VPN = encrypted internet tunnel; Transit Gateway = central hub. Common confusions include swapping the encryption and dedicated nature of Direct Connect and VPN.

Full explanation →

1145

MCQhard

A company has a VPC with multiple subnets. They want to ensure that all outbound traffic from EC2 instances in the VPC goes through a centralized NAT device for inspection. They have deployed a NAT instance in a public subnet and configured the route tables for private subnets to point to the NAT instance. However, traffic is not being routed through the NAT instance. What is the most likely cause?

A.The source/destination check is enabled on the NAT instance.

B.The NAT instance does not have a public IP address.

C.The route table for the private subnets does not have a default route (0.0.0.0/0) pointing to the NAT instance.

D.The security group of the NAT instance blocks outbound traffic.

AnswerA

By default, EC2 instances check that the source or destination of traffic matches their own IP. This must be disabled for NAT instances.

Why this answer

The source/destination check is a security feature on EC2 instances that prevents them from forwarding traffic unless the instance is the source or destination of the packet. Since a NAT instance must forward traffic that it did not originate (e.g., from private instances to the internet), this check must be disabled. When enabled, the NAT instance drops packets that are not addressed to itself, breaking the routing of outbound traffic through it.

Exam trap

The trap here is that candidates often assume the issue is a missing route or security group rule, overlooking the fact that EC2 instances by default cannot act as routers unless the source/destination check is explicitly disabled.

How to eliminate wrong answers

Option B is wrong because a NAT instance in a public subnet can route traffic using an Elastic IP or a public IP assigned to its network interface, but the lack of a public IP would only affect return traffic from the internet, not the outbound path from private instances to the NAT instance. Option C is wrong because the question states that the route tables for private subnets are configured to point to the NAT instance, implying a default route (0.0.0.0/0) is present; if it were missing, traffic would not even attempt to reach the NAT instance. Option D is wrong because security groups are stateful and allow outbound traffic by default; unless explicitly blocked, outbound traffic from the NAT instance is permitted, and the issue is about forwarding traffic, not initiating it.

Full explanation →

1146

Multi-Selectmedium

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. They need to add IPv6 support for their internet-facing Application Load Balancer. The VPC is already associated with an IPv6 CIDR block. What additional configuration is required? (Choose two.)

Select 2 answers

A.Configure NAT64 and DNS64 on the VPC.

B.Add a route in the subnet's route table for ::/0 to the Internet Gateway.

C.Associate an IPv6 CIDR block with the public subnet where the ALB is deployed.

D.Assign an IPv6 address to the ALB's network interface.

E.Create an Egress-Only Internet Gateway for the VPC.

AnswersB, C

Correct. The route ::/0 to the internet gateway is required to allow IPv6 traffic to and from the internet for the subnet where the ALB resides.

Why this answer

Options B and C are correct. To support IPv6 clients on an internet-facing ALB, the subnet where the ALB is deployed must have an IPv6 CIDR block associated (C), and the subnet's route table must include a route for ::/0 to the internet gateway (B). Option A is incorrect because NAT64/DNS64 is not needed; the ALB natively supports IPv6.

Option D is incorrect because the ALB uses the subnet's IPv6 CIDR, not an assigned IPv6 address on its network interface. Option E is incorrect because an Egress-Only Internet Gateway is used for outbound-only IPv6 traffic from private subnets, not for internet-facing ALBs.

Exam trap

A common trap is thinking that you need to assign an IPv6 address directly to the ALB's network interface, but the ALB inherits IPv6 support from the subnet's IPv6 CIDR.

Full explanation →

1147

Multi-Selectmedium

A company has a security requirement to log and monitor all DNS queries made by EC2 instances in a VPC. Which TWO AWS solutions can meet this requirement?

Select 2 answers

A.Enable Amazon Route 53 Resolver Query Logging.

B.Use AWS CloudTrail to log DNS queries.

C.Enable Amazon Route 53 Resolver DNS Firewall with logging.

D.Use Amazon CloudWatch Logs with a custom agent to capture DNS logs.

E.Enable VPC Flow Logs.

AnswersA, C

This service logs all DNS queries made by resources in the VPC.

Why this answer

Amazon Route 53 Resolver Query Logging (Option A) logs all DNS queries that are forwarded by the Route 53 Resolver within a VPC. Amazon Route 53 Resolver DNS Firewall (Option C) provides DNS filtering and can log DNS queries that match the firewall rules. Both are valid AWS solutions for logging DNS queries from EC2 instances.

Option B (AWS CloudTrail) logs API calls, not DNS queries. Option D (Amazon CloudWatch Logs with a custom agent) is not a native AWS service for DNS logging; it requires custom configuration and is not a managed solution. Option E (VPC Flow Logs) captures IP traffic metadata, not DNS queries.

Full explanation →

1148

MCQmedium

Refer to the exhibit. A network engineer is analyzing VPC Flow Logs to troubleshoot connectivity issues. The engineer notices that traffic from 10.0.1.5 to 192.168.1.1 on port 80 is logged as ACCEPT, but the application team reports that the web request failed. What is the most likely cause?

A.The VPC Flow Logs are not capturing all packets due to sampling.

B.The network ACL is returning an ICMP unreachable message that is not logged.

C.The destination host 192.168.1.1 is not reachable or does not have a route back to the source.

D.The security group on the ENI is blocking outbound traffic to 192.168.1.1.

AnswerC

The outbound packet was accepted, but the lack of a return path or the destination being down would cause the application to fail.

Why this answer

The VPC Flow Logs record the state of the TCP handshake from the perspective of the network path, but they do not confirm that the destination host successfully processed the request or that a return path exists. If 192.168.1.1 has no route back to 10.0.1.5, the initial SYN-ACK will never reach the source, causing the application to time out even though the forward traffic was accepted by the network ACL and security group.

Exam trap

AWS often tests the misconception that an ACCEPT log entry guarantees end-to-end connectivity, when in fact it only confirms that the packet passed the hypervisor-level firewall rules, not that the destination host processed it or that a return path exists.

How to eliminate wrong answers

Option A is wrong because VPC Flow Logs capture all packets by default; sampling is only enabled when explicitly configured, and the question does not mention sampling. Option B is wrong because network ACLs do not generate ICMP unreachable messages; they silently drop traffic, and any ICMP unreachable would be generated by the destination host or a router, not the ACL. Option D is wrong because if the security group on the ENI were blocking outbound traffic to 192.168.1.1, the flow log entry would show REJECT or no log entry at all, not ACCEPT.

Full explanation →

1149

MCQeasy

A network engineer needs to capture and analyze DNS query logs generated by Amazon Route 53. Which AWS service should be used to store and query these logs?

A.AWS CloudTrail

B.Amazon Kinesis Data Firehose

C.Amazon CloudWatch Logs

D.Amazon S3

AnswerC

Route 53 can publish DNS query logs to CloudWatch Logs for analysis.

Why this answer

Amazon Route 53 can be configured to log DNS queries to Amazon CloudWatch Logs. CloudWatch Logs provides a centralized location to store and query these logs using CloudWatch Logs Insights. Option A (AWS CloudTrail) records API calls, not DNS queries.

Option B (Amazon Kinesis Data Firehose) is a streaming data delivery service that can deliver logs to destinations like S3, but it does not directly store logs for querying. Option D (Amazon S3) is an object storage service and requires additional services (e.g., Athena) to query logs. Therefore, Amazon CloudWatch Logs is the correct service for storing and querying Route 53 DNS query logs directly.

Full explanation →

1150

MCQhard

A global company is designing a multi-region architecture with VPCs in us-east-1, eu-west-1, and ap-southeast-1. They are using AWS Transit Gateway with inter-region peering between all three regions. The company also has on-premises data centers in the US and Europe connected via Direct Connect to the Transit Gateways in us-east-1 and eu-west-1 respectively. The on-premises networks use BGP to advertise their CIDRs (10.0.0.0/8 for US, 172.16.0.0/12 for Europe). The Transit Gateway route tables are configured to propagate routes from all attachments. The company needs all VPCs and on-premises networks to be able to communicate with each other. After configuration, the VPC in ap-southeast-1 can communicate with the VPCs in us-east-1 and eu-west-1, but cannot communicate with either on-premises network. The VPCs in us-east-1 and eu-west-1 can communicate with all on-premises networks. What is the MOST likely cause of this issue?

A.The VPC in ap-southeast-1 has a security group that blocks traffic from on-premises IP ranges

B.The inter-region peering attachments in ap-southeast-1 do not have route propagation enabled

C.The on-premises networks are not advertising their CIDRs to the ap-southeast-1 region

D.The Direct Connect gateways are not attached to the Transit Gateways in us-east-1 and eu-west-1

AnswerB

Without propagation, the ap-southeast-1 Transit Gateway does not learn the on-premises CIDRs from the other regions.

Why this answer

The on-premises CIDRs are advertised via Direct Connect into the Transit Gateways in us-east-1 and eu-west-1. Those Transit Gateways propagate the routes to the inter-region peering attachments. However, the Transit Gateway in ap-southeast-1 needs to have routes for the on-premises CIDRs pointing to the inter-region peering attachments.

This is typically done by enabling route propagation from the inter-region peering attachment. If the route propagation is not enabled, the routes will not be added automatically. The engineer likely assumed propagation works automatically, but it must be explicitly enabled for each attachment.

Since the VPCs in us-east-1 and eu-west-1 can reach on-premises, the local Direct Connect routes are fine. The issue is that the ap-southeast-1 Transit Gateway route table does not have routes for the on-premises CIDRs via the peering attachments.

Full explanation →

1151

MCQmedium

A network administrator is troubleshooting connectivity to a web server in subnet with network ACL 'acl-12345678'. The web server is on port 443. The administrator finds that traffic from IP 10.0.1.5 is being denied. Why is the traffic being denied?

A.The subnet is not associated with this network ACL.

B.The security group attached to the web server is blocking the traffic.

C.The network ACL rule 100 denies traffic from 10.0.0.0/8, which includes the IP 10.0.1.5.

D.The network ACL rule 100 allows traffic from 0.0.0.0/0, but rule 200 denies traffic from 10.0.0.0/8, and rule 200 is evaluated first.

AnswerC

Rule 100 matches and denies.

Why this answer

Network ACLs are stateless and evaluated in ascending order by rule number. Rule 100 denies traffic from 10.0.0.0/8, which includes the source IP 10.0.1.5, so any traffic from that IP is denied regardless of later allow rules. Since network ACLs do not track connection state, the deny is applied immediately upon matching rule 100.

Exam trap

The trap here is that candidates often confuse the evaluation order of network ACL rules (ascending by rule number) with the order of security group rules (all evaluated until a match), or mistakenly think that a higher-numbered allow rule overrides a lower-numbered deny rule.

How to eliminate wrong answers

Option A is wrong because if the subnet were not associated with the network ACL, the default network ACL (which allows all traffic) would apply, and traffic would not be denied. Option B is wrong because security groups are stateful and operate at the instance level, not the subnet level; the question specifies the network ACL is the cause, and security groups would not deny traffic from a specific IP unless explicitly configured, but the scenario points to the ACL. Option D is wrong because network ACL rules are evaluated in numerical order from lowest to highest; rule 100 is evaluated before rule 200, so if rule 100 denies the traffic, rule 200 is never reached.

Full explanation →

1152

MCQhard

A company is running a latency-sensitive application in a VPC with a public subnet and a private subnet. The application in the private subnet needs to access an Amazon S3 bucket in the same region. The company wants to minimize latency and avoid using a NAT gateway. Which solution meets these requirements?

A.Use S3 Transfer Acceleration and access the bucket via the public endpoint

B.Create a VPC Gateway Endpoint for Amazon S3 and update the route table for the private subnet

C.Attach an Internet Gateway to the VPC and route the private subnet traffic through a NAT instance

D.Set up a NAT gateway in the public subnet and route traffic to the S3 bucket through it

AnswerB

A Gateway Endpoint provides private connectivity to S3 without leaving the AWS network, minimizing latency and avoiding NAT gateway costs.

Why this answer

A VPC Gateway Endpoint for Amazon S3 allows instances in a private subnet to access S3 without traversing the internet or requiring a NAT gateway. This minimizes latency by routing traffic over the AWS internal network, and it avoids the cost and complexity of NAT devices. The route table for the private subnet must be updated with a route pointing to the gateway endpoint for the S3 prefix list.

Exam trap

The trap here is that candidates often assume S3 Transfer Acceleration is always faster, but it is designed for cross-region or long-distance transfers and actually adds latency for same-region traffic due to additional routing and edge location processing.

How to eliminate wrong answers

Option A is wrong because S3 Transfer Acceleration is designed for long-distance transfers over the public internet and does not reduce latency for same-region access; it actually adds overhead. Option C is wrong because routing private subnet traffic through a NAT instance still forces traffic over the internet, increasing latency and requiring a public IP, which contradicts the requirement to avoid a NAT gateway. Option D is wrong because a NAT gateway introduces additional hop latency and cost, and is unnecessary when a VPC Gateway Endpoint provides direct, private connectivity to S3 within the same region.

Full explanation →

1153

MCQmedium

A company has a VPC with a public subnet for a web server and a private subnet for a database. The web server needs to make API calls to Amazon S3. Which is the most secure way to provide this access without traffic leaving the AWS network?

A.Use an AWS Site-to-Site VPN to connect to a remote network that has access to S3.

B.Create a VPC gateway endpoint for Amazon S3 and attach it to the route table of the private subnet.

C.Set up a NAT gateway in the public subnet and route the web server's traffic through it.

D.Use an internet gateway and a public IP address on the web server.

AnswerB

Gateway endpoint provides private, secure access to S3.

Why this answer

A VPC gateway endpoint for Amazon S3 allows resources in a private subnet to access S3 privately using the AWS network, without traversing the internet or requiring a NAT gateway. This is the most secure option because traffic stays within the AWS backbone and does not require public IPs or external connectivity.

Exam trap

The trap here is that candidates often choose a NAT gateway (Option C) thinking it provides private outbound access, but they overlook that NAT gateway traffic still goes to the internet, whereas a gateway endpoint keeps traffic entirely within AWS.

How to eliminate wrong answers

Option A is wrong because an AWS Site-to-Site VPN connects to a remote network, which would route traffic outside the VPC and potentially over the internet or a VPN connection, not keeping it within the AWS network. Option C is wrong because a NAT gateway in a public subnet would route traffic through the internet to reach S3, which violates the requirement of not leaving the AWS network and introduces additional security risks. Option D is wrong because using an internet gateway and a public IP address exposes the web server to the internet, increasing the attack surface and again forcing traffic to leave the AWS network.

Full explanation →

1154

MCQhard

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16 and an IPv6 CIDR of 2001:db8:1234::/56. The company hosts a web application on IPv4-only EC2 instances in a private subnet. The application must be accessible from the internet via IPv6. The company has an internet-facing Application Load Balancer (ALB) with dual-stack IP address type. The ALB is in a public subnet. The target group is configured with IP address type IPv4. Users report that they can access the application via IPv4 but not via IPv6. The ALB security group allows inbound HTTP/HTTPS from ::/0. What is the MOST likely cause?

A.The public subnet does not have an associated IPv6 CIDR.

B.The target group is configured with IP address type IPv4, but the ALB must use IPv6 to communicate with the targets.

C.The ALB is configured as IPv4-only instead of dual-stack.

D.The private subnet's route table does not have an IPv6 route to the NAT gateway or egress-only internet gateway.

AnswerA

Correct. Without an IPv6 CIDR on the public subnet, the ALB cannot obtain an IPv6 address, so it cannot receive IPv6 traffic despite being configured as dual-stack.

Why this answer

The most likely cause is that the public subnet does not have an associated IPv6 CIDR. For an ALB to accept IPv6 traffic, it must have an IPv6 address assigned to its network interface. This requires the public subnet to have an IPv6 CIDR block attached.

Even though the ALB is configured as dual-stack, without an IPv6 CIDR on the subnet, the ALB cannot obtain an IPv6 address and therefore cannot receive IPv6 traffic. Option B is incorrect because an ALB can forward IPv6 client traffic to IPv4 targets using IPv4 communication; the target group IP address type does not need to be IPv6. Option C is false as the ALB is dual-stack.

Option D is irrelevant because the private subnet's route table does not affect ALB-to-target communication.

Exam trap

Candidates often assume that a dual-stack ALB automatically gets an IPv6 address, but it also requires the subnet to have an IPv6 CIDR.

Full explanation →

1155

MCQmedium

A company uses AWS Direct Connect to connect its on-premises network to AWS. The security team wants to encrypt all traffic traversing the Direct Connect link. Which solution should be used?

A.Enable encryption on the Direct Connect virtual interface

B.Use TLS on all applications that communicate across the link

C.Establish an IPsec VPN tunnel over the Direct Connect link

D.Use VPC endpoints for all AWS services accessed

AnswerC

Provides encryption for all traffic over the link.

Why this answer

An IPsec VPN tunnel over Direct Connect encrypts all traffic traversing the link, providing encryption while maintaining low latency. Option A is wrong because Direct Connect does not natively encrypt data; encryption must be added separately. Option B is wrong because TLS only protects application-layer traffic, not all traffic at the network level.

Option D is wrong because VPC endpoints only protect traffic to specific AWS services, not all traffic across the Direct Connect link.

Full explanation →

1156

MCQmedium

A company is setting up a Direct Connect connection to connect its on-premises data center to AWS. The connection is established, and a private virtual interface (VIF) is configured. The on-premises router can ping the VIF's Amazon side IP address, but cannot ping an EC2 instance in the VPC. The VPC has a virtual private gateway attached, and the route tables are correctly configured. What should the company check next?

A.Verify that the on-premises router is advertising the VPC CIDR to the Direct Connect router.

B.Check that the NACLs on the EC2 instance's subnet allow inbound ICMP.

C.Confirm that the private VIF is associated with the correct virtual private gateway.

D.Ensure that BGP is established and receiving routes.

AnswerA

The on-premises router must advertise the VPC CIDR for return traffic.

Why this answer

The on-premises router can ping the VIF's Amazon side IP, confirming that Layer 2 and Layer 3 connectivity over the Direct Connect link is working, and BGP is established. However, the inability to ping the EC2 instance indicates that return traffic from the VPC is not reaching the on-premises network. For return traffic to be routed correctly, the on-premises router must advertise the VPC CIDR (or a specific prefix) to the Direct Connect router via BGP; otherwise, the AWS side will not forward traffic destined for the on-premises network over the VIF.

Exam trap

The trap here is that candidates assume BGP being established (as evidenced by a successful ping to the VIF Amazon side IP) means all routing is correct, but they overlook the requirement for the on-premises router to advertise the VPC CIDR to enable return traffic.

How to eliminate wrong answers

Option B is wrong because the issue is not about inbound ICMP to the EC2 instance; the ping fails due to missing return path routing, not because of security group or NACL filtering. Option C is wrong because the private VIF is already associated with a virtual private gateway (VGW) and the VPC route tables are correctly configured, so the VIF association is not the problem. Option D is wrong because the on-premises router can ping the VIF's Amazon side IP, which proves that BGP is established and routes are being exchanged; the problem is specifically that the on-premises router is not advertising the VPC CIDR back to AWS.

Full explanation →

1157

MCQhard

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. After a network change, some VPCs cannot reach the on-premises network. The Transit Gateway route table shows the correct association and propagation. What is the most likely cause?

A.The Transit Gateway attachment is in a failed state

B.The VPN connection to the on-premises network has insufficient bandwidth

C.The BGP session between the Transit Gateway and on-premises router is down

D.The VPC route tables do not have a route pointing to the Transit Gateway

AnswerD

Without a route to the Transit Gateway, traffic from the VPC cannot reach on-premises networks.

Why this answer

The VPC route tables do not have a route pointing to the Transit Gateway. Even though the Transit Gateway route table has correct associations and propagations, traffic from VPCs to on-premises requires a route in the VPC route tables pointing to the Transit Gateway attachment. Without such a route, VPCs cannot send traffic to the Transit Gateway, causing connectivity loss.

Option A is incorrect because the attachment state is fine if the route table shows correct association. Option B is incorrect because insufficient bandwidth would cause performance issues, not complete loss of connectivity. Option C is incorrect because a down BGP session would affect route propagation, but the Transit Gateway route table already shows correct propagation, implying BGP is functioning.

Full explanation →

1158

MCQeasy

A company wants to improve the performance and availability of its application that is deployed on EC2 instances in a single Availability Zone. Which architecture should the company implement?

A.Add more subnets in the same Availability Zone

B.Deploy EC2 instances in multiple Availability Zones

C.Use larger EC2 instances

D.Use Auto Scaling in the same Availability Zone

AnswerB

Multi-AZ deployment provides high availability.

Why this answer

Deploying EC2 instances across multiple Availability Zones (AZs) improves both performance and availability by eliminating a single point of failure. If one AZ experiences an outage, traffic can be routed to healthy instances in another AZ using an Elastic Load Balancer or Route 53 DNS failover. This architecture also distributes the load, reducing latency for users in different geographic regions.

Exam trap

The ANS-C01 exam often tests the misconception that adding more subnets or using Auto Scaling within a single AZ improves availability, when in reality only distributing resources across multiple AZs provides true fault tolerance.

How to eliminate wrong answers

Option A is wrong because adding more subnets within the same AZ does not provide fault isolation; all subnets in a single AZ share the same underlying infrastructure and are subject to the same failure domain. Option C is wrong because using larger EC2 instances only increases compute capacity, not availability; a single AZ failure still takes all instances offline regardless of size. Option D is wrong because Auto Scaling in the same AZ only replaces failed instances within that same AZ, which does not protect against an AZ-wide outage.

Full explanation →

1159

MCQmedium

A company hosts a multi-tier web application in a VPC. The web servers are in a public subnet, and the application servers are in a private subnet. The application servers need to access a third-party API over the internet. The company wants to ensure that the application servers' IP addresses are not exposed to the internet, and that all outbound traffic to the internet is logged. Additionally, the company wants to restrict outbound traffic to only the specific API endpoints. Which solution should be used?

A.Use a VPC endpoint for the third-party API service.

B.Attach an internet gateway directly to the private subnet and configure the route table to send default traffic to the internet gateway. Use security groups to restrict outbound traffic to the API endpoints. Enable VPC Flow Logs for logging.

C.Deploy a proxy server in the public subnet and configure the application servers to use the proxy. Restrict outbound traffic from the proxy using security groups. Log proxy access logs.

D.Deploy a NAT gateway in the public subnet and add a route in the private subnet's route table pointing to the NAT gateway. Use security groups on the application servers to restrict outbound traffic to the API endpoints. Enable logs on the NAT gateway using VPC Flow Logs or NAT gateway logs.

AnswerD

The NAT gateway provides outbound internet access with private IPs, and security groups control traffic. Logging can be enabled via VPC Flow Logs.

Why this answer

A NAT gateway in a public subnet allows instances in private subnets to access the internet while hiding their private IPs. By controlling the outbound rules in the security group or using a network firewall, you can restrict traffic to specific API endpoints. AWS CloudWatch Logs or VPC Flow Logs can capture the NAT gateway logs.

Option A is incorrect because a VPC endpoint is used for accessing AWS services privately and cannot be used for internet API access. Option B is incorrect because attaching an internet gateway directly to the private subnet would expose the instances' private IPs to the internet. Option C is incorrect because while a proxy server could work, it adds unnecessary complexity and management overhead compared to a NAT gateway.

Full explanation →

1160

MCQhard

A company has a hybrid network with multiple AWS Direct Connect connections to multiple VPCs. They want to monitor network performance and receive alerts when latency exceeds a threshold. Which combination of AWS services should be used to achieve this?

A.AWS CloudTrail and Amazon SNS

B.AWS Trusted Advisor and Amazon SES

C.Amazon CloudWatch and Amazon CloudWatch Alarms

D.VPC Flow Logs and Amazon CloudWatch Logs

AnswerC

Amazon CloudWatch collects Direct Connect metrics including latency. CloudWatch Alarms can trigger alerts via SNS when latency thresholds are exceeded.

Why this answer

Amazon CloudWatch collects metrics from Direct Connect, including latency, and CloudWatch Alarms can trigger notifications via SNS when thresholds are exceeded. Option A is incorrect because CloudTrail logs API calls, not performance metrics. Option B is incorrect because Trusted Advisor provides best practice checks, not real-time latency monitoring, and SES is for email sending, not alerting.

Option D is incorrect because VPC Flow Logs capture IP traffic metadata, not latency metrics, and CloudWatch Logs store log data, not metrics.

Full explanation →

1161

Multi-Selecteasy

A company needs to audit network traffic in a VPC for compliance. Which THREE AWS services can be used to capture and analyze network traffic?

Select 3 answers

A.AWS Config

B.Traffic Mirroring

C.VPC Flow Logs

D.AWS Network Firewall

E.AWS CloudTrail

AnswersB, C, D

Traffic Mirroring captures and inspects traffic.

Why this answer

Traffic Mirroring captures and inspects traffic. Option C is correct because VPC Flow Logs capture IP traffic information. Option D is correct because AWS Network Firewall can log traffic.

Option A is wrong because AWS Config monitors resource configurations, not traffic. Option E is wrong because CloudTrail logs API calls, not network traffic.

Full explanation →

1162

MCQeasy

A company is using AWS Transit Gateway to interconnect multiple VPCs and on-premises networks. The network team notices that traffic between two VPCs is taking an unexpected path. Which AWS service should be used to analyze the packet-level traffic flow and identify the path?

A.AWS CloudTrail

B.AWS X-Ray

C.AWS Config

D.VPC Flow Logs

AnswerD

VPC Flow Logs capture IP traffic metadata and can be used to trace paths.

Why this answer

VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet/byte counts) at the network interface level, enabling analysis of packet-level traffic flow paths through AWS Transit Gateway. By enabling flow logs on the Transit Gateway attachment or VPC subnets, you can trace the actual path traffic takes between VPCs, including whether it traverses the Transit Gateway or an unexpected route.

Exam trap

AWS often tests the misconception that CloudTrail or Config can analyze network traffic paths, but only VPC Flow Logs provide the packet-level metadata needed to trace the actual data plane flow through Transit Gateway.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail records API calls and management events, not packet-level traffic flows; it cannot show the data plane path of network traffic. Option B is wrong because AWS X-Ray traces application-layer requests (e.g., HTTP/SQL) and is designed for distributed application debugging, not for analyzing network-layer packet flows or routing paths. Option C is wrong because AWS Config evaluates resource configurations and compliance rules (e.g., route table settings) but does not capture or analyze live packet-level traffic flows.

Full explanation →

1163

Multi-Selecthard

A company is designing a network architecture for a highly sensitive application that must meet strict compliance requirements. The application is deployed in a VPC with multiple subnets. The company needs to ensure that all traffic between subnets is encrypted and that no traffic can bypass the encryption. Which TWO steps should be taken?

Select 2 answers

A.Use network ACLs to block all traffic except encrypted protocols (e.g., IPSec).

B.Set up VPN connections between each subnet's route tables.

C.Deploy a VPC CNI plugin that supports encryption for pods.

D.Use security groups to allow only encrypted traffic.

E.Enable VPC Flow Logs to detect unencrypted traffic.

AnswersA, C

NACLs can block unencrypted traffic by blocking non-IPSec ports.

Why this answer

Network ACLs can be configured to block all traffic except encrypted protocols like IPSec, thereby enforcing encryption at the subnet level. Option C is correct: A VPC CNI plugin that supports encryption can enforce encryption for pods in Kubernetes clusters, which is relevant for containerized workloads in the VPC. Option B is incorrect: VPN connections are established between VPCs or between a VPC and on-premises networks, not between subnets within the same VPC.

It is not possible to set up VPN connections between subnet route tables. Option D is wrong: Security groups only filter traffic based on IP addresses and ports; they cannot inspect or enforce encryption of the traffic content. Option E is wrong: VPC Flow Logs only log metadata about traffic and cannot enforce or detect whether the traffic payload is encrypted.

Therefore, the correct steps are A and C.

Exam trap

A common trap is to assume that VPN connections can be established between subnets within a VPC to encrypt traffic. However, intra-VPC traffic is already within the same network and cannot be routed through a VPN connection. VPNs are for connecting separate networks.

Full explanation →

1164

MCQmedium

A company has set up a transit gateway with attachments to VPC-A and VPC-B. The transit gateway route table shows routes to both VPCs and a blackhole for 0.0.0.0/0. VPC-A's public subnet route table sends 10.1.0.0/16 traffic to the transit gateway. However, an EC2 instance in VPC-A's public subnet cannot reach an instance in VPC-B. What is the most likely cause?

A.VPC-B's route table does not have a route to VPC-A's CIDR via the transit gateway.

B.VPC-A's route table does not have a route to the transit gateway.

C.The transit gateway route table does not have a route for 10.0.0.0/16.

D.The blackhole route in the transit gateway is blocking traffic between VPCs.

AnswerA

For bidirectional communication, VPC-B must also have a route back to VPC-A via the transit gateway.

Why this answer

For traffic to flow from VPC-A to VPC-B via a transit gateway, both VPCs must have routes in their route tables pointing to the transit gateway for the other VPC's CIDR. Since VPC-A's route table sends 10.1.0.0/16 (VPC-B's CIDR) to the transit gateway, but VPC-B's route table lacks a return route to VPC-A's CIDR via the transit gateway, the return traffic from VPC-B is dropped, causing connectivity failure.

Exam trap

AWS often tests the misconception that a transit gateway route table alone ensures bidirectional connectivity, when in fact each VPC's subnet route tables must have explicit routes for the other VPC's CIDR to enable return traffic.

How to eliminate wrong answers

Option B is wrong because VPC-A's route table already has a route to the transit gateway (it sends 10.1.0.0/16 traffic to the transit gateway), so this is not the issue. Option C is wrong because the transit gateway route table shows routes to both VPCs, and the problem is about VPC-B's missing return route, not a missing route in the transit gateway for 10.0.0.0/16. Option D is wrong because the blackhole route for 0.0.0.0/0 in the transit gateway only drops traffic destined for the internet, not traffic between VPCs, which is handled by the specific VPC routes.

Full explanation →

1165

MCQhard

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download patches from an S3 bucket in the same AWS region. The company wants to ensure that traffic does not traverse the internet. Which solution is MOST cost-effective?

A.Attach an Internet Gateway to the VPC and route the private subnet traffic directly to S3.

B.Create a Gateway VPC Endpoint for S3 and add a route in the private subnet's route table to the endpoint.

C.Create an Interface VPC Endpoint for S3 in the private subnet.

D.Deploy a NAT Gateway in a public subnet and route the private subnet traffic through it to access S3.

AnswerB

Gateway VPC Endpoints are free and allow private access to S3 without internet.

Why this answer

The most cost-effective solution because a Gateway VPC Endpoint for S3 provides private connectivity to S3 without any hourly charges, and it does not require a NAT Gateway or Internet Gateway. Option A is incorrect because an Internet Gateway would route traffic through the internet, which violates the requirement and is not cost-effective. Option C is incorrect because an Interface VPC Endpoint for S3 incurs hourly charges, making it more expensive than a Gateway Endpoint.

Option D is incorrect because a NAT Gateway also incurs hourly and data processing charges, and it routes traffic through the internet, which is not desired.

Full explanation →

1166

MCQmedium

A company has a VPC with multiple subnets. They want to block all traffic from the internet to their private subnets, but allow outbound internet traffic from those subnets through a NAT Gateway. Which configuration should they use?

A.Route table with 0.0.0.0/0 -> NAT Gateway

B.Route table with 0.0.0.0/0 -> Virtual Private Gateway

C.Route table with 0.0.0.0/0 -> VPC Peering Connection

D.Route table with 0.0.0.0/0 -> Internet Gateway

AnswerA

This allows outbound traffic only, as NAT Gateway does not allow inbound connections from the internet.

Why this answer

A route table associated with the private subnets should have a default route (0.0.0.0/0) pointing to the NAT Gateway. This allows outbound internet traffic while blocking inbound internet traffic. Option B (Virtual Private Gateway) is for VPN connections.

Option C (VPC Peering) is for connectivity between VPCs. Option D (Internet Gateway) would allow inbound internet traffic, which is not desired.

Full explanation →

1167

Multi-Selecthard

A company is designing a highly available hybrid network using two AWS Direct Connect connections from different providers. The company wants to use BGP to advertise the same on-premises prefixes to AWS. Which THREE practices should be followed to ensure high availability and optimal traffic flow? (Choose three.)

Select 3 answers

A.Advertise different on-premises prefixes on each connection

B.Advertise the same prefixes with different prefix lengths to influence route selection

C.Configure a unique private ASN for each Direct Connect connection

D.Set the same MED value for prefixes advertised on both connections

E.Use different BGP community tags for each connection to influence routing policies

AnswersB, C, E

AWS prefers more specific prefixes (longer prefix length).

Why this answer

Advertising the same prefixes with different prefix lengths allows AWS to prefer the more specific prefix, enabling path selection and load balancing while maintaining redundancy. Option C is correct because using a unique private ASN for each Direct Connect connection prevents BGP's AS_PATH loop detection from discarding routes when both connections advertise the same prefixes. Option E is correct because using different BGP community tags for each connection allows you to influence routing policies (e.g., via local preference) to control traffic flow.

Option A is incorrect because advertising different prefixes on each connection compromises redundancy; if one connection fails, its prefixes become unreachable. Option D is incorrect because setting the same MED value on both connections provides no differentiation for path selection, whereas using different MED values can influence which connection is preferred.

Full explanation →

1168

MCQmedium

A company is designing a VPC with subnets in multiple Availability Zones (AZs) for a web application. The application must be fault-tolerant and highly available. Which design should the network engineer implement?

A.Deploy all application instances in a single AZ behind an Application Load Balancer.

B.Place one instance in each of two AZs and use an internet gateway for load balancing.

C.Deploy application instances in two AZs behind an Application Load Balancer that spans both AZs.

D.Use a Network Load Balancer in a single AZ with instances in multiple AZs.

AnswerC

This provides fault tolerance and high availability across AZs.

Why this answer

Deploying application instances in two Availability Zones (AZs) behind an Application Load Balancer (ALB) that spans both AZs provides fault tolerance and high availability. If one AZ fails, the ALB automatically routes traffic to healthy instances in the remaining AZ, ensuring continuous service. This design leverages cross-zone load balancing, which is enabled by default for ALBs, to distribute traffic evenly across instances in multiple AZs.

Exam trap

The trap here is that candidates often assume a single load balancer in one AZ is sufficient if instances are in multiple AZs, but they overlook that the load balancer itself must be deployed across multiple AZs to avoid being a single point of failure.

How to eliminate wrong answers

Option A is wrong because deploying all application instances in a single AZ creates a single point of failure; if that AZ experiences an outage, the entire application becomes unavailable, violating fault-tolerance requirements. Option B is wrong because an internet gateway is a VPC component for internet connectivity, not a load balancer; it cannot perform health checks or distribute traffic across instances, so it provides no load balancing or high availability. Option D is wrong because a Network Load Balancer (NLB) in a single AZ cannot route traffic to instances in other AZs unless cross-zone load balancing is explicitly enabled, and even then, the NLB itself is a single point of failure if that AZ fails; the design does not meet high availability standards.

Full explanation →

1169

MCQhard

A company has a VPC with a VPN connection to an on-premises network. The network team reports that the VPN tunnel is flapping intermittently. You need to identify the cause. Which AWS service provides logs that can help troubleshoot the VPN tunnel status?

A.VPC Flow Logs

B.Amazon CloudWatch

C.AWS CloudTrail

D.AWS Health Dashboard

AnswerB

Amazon CloudWatch provides metrics for VPN tunnels, including tunnel state, data in/out, and other status indicators. These logs help identify the cause of tunnel flapping.

Why this answer

Amazon CloudWatch provides VPN tunnel metrics, including tunnel state, data in/out, and other status indicators that help identify the cause of flapping. Option A (VPC Flow Logs) captures IP traffic but not tunnel status. Option C (AWS CloudTrail) logs API calls, not tunnel status.

Option D (AWS Health Dashboard) shows service health events but not detailed tunnel status.

Full explanation →

1170

MCQmedium

An e-commerce company runs a web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. During a flash sale, the application experiences high latency. The network team notices that the ALB is receiving more traffic than expected. What is the most likely cause?

A.The ALB is configured to terminate HTTPS, which increases CPU load on the ALB.

B.The Auto Scaling group's scaling policies are too aggressive, causing frequent instance launches.

C.The ALB health checks are too frequent, consuming resources.

D.The ALB is not protected by AWS WAF, allowing a DDoS attack or excessive traffic to reach the backend.

AnswerD

Without WAF, the ALB can be targeted by attacks that consume its capacity.

Why this answer

The sudden spike in traffic reaching the ALB beyond expected levels, combined with high latency, strongly indicates that the ALB is being overwhelmed by malicious or excessive traffic. Without AWS WAF protection, the ALB cannot filter out DDoS attacks or unwanted requests at Layer 7, so all traffic passes through to the backend instances, causing resource exhaustion and latency. AWS WAF integrates directly with ALBs to inspect and block malicious traffic before it reaches the application.

Exam trap

The trap here is that candidates may assume high latency is always caused by backend scaling issues (Option B) or health check overhead (Option C), but the key clue is 'ALB is receiving more traffic than expected,' which points directly to an external traffic source, not internal configuration problems.

How to eliminate wrong answers

Option A is wrong because HTTPS termination at the ALB does increase CPU usage on the ALB node, but this is a normal, expected operation and would not cause the ALB to receive 'more traffic than expected' — it only processes the traffic it receives. Option B is wrong because aggressive Auto Scaling policies cause more frequent instance launches, which could temporarily increase load on the ALB during scale-up events, but this does not explain why the ALB itself is receiving more traffic than expected; scaling policies respond to traffic, they don't generate it. Option C is wrong because ALB health checks are lightweight HTTP/HTTPS requests sent to the target group instances, not to the ALB itself, and they consume negligible resources on the ALB; they do not increase the traffic volume reaching the ALB.

Full explanation →

1171

Matchingmedium

Match each AWS networking feature to its purpose for high availability or fault tolerance.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Static public IP that can be remapped to another instance

DNS-based routing to healthy endpoints

Distributes traffic evenly across all registered targets in all AZs

Improves availability and performance using Anycast IPs

Captures IP traffic information for troubleshooting

Why these pairings

Correct matches: Elastic Load Balancer distributes traffic, Route 53 provides DNS health checks, and Global Accelerator uses anycast routing. Common confusions: ELB does not handle DNS; Route 53 does not direct traffic over the global network; Global Accelerator does not log traffic.

Full explanation →

1172

Multi-Selectmedium

A security engineer is designing a network security solution for a multi-tier application. The web tier must be accessible from the internet on ports 80 and 443. The application tier must only accept traffic from the web tier. The database tier must only accept traffic from the application tier on port 3306. Which THREE network access control mechanisms should be used?

Select 3 answers

A.Security groups that allow traffic from specific security groups for the database tier.

B.AWS WAF to filter traffic to the database tier.

C.IAM policies to restrict access to the database.

D.Network ACLs to provide stateless filtering at the subnet level.

E.Security groups that reference other security groups as sources.

AnswersA, D, E

Database security groups should allow inbound traffic from the application security group.

Why this answer

Options A, D, and E are correct network access control mechanisms. Option A is correct because security groups can allow traffic based on source security group IDs, enabling tier-specific access. Option D is correct because network ACLs provide stateless filtering at the subnet level, adding a layer of defense.

Option E is correct because security groups can reference other security groups as sources, allowing the database tier to accept traffic only from the application tier security group. Option B is incorrect because AWS WAF is a web application firewall that filters HTTP/HTTPS traffic at the application layer, not suitable for database tier access control. Option C is incorrect because IAM policies manage user and resource permissions, not network-level traffic filtering.

Full explanation →

1173

Multi-Selecteasy

Which TWO AWS services can be used to centrally manage and enforce security policies across multiple accounts? (Choose two.)

Select 2 answers

A.AWS Config

B.Amazon VPC Flow Logs

C.AWS CloudTrail

D.AWS Identity and Access Management (IAM)

E.AWS Organizations

AnswersA, E

Can evaluate resource configurations against desired policies across accounts.

Why this answer

AWS Config allows you to define and enforce rules that evaluate resource configurations across accounts, and you can aggregate compliance data centrally using Config aggregators. AWS Organizations enables you to apply service control policies (SCPs) to centrally manage permissions across all accounts in the organization. Option B (VPC Flow Logs) captures IP traffic metadata but does not enforce security policies.

Option C (CloudTrail) records API activity for auditing, not policy enforcement. Option D (IAM) manages permissions but is per-account and not designed for centralized policy management across multiple accounts.

Full explanation →

1174

Multi-Selectmedium

Which TWO of the following are valid methods to connect a VPC to an on-premises network? (Choose 2.)

Select 2 answers

A.AWS Site-to-Site VPN

B.Internet gateway

C.NAT gateway

D.VPC peering

E.AWS Direct Connect

AnswersA, E

Valid method.

Why this answer

AWS Site-to-Site VPN creates an encrypted tunnel between a VPC and an on-premises network using IPsec. It uses a virtual private gateway or transit gateway on the AWS side and a customer gateway device on-premises, enabling secure communication over the public internet.

Exam trap

The trap here is that candidates often confuse internet-facing connectivity options (internet gateway, NAT gateway) with hybrid connectivity methods, or mistakenly think VPC peering can extend to on-premises networks, when it is strictly limited to inter-VPC communication within AWS.

Full explanation →

1175

MCQmedium

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to add a second CIDR block of 10.1.0.0/16 for additional subnets. After adding the CIDR, the existing subnets cannot communicate with the new subnets. What is the most likely cause?

A.Security groups are blocking traffic between the old and new subnets.

B.The VPC CIDR cannot be extended; a new VPC must be created.

C.Route tables for the existing subnets do not have routes to the new CIDR.

D.Network ACLs are blocking traffic by default.

AnswerC

Route tables must include routes for the new CIDR to enable communication.

Why this answer

When adding a secondary CIDR to a VPC, route tables for existing subnets must be updated to include routes to the new CIDR block; otherwise, traffic destined for the new subnets will not be routed correctly. Option A is wrong because security groups are stateful and automatically allow return traffic; they are not the cause of connectivity loss when adding a new CIDR. Option B is wrong because you can add a secondary CIDR to an existing VPC without creating a new VPC.

Option D is wrong because Network ACLs are stateless but are not the primary issue; the problem is the missing routes in the route tables.

Full explanation →

1176

Multi-Selecteasy

Which TWO are valid methods to monitor and troubleshoot AWS Direct Connect connections?

Select 2 answers

A.Use CloudFront to monitor Direct Connect utilization.

B.Enable AWS CloudTrail to log Direct Connect API calls.

C.Enable Direct Connect Connection and Virtual Interface metrics in CloudWatch.

D.Use AWS Direct Connect Connection tests to verify connectivity and performance.

E.Enable VPC Flow Logs on the VIF.

AnswersC, D

CloudWatch provides metrics for Direct Connect, such as connection state and BGP status.

Why this answer

Options C and D are correct. Option C: Direct Connect connection and virtual interface metrics can be monitored through CloudWatch, providing utilization and error stats. Option D: Direct Connect Connection tests (e.g., using the AWS Management Console or CLI) allow you to verify connectivity and performance.

Options A and B are incorrect: CloudFront is a CDN and not used for Direct Connect monitoring; CloudTrail logs API calls but does not provide real-time connection monitoring. Option E is incorrect: VPC Flow Logs capture IP traffic for VPCs, not Direct Connect link-level data.

Full explanation →

1177

MCQeasy

A company has a VPC with a CIDR block of 192.168.0.0/16. They have two subnets: Subnet A (192.168.1.0/24) and Subnet B (192.168.2.0/24). They launch an EC2 instance in Subnet A and another EC2 instance in Subnet B. They want to ensure that both instances can communicate with each other. The instances are in the same VPC. What is the simplest way to enable communication between these instances?

A.Create a VPC Peering connection between Subnet A and Subnet B

B.No additional configuration is needed; instances in the same VPC can communicate by default

C.Create a NAT Gateway in each subnet

D.Attach an internet gateway to the VPC

AnswerB

Default VPC routing allows communication between subnets.

Why this answer

By default, all instances within the same VPC can communicate with each other using private IP addresses, regardless of which subnet they reside in. The VPC's implicit router enables this layer-3 connectivity as long as the subnets' route tables do not explicitly block traffic and the instances' security groups or network ACLs permit the traffic. Since both subnets are within the same VPC (192.168.0.0/16), no additional configuration is required for basic IP-level communication.

Exam trap

The trap here is that candidates may overthink the scenario and assume that different subnets require explicit routing or peering, when in fact the VPC's implicit local route already handles all intra-VPC traffic by default.

How to eliminate wrong answers

Option A is wrong because VPC peering connects entire VPCs, not subnets, and is unnecessary when instances are already in the same VPC. Option C is wrong because a NAT Gateway is used to enable outbound internet access for instances in private subnets, not to enable communication between instances within the same VPC. Option D is wrong because an internet gateway provides internet connectivity, not internal VPC communication, and attaching it does not affect intra-VPC routing.

Full explanation →

1178

MCQhard

A company has a VPC with a public subnet and a private subnet. The private subnet instances need to make outbound internet requests. A NAT Gateway is deployed in the public subnet. The network engineer notices that instances in the private subnet cannot reach the internet, but the NAT Gateway's Elastic IP is reachable from the internet. Which of the following is the most likely cause?

A.The network ACL on the private subnet blocks outbound traffic.

B.The route table for the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT Gateway.

C.The NAT Gateway is not associated with an Elastic IP.

D.The security group attached to the NAT Gateway blocks outbound traffic.

AnswerB

Without this route, outbound traffic cannot reach the NAT Gateway.

Why this answer

The private subnet instances cannot reach the internet because the route table for the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT Gateway. Without this route, traffic destined for the internet has no path. Option A is incorrect because a NACL blocking outbound traffic would cause a different symptom, but the stem indicates the NAT Gateway's EIP is reachable, suggesting routing is the issue.

Option C is incorrect because the NAT Gateway is already associated with an Elastic IP. Option D is incorrect because security groups are not applied to NAT Gateways; they are applied to instances.

Full explanation →

1179

MCQmedium

A network engineer created a VPC interface endpoint for a third-party SaaS service using AWS PrivateLink. The endpoint shows 'available' state, but on-premises clients cannot connect to the service via the private endpoint DNS name. What is the MOST likely reason?

A.The endpoint is not in the 'available' state.

B.Private DNS is not enabled for the endpoint.

C.The endpoint is not associated with any subnet.

D.The endpoint type is Gateway, not Interface.

AnswerB

Private DNS must be enabled for the private hosted zone to resolve the endpoint DNS name.

Why this answer

Private DNS for the endpoint must be enabled for the private DNS name to resolve correctly from on-premises. Option A is incorrect because the endpoint is in 'available' state. Option C is incorrect because the subnet IDs are present.

Option D is incorrect because the endpoint type is Interface, not Gateway.

Full explanation →

1180

MCQhard

A security engineer is troubleshooting an issue where Amazon Inspector is not finding any vulnerabilities in an EC2 instance. The instance has the AWS Systems Manager Agent (SSM Agent) installed and is managed by AWS Systems Manager. What is the most likely reason for Inspector not reporting findings?

A.The EC2 instance does not have an IAM role that allows Inspector to scan it.

B.The EC2 instance is in a private subnet without a NAT gateway.

C.The EC2 instance's security group blocks outbound traffic to the Inspector service.

D.The EC2 instance is not managed by AWS Systems Manager.

AnswerA

Correct. The EC2 instance must have an IAM role (e.g., AmazonInspector-ENI-EC2-Role) that allows Inspector to access and scan it. Without this role, Inspector cannot report findings.

Why this answer

Amazon Inspector requires an IAM role that grants it permission to assess the EC2 instance. Without such a role, Inspector cannot perform vulnerability scans, even if the SSM Agent is installed and the instance is managed by Systems Manager. The other options are incorrect: the instance is managed by SSM (contradicting D), and missing NAT gateway or security group outbound rules do not prevent Inspector from scanning (Inspector initiates scans internally).

Full explanation →

1181

MCQeasy

A company uses AWS Direct Connect to connect its data center to a VPC. The VIF is up, and the BGP session is established. However, the on-premises router cannot ping the VPC's private IP addresses. Which configuration is most likely missing?

A.The Direct Connect virtual interface is in the wrong VLAN.

B.The BGP password is incorrect.

C.The on-premises router is not advertising the VPC CIDR via BGP.

D.The VPC route table does not have a route pointing to the Virtual Private Gateway for the on-premises CIDR.

AnswerD

Without this route, the VPC does not know to send traffic to the Direct Connect via the VGW.

Why this answer

For traffic to reach VPC private IPs, the VPC route table must have a route pointing to the Virtual Private Gateway (VGW) for the on-premises CIDR. Even with BGP up, without this route, traffic won't be sent to the VGW.

Full explanation →

1182

MCQmedium

A company uses AWS Direct Connect to connect its on-premises network to a VPC. The connection uses a private virtual interface (VIF) to access the VPC. The network team is monitoring the link and notices that the BGP session goes down intermittently. The team has checked the physical layer and found no issues. The BGP keepalive timer is set to 30 seconds on both sides. The network engineer suspects that the issue might be related to the BGP hold timer. What should the engineer do to stabilize the BGP session?

A.Configure a static route on the on-premises router for the VPC CIDR.

B.Decrease the BGP hold timer to 10 seconds on the on-premises router.

C.Increase the BGP hold timer to 90 seconds on both the on-premises router and the AWS side.

D.Change the virtual interface to a public VIF to improve BGP stability.

AnswerC

Correct: A higher hold timer reduces the chance of BGP session flapping due to intermittent connectivity.

Why this answer

Increasing the BGP hold timer to 90 seconds on both the on-premises router and the AWS side allows more time to receive keepalive messages, reducing the likelihood of the session going down due to transient network issues or slight delays. This stabilizes the BGP session without changing the underlying physical connection. Option A is incorrect because a static route would bypass BGP and remove the dynamic routing benefits.

Option B is incorrect because decreasing the hold timer makes the session more sensitive to delays, worsening the flapping. Option D is incorrect because changing to a public VIF does not affect BGP stability and is unrelated to the hold timer issue.

Full explanation →

1183

MCQhard

A company uses AWS Direct Connect to connect their on-premises network to AWS. They have a VPC with a virtual private gateway (VGW) and a private VIF attached to it. They recently added a second Direct Connect connection for redundancy. Both connections are active and advertised via BGP. The on-premises network uses BGP with the same AS number. After configuration, they notice that traffic is not load-balanced as expected; instead, all traffic flows through one connection. What is the most likely cause?

A.The on-premises router has a static route pointing to the primary connection, overriding BGP learned routes.

B.Both Direct Connect connections are in the same AWS region and use the same VGW, so traffic cannot be load-balanced.

C.The on-premises router is configured with a higher local preference for one of the BGP sessions, causing it to prefer that path.

D.The Direct Connect connections are using different VLANs, causing asymmetric routing.

AnswerC

BGP path selection can be influenced by local preference. If one session has a higher local preference, all traffic will use that path.

Full explanation →

1184

MCQhard

Refer to the exhibit. A company applies this bucket policy to an S3 bucket. Users in a different VPC with IP range 10.0.0.0/16 are able to access objects, but users in a different VPC with IP range 10.1.0.0/16 cannot. What is the most likely cause?

A.The bucket policy uses the wrong condition key

B.The users are accessing the bucket through a NAT Gateway, which changes the source IP

C.The bucket policy specifies the wrong resource ARN

D.The bucket policy does not specify a principal

AnswerB

NAT changes private IP to public IP, which does not match the condition.

Why this answer

The users in 10.1.0.0/16 are likely accessing the bucket through a NAT Gateway, which translates their private source IPs to the NAT's public IP. The bucket policy uses 'aws:SourceIp' with the condition '10.1.0.0/16', but after NAT, the source IP is no longer in that range, causing access to be denied. Option A is incorrect because the condition key 'aws:SourceIp' is appropriate; the problem is the IP after translation.

Option C is incorrect because the resource ARN is specified correctly. Option D is incorrect because bucket policies can be written without a principal to apply to all principals; it's valid.

Full explanation →

1185

MCQeasy

A solutions architect is designing a VPC with public and private subnets in two Availability Zones. The private subnets require outbound internet access for software updates, but inbound internet access must be blocked. Which solution meets these requirements?

A.Attach an internet gateway to the VPC and add a default route to the internet gateway in the private subnet route tables.

B.Deploy a NAT Gateway in a public subnet and add a default route to the NAT Gateway in the private subnet route tables.

C.Launch an EC2 instance in a public subnet with a proxy software and route private subnet traffic through it.

D.Create a VPC endpoint for Amazon S3 and add a route to the endpoint in the private subnet route tables.

AnswerB

NAT Gateway provides outbound-only internet access.

Why this answer

A NAT Gateway, deployed in a public subnet with an Elastic IP and a route to an Internet Gateway, enables outbound traffic from private subnets to the internet while blocking unsolicited inbound connections. The private subnet route table directs default traffic (0.0.0.0/0) to the NAT Gateway, which performs source network address translation (SNAT) on outbound packets, ensuring responses return to the NAT Gateway without exposing private instances directly.

Exam trap

The trap here is that candidates may confuse a NAT Gateway with an Internet Gateway, thinking that a default route to an Internet Gateway in a private subnet is acceptable, but an Internet Gateway allows bidirectional traffic, which would expose private instances to inbound internet connections.

How to eliminate wrong answers

Option A is wrong because adding a default route to an internet gateway in a private subnet route table would make the private subnet effectively public, allowing inbound internet traffic to reach instances directly, violating the requirement to block inbound access. Option C is wrong because while an EC2 instance with proxy software could provide outbound access, it introduces a single point of failure, requires ongoing management (patching, scaling), and is less reliable and cost-effective than a managed NAT Gateway, which is the recommended AWS solution. Option D is wrong because a VPC endpoint for Amazon S3 only provides private connectivity to S3, not general outbound internet access for software updates from arbitrary sources on the internet.

Full explanation →

1186

MCQeasy

A company uses AWS Site-to-Site VPN to connect its on-premises network to a VPC. The VPN connection uses static routes. Recently, the on-premises network administrator added a new subnet (10.0.3.0/24) and needs to ensure that traffic to this subnet is routed through the VPN tunnel. What must be done in the AWS VPC to enable this connectivity?

A.Update the customer gateway configuration

B.Enable route propagation on the VPN connection

C.Create a new VPN connection for the new subnet

D.Add a static route for 10.0.3.0/24 in the VPN connection's route table

AnswerD

Correct. You need to add a static route for 10.0.3.0/24 in the VPN connection's route table so that traffic to that subnet is routed through the VPN tunnel.

Why this answer

For a Site-to-Site VPN connection using static routes, the on-premises network administrator must add a new static route in the VPC route table for the new subnet (10.0.3.0/24), pointing to the virtual private gateway. Option D accomplishes this by adding a static route in the VPN connection's route table. Route propagation (Option B) is only available when the VPN uses BGP dynamic routing, not static routes.

Options A and C are incorrect because the customer gateway configuration does not affect VPC routing, and creating a new VPN connection is unnecessary.

Exam trap

The trap is that candidates might think that enabling route propagation (Option B) works for static route VPNs, but propagation is only supported with BGP. For static routes, you must manually add a static route to the VPC route table.

How to eliminate wrong answers

Option A is wrong because the customer gateway configuration represents the on-premises router's public IP and BGP ASN (if used), not the routes; updating it does not add routes to the VPC route table. Option B is wrong because route propagation is only applicable to BGP-based VPN connections (dynamic routing), not static route VPNs; enabling it on a static route VPN has no effect. Option C is wrong because creating a new VPN connection is unnecessary and wasteful; you can add multiple static routes to the same VPN connection, and a single tunnel can handle multiple subnets.

Full explanation →

1187

MCQeasy

A company has a VPC with CIDR 10.0.0.0/16 and needs to connect to an on-premises network with CIDR 10.0.0.0/8. They plan to use AWS Direct Connect with a private virtual interface. What should they do to resolve the overlapping CIDR conflict?

A.Create a VPN connection with dynamic routing and use BGP to advertise the VPC CIDR.

B.Create a VPC peering connection between the VPC and the on-premises network.

C.Change the VPC CIDR to a non-overlapping range, such as 172.16.0.0/16, and re-create the VPC with the new CIDR.

D.Use a NAT Gateway in the VPC to translate the on-premises IP addresses.

AnswerC

The only solution is to use non-overlapping IP address ranges.

Why this answer

AWS does not support network address translation (NAT) for overlapping CIDRs on a Direct Connect private virtual interface. The only way to resolve the conflict is to change the VPC CIDR to a non-overlapping range (e.g., 172.16.0.0/16) and recreate the VPC, as the VPC CIDR cannot be modified after creation. This ensures that routes between the VPC and on-premises network do not conflict.

Exam trap

The trap here is that candidates assume NAT or VPN can magically resolve overlapping IP ranges, but AWS Direct Connect private VIFs require non-overlapping CIDRs for proper routing, and no AWS service (including NAT Gateway or VPN) can translate on-premises IPs in this context.

How to eliminate wrong answers

Option A is wrong because a VPN connection with dynamic routing does not resolve overlapping CIDRs; BGP would still advertise the conflicting 10.0.0.0/16 into the on-premises network, causing routing loops or blackholing. Option B is wrong because VPC peering does not support overlapping CIDRs and cannot connect a VPC to an on-premises network; it only connects VPCs within AWS. Option D is wrong because a NAT Gateway translates traffic from private instances to the internet, not from the VPC to on-premises; it cannot translate on-premises IP addresses and does not resolve overlapping CIDR conflicts in a Direct Connect private VIF.

Full explanation →

1188

MCQmedium

A company is deploying a web application across multiple Availability Zones in a single region. They want to distribute incoming traffic evenly across all healthy EC2 instances. Which AWS service should be used as the entry point?

A.Application Load Balancer (ALB)

B.Amazon CloudFront

C.Network Load Balancer (NLB)

D.Amazon Route 53 with simple routing

AnswerA

Layer 7 load balancer with health checks.

Why this answer

An Application Load Balancer (ALB) operates at Layer 7 and can distribute HTTP/HTTPS traffic across multiple targets in different Availability Zones. It supports health checks and round-robin routing to evenly distribute incoming requests across healthy EC2 instances, making it the correct entry point for a web application requiring even traffic distribution across AZs.

Exam trap

The trap here is that candidates often confuse the Network Load Balancer (NLB) as the default choice for all load balancing, but the question specifies a web application (HTTP/HTTPS) requiring even distribution, which is a Layer-7 use case best served by the ALB, not the NLB.

How to eliminate wrong answers

Option B is wrong because Amazon CloudFront is a content delivery network (CDN) that caches content at edge locations; it does not natively distribute traffic evenly across EC2 instances in a region and is not designed as a direct entry point for load balancing. Option C is wrong because a Network Load Balancer (NLB) operates at Layer 4 and handles TCP/UDP traffic, but it is not optimized for HTTP/HTTPS web applications and does not provide the same layer-7 features (e.g., path-based routing, host-based routing) that an ALB offers for even distribution. Option D is wrong because Amazon Route 53 with simple routing returns a fixed set of IP addresses without considering instance health or load, so it cannot evenly distribute traffic across healthy instances; it lacks health-check-based failover and load-aware distribution.

Full explanation →

1189

MCQhard

A company uses AWS Organizations with SCPs to restrict access to services. The security team needs to ensure that no IAM role can be created without an approved custom trust policy. Which SCP should be attached to the root OU to enforce this requirement?

A.{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:CreateRole","Resource":"*","Condition":{"StringNotEquals":{"aws:RequestTag/Approved":"true"}}}]}

B.{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:CreateRole","Resource":"*"}]}

C.{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:CreateRole","Resource":"arn:aws:iam::*:role/*","Condition":{"StringNotLike":{"iam:RoleName":"approved-*"}}}]}

D.{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:PassRole","Resource":"*"}]}

AnswerA

This SCP denies CreateRole unless the request includes a tag 'Approved' with value 'true', enforcing the requirement.

Why this answer

It uses a Deny effect with a condition that only blocks IAM role creation when the request does not include a tag with key 'Approved' set to 'true'. This enforces that every new IAM role must have an approved custom trust policy by requiring the tag as a proxy for approval, while still allowing role creation when the tag is present. The SCP is attached to the root OU to apply globally across all accounts in the organization.

Exam trap

AWS often tests the distinction between using tags versus naming conventions or resource-based conditions to enforce governance, and candidates mistakenly choose naming-based conditions (Option C) thinking they can enforce policy approval, but tags are the only reliable way to pass metadata at creation time that can be evaluated by SCPs.

How to eliminate wrong answers

Option B is wrong because it denies all iam:CreateRole actions unconditionally, which would prevent any IAM role from being created at all, even those with an approved trust policy, thus violating the requirement to allow approved roles. Option C is wrong because it uses a condition on the role name pattern 'approved-*', which is a naming convention and does not enforce an approved custom trust policy; roles could be named 'approved-*' without having an approved trust policy, and roles with a different name but an approved policy would be blocked. Option D is wrong because it denies iam:PassRole, which controls the ability to pass an existing role to an AWS service, not the creation of a new role; this does not address the requirement to restrict role creation based on trust policy approval.

Full explanation →

1190

Multi-Selecthard

A company wants to use AWS Transit Gateway to connect multiple VPCs and on-premises networks. They need to centrally manage and enforce security policies. Which THREE components are required?

Select 3 answers

A.Transit Gateway route tables

B.VPC Gateway Endpoints

C.AWS Resource Access Manager (RAM)

D.AWS Direct Connect Gateway

E.AWS Network Firewall

AnswersA, C, E

Route tables control how traffic is routed between attachments.

Why this answer

Transit Gateway route tables (A) are required to control the routing of traffic between attached VPCs, VPNs, and Direct Connect connections. They allow you to isolate or share networks by defining which attachments can communicate with each other, enabling centralized policy enforcement.

Exam trap

The trap here is that candidates often confuse optional integration components (like Direct Connect Gateway or Gateway Endpoints) with the mandatory building blocks required to centrally manage and enforce security policies across a Transit Gateway topology.

Full explanation →

1191

MCQeasy

A company has a VPC with public and private subnets. The private subnets need outbound internet access for software updates. Which design will meet this requirement most securely?

A.Deploy a NAT Gateway in a public subnet and add a route to it from the private subnets.

B.Add a default route to the IGW from the private subnet route table.

C.Place the instances in a public subnet with a route to an Internet Gateway (IGW).

D.Deploy a NAT instance in a private subnet and configure routes to it.

AnswerA

NAT Gateway allows outbound traffic from private subnets while blocking inbound traffic.

Why this answer

A NAT Gateway deployed in a public subnet with an Elastic IP allows private subnet instances to initiate outbound connections to the internet (e.g., for software updates) while preventing unsolicited inbound connections. The private subnet route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway, which then forwards traffic to the Internet Gateway (IGW) in the public subnet. This design is the most secure because it avoids exposing private instances directly to the internet and uses a managed, highly available service.

Exam trap

AWS often tests the misconception that a NAT instance can be placed in a private subnet and still provide outbound internet access, but in reality, a NAT device must reside in a public subnet with a route to an IGW to translate and forward traffic.

How to eliminate wrong answers

Option B is wrong because adding a default route to the IGW from the private subnet route table would directly expose private instances to the internet, allowing unsolicited inbound traffic and bypassing any NAT functionality, which violates security best practices. Option C is wrong because placing instances in a public subnet with a route to an IGW gives them public IP addresses and direct internet access, making them vulnerable to inbound attacks and defeating the purpose of using private subnets for security. Option D is wrong because deploying a NAT instance in a private subnet would require a route to an IGW or another NAT device for outbound traffic, creating a circular dependency; NAT instances must be in a public subnet to reach the IGW, and using a NAT instance also introduces single points of failure and management overhead compared to a managed NAT Gateway.

Full explanation →

1192

MCQhard

A company is designing a multi-region active-active architecture using Application Load Balancers (ALBs) and AWS Global Accelerator. They need to ensure that traffic is distributed evenly across regions and that failover happens automatically. Which configuration should they use?

A.Use Route 53 latency-based routing with health checks

B.Configure Global Accelerator with a single endpoint group containing both ALBs

C.Configure Global Accelerator with two endpoints (one per region) and set equal weights

D.Use a Network Load Balancer in each region and Route 53 weighted routing

AnswerC

Global Accelerator supports endpoint weights for traffic distribution and health checks for failover.

Why this answer

Global Accelerator uses endpoint weights to distribute traffic. Setting equal weights for both regional endpoints ensures even distribution, and health checks automatically route traffic away from unhealthy regions.

Full explanation →

1193

MCQmedium

A company has set up a Direct Connect connection with a private VIF to its VPC. The BGP session is up, but traffic is not passing between the on-premises network and the VPC. Which configuration should be verified?

A.Ensure jumbo frames are enabled on the Direct Connect interface

B.Verify that the VIF is a public VIF

C.Review the Direct Connect virtual interface metrics in CloudWatch

D.Check the BGP advertised routes and the VPC route tables

AnswerD

Routes must be properly advertised and propagated to the VPC route table.

Why this answer

For traffic to flow between on-premises and the VPC over a Direct Connect private VIF, the on-premises network must advertise the appropriate routes via BGP, and the VPC route tables must have routes pointing to the virtual private gateway (VGW). Option A is wrong because jumbo frames are not required for basic connectivity. Option B is wrong because the VIF type (private vs public) is not the issue—the BGP session is already up, indicating the VIF is correctly configured as private.

Option C is wrong because CloudWatch metrics are for monitoring performance, not for diagnosing routing issues.

Full explanation →

1194

Multi-Selectmedium

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. The network team needs to monitor the BGP session status for each VPN attachment. Which TWO services can be used to monitor BGP status and receive alerts if a session goes down?

Select 2 answers

A.Amazon CloudWatch Alarms on the BGP status metric.

B.AWS Config rules.

C.VPC Flow Logs.

D.AWS CloudTrail logs.

E.Amazon CloudWatch metrics for VPN tunnels.

AnswersA, E

Alarms can notify when BGP goes down.

Why this answer

Amazon CloudWatch provides metrics for VPN tunnels, including the BGP status metric (e.g., TunnelState, BGPStatus). CloudWatch Alarms can be set on this metric to trigger notifications if the BGP session goes down. Option A is correct because CloudWatch Alarms on the BGP status metric directly monitor and alert on BGP session state.

Option E is correct because CloudWatch metrics for VPN tunnels include BGP status data. Option B (AWS Config) is incorrect because AWS Config is used for resource compliance and configuration changes, not real-time monitoring of BGP sessions. Option C (VPC Flow Logs) is incorrect because VPC Flow Logs capture IP traffic information, not BGP routing protocol status.

Option D (AWS CloudTrail) is incorrect because CloudTrail logs API calls, not BGP session state.

Full explanation →

1195

Drag & Dropmedium

Order the steps to troubleshoot an inter-Region VPC peering connection that is not working:

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

First verify peering status, then check routes, then security groups/ACLs, then test, then use flow logs.

Full explanation →

1196

MCQeasy

A company has a VPC with public and private subnets. The security team wants to allow instances in a private subnet to download software updates from the internet but prevent inbound internet traffic. Which AWS service should be used?

A.Internet gateway

B.AWS Site-to-Site VPN

C.VPC peering connection

D.NAT gateway

AnswerD

NAT gateway enables outbound internet traffic from private subnets.

Why this answer

A NAT gateway allows outbound internet traffic from private subnets while blocking unsolicited inbound traffic. Option D is correct. Option A is wrong because an internet gateway enables bidirectional traffic, which would allow inbound traffic.

Option B is wrong because AWS Site-to-Site VPN is used for hybrid connectivity between on-premises and AWS, not for outbound internet access from private subnets. Option C is wrong because VPC peering connects VPCs together, not to the internet.

Full explanation →

1197

MCQeasy

A company has an AWS Direct Connect connection and wants to use it to access Amazon S3 buckets without traversing the public internet. Which virtual interface type should be used?

A.Transit virtual interface

B.Hosted virtual interface

C.Private virtual interface

D.Public virtual interface

AnswerD

Public VIF provides access to public AWS services over Direct Connect.

Why this answer

A public virtual interface is the correct choice because it allows access to AWS public services, such as Amazon S3, over a Direct Connect connection without traversing the public internet. It uses the same BGP peering and routing policies as private virtual interfaces but directs traffic to the public IP address space of AWS services, ensuring traffic stays within the AWS global network.

Exam trap

The trap here is that candidates often confuse 'private' with 'secure' and assume a private virtual interface is needed for any non-internet access, not realizing that public virtual interfaces are specifically designed for AWS public services and still provide private, dedicated connectivity over Direct Connect.

How to eliminate wrong answers

Option A is wrong because a transit virtual interface is used to connect a Direct Connect gateway to a transit gateway, enabling connectivity to multiple VPCs and VPNs, not directly to Amazon S3. Option B is wrong because a hosted virtual interface is provisioned by an AWS Direct Connect partner for use by a customer, but it can be either private or public; the type (public) is what matters for S3 access, not the hosting model. Option C is wrong because a private virtual interface is used to access resources within a VPC using private IP addresses, not AWS public services like S3, which require routing to public endpoints.

Full explanation →

1198

MCQmedium

A company is designing a multi-region architecture with an Application Load Balancer (ALB) in us-east-1 and a Network Load Balancer (NLB) in eu-west-1. They need to route traffic from the ALB to the NLB using a fixed IP address. Which AWS service should be used to provide a static IP for the NLB and enable cross-region load balancing?

A.AWS WAF

B.Amazon CloudFront

C.AWS Transit Gateway

D.AWS Global Accelerator

AnswerD

Global Accelerator provides static IPs and can route to NLB across regions.

Why this answer

AWS Global Accelerator provides two static anycast IP addresses that serve as a fixed entry point for traffic. It can route traffic from the ALB in us-east-1 to the NLB in eu-west-1 by using an endpoint group that includes the NLB's IP address, enabling cross-region load balancing with a static IP. This allows the ALB to forward traffic to the Global Accelerator's static IP, which then optimally routes to the NLB in the other region.

Exam trap

The trap here is that candidates often confuse Amazon CloudFront's ability to serve content with a static IP (via custom origins) with the need for a fixed IP that routes traffic from an ALB to an NLB across regions, overlooking that Global Accelerator is specifically designed for this use case with TCP/UDP traffic and static anycast IPs.

How to eliminate wrong answers

Option A is wrong because AWS WAF is a web application firewall that protects against common web exploits, not a service for providing static IP addresses or cross-region routing. Option B is wrong because Amazon CloudFront is a content delivery network (CDN) that uses edge locations and can have static IPs via custom origins, but it is designed for HTTP/HTTPS traffic and does not natively support routing traffic from an ALB to an NLB with a fixed IP for cross-region load balancing; it also does not provide a static IP for the NLB itself. Option C is wrong because AWS Transit Gateway is a network transit hub to connect VPCs and on-premises networks within a region or across regions using peering attachments, but it does not provide static IP addresses for load balancers and is not designed to route traffic from an ALB to an NLB with a fixed IP endpoint.

Full explanation →

1199

MCQhard

A company is designing a multi-Region architecture using AWS Transit Gateway and Direct Connect. They have VPCs in us-east-1 and eu-west-1, each with an attached Transit Gateway. The Direct Connect gateway is associated with the Transit Gateway in us-east-1. They need to enable communication between VPCs across Regions using the Direct Connect gateway. What is the correct design to achieve this?

A.Create a single Transit Gateway that spans both Regions and attach VPCs in both Regions.

B.Use VPC peering between the VPCs and route Direct Connect traffic through the VPC peering connection.

C.Create a Transit Gateway peering attachment between the Transit Gateways in us-east-1 and eu-west-1, and route traffic over the Direct Connect gateway via the peering.

D.Associate the Direct Connect gateway with both Transit Gateways in us-east-1 and eu-west-1.

AnswerC

Transit Gateway peering enables inter-Region connectivity. The Direct Connect gateway remains associated with the Transit Gateway in us-east-1, and routes can be propagated to allow traffic to flow across the peering.

Why this answer

Transit Gateway peering attachments allow transitive routing between Transit Gateways in different AWS Regions. By establishing a peering attachment between the Transit Gateways in us-east-1 and eu-west-1, traffic from the VPC in eu-west-1 can be routed through its local Transit Gateway, across the peering attachment to the Transit Gateway in us-east-1, and then over the Direct Connect gateway to on-premises networks. This design enables cross-region VPC communication via Direct Connect without requiring a single Transit Gateway or direct VPC peering.

Exam trap

The trap here is that candidates often assume a Direct Connect gateway can be associated with multiple Transit Gateways across regions, but AWS only supports a one-to-one association between a Direct Connect gateway and a Transit Gateway at a time, requiring Transit Gateway peering for cross-region connectivity.

How to eliminate wrong answers

Option A is wrong because a single Transit Gateway cannot span multiple AWS Regions; Transit Gateways are regional resources and cannot be shared across regions. Option B is wrong because VPC peering does not support transitive routing through a Direct Connect gateway; traffic would need to traverse the peering connection, but Direct Connect traffic cannot be routed through a VPC peering connection to reach another VPC without additional complex routing and potential asymmetric routing issues. Option D is wrong because a Direct Connect gateway can only be associated with a single Transit Gateway in one Region at a time; associating it with both Transit Gateways is not supported and would cause routing conflicts.

Full explanation →

1200

MCQmedium

A company is using AWS Direct Connect to connect its on-premises data center to AWS. The network team notices increased latency and packet loss during peak hours. The Direct Connect virtual interface (VIF) is configured as a private VIF to a VPC. What is the MOST likely cause of the issue?

A.Jumbo frames are not enabled on the VIF.

B.The VIF bandwidth is insufficient for the traffic volume.

C.The BGP keepalive timer is set too low.

D.The MTU size of the VIF is set to 1500 bytes.

AnswerB

Bursty traffic can exceed the provisioned bandwidth, causing congestion.

Why this answer

The most likely cause is insufficient VIF bandwidth for the traffic volume. During peak hours, increased traffic can exceed the provisioned bandwidth, causing congestion, which manifests as increased latency and packet loss. Option A is incorrect because jumbo frames (larger MTU) can improve efficiency but not prevent congestion.

Option C is incorrect because BGP keepalive timers affect routing convergence, not throughput. Option D is incorrect because a 1500-byte MTU is standard and should not cause issues; the problem arises only during peak hours, indicating a capacity issue.

Full explanation →

Page 16 of 22

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

Practice ANS-C01 by domain

Target a specific domain to shore up weak areas.

Network Management and Operations Network Security, Compliance and Governance Network Design Network Implementation

See all domains with question counts →