Knowledge + Practice

AWS Certified Advanced Networking Specialty ANS-C01 (ANS-C01) — Questions 1201–1275

1621 questions total · 22pages · All types, answers revealed

Take a mock exam Exam hub

Page 17 of 22

1201

MCQhard

A company is implementing a multi-region architecture with VPCs in us-east-1 and eu-west-1. They want to connect these VPCs using a Transit Gateway and ensure that traffic between regions can be inspected by a firewall in us-east-1. Which configuration is required?

A.Establish a VPN connection between the two VPCs and route traffic through the firewall.

B.Create a Transit Gateway in each region, peer them, and configure route tables to send inter-region traffic through the inspection VPC in us-east-1.

C.Create a VPC peering connection between the two VPCs and update route tables.

D.Use a Direct Connect gateway to connect the two VPCs directly.

AnswerB

Transit Gateway peering enables cross-region connectivity, and route tables can steer traffic for inspection.

Why this answer

It uses Transit Gateway inter-region peering to connect the two regions, and by attaching an inspection VPC (with a firewall) in us-east-1 to the Transit Gateway, you can route all inter-region traffic through that VPC for inspection. The Transit Gateway route tables in each region are configured to send traffic destined for the other region to the inspection VPC attachment, ensuring traffic is inspected before being forwarded.

Exam trap

The trap here is that candidates often confuse VPC peering (which is non-transitive) with Transit Gateway peering (which supports transitive routing through inspection VPCs), leading them to select Option C incorrectly.

How to eliminate wrong answers

Option A is wrong because establishing a VPN connection between the two VPCs does not inherently provide traffic inspection through a firewall in us-east-1; it would require complex manual routing and does not leverage Transit Gateway for centralized inspection. Option C is wrong because VPC peering does not support transitive routing, so you cannot route traffic through an inspection VPC in us-east-1; traffic would flow directly between the peered VPCs without inspection. Option D is wrong because a Direct Connect gateway is used for connecting on-premises networks to VPCs, not for inter-region VPC connectivity, and it does not provide a mechanism for traffic inspection between regions.

Full explanation →

1202

MCQmedium

A security engineer must ensure that all traffic between an application running on Amazon EC2 and an Amazon RDS database is encrypted in transit. The VPC has a public subnet for the EC2 instance and a private subnet for the RDS database. What is the MOST secure way to enforce encryption for this traffic?

A.Enable IAM database authentication for the RDS instance.

B.Use a security group rule that allows traffic only on port 443.

C.Configure the RDS DB instance to require SSL/TLS connections and configure the application to connect using SSL.

D.Place both the EC2 instance and the RDS database in the same subnet and use a network ACL to enforce encryption.

AnswerC

Enabling SSL/TLS on RDS ensures that all connections to the database are encrypted in transit.

Why this answer

Configuring the RDS DB instance to require SSL/TLS connections ensures that the application encrypts data in transit when connecting to the database. This is the most secure way to enforce encryption for traffic between EC2 and RDS. Option A is incorrect because IAM database authentication controls access, not encryption.

Option B is incorrect because a security group rule allowing only port 443 does not enforce encryption; it only restricts traffic to that port. Option D is incorrect because placing both resources in the same subnet does not enforce encryption, and a network ACL is stateless and cannot enforce encryption.

Full explanation →

1203

MCQmedium

A company is using AWS Organizations to manage multiple accounts. The network team needs to allow a centralized inspection VPC to inspect all traffic between VPCs in different accounts. Which AWS service should be used to route traffic through the inspection VPC?

A.AWS Transit Gateway

B.VPC peering connections

C.AWS PrivateLink

D.AWS Site-to-Site VPN

AnswerA

Transit Gateway supports transitive routing and central inspection.

Why this answer

AWS Transit Gateway acts as a central hub for inter-VPC and inter-account traffic, enabling you to attach VPCs from multiple AWS accounts (via AWS Organizations) and route traffic through a centralized inspection VPC. By using Transit Gateway route tables and a dedicated inspection VPC with appliances (e.g., firewall), you can enforce traffic inspection for all cross-account VPC communications without requiring individual peering connections.

Exam trap

The trap here is that candidates often confuse VPC peering's ability to connect VPCs with the need for transitive routing, mistakenly thinking they can chain multiple peering connections to route traffic through an inspection VPC, but VPC peering explicitly does not support transitive routing.

How to eliminate wrong answers

Option B is wrong because VPC peering connections only allow direct, one-to-one connectivity between two VPCs and do not support transitive routing; you cannot route traffic from one peered VPC through another VPC for inspection. Option C is wrong because AWS PrivateLink provides private connectivity to specific services or endpoints (e.g., NLB-backed services) and is not designed for routing general inter-VPC traffic through a centralized inspection point. Option D is wrong because AWS Site-to-Site VPN is used to connect on-premises networks to AWS VPCs, not for routing traffic between VPCs within AWS.

Full explanation →

1204

MCQeasy

A security team requires that all traffic between Amazon EC2 instances in different subnets of a VPC be logged. Which AWS service should be used to capture and log the traffic?

A.VPC Flow Logs

B.AWS CloudTrail

C.VPC Traffic Mirroring

D.AWS Config

AnswerA

VPC Flow Logs capture network traffic metadata and can be logged to CloudWatch Logs or S3.

Why this answer

VPC Flow Logs capture IP traffic information for network interfaces and can be published to Amazon CloudWatch Logs or Amazon S3. This allows logging of all traffic between EC2 instances in different subnets. Option B is incorrect because AWS CloudTrail logs API calls and actions taken on AWS resources, not network traffic.

Option C is incorrect because VPC Traffic Mirroring copies traffic for deep packet inspection and analysis, but it is not a logging service; it is used for traffic monitoring and security analysis. Option D is incorrect because AWS Config tracks resource configuration changes and evaluates compliance, not network traffic.

Full explanation →

1205

MCQmedium

A company has a Direct Connect connection with a single private virtual interface (VIF) to a virtual private gateway (VGW) attached to a VPC. The VPC CIDR is 10.0.0.0/16. The on-premises CIDR is 172.16.0.0/12. The BGP session is established, and the on-premises router is advertising the 172.16.0.0/12 route to the VGW. The VGW is configured to propagate routes to the VPC route tables. However, instances in the VPC cannot reach on-premises resources. The VPC route table shows a propagated route for 172.16.0.0/12 with a target of the VGW. What is the most likely issue?

A.The security groups for the VPC instances do not allow outbound traffic to the on-premises network

B.The VPC route table does not have a route for the on-premises CIDR

C.The on-premises router does not have a route to the VPC CIDR via the Direct Connect interface

D.The BGP session is not advertising the VPC CIDR to the on-premises router

AnswerC

Without a return route, traffic cannot reach the VPC.

Why this answer

The on-premises router must also have a route back to the VPC CIDR via the Direct Connect interface for traffic to flow bidirectionally. Option A is wrong because security groups are stateful, so outbound traffic is automatically allowed. Option B is wrong because the VPC route table does contain the propagated route for 172.16.0.0/12.

Option D is wrong because the BGP session is established and the VGW does not need to advertise the VPC CIDR for outbound traffic; the problem is the lack of a return route on the on-premises router.

Full explanation →

1206

MCQmedium

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The application must be accessible only from a specific AWS Client VPN endpoint. The security team has configured the ALB security group to allow inbound traffic from the Client VPN CIDR range, but users report that they can still access the application from outside the VPN. What is the MOST likely cause of this issue?

A.The ALB security group is not set as the source for inbound traffic; instead, traffic reaches the ALB directly from the internet.

B.The network ACL is stateless and requires separate inbound and outbound rules for return traffic.

C.The subnet's network ACL allows inbound HTTP/HTTPS traffic from 0.0.0.0/0.

D.The EC2 instances' security group allows inbound traffic from 0.0.0.0/0.

AnswerA

If the ALB security group does not restrict inbound traffic, traffic can bypass the Client VPN.

Why this answer

The ALB security group is configured to allow inbound traffic from the Client VPN CIDR range, but if the ALB itself is internet-facing (i.e., it has public IP addresses and is deployed in public subnets), traffic can bypass the security group rules if the security group is not actually applied to the ALB's network interfaces. The most likely cause is that the ALB security group is not set as the source for inbound traffic; instead, traffic reaches the ALB directly from the internet, meaning the security group rules are not being enforced on the ALB's listener. This allows users outside the VPN to access the application because the ALB accepts traffic from any source unless the security group explicitly restricts it.

Exam trap

The trap here is that candidates assume the ALB security group is automatically enforced, but AWS tests the nuance that an internet-facing ALB can still receive traffic from the internet if the security group is not properly applied or if the ALB is not configured to restrict traffic to the VPN CIDR.

How to eliminate wrong answers

Option B is wrong because network ACLs are stateless and require separate inbound and outbound rules, but this does not explain why users outside the VPN can access the application; network ACLs operate at the subnet level and would affect all traffic, not just VPN traffic. Option C is wrong because even if the subnet's network ACL allows inbound HTTP/HTTPS traffic from 0.0.0.0/0, the ALB security group should still block non-VPN traffic; the security group is the primary control for the ALB, and a permissive NACL does not override a restrictive security group. Option D is wrong because the EC2 instances' security group allowing inbound traffic from 0.0.0.0/0 is irrelevant if the ALB is the entry point; the ALB terminates the client connection and forwards traffic to the instances, so the instances' security group only needs to allow traffic from the ALB's security group, not from the internet.

Full explanation →

1207

MCQhard

A company is troubleshooting connectivity between two VPCs (VPC-A and VPC-B) that are peered together. Both VPCs are in the same region. VPC-A has a CIDR of 10.0.0.0/16 and VPC-B has a CIDR of 10.0.0.0/16. The peering connection is established and the route tables are updated. However, EC2 instances in VPC-A cannot ping EC2 instances in VPC-B. What is the most likely cause?

A.The route tables do not have routes to the private IP addresses of the instances.

B.The VPCs have overlapping CIDR blocks.

C.The security groups in VPC-B do not allow inbound ICMP traffic from VPC-A.

D.The VPCs are in different regions and peering does not work across regions.

AnswerB

Overlapping CIDRs prevent proper routing in VPC peering.

Why this answer

VPC peering requires non-overlapping CIDR blocks because the VPCs must have unique IP address spaces for routing to work correctly. Since both VPC-A and VPC-B use the same CIDR 10.0.0.0/16, the route tables cannot distinguish between the two VPCs, causing traffic to be misrouted or dropped. This is the most likely cause of the ping failure, as overlapping CIDRs prevent proper destination-based routing in the VPC peering connection.

Exam trap

The ANS-C01 exam often tests the misconception that security groups or route table entries are the primary cause of connectivity issues in VPC peering, when in fact overlapping CIDR blocks create a fundamental routing conflict that overrides all other configurations.

How to eliminate wrong answers

Option A is wrong because route tables in a VPC peering configuration do not need routes to individual private IP addresses; they need routes to the destination VPC's CIDR block, which are already updated per the scenario. Option C is wrong while security groups could block ICMP traffic, the overlapping CIDR issue is a more fundamental problem that would prevent connectivity regardless of security group rules, and the question asks for the most likely cause. Option D is wrong because the scenario explicitly states both VPCs are in the same region, and VPC peering does support cross-region peering, so this option is factually incorrect.

Full explanation →

1208

MCQeasy

A company uses AWS Direct Connect to connect its on-premises network to a VPC. The network team notices intermittent packet loss on the Direct Connect virtual interface (VIF). Which AWS service should be used to monitor the latency and packet loss on the VIF?

A.AWS Health Dashboard

B.VPC Flow Logs

C.AWS CloudWatch

D.AWS Transit Gateway Network Manager

AnswerC

CloudWatch provides Direct Connect metrics including packet loss and latency.

Why this answer

CloudWatch provides metrics for Direct Connect including packet loss and latency. VPC Flow Logs capture IP traffic metadata but not latency. AWS Health Dashboard shows service health.

Transit Gateway is a network transit hub but not a monitoring service.

Full explanation →

1209

MCQmedium

Refer to the exhibit. A network engineer has established a VPC peering connection between VPC A (10.0.0.0/16) in account 111111111111 and VPC B (192.168.0.0/16) in account 222222222222. The peering connection status is 'active'. However, instances in VPC A cannot reach instances in VPC B. What is the MOST likely cause?

A.The peering connection is not in the 'active' state

B.Route tables in one or both VPCs do not have routes to the peer CIDR

C.Security groups in VPC B are blocking traffic

D.The CIDR blocks overlap

AnswerB

Missing routes prevent communication.

Why this answer

The VPC peering connection is active, so A is incorrect. The CIDR blocks (10.0.0.0/16 and 192.168.0.0/16) do not overlap, so D is incorrect. Security groups can block traffic, but the most common cause is missing routes in the route tables of one or both VPCs to the peer CIDR via the peering connection.

Therefore, B is correct.

Full explanation →

1210

MCQhard

A company is designing a multi-account architecture. They need to centralize VPC flow logs from all accounts into a single Amazon S3 bucket in the security account. The logs must be encrypted at rest using a customer-managed KMS key in the security account. Which combination of steps is required?

A.Configure the S3 bucket policy to allow the log accounts to write; encryption is automatic with SSE-S3.

B.Create a KMS key in each account and configure the S3 bucket to use each key.

C.Configure the KMS key policy to allow the log-producing accounts to use the key, and the S3 bucket policy to allow those accounts to write.

D.Create a KMS key in the security account with no key policy changes; use bucket policies to allow cross-account writes.

AnswerC

Cross-account KMS requires key policy; bucket policy allows writes.

Why this answer

To centralize VPC flow logs with customer-managed KMS encryption, you need both a KMS key policy that grants the log-producing accounts permission to use the key (kms:Encrypt, kms:GenerateDataKey) and an S3 bucket policy that allows those accounts to write objects. Option A is wrong because SSE-S3 cannot be used with cross-account access in this context. Option B is wrong because using separate keys per account defeats centralization.

Option D is wrong because without modifying the KMS key policy, cross-account encryption will fail.

Full explanation →

1211

MCQmedium

A network engineer is troubleshooting why an EC2 instance (with the above security group) is not responding to HTTP requests from the internet. The instance is in a public subnet with an Internet Gateway attached. The route table has a default route to the Internet Gateway. What is the most likely cause?

A.The security group only allows traffic from the 10.0.0.0/8 range

B.The security group does not allow inbound ICMP traffic

C.The route table does not have a route for the internet

D.The network ACL is blocking inbound HTTP

AnswerA

The security group rule only permits HTTP from the private 10.0.0.0/8 CIDR, not from the internet.

Why this answer

The security group only allows inbound HTTP traffic from the 10.0.0.0/8 IP range, which is a private address space. Since the request originates from the internet (a public IP), it does not match the allowed source and is therefore denied. Option A correctly identifies this issue.

Options B, C, and D are incorrect: ICMP is not required for HTTP, the route table does have a default route to the IGW, and there is no information about network ACLs blocking HTTP.

Full explanation →

1212

MCQeasy

A company wants to provide secure access to an S3 bucket from a VPC without using an internet gateway or NAT device. Which AWS feature should be used?

A.Internet gateway

B.NAT gateway

C.AWS Site-to-Site VPN connection

D.VPC endpoint (Gateway type) for S3

AnswerD

A Gateway VPC endpoint provides private access to S3.

Why this answer

A VPC endpoint (Gateway type) for S3 allows instances within a VPC to access S3 buckets privately using the AWS network, without requiring an internet gateway or NAT device. This is achieved by adding an endpoint route in the VPC route table that directs S3 traffic through the AWS backbone, ensuring data never traverses the public internet.

Exam trap

AWS often tests the misconception that a NAT gateway alone provides private S3 access, but candidates must remember that NAT gateways still require an internet gateway and do not eliminate internet transit for S3 traffic.

How to eliminate wrong answers

Option A is wrong because an internet gateway provides direct internet access, which is explicitly not allowed per the requirement to avoid internet gateways or NAT devices. Option B is wrong because a NAT gateway enables outbound internet traffic from private subnets, but it still relies on an internet gateway and public IPs, violating the no-internet-gateway condition. Option C is wrong because an AWS Site-to-Site VPN connection extends an on-premises network to the VPC over the internet, but it does not provide direct private access to S3 from within the VPC without additional routing and still uses the internet for the VPN tunnel.

Full explanation →

1213

MCQmedium

A company uses AWS Direct Connect with a private virtual interface (VIF) to connect its on-premises network to its VPC. The on-premises network team reports that they can ping the private IP address of an EC2 instance in the VPC, but cannot establish a TCP connection to a web server running on that instance. The network security group allows inbound TCP port 80 from the on-premises CIDR. What should the network engineer check next?

A.Review the network ACL associated with the subnet to ensure it allows inbound TCP 80.

B.Check the operating system firewall and web server configuration on the EC2 instance.

C.Check the BGP session status on the Direct Connect virtual interface.

D.Verify the route table on the VPC has a route back to the on-premises network.

AnswerB

The OS firewall or application may block TCP despite security group allowing it.

Why this answer

The instance's OS firewall or web server configuration may be blocking the TCP connection, even though ping works (ICMP may be allowed). Option A is wrong because ping works, indicating routing and NACL are fine. Option C is wrong because the BGP session status is unrelated to connectivity to the instance.

Option D is wrong because the NACL is stateless and would affect ping as well, so routing is fine.

Full explanation →

1214

MCQeasy

A security engineer needs to ensure that all internet-bound traffic from a VPC is inspected by a third-party firewall appliance before reaching the internet. The firewall is deployed in a separate VPC. Which AWS service should the engineer use to route traffic from the source VPC to the firewall VPC?

A.AWS Transit Gateway with a route table that points the default route (0.0.0.0/0) to the firewall VPC attachment.

B.VPC Gateway Endpoint for the firewall service.

C.AWS PrivateLink to connect to the firewall service in the other VPC.

D.VPC Peering connection between the two VPCs with a route table entry that sends internet traffic to the peering connection.

AnswerA

AWS Transit Gateway supports transitive routing between VPCs. By configuring a route table with a default route pointing to the firewall VPC attachment, all internet-bound traffic from the source VPC is routed through the firewall VPC for inspection.

Why this answer

AWS Transit Gateway enables transitive routing between VPCs. By creating a route table in the Transit Gateway with a default route (0.0.0.0/0) pointing to the firewall VPC attachment, all internet-bound traffic from the source VPC is forwarded to the firewall for inspection before reaching the internet. Option B (VPC Gateway Endpoint) is incorrect because Gateway Endpoints are used for privately accessing AWS services (like S3 or DynamoDB) from a VPC, not for routing traffic to a third-party firewall.

Option C (AWS PrivateLink) is incorrect because PrivateLink allows you to access services hosted in other VPCs via Network Load Balancers and ENIs, but it does not provide transitive routing for internet-bound traffic. Option D (VPC Peering) is incorrect because VPC peering connections do not support transitive routing; you cannot route traffic from one VPC through a peered VPC to another destination.

Full explanation →

1215

MCQmedium

A security engineer is designing a hybrid network with an AWS Site-to-Site VPN. The company requires that all traffic between the on-premises network and VPC be encrypted in transit. Which configuration ensures this requirement is met?

A.Use VPC peering instead of VPN

B.Use AWS Direct Connect with MACsec

C.Deploy a Transit Gateway with route tables

D.Use AWS Site-to-Site VPN with IPsec tunnels

AnswerD

Site-to-Site VPN encrypts all traffic via IPsec.

Why this answer

AWS Site-to-Site VPN inherently uses IPsec tunnels to encrypt all traffic. Option A is wrong because VPC peering does not provide encryption; it uses the AWS network without encryption. Option B is wrong because Direct Connect does not encrypt by default; MACsec is an optional encryption layer but not the standard Site-to-Site VPN.

Option C is wrong because Transit Gateway itself is a network transit hub and does not provide encryption; it can route encrypted VPN traffic but does not encrypt.

Full explanation →

1216

MCQhard

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group behind a Network Load Balancer (NLB). The application requires that all packets from a given client session are sent to the same target instance for the duration of the session. Which feature should be enabled on the NLB to meet this requirement?

A.Enable proxy protocol v2

B.Enable cross-zone load balancing

C.Enable stickiness using the source IP address

D.Configure health checks to mark targets as healthy

AnswerC

NLB uses a consistent hash based on source IP, protocol, and port to route packets from the same client to the same target, ensuring session persistence.

Why this answer

Enabling stickiness using the source IP address on a Network Load Balancer (NLB) ensures that all packets from a given client IP are routed to the same target instance for the duration of the session. This is achieved by the NLB hashing the source IP address (and optionally port and protocol) to consistently select the same target, which meets the requirement for session persistence without relying on application-layer cookies.

Exam trap

The trap here is that candidates often confuse Proxy Protocol v2 with session persistence, thinking that passing client IP information to the backend automatically ensures stickiness, when in fact Proxy Protocol only provides metadata and does not influence load balancer routing decisions.

How to eliminate wrong answers

Option A is wrong because Proxy Protocol v2 is a mechanism for passing client connection metadata (such as source IP and port) to the backend targets, but it does not provide any session persistence or stickiness; it simply adds a header to the forwarded traffic. Option B is wrong because cross-zone load balancing distributes traffic evenly across targets in all Availability Zones, which can actually break session persistence by sending packets from the same client to different targets across zones. Option D is wrong because health checks only determine whether a target is considered healthy or unhealthy for traffic routing; they do not influence which target receives packets from a specific client session.

Full explanation →

1217

Multi-Selecthard

A company is using AWS Direct Connect to connect their on-premises network to AWS. They need to ensure that traffic from a specific on-premises subnet can only access a specific VPC subnet. Which two components must be configured? (Choose two.)

Select 2 answers

A.VPN connection

B.Route tables with specific routes

C.Public virtual interface (VIF)

D.Private virtual interface (VIF)

E.Transit virtual interface (VIF)

AnswersB, D

Route tables ensure traffic from on-premises is directed to the correct VPC subnet.

Why this answer

To restrict traffic from a specific on-premises subnet to a specific VPC subnet using AWS Direct Connect, you need two components. First, a private virtual interface (VIF) is required because it provides connectivity to VPCs (as opposed to public or transit VIFs). Second, route tables with specific routes must be configured on both the on-premises router and the VPC route tables to ensure that traffic is directed to the correct destination subnet.

Option B (Route tables with specific routes) and Option D (Private virtual interface) are correct. Option A (VPN connection) is not needed because Direct Connect itself provides the private connectivity. Option C (Public virtual interface) is incorrect as it is used for accessing public AWS endpoints, not VPC subnets.

Option E (Transit virtual interface) is used for connecting to multiple VPCs via a transit gateway, not for a single VPC subnet.

Full explanation →

1218

MCQmedium

A company is deploying a web application behind an Application Load Balancer (ALB). The application must only accept traffic from the ALB. Which security group configuration should be used for the EC2 instances?

A.Allow inbound from 0.0.0.0/0 on port 80

B.Allow inbound from the ALB security group on port 80

C.Allow inbound from the ALB's private IP addresses on port 80

D.Allow inbound from the VPC CIDR on port 80

AnswerB

Correct. Allowing inbound from the ALB security group on port 80 ensures that only traffic originating from the ALB is accepted, as the ALB's security group is automatically associated with all ALB nodes.

Why this answer

To ensure the EC2 instances only accept traffic from the ALB, the security group should reference the ALB's security group as the source. This is a best practice because the ALB acts as a proxy, and using its security group dynamically allows traffic from any ALB instance, even if the ALB's IP addresses change. Option A is insecure as it allows traffic from any source (0.0.0.0/0).

Option C is not recommended because the ALB's private IP addresses can change (e.g., during scaling or replacement), making static IP rules difficult to maintain. Option D is too broad, as it would allow traffic from any resource within the VPC CIDR, not just the ALB.

Full explanation →

1219

MCQhard

A security team is designing a network architecture that must meet PCI DSS compliance. They have a VPC with multiple subnets and need to ensure that all traffic between subnets is inspected by a stateful firewall. The solution must also support scalability and high availability. Which AWS service should they use?

A.AWS Network Firewall

B.Security groups on each subnet

C.AWS WAF

D.Network ACLs on each subnet

AnswerA

AWS Network Firewall provides stateful inspection, scales automatically, and supports high availability, making it suitable for PCI DSS compliance.

Why this answer

AWS Network Firewall provides stateful inspection, scales automatically, and supports high availability, making it suitable for PCI DSS compliance. Option B (security groups) is wrong because security groups are stateful but operate at the instance level and do not provide centralized traffic inspection between subnets. Option C (AWS WAF) is wrong because it focuses on web application layer (HTTP/S) traffic, not network-layer inspection.

Option D (Network ACLs) is wrong because they are stateless and only provide basic allow/deny rules without stateful inspection.

Full explanation →

1220

MCQeasy

A company is designing a hybrid network using AWS Direct Connect. They want to extend their on-premises network to multiple VPCs in the same AWS Region. Which resource should they use to achieve this?

A.Direct Connect transit virtual interface

B.Direct Connect gateway

C.Direct Connect private virtual interface (VIF)

D.Link Aggregation Group (LAG)

AnswerB

A Direct Connect gateway allows a single private virtual interface to connect to multiple VPCs in the same Region, satisfying the requirement to extend the on-premises network to more than one VPC without provisioning separate virtual interfaces per VPC. This gateway aggregates traffic across VPCs, enabling transitive routing while keeping each VPC’s route table isolated.

Why this answer

A Direct Connect gateway is the correct resource because it allows you to associate up to 10 VPCs (or 20 with a quota increase) in the same or different AWS Regions with a single Direct Connect connection. It acts as a central hub, enabling connectivity from your on-premises network to multiple VPCs via a single private virtual interface (VIF) attached to the Direct Connect gateway, without needing separate VIFs per VPC.

Exam trap

The trap here is that candidates often confuse a Direct Connect gateway with a transit gateway or a private VIF, mistakenly thinking a private VIF alone can connect to multiple VPCs, but AWS requires a Direct Connect gateway to aggregate multiple VPC associations under a single VIF.

How to eliminate wrong answers

Option A is wrong because a Direct Connect transit virtual interface is used to connect to a transit gateway, not directly to multiple VPCs; it requires a transit gateway in between and is typically used for large-scale multi-VPC architectures. Option C is wrong because a Direct Connect private virtual interface (VIF) can only connect to a single VPC (or a Direct Connect gateway) and cannot directly extend to multiple VPCs on its own. Option D is wrong because a Link Aggregation Group (LAG) is a logical bundle of multiple physical connections to increase bandwidth or provide redundancy, but it does not provide the logical routing or multi-VPC connectivity needed for this scenario.

Full explanation →

1221

MCQmedium

A network engineer deploys this CloudFormation template. After deployment, an EC2 instance launched in PublicSubnet1 cannot reach the internet. What is the most likely cause?

A.The Internet Gateway is not attached to the VPC.

B.The subnet does not have a route to the Internet Gateway because the route table is not associated with the subnet.

C.The subnet does not have MapPublicIpOnLaunch set to true.

D.The security group is blocking outbound traffic.

AnswerB

The template does not associate the custom route table with PublicSubnet1; it uses the main route table which lacks the IGW route.

Why this answer

The most likely cause is that the route table containing the default route (0.0.0.0/0) pointing to the Internet Gateway is not associated with PublicSubnet1. Without this association, traffic from the subnet has no path to the Internet Gateway, even if the IGW is attached to the VPC. CloudFormation templates often create separate route tables and subnets, and a missing subnet-to-route-table association is a common misconfiguration.

Exam trap

AWS often tests the distinction between having an Internet Gateway attached to the VPC (which is necessary but not sufficient) and having a proper route table association with a default route to that IGW, leading candidates to mistakenly select Option A when the real issue is the missing subnet-to-route-table linkage.

How to eliminate wrong answers

Option A is wrong because if the Internet Gateway were not attached to the VPC, no subnet in the VPC could reach the internet, but the question specifies only PublicSubnet1 has the issue, implying the IGW is attached. Option C is wrong because MapPublicIpOnLaunch controls whether an auto-assigned public IPv4 address is given to the instance, but even without a public IP, the instance could still reach the internet via a NAT device or an Elastic IP; the core issue is routing, not IP assignment. Option D is wrong because security groups by default allow all outbound traffic (unless explicitly modified), and the question does not indicate any custom outbound deny rule; the problem is at the subnet routing layer, not the instance firewall.

Full explanation →

1222

MCQeasy

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company has an internet gateway attached to the VPC and a NAT gateway in a public subnet. Which route table configuration is required for the private subnets to access the internet?

A.Add a route in the private subnet route table with destination 0.0.0.0/0 and target the internet gateway.

B.Add a route in the private subnet route table with destination 0.0.0.0/0 and target the NAT gateway.

C.Add a route in the public subnet route table with destination 0.0.0.0/0 and target the NAT gateway.

D.Add a route in the private subnet route table with destination 0.0.0.0/0 and target the internet gateway, and associate an Elastic IP with the NAT gateway.

AnswerB

This allows private instances to use NAT for internet access.

Why this answer

Private subnets require a default route (0.0.0.0/0) pointing to the NAT gateway to enable outbound internet access while preventing inbound traffic from the internet. The NAT gateway, residing in a public subnet with an associated Elastic IP, translates private IP addresses to the Elastic IP for internet-bound traffic. The internet gateway is used by public subnets, not private subnets, for direct internet access.

Exam trap

AWS often tests the misconception that private subnets can use the internet gateway directly via a default route, but the trap here is that private subnets must route through a NAT gateway or NAT instance to maintain their private nature and avoid direct inbound internet access.

How to eliminate wrong answers

Option A is wrong because adding a route with destination 0.0.0.0/0 targeting the internet gateway in a private subnet route table would allow direct inbound traffic from the internet, bypassing the NAT gateway and defeating the purpose of a private subnet. Option C is wrong because modifying the public subnet route table does not affect traffic originating from private subnets; private subnets have their own route table that must direct traffic to the NAT gateway. Option D is wrong because associating an Elastic IP with the NAT gateway is already a requirement for its operation, but the route in the private subnet route table must target the NAT gateway, not the internet gateway; targeting the internet gateway would still allow direct internet access without NAT.

Full explanation →

1223

MCQeasy

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team wants to centrally inspect and filter traffic between VPCs using a third-party firewall appliance. Which architecture should be used?

A.AWS PrivateLink endpoints in each VPC

B.AWS Network Firewall deployed in each VPC

C.VPC peering between each VPC and the inspection VPC

D.Transit Gateway with appliance mode and a dedicated inspection VPC

AnswerD

Transit Gateway appliance mode enables symmetric routing for inspection.

Why this answer

Transit Gateway with appliance mode and a dedicated inspection VPC is the correct architecture because it enables symmetric routing, forcing traffic through the inspection VPC for centralized inspection. Option A (AWS PrivateLink) is incorrect; PrivateLink provides private connectivity to services, not traffic inspection between VPCs. Option B (AWS Network Firewall in each VPC) is incorrect because deploying a firewall in each VPC is distributed, not centralized, and does not leverage Transit Gateway.

Option C (VPC peering) is incorrect because VPC peering does not support transitive routing; peering each VPC to an inspection VPC would be complex and does not take advantage of Transit Gateway's centralized routing capabilities.

Full explanation →

1224

Multi-Selectmedium

A company is designing a hybrid network using AWS Direct Connect and a Site-to-Site VPN as a backup. The company has two Direct Connect connections from different providers for redundancy. The company wants to use BGP to automatically fail over to the VPN if both Direct Connect connections fail. Which TWO configurations are required to achieve this?

Select 2 answers

A.Set a higher local preference on the VPN route to make it preferred over Direct Connect.

B.Configure the VPN connection with static routes instead of BGP.

C.Disable route propagation on the VPN connection's route table.

D.Adjust BGP attributes on the Direct Connect routes to be preferred over the VPN routes.

E.Use a VPN connection that supports dynamic BGP routing.

AnswersD, E

By making Direct Connect routes more preferred (e.g., higher local preference), the VPN will only be used when Direct Connect is down.

Why this answer

Setting a higher local preference on Direct Connect routes makes them more preferred over VPN routes under normal conditions. Option E is correct because dynamic BGP routing on the VPN is required to allow automatic failover and route advertisement when Direct Connect fails, enabling BGP to withdraw routes and trigger failover.

Exam trap

The ANS-C01 exam often tests the misconception that you should set a higher local preference on the backup path (VPN) to make it preferred, but the correct approach is to make the primary path (Direct Connect) more preferred so that failover occurs only when the primary is unavailable.

Full explanation →

1225

MCQmedium

A security engineer runs tcpdump on an EC2 instance (10.0.1.5) and sees the output above. The instance is in a private subnet with a security group that allows inbound HTTPS from 0.0.0.0/0. The instance is behind a Network Load Balancer (NLB) that has a public IP. The engineer is unable to establish an HTTPS connection from the internet. What is the most likely cause?

A.The NLB is not preserving the source IP, so the security group is blocking the traffic.

B.The NLB's target group health checks are failing, causing the NLB to consider the instance unhealthy.

C.The instance's operating system firewall is blocking the connection.

D.The security group is blocking inbound traffic from the NLB.

AnswerB

The tcpdump shows the handshake from the NLB, but if health checks fail, the NLB stops sending traffic.

Why this answer

The tcpdump output shows the NLB's health check traffic (SYN packets from the NLB's private IPs) reaching the instance, but the engineer cannot establish an HTTPS connection from the internet. If the target group health checks are failing, the NLB marks the instance as unhealthy and stops forwarding traffic to it, which would prevent any internet HTTPS connections from reaching the instance. This is the most likely cause because the security group allows inbound HTTPS from 0.0.0.0/0, and the NLB does not preserve source IP by default, so the security group is not blocking traffic from the internet.

Exam trap

AWS often tests the misconception that security group rules are the primary cause of connectivity issues with NLBs, but the real trap is that candidates overlook how NLB health checks directly control traffic forwarding, and a failing health check silently drops all traffic even when security groups and routes are correctly configured.

How to eliminate wrong answers

Option A is wrong because the NLB does not preserve source IP by default (it uses its own private IPs as the source), so the security group allowing inbound HTTPS from 0.0.0.0/0 would still permit traffic from the NLB's private IPs; the issue is not about source IP preservation blocking traffic. Option C is wrong because the tcpdump output shows the instance is receiving SYN packets (health checks), indicating the OS network stack is responding; if an OS firewall were blocking, the instance would not receive or respond to any packets, but the tcpdump shows incoming SYN packets. Option D is wrong because the security group explicitly allows inbound HTTPS from 0.0.0.0/0, which includes the NLB's private IPs; the security group is not blocking traffic from the NLB.

Full explanation →

1226

MCQeasy

A company has a VPC with multiple subnets. An EC2 instance in a private subnet needs to access an S3 bucket. Which AWS service should be used to allow this access without traversing the internet?

A.Transit Gateway

B.NAT gateway

C.VPC Gateway Endpoint for S3

D.Internet gateway

AnswerC

Gateway Endpoint allows private access to S3.

Why this answer

A VPC Gateway Endpoint for S3 allows EC2 instances in a private subnet to access S3 buckets without traversing the internet by using AWS's internal network. It uses prefix lists and route table entries to direct S3 traffic through the endpoint, which is horizontally scaled and highly available. This avoids the need for a NAT gateway or internet gateway, keeping traffic within the AWS backbone.

Exam trap

The trap here is that candidates often confuse VPC Gateway Endpoints with VPC Interface Endpoints (powered by PrivateLink) or assume a NAT gateway is required for any outbound traffic, not realizing that S3 and DynamoDB support Gateway Endpoints for direct private access.

How to eliminate wrong answers

Option A is wrong because Transit Gateway is used to interconnect VPCs and on-premises networks, not to provide direct private access to AWS services like S3. Option B is wrong because a NAT gateway enables outbound internet access for private subnets, but it still routes traffic over the internet, which is unnecessary and incurs additional cost for S3 access. Option D is wrong because an internet gateway provides internet access for public subnets, but it requires the EC2 instance to have a public IP or route through a NAT device, violating the requirement to avoid traversing the internet.

Full explanation →

1227

MCQmedium

A company wants to audit all Network Load Balancer (NLB) operations performed in their AWS account. Which AWS service should they use?

A.AWS CloudTrail

B.Amazon CloudWatch Logs

C.AWS Config

D.VPC Flow Logs

AnswerA

CloudTrail records API calls for auditing.

Why this answer

AWS CloudTrail records API calls for all AWS services, including Network Load Balancer (NLB) operations. Therefore, to audit NLB operations, CloudTrail should be used. Option B (Amazon CloudWatch Logs) stores logs but does not natively capture API calls.

Option C (AWS Config) tracks resource configurations and changes, not API operations. Option D (VPC Flow Logs) captures network traffic information, not API calls. Hence, Option A is correct.

Full explanation →

1228

MCQmedium

A company is deploying a global application behind an Application Load Balancer (ALB) in AWS. They want to use AWS Global Accelerator to improve performance by directing traffic to the nearest healthy endpoint. Which configuration is required to achieve this?

A.Create an accelerator with an endpoint group that includes the ALB as an endpoint

B.Configure Route 53 health checks for the ALB and associate them with Global Accelerator

C.Configure a CloudFront distribution with the ALB as an origin and enable Global Accelerator

D.Create a Route 53 latency-based routing record set pointing to the ALB

AnswerA

Global Accelerator directs traffic to the nearest healthy endpoint in the endpoint group.

Why this answer

AWS Global Accelerator uses endpoint groups to direct traffic to the nearest healthy endpoint. By creating an accelerator with an endpoint group that includes the ALB as an endpoint, Global Accelerator can route user traffic over the AWS global network to the optimal ALB based on latency and health, improving performance for global users.

Exam trap

The ANS-C01 exam often tests the misconception that Route 53 latency-based routing or CloudFront can replace Global Accelerator for performance optimization, but the key differentiator is that Global Accelerator uses anycast IPs and the AWS global network for non-cached, dynamic traffic.

How to eliminate wrong answers

Option B is wrong because Route 53 health checks are not used by Global Accelerator; Global Accelerator performs its own health checks on endpoints within endpoint groups. Option C is wrong because CloudFront is a CDN that caches content at edge locations, and while it can use Global Accelerator, the question specifically requires Global Accelerator to direct traffic to the nearest healthy ALB endpoint, not to cache content. Option D is wrong because Route 53 latency-based routing directs traffic to the ALB based on DNS resolution, which does not provide the same performance benefits as Global Accelerator's anycast IP and AWS global network optimization.

Full explanation →

1229

MCQeasy

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. It needs to connect to an on-premises data center via AWS Direct Connect. The on-premises network uses 10.0.0.0/8. Which action should the network engineer take to avoid IP address overlap?

A.Use a NAT gateway to translate the VPC addresses when connecting to on-premises.

B.Use AWS Direct Connect gateway to automatically handle overlapping IPs.

C.Add a secondary CIDR block to the VPC and use it for resources that need to connect to on-premises.

D.Create a new VPC with a non-overlapping CIDR block, such as 172.16.0.0/16, and migrate resources.

AnswerD

Changing the VPC CIDR to a non-overlapping range solves the conflict.

Why this answer

The VPC CIDR 10.0.0.0/16 is a subset of the on-premises 10.0.0.0/8, creating an overlap that prevents Direct Connect routing. AWS does not support overlapping IP spaces across a Direct Connect virtual interface; the only viable solution is to use a non-overlapping CIDR (e.g., 172.16.0.0/16) for the VPC and migrate resources to it.

Exam trap

The ANS-C01 exam often tests the misconception that a NAT gateway or Direct Connect gateway can magically resolve IP overlap, but neither provides NAT for private VIF traffic, and the only correct solution is to avoid overlapping CIDRs entirely.

How to eliminate wrong answers

Option A is wrong because a NAT gateway translates source IPs for outbound traffic to the internet, not for Direct Connect traffic; it cannot resolve overlapping IPs in a private VIF scenario, and AWS does not support NAT for Direct Connect private virtual interfaces. Option B is wrong because a Direct Connect gateway aggregates virtual interfaces and transit gateways but does not perform IP address translation or automatically handle overlapping IPs; overlapping CIDRs still cause routing conflicts. Option C is wrong because adding a secondary CIDR to the VPC does not eliminate the overlap with the on-premises 10.0.0.0/8; the VPC’s primary CIDR (10.0.0.0/16) still overlaps, and both CIDRs are advertised, causing routing ambiguity.

Full explanation →

1230

MCQmedium

A company is designing a multi-region active-active architecture with Amazon Route 53. The application is deployed behind Application Load Balancers (ALBs) in us-east-1 and eu-west-1. The company wants to minimize latency for users and provide automatic failover. Which routing policy should be used?

A.Failover routing policy

B.Geolocation routing policy

C.Latency-based routing policy

D.Weighted routing policy

AnswerC

Latency-based routing directs users to the endpoint with the lowest latency and supports health checks for automatic failover.

Why this answer

Latency-based routing policy is the correct choice because it directs traffic to the AWS region that provides the lowest latency for the end user, which aligns with the requirement to minimize latency. Additionally, Route 53 automatically performs health checks on the ALBs; if one region's ALB becomes unhealthy, Route 53 routes traffic to the healthy region, providing automatic failover in an active-active architecture.

Exam trap

The ANS-C01 exam often tests the misconception that geolocation routing is the best choice for minimizing latency, but geolocation routes based on political boundaries rather than actual network performance, which can lead to suboptimal routing.

How to eliminate wrong answers

Option A is wrong because failover routing policy is designed for active-passive setups where primary and secondary endpoints are explicitly defined; it does not consider latency and would not route users to the lowest-latency region. Option B is wrong because geolocation routing policy routes traffic based on the user's geographic location, not on actual network latency, and it does not provide automatic failover if the endpoint in the designated region becomes unhealthy. Option D is wrong because weighted routing policy distributes traffic based on assigned weights, which does not minimize latency for individual users and does not inherently provide automatic failover based on endpoint health.

Full explanation →

1231

MCQhard

A company has a VPC with a VPN connection to an on-premises data center. They want to ensure that traffic between the VPC and on-premises is encrypted and authenticated. Which two components are required to establish the VPN tunnel?

A.AWS Direct Connect and Direct Connect Gateway

B.Virtual Private Gateway and Customer Gateway

C.Internet Gateway and NAT Gateway

D.Transit Gateway and VPN Attachment

AnswerB

VPG and CGW are the required endpoints for a VPN connection.

Why this answer

A Virtual Private Gateway (VPG) is the AWS-side endpoint, and a Customer Gateway (CGW) represents the on-premises router. Option A (Internet Gateway) is for internet traffic. Option C (Direct Connect) is a different service.

Option D (Transit Gateway) is optional.

Full explanation →

1232

Multi-Selectmedium

A company has a VPC with public and private subnets. The public subnet has a NAT Gateway. The private subnet instances need to access an S3 bucket in the same region. Which THREE steps should the network engineer take to ensure the most cost-effective and secure access without traversing the internet?

Select 3 answers

A.Create a VPC Gateway Endpoint for S3.

B.Attach an endpoint policy that allows access to the specific S3 bucket.

C.Create a VPC Interface Endpoint for S3.

D.Update the route table for the private subnets to include a route to the S3 endpoint.

E.Create a NAT Gateway in the public subnet.

AnswersA, B, D

Gateway Endpoints are free and provide private access to S3.

Why this answer

A VPC Gateway Endpoint for S3 provides private, cost-effective access to S3 without traversing the internet or requiring a NAT Gateway. It uses AWS's internal network and route table entries to direct S3 traffic through the endpoint, avoiding data transfer costs and improving security.

Exam trap

AWS often tests the misconception that Interface Endpoints are required for all AWS services, but for S3 and DynamoDB, Gateway Endpoints are the correct, cost-effective choice, and candidates may incorrectly select Interface Endpoints due to familiarity with other services.

Full explanation →

1233

MCQeasy

A company is using AWS Shield Advanced to protect against DDoS attacks. The security team wants to receive notifications when an attack is detected. Which service should be used to send these notifications?

A.AWS Lambda

B.AWS Config

C.Amazon SQS

D.Amazon SNS

AnswerD

SNS can send notifications via email, SMS, etc., triggered by CloudWatch Events.

Why this answer

AWS Shield Advanced integrates with Amazon CloudWatch to publish metrics and events. These events can be routed via Amazon EventBridge to trigger an Amazon SNS topic, which then sends notifications (e.g., email, SMS) to the security team. Option A (AWS Lambda) is a compute service, not a notification service.

Option B (AWS Config) is used for configuration auditing and compliance, not notifications. Option C (Amazon SQS) is a message queue service; although it can receive events, it is not the service used to send direct notifications to subscribers. Only Amazon SNS (Option D) provides push-based notifications to endpoints like email, SMS, and mobile devices.

Full explanation →

1234

MCQhard

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to connect to the internet for patching. The security team wants to minimize the attack surface. Which solution should be used?

A.Set up a proxy server in the public subnet

B.Attach an Internet Gateway to the private subnet

C.Create a NAT Gateway in the public subnet and update route tables

D.Use a VPN connection to the on-premises network

AnswerC

A NAT Gateway in the public subnet allows the EC2 instance in the private subnet to initiate outbound connections to the internet for patching while preventing unsolicited inbound traffic, thus minimizing the attack surface.

Why this answer

A NAT Gateway in the public subnet allows the EC2 instance in the private subnet to initiate outbound connections to the internet for patching while preventing unsolicited inbound traffic, thus minimizing the attack surface. Option A is incorrect because a proxy server adds unnecessary complexity and overhead compared to a managed NAT Gateway, and it still requires careful configuration to minimize attack surface. Option B is incorrect because an Internet Gateway cannot be attached directly to a private subnet; it is attached to the VPC and requires a public subnet for route propagation.

Option D is incorrect because a VPN connection is designed for hybrid connectivity to on-premises networks, not for general internet access from a VPC.

Full explanation →

1235

MCQeasy

A company is deploying a VPC with public and private subnets. They want to allow instances in a private subnet to access the internet for software updates while preventing inbound internet traffic. Which configuration should be used?

A.Create a VPC endpoint for internet access

B.Use a transit gateway with a NAT instance

C.Attach an internet gateway to the VPC and add a route in the private subnet to the internet gateway for 0.0.0.0/0

D.Attach an internet gateway to the VPC, and create a NAT gateway in a public subnet. Add a route in the private subnet route table to the NAT gateway for 0.0.0.0/0

AnswerD

NAT gateway enables outbound internet from private subnets.

Why this answer

A NAT gateway, deployed in a public subnet with an Internet Gateway (IGW) attached, allows instances in private subnets to initiate outbound IPv4 traffic to the internet (e.g., for software updates) while the IGW's one-way translation prevents unsolicited inbound traffic from reaching the private instances. The private subnet's route table must include a default route (0.0.0.0/0) pointing to the NAT gateway's elastic network interface.

Exam trap

The trap here is that candidates confuse a NAT gateway's outbound-only behavior with an Internet Gateway's bidirectional routing, leading them to incorrectly select Option C, which would allow inbound traffic and violate the security requirement.

How to eliminate wrong answers

Option A is wrong because a VPC endpoint (e.g., Gateway or Interface endpoint) provides private connectivity to specific AWS services (like S3 or DynamoDB) via the AWS network, not general internet access for arbitrary software update servers. Option B is wrong because a transit gateway is used for inter-VPC or on-premises connectivity, not for providing outbound internet access; a NAT instance (a managed EC2 instance) can work but is less reliable and scalable than a NAT gateway, and the transit gateway adds unnecessary complexity. Option C is wrong because adding a route in the private subnet to the internet gateway for 0.0.0.0/0 would directly expose private instances to inbound internet traffic, as the IGW does not perform source NAT; it would allow bidirectional traffic, violating the requirement to prevent inbound internet traffic.

Full explanation →

1236

Multi-Selecthard

A company has a VPC with a CIDR of 10.0.0.0/16 and wants to connect to another VPC with CIDR 10.0.0.0/16 in a different account. The VPCs are in the same region. Which THREE steps are necessary to establish connectivity? (Choose THREE.)

Select 3 answers

A.Change the CIDR block of one VPC to a non-overlapping range.

B.Create VPC endpoints in each VPC for the other VPC's services.

C.Set up a VPN connection between the VPCs.

D.Create a VPC peering connection request from one account and accept it in the other.

E.Update route tables in both VPCs to add routes for the peered VPC CIDR.

AnswersA, D, E

Overlapping CIDRs prevent direct peering.

Why this answer

VPC peering requires non-overlapping CIDR blocks. Since both VPCs use 10.0.0.0/16, they have identical address spaces, which makes routing ambiguous and prevents the peering connection from being established. AWS enforces this rule to ensure that route tables can uniquely direct traffic between the peered VPCs without conflicts.

Exam trap

The ANS-C01 exam often tests the misconception that overlapping CIDRs can be resolved by simply updating route tables, but AWS strictly prohibits VPC peering with overlapping CIDRs, making a CIDR change mandatory before any routing can be configured.

Full explanation →

1237

Multi-Selectmedium

A financial services company is designing a VPC with multiple tiers: web, application, and database. The web tier must be accessible from the internet, but the application and database tiers must not have direct internet access. The company needs to allow the application tier to download patches from the internet. Which THREE components should be included in the design? (Choose three.)

Select 3 answers

A.Direct Connect virtual interface

B.VPC Peering connection

C.Internet Gateway (IGW)

D.NAT Gateway in a public subnet

E.Public subnet for the web tier

AnswersC, D, E

IGW is required for the public subnet to receive internet traffic.

Why this answer

An Internet Gateway (IGW) is required for the web tier to be accessible from the internet. It provides a target in the VPC route tables for internet-routable traffic and performs NAT for instances with public IPs. Without an IGW, the public subnet cannot communicate with the internet.

Exam trap

The ANS-C01 exam often tests the misconception that a NAT Gateway alone provides internet access without an IGW, but the NAT Gateway must be placed in a public subnet that has a route to an IGW to function.

Full explanation →

1238

MCQhard

A company has a VPC with public and private subnets. They launch an Application Load Balancer (ALB) in the public subnets and targets in private subnets. Security requirements dictate that the targets should only accept traffic from the ALB. Which security group configuration meets this requirement?

A.Set the target security group inbound rule to allow HTTP from 0.0.0.0/0.

B.Set the target security group inbound rule to allow HTTP from the ALB security group ID.

C.Set the target security group inbound rule to allow HTTP from the ALB's public IP address.

D.Set the target security group inbound rule to allow HTTP from the VPC CIDR.

AnswerB

This allows traffic only from the ALB's elastic network interfaces.

Why this answer

Referencing the ALB security group by ID in the target security group inbound rule allows traffic only from that specific security group, ensuring that only the ALB can reach the targets. This is a best practice for securing traffic between an ALB and its targets. Option A is incorrect because allowing HTTP from 0.0.0.0/0 would permit traffic from any source, not just the ALB.

Option C is incorrect because the ALB's traffic originates from its elastic network interfaces (ENIs), which are associated with the ALB security group, not a fixed public IP. Option D is incorrect because allowing traffic from the entire VPC CIDR would permit any resource in the VPC to reach the targets, not just the ALB.

Full explanation →

1239

MCQmedium

A network engineer is troubleshooting connectivity issues between an on-premises network and an Amazon VPC over an AWS Direct Connect connection. The on-premises network uses BGP to advertise routes to the VPC. The VPC is associated with a virtual private gateway (VGW). The on-premises network can reach resources in the VPC, but VPC resources cannot reach on-premises resources. What is the most likely cause?

A.The virtual private gateway is not attached to the VPC.

B.The BGP session is not established.

C.The security group associated with the VPC resources is blocking inbound traffic from on-premises.

D.The VPC route tables do not have a route for the on-premises CIDR pointing to the virtual private gateway.

AnswerD

Without a route, VPC traffic destined for on-premises will not be routed to the Direct Connect.

Why this answer

For traffic from the VPC to reach on-premises resources, the VPC route tables must contain a route for the on-premises CIDR block that points to the virtual private gateway (VGW). Since on-premises can reach the VPC, the BGP session is established (so B is incorrect) and the VGW is attached (so A is incorrect). Security groups are stateful and allow return traffic; they do not block outbound-initiated traffic (so C is incorrect).

Full explanation →

1240

Multi-Selectmedium

A company is designing a network for a multi-account AWS environment using AWS Organizations. The company must centralize internet egress for all accounts. Which TWO solutions should the company use? (Choose two.)

Select 2 answers

A.Use VPC Peering to connect all VPCs to the egress VPC.

B.Deploy a AWS Client VPN endpoint in each VPC.

C.Use AWS Transit Gateway to route traffic from all VPCs to the egress VPC.

D.Attach an Internet Gateway to each VPC and allow direct internet access.

E.Create a centralized egress VPC with a NAT Gateway and Internet Gateway.

AnswersC, E

Transit Gateway provides transitive routing.

Why this answer

AWS Transit Gateway acts as a central hub, enabling transitive routing between all attached VPCs. This allows traffic from multiple VPCs to be routed to a centralized egress VPC without requiring complex peering relationships or full mesh connectivity.

Exam trap

AWS often tests the misconception that VPC Peering can be used for transitive routing, but VPC Peering is non-transitive and cannot forward traffic from one peered VPC to another, making Transit Gateway the correct choice for centralized egress.

Full explanation →

1241

MCQhard

A company has an AWS Direct Connect connection with a private VIF to a VPC. They notice that traffic from the on-premises network to the VPC is being routed through the internet instead of the Direct Connect. The VPC route table has a route pointing to the virtual private gateway for the on-premises CIDR. What is the most likely cause?

A.The virtual private gateway is not attached to the VPC

B.The security group on the VPC resources blocks the traffic

C.The on-premises CIDR is more specific than the VPC route table entry

D.The on-premises router is not advertising the prefix via BGP over the Direct Connect

AnswerD

Without BGP advertisement, the route is not propagated to the VPC.

Why this answer

If the on-premises router is not advertising the prefix via BGP over the Direct Connect, the VPC will not have a route to the on-premises network through the Direct Connect, causing traffic to go over the internet. Option A is incorrect because if the virtual private gateway were not attached, the VPC would have no route to the on-premises network at all. Option B is incorrect because security groups do not affect routing decisions; they filter traffic at the instance level.

Option C is incorrect because a more specific route would still use the virtual private gateway, not the internet.

Full explanation →

1242

MCQeasy

A company wants to securely connect their on-premises data center to AWS using a site-to-site VPN. They have multiple branch offices that also need to connect to AWS. Which AWS service should they use to simplify the management of multiple VPN connections?

A.VPC Peering

B.AWS Direct Connect

C.AWS Transit Gateway

D.VPN CloudHub

AnswerC

Transit Gateway provides a hub-and-spoke model to connect multiple VPNs and VPCs.

Why this answer

AWS Transit Gateway (C) acts as a central hub that interconnects VPCs and on-premises networks, allowing you to manage multiple site-to-site VPN connections and branch office attachments through a single gateway. This simplifies routing and reduces operational overhead compared to managing individual VPN connections between each branch and each VPC.

Exam trap

The trap here is that candidates often confuse VPN CloudHub with Transit Gateway, but CloudHub is a simpler, older solution that lacks the centralized management, advanced routing policies, and scalability of Transit Gateway, which is the modern best practice for multi-site VPN connectivity.

How to eliminate wrong answers

Option A is wrong because VPC Peering provides direct connectivity between two VPCs only, and does not support VPN connections to on-premises data centers or branch offices. Option B is wrong because AWS Direct Connect is a dedicated physical connection for high-bandwidth, low-latency links, not a service to simplify management of multiple VPN connections; it also requires separate VPN or Transit Gateway for encryption. Option D is wrong because VPN CloudHub is a legacy AWS solution that uses a single virtual private gateway to connect multiple branch offices via VPN, but it lacks the advanced routing, scalability, and centralized management features of Transit Gateway.

Full explanation →

1243

Multi-Selecthard

A company is designing a hybrid network using AWS Transit Gateway. The company has three VPCs (VPC-A, VPC-B, VPC-C) all attached to the same Transit Gateway. The on-premises network connects to the Transit Gateway via a Direct Connect gateway. The company needs to ensure that VPC-C can communicate with the on-premises network but not with VPC-A or VPC-B. Which TWO actions should the network engineer take?

Select 2 answers

A.Establish a VPN attachment between VPC-C and the Direct Connect gateway.

B.Associate the VPC-C route table with the Direct Connect gateway attachment.

C.Establish VPC peering connections between VPC-C and VPC-A, and VPC-C and VPC-B.

D.Create a separate Transit Gateway route table for VPC-C and do not propagate VPC-A and VPC-B routes.

E.Apply a network ACL on VPC-C subnets to block traffic from VPC-A and VPC-B.

AnswersB, D

Correct: Associating the VPC-C route table with the Direct Connect gateway attachment allows VPC-C to exchange routes with on-premises, enabling communication.

Why this answer

Associating the VPC-C route table with the Direct Connect gateway attachment allows VPC-C to exchange routes with the on-premises network via the Transit Gateway, enabling communication. Option D is correct because creating a separate Transit Gateway route table for VPC-C and not propagating VPC-A and VPC-B routes ensures that VPC-C has no routes to those VPCs, effectively isolating it from them at the network layer. Option A is incorrect because a VPN attachment does not provide connectivity to on-premises via Direct Connect; the Direct Connect gateway attachment is required.

Option C is incorrect because VPC peering enables direct communication between VPCs, which is not desired. Option E is incorrect because network ACLs at the subnet level do not control routing across a Transit Gateway; route table isolation is needed.

Exam trap

The trap here is that candidates often confuse security groups or network ACLs as mechanisms to control inter-VPC traffic across a Transit Gateway, when in fact route table isolation is the correct method to enforce such network segmentation at the transit layer.

Full explanation →

1244

MCQmedium

A network engineer is troubleshooting connectivity issues. The route table shows a blackhole route for 10.0.0.0/8 pointing to a VPC endpoint (vpce-12345678). What is the most likely cause of the blackhole state?

A.The VPC endpoint (vpce-12345678) has been deleted.

B.The VPC CIDR 10.0.0.0/16 is overlapping with the endpoint route.

C.The route table does not have a route to the internet.

D.The internet gateway is not attached to the VPC.

AnswerA

A deleted endpoint results in a blackhole route.

Why this answer

A blackhole route in a VPC route table indicates that the target for the route (in this case, a VPC endpoint) is not in a valid state. When a VPC endpoint (vpce-12345678) is deleted, all routes pointing to it become blackhole routes because the target no longer exists. This causes traffic destined for 10.0.0.0/8 to be dropped silently.

Exam trap

The trap here is that candidates may think a blackhole route is caused by routing conflicts or missing internet connectivity, rather than recognizing that it specifically indicates the target resource (like a VPC endpoint) has been deleted or is in an invalid state.

How to eliminate wrong answers

Option B is wrong because overlapping CIDRs do not cause a blackhole state; overlapping routes are handled by longest prefix match, and the route table would still show the route as active, not blackhole. Option C is wrong because the absence of an internet route does not cause a blackhole state for a specific endpoint route; it would simply prevent internet-bound traffic, not affect the 10.0.0.0/8 route. Option D is wrong because an internet gateway not being attached does not cause a blackhole state for a VPC endpoint route; it would only affect routes targeting the internet gateway.

Full explanation →

1245

MCQhard

An administrator needs to create an interface VPC endpoint for Amazon S3 in a VPC and attach an elastic network interface (ENI) to an EC2 instance. The administrator applies the IAM policy shown in the exhibit. Which action will be DENIED by this policy?

A.Attach the ENI to the EC2 instance

B.Create the VPC endpoint

C.Describe VPC endpoints

D.Modify the VPC endpoint

AnswerB

The policy allows ec2:CreateVpcEndpoint, but the Resource "*" is not sufficient; the action requires the resource to specify the VPC endpoint service ARN. Therefore, this action will be denied.

Why this answer

The IAM policy allows ec2:CreateVpcEndpoint, but the Resource is set to "*" which does not satisfy the resource requirement for this action. The ec2:CreateVpcEndpoint action requires the resource to be the VPC endpoint service (e.g., arn:aws:ec2:region:account-id:vpc-endpoint-service/*). Without a specific resource ARN, the policy does not grant permission to create the endpoint, so the action will be denied.

In contrast, ec2:AttachNetworkInterface, ec2:DescribeVpcEndpoints, and ec2:ModifyVpcEndpoint are allowed by the policy with the wildcard resource.

Full explanation →

1246

MCQhard

A company has a Direct Connect connection with a private VIF to a VPC. They notice that the BGP session is flapping every few minutes. The network team confirms that the customer router and AWS router are configured correctly. What is the MOST likely cause of the BGP flapping?

A.The BGP community string is not set correctly

B.MTU mismatch between the customer router and the AWS Direct Connect endpoint

C.Incorrect BGP ASN configuration on the virtual interface

D.Bidirectional Forwarding Detection (BFD) is not enabled

AnswerB

Packet drops cause BGP session instability.

Why this answer

B is correct because an MTU mismatch between the customer router and the AWS Direct Connect endpoint can cause BGP session flapping. When the MTU is mismatched, larger BGP keepalive or update packets may be fragmented or dropped, leading to hold timer expirations and session resets. This occurs even if both routers are configured correctly for BGP, as the issue lies at the Layer 2/3 boundary rather than the BGP configuration itself.

Exam trap

The ANS-C01 exam often tests the misconception that BGP flapping is always caused by BGP configuration errors (ASN, communities) or missing features like BFD, when in reality Layer 2/3 issues like MTU mismatch are a common root cause in Direct Connect scenarios.

How to eliminate wrong answers

Option A is wrong because BGP communities are optional transitive attributes used for route tagging and policy, not for session stability; an incorrect community string would not cause BGP session flapping. Option C is wrong because an incorrect BGP ASN on the virtual interface would prevent the BGP session from establishing at all, not cause intermittent flapping after it has come up. Option D is wrong because BFD is a fast failure detection mechanism that enhances BGP convergence but is not required for session stability; its absence does not cause flapping.

Full explanation →

1247

MCQmedium

A company has a VPC with public and private subnets. They have a web server in the public subnet that needs to make API calls to Amazon S3. The web server has a public IP. What is the MOST secure way to allow the web server to access S3 without traversing the internet?

A.Create a Gateway VPC Endpoint for S3 and add a route in the public subnet's route table to S3 via the endpoint

B.Place a forward proxy server in the public subnet and configure the web server to use it for S3

C.Create an Interface VPC Endpoint for S3 in the public subnet

D.Set up a NAT Gateway in the same subnet and route S3 traffic through it

AnswerA

Correct; Gateway Endpoint provides private access to S3 without internet.

Why this answer

A Gateway VPC Endpoint for S3 allows resources within a VPC to access S3 over the AWS private network without traversing the internet. By adding a route in the public subnet's route table pointing to the endpoint, the web server can reach S3 privately, even though it has a public IP. This is the most secure option because traffic stays within the AWS backbone and does not require an internet gateway, NAT, or proxy.

Exam trap

The trap here is that candidates often confuse Gateway VPC Endpoints with Interface VPC Endpoints, assuming an interface is needed for all services, but S3 and DynamoDB exclusively use Gateway Endpoints for private connectivity without internet traversal.

How to eliminate wrong answers

Option B is wrong because a forward proxy server would still route traffic through the internet gateway, defeating the requirement to avoid internet traversal and adding unnecessary complexity and latency. Option C is wrong because an Interface VPC Endpoint for S3 is typically used for private subnets or on-premises connectivity via AWS PrivateLink; placing it in a public subnet is unnecessary and does not provide the same cost-effective, high-throughput connectivity as a Gateway Endpoint. Option D is wrong because a NAT Gateway in the same subnet would route S3 traffic through the internet gateway, which violates the requirement to avoid internet traversal and introduces additional cost and latency.

Full explanation →

1248

MCQmedium

A company is deploying a multi-tier web application across multiple AWS accounts. They want to centralize network security by using a shared services VPC with a Transit Gateway. All application VPCs will be attached to the Transit Gateway. The security team needs to inspect and filter traffic between application VPCs. Which solution should be used to meet this requirement?

A.Deploy a Transit Gateway and attach a central inspection VPC with a firewall appliance. Configure route tables to send inter-VPC traffic through the inspection VPC.

B.Create VPC Peering connections between each pair of application VPCs and apply security groups to the peer connections.

C.Use security groups in each application VPC to control traffic between VPCs.

D.Use network ACLs in each application VPC to filter traffic between VPCs.

AnswerA

This architecture allows centralized inspection of all traffic between VPCs by routing it through the inspection VPC.

Why this answer

A Transit Gateway with a central inspection VPC allows you to route all inter-VPC traffic through a firewall appliance for inspection. By configuring route tables on the Transit Gateway, you can force traffic between application VPCs to traverse the inspection VPC, enabling centralized security filtering without requiring point-to-point peering or per-VPC rules.

Exam trap

The ANS-C01 exam often tests the misconception that security groups or network ACLs can filter traffic between VPCs, but they are scoped to a single VPC and cannot inspect traffic traversing a Transit Gateway or VPC Peering connection.

How to eliminate wrong answers

Option B is wrong because VPC Peering connections do not support transitive routing or centralized inspection; each pair must be explicitly peered, and security groups cannot be applied to the peering connection itself—they only apply to resources within a VPC. Option C is wrong because security groups are stateful and operate at the instance level within a single VPC; they cannot filter traffic between VPCs across a Transit Gateway or peering connection. Option D is wrong because network ACLs are stateless and apply only at the subnet level within a single VPC; they cannot filter traffic that traverses a Transit Gateway or VPC Peering connection between different VPCs.

Full explanation →

1249

MCQmedium

A company is troubleshooting connectivity issues between an on-premises network and a VPC connected via AWS VPN CloudHub. The on-premises network uses multiple customer gateways (CGWs) connected to a single virtual private gateway (VGW). The company wants to ensure that all traffic from the VPC to on-premises is routed through a specific CGW. Which configuration should be used?

A.Adjust the BGP local preference on the preferred CGW to a higher value

B.Remove the other CGWs from the VGW

C.Modify the VPN tunnel option to prefer the specific tunnel

D.Configure a static route in the VPC route table pointing to the VGW with a more specific prefix for the on-premises network

AnswerD

Static routes take precedence over BGP routes.

Why this answer

In an AWS VPN CloudHub setup, the VPC route table controls how traffic from the VPC is forwarded to the on-premises network via the virtual private gateway (VGW). By adding a static route with a more specific prefix (e.g., a /24 instead of a /16) for the on-premises network, you force the VPC to prefer that route over any dynamically learned routes from other CGWs, ensuring all traffic uses the designated CGW. This approach leverages the longest prefix match rule in the VPC route table, overriding BGP-learned routes without altering the BGP configuration.

Exam trap

The trap here is that candidates often confuse BGP path selection attributes (like local preference) with VPC route table behavior, assuming they can influence outbound VPC traffic from AWS, when in fact BGP attributes only affect inbound traffic direction from on-premises to AWS.

How to eliminate wrong answers

Option A is wrong because adjusting BGP local preference on the preferred CGW influences inbound traffic direction (from on-premises to AWS), not outbound traffic from the VPC to on-premises; the VPC route table does not consider BGP attributes like local preference. Option B is wrong because removing other CGWs from the VGW would disrupt connectivity to those on-premises locations, which is not a scalable or intended solution for traffic steering. Option C is wrong because modifying the VPN tunnel option (e.g., tunnel preference) affects which tunnel within a single VPN connection is used, not which CGW or VPN connection is selected for traffic from the VPC.

Full explanation →

1250

Multi-Selecteasy

Which TWO AWS services can be used to centrally manage and monitor network traffic across multiple VPCs and on-premises networks?

Select 2 answers

A.AWS Transit Gateway Network Manager

B.Amazon CloudWatch

C.AWS WAF

D.AWS Direct Connect

E.AWS Shield

AnswersA, B

It provides a central dashboard for network connectivity.

Why this answer

AWS Transit Gateway Network Manager provides a central view of network topology and metrics. Amazon CloudWatch can aggregate logs and metrics from multiple sources.

Full explanation →

1251

MCQeasy

A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can read objects. Which policy type should be used?

A.Configure a VPC endpoint policy

B.Configure a network ACL to block all traffic except from the VPC CIDR

C.Use an S3 access point with a network origin condition

D.Attach an S3 bucket policy with a condition for aws:SourceVpc

AnswerD

Bucket policies with aws:SourceVpc condition restrict access to traffic originating from the specified VPC.

Why this answer

S3 bucket policies support condition keys like `aws:SourceVpc` to restrict access to traffic originating from a specific VPC. Option D is correct because attaching a bucket policy with this condition directly limits access to the desired VPC. Option A is incorrect because a VPC endpoint policy controls actions allowed via the endpoint, but does not replace the need for a bucket policy.

Option B is incorrect because network ACLs operate at the subnet level and cannot enforce S3 access restrictions. Option C is incorrect because while S3 access points can have policies, they are not the primary method for restricting access by VPC; a bucket policy with the `aws:SourceVpc` condition is the appropriate approach.

Full explanation →

1252

MCQmedium

Refer to the exhibit. A Direct Connect private virtual interface is in the 'available' state, and the BGP session is up. However, the on-premises network cannot reach any resources in the VPC attached to the Direct Connect gateway. What is the MOST likely cause?

A.The BGP ASN is private and not allowed

B.The VLAN ID is incorrect

C.The Direct Connect gateway is not associated with the virtual private gateway or route propagation is not enabled

D.The BGP session is not established

AnswerC

Routes are not being advertised.

Why this answer

Even though the Direct Connect private virtual interface is in the 'available' state and the BGP session is up, the on-premises network cannot reach VPC resources because the Direct Connect gateway is not associated with the virtual private gateway or route propagation is not enabled. This association is necessary for route exchange between the VPC and on-premises network. Option A is incorrect because the BGP ASN being private is allowed; the BGP session is up indicating ASN is valid.

Option B is incorrect because the VLAN ID is irrelevant once the virtual interface is available and BGP is up. Option D is incorrect because the BGP session is established.

Full explanation →

1253

MCQmedium

A company is setting up a new VPC with a CIDR block of 10.0.0.0/16. They need to create subnets for different tiers: public (web servers), private (application servers), and database (RDS). They want to maximize the number of available IP addresses while ensuring each subnet has at least 256 IP addresses. Which subnet design meets these requirements?

A.Create six /24 subnets (256 IPs each) across two Availability Zones (three per AZ).

B.Create three /25 subnets (128 IPs each) in one Availability Zone.

C.Create six /26 subnets (64 IPs each) across two Availability Zones.

D.Create three /24 subnets (256 IPs each) in one Availability Zone.

AnswerA

/24 provides 256 IPs, and using two AZs provides high availability.

Why this answer

It creates six /24 subnets (each with 256 IP addresses) across two Availability Zones, meeting the requirement of at least 256 IPs per subnet while maximizing total available IPs (1,536 IPs) and providing high availability by distributing subnets across multiple AZs. The /24 subnet mask provides exactly 256 IPs (254 usable) per subnet, which satisfies the minimum requirement without wasting address space.

Exam trap

The trap here is that candidates focus solely on the IP count requirement (at least 256 IPs) and overlook the high-availability requirement implied by 'maximize the number of available IP addresses' and best practices, leading them to choose Option D (three /24 subnets in one AZ) instead of the correct multi-AZ design.

How to eliminate wrong answers

Option B is wrong because /25 subnets provide only 128 IPs (126 usable) per subnet, which does not meet the requirement of at least 256 IP addresses. Option C is wrong because /26 subnets provide only 64 IPs (62 usable) per subnet, far below the 256 IP minimum requirement. Option D is wrong because while it creates three /24 subnets with 256 IPs each, it places all subnets in a single Availability Zone, which violates best practices for high availability and fault tolerance; the requirement to 'maximize the number of available IP addresses' is also not met compared to six subnets.

Full explanation →

1254

MCQeasy

A company is using AWS Direct Connect with a private VIF to connect its on-premises data center to a VPC. The network team wants to monitor the link health and receive alarms if the connection goes down. Which AWS service should they use?

A.Amazon CloudWatch with Direct Connect metrics.

B.Amazon Inspector.

C.AWS Config.

D.VPC Flow Logs.

AnswerA

CloudWatch provides metrics like ConnectionState and BGP status for Direct Connect.

Why this answer

Amazon CloudWatch provides metrics for Direct Connect connections, such as connection state and BGP status, and can trigger alarms. Option B is wrong because Amazon Inspector is for security assessments, not link health monitoring. Option C is wrong because AWS Config tracks configuration changes, not operational status.

Option D is wrong because VPC Flow Logs capture IP traffic logs, not link health.

Full explanation →

1255

MCQeasy

A company wants to provide its employees with secure access to internal applications hosted in a VPC. The employees work remotely and use personal laptops. The solution must authenticate users against the company's existing identity provider (IdP) and must support both Windows and macOS clients. Which AWS service should be used?

A.AWS Transit Gateway

B.AWS Site-to-Site VPN

C.AWS Direct Connect

D.AWS Client VPN

AnswerD

Correct; AWS Client VPN provides remote access with user authentication.

Why this answer

AWS Client VPN is a fully managed, cloud-based VPN solution that allows remote employees to securely access resources in a VPC using their personal laptops. It supports both Windows and macOS clients natively and can integrate with the company's existing identity provider (IdP) via SAML-based authentication, meeting all stated requirements.

Exam trap

The trap here is that candidates often confuse Site-to-Site VPN (which connects networks) with Client VPN (which connects individual users), leading them to select AWS Site-to-Site VPN despite the requirement for remote employee access from personal laptops.

How to eliminate wrong answers

Option A is wrong because AWS Transit Gateway is a network transit hub used to interconnect VPCs and on-premises networks, not a remote access VPN service for individual client devices. Option B is wrong because AWS Site-to-Site VPN creates an encrypted tunnel between two networks (e.g., a corporate data center and AWS), not between individual remote clients and the VPC; it does not support client-level authentication against an IdP. Option C is wrong because AWS Direct Connect provides a dedicated physical network connection from on-premises to AWS, which is not suitable for remote employees using personal laptops and does not include built-in client authentication or support for macOS/Windows clients.

Full explanation →

1256

MCQhard

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access an S3 bucket for backups. The company wants to minimize data transfer costs and avoid traversing the internet. Which solution should be used?

A.Create a VPC Gateway Endpoint for S3 and attach a bucket policy allowing access from the VPC

B.Set up a proxy server in the public subnet and configure the EC2 instance to use it

C.Create a VPC Interface Endpoint for S3 and associate it with the private subnet

D.Place the EC2 instance in a public subnet with a public IP and use a NAT gateway

AnswerA

Cost-effective and private.

Why this answer

A VPC Gateway Endpoint for S3 provides private connectivity to S3 from within the VPC without needing an internet gateway, NAT gateway, or VPN. This minimizes data transfer costs and avoids internet traversal. Option A (Gateway Endpoint) is the correct solution.

Option B (proxy server) introduces additional complexity and cost, and does not avoid internet traversal. Option C (Interface Endpoint) is more expensive and is not necessary because S3 supports Gateway Endpoints. Option D (public subnet with NAT) requires the instance to have a public IP and uses a NAT gateway, which incurs costs and uses the internet.

Full explanation →

1257

Multi-Selecthard

Which THREE of the following are valid considerations when designing a multi-VPC architecture using AWS Transit Gateway? (Choose three.)

Select 3 answers

A.You can route internet-bound traffic from multiple VPCs through a single shared VPC with a NAT gateway.

B.Transit Gateway does not support multicast traffic.

C.You can use separate route tables to isolate traffic between different VPCs.

D.VPCs attached to the same Transit Gateway can have overlapping CIDR blocks.

E.You can attach a Direct Connect Gateway to a Transit Gateway for hybrid connectivity.

AnswersA, C, E

Centralized NAT via Transit Gateway routing.

Why this answer

AWS Transit Gateway allows you to centralize internet-bound traffic by routing it from multiple VPCs through a single shared VPC that contains a NAT gateway. This design reduces costs and simplifies management by avoiding the need for a separate NAT gateway in each VPC, as the Transit Gateway can propagate routes to direct traffic to the shared VPC's NAT gateway for egress to the internet.

Exam trap

The ANS-C01 exam often tests the misconception that Transit Gateway does not support multicast at all, when in fact it does support it with specific configuration requirements, and the trap with overlapping CIDRs is that candidates assume route tables can resolve conflicts, but Transit Gateway requires unique CIDRs across all attached VPCs for proper routing.

Full explanation →

1258

Multi-Selectmedium

A company is using AWS Organizations and wants to centrally manage and enforce the use of VPC endpoints for S3 across all accounts. Which THREE services/tools can be combined to achieve this?

Select 3 answers

A.VPC Flow Logs

B.AWS Config rules

C.AWS CloudFormation StackSets

D.AWS Service Control Policies (SCPs)

E.AWS Transit Gateway

AnswersB, C, D

Config rules can evaluate whether VPC endpoints exist and trigger remediation.

Why this answer

To centrally manage and enforce the use of VPC endpoints for S3 across all accounts in AWS Organizations, you can combine AWS Service Control Policies (SCPs) to allow or deny VPC endpoint creation at the organizational level, AWS CloudFormation StackSets to deploy VPC endpoints consistently across multiple accounts, and AWS Config rules to detect non-compliant resources such as missing VPC endpoints. Option B (AWS Config rules) is correct because it can evaluate compliance and trigger remediation. Option C (AWS CloudFormation StackSets) is correct because it automates deployment of VPC endpoints in target accounts.

Option D (AWS SCPs) is correct because it enforces policies on endpoint creation. Option A (VPC Flow Logs) is wrong because it only logs traffic, not enforce policies. Option E (AWS Transit Gateway) is wrong because it provides network connectivity, not endpoint management.

Full explanation →

1259

Multi-Selectmedium

A company is designing a security group configuration for a three-tier web application (web, application, database). The web tier is accessible from the internet. Which TWO rules should be applied to meet security best practices?

Select 2 answers

A.App tier security group: inbound from 0.0.0.0/0 on port 8080.

B.Database tier security group: inbound from the web tier security group on port 3306.

C.App tier security group: inbound from the web tier security group on port 8080.

D.Web tier security group: inbound from 0.0.0.0/0 on port 443.

E.Database tier security group: inbound from 0.0.0.0/0 on port 3306.

AnswersC, D

The app tier should only accept traffic from the web tier.

Why this answer

In a three-tier architecture, the web tier should be accessible from the internet, so the web tier security group should allow inbound traffic on port 443 (HTTPS) from 0.0.0.0/0 (option D). The application tier should be accessible only from the web tier, so its security group should allow inbound traffic on port 8080 from the web tier security group (option C). The database tier should be accessible only from the application tier, not directly from the web tier or internet.

Therefore, options C and D meet best practices.

Full explanation →

1260

Drag & Dropmedium

Arrange the steps to configure an AWS Client VPN endpoint for remote access:

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

First create certificates, then the endpoint, associate with network, authorize access, then distribute client config.

Full explanation →

1261

MCQhard

A company has multiple VPCs connected via a transit gateway. Each VPC has a security group that allows traffic from the other VPCs' CIDR blocks. The security group rules are getting complex. How can the company simplify security group management while maintaining the same level of security?

A.Use managed prefix lists in security group rules.

B.Use VPC endpoints for inter-VPC communication.

C.Deploy AWS Network Firewall to centralize rules.

D.Replace security groups with network ACLs.

AnswerA

Prefix lists simplify by grouping CIDRs.

Why this answer

Use managed prefix lists. Prefix lists allow you to group CIDR blocks and reference them in security group rules, simplifying management. Option B is wrong because VPC endpoints are for accessing AWS services privately, not for inter-VPC communication.

Option C is wrong because AWS Network Firewall adds another layer of complexity and cost; prefix lists achieve simplification more directly. Option D is wrong because network ACLs are stateless and less granular than security groups, and they cannot use prefix lists for rule simplification.

Full explanation →

1262

MCQeasy

A company has a VPC with a public subnet hosting a web server. They want to make the web server accessible over the internet. The web server has a public IP address. The public subnet route table has a default route (0.0.0.0/0) to an internet gateway. The security group for the web server allows inbound HTTP (port 80) from 0.0.0.0/0. However, external users cannot access the web server. What is the most likely cause?

A.The internet gateway is not attached to the VPC

B.The web server is not listening on port 80

C.The route table for the public subnet does not have a route to the internet gateway

D.The network ACL for the public subnet is blocking inbound HTTP traffic

AnswerA

Internet gateway must be attached for public traffic.

Why this answer

The internet gateway must be attached to the VPC. If it is not attached, traffic cannot flow. Option B (NACL) could be blocking but default NACL allows all traffic.

Option C (web server not listening) is possible but less likely than IGW attachment. Option D (route table) is already correct.

Full explanation →

1263

MCQmedium

A company has set up a Site-to-Site VPN connection between its on-premises network and AWS. The VPN tunnel shows as 'UP' but traffic is not flowing. What should the engineer check?

A.Ensure the customer gateway is configured correctly

B.Verify the security group rules for the VPN connection

C.Check the internet gateway route table

D.Verify that route propagation is enabled on the VPC route table

AnswerD

Without route propagation, the VPC does not know about the on-premises network.

Why this answer

Route propagation from the virtual private gateway to the VPC route table must be enabled. Option A is wrong because the tunnel state is up, so security group is not likely the issue (security group affects instances, not VPN endpoint). Option B is wrong because the internet gateway is for public internet access, not VPN.

Option C is wrong because the customer gateway is the on-premises endpoint; it is configured but if routes are not propagated, traffic won't flow.

Full explanation →

1264

Multi-Selectmedium

A network engineer is troubleshooting high latency on an AWS Transit Gateway that connects multiple VPCs and an on-premises network via AWS Site-to-Site VPN. The engineer wants to identify potential causes. Which TWO actions should the engineer take? (Choose two.)

Select 2 answers

A.Review the NACL rules for each subnet in the VPCs.

B.Review the CloudWatch metrics for the VPN tunnels for packet loss and latency.

C.Enable Transit Gateway Flow Logs to capture traffic between attachments.

D.Re-create the VPN connections to reset the tunnels.

E.Enable VPC Flow Logs on the VPCs attached to the transit gateway.

AnswersB, C

VPN tunnel metrics can indicate performance issues.

Why this answer

CloudWatch metrics for VPN tunnels provide direct visibility into packet loss and latency, which are key indicators of performance issues on the AWS Site-to-Site VPN component of the Transit Gateway. Option C is correct because Transit Gateway Flow Logs capture IP traffic information between attachments, allowing the engineer to analyze traffic patterns, identify drops, and pinpoint which VPC or VPN attachment is contributing to the high latency.

Exam trap

The trap here is that candidates often confuse VPC Flow Logs with Transit Gateway Flow Logs, assuming VPC Flow Logs can diagnose Transit Gateway latency, but VPC Flow Logs lack the attachment-level context and latency metrics needed for this specific troubleshooting scenario.

Full explanation →

1265

MCQhard

A company has a VPC with a CIDR of 172.16.0.0/16. The VPC contains an Amazon RDS for MySQL database in a private subnet. The database is accessed by EC2 instances in the same VPC and by on-premises servers via a Site-to-Site VPN. The network team recently enabled VPC Flow Logs and noticed that the database is receiving a high number of SYN packets from an IP address that is not part of the VPC or on-premises network. The security group for the database only allows inbound traffic on port 3306 from the EC2 instances' security group and the on-premises CIDR (10.0.0.0/8). The network ACL for the database subnet allows inbound and outbound traffic on all ports from all sources. What is the most likely cause of the unexpected traffic?

A.The security group for the database has an inbound rule that allows traffic from 0.0.0.0/0.

B.The RDS database has a public endpoint that is accessible from the internet.

C.The Site-to-Site VPN is misconfigured and routing internet traffic into the VPC.

D.The network ACL for the database subnet allows all inbound traffic, so packets from the internet reach the database subnet's network ACL before being evaluated by the security group.

AnswerD

NACL is stateless and allows all traffic, so packets enter the subnet and are then evaluated by the security group, which drops them.

Why this answer

The network ACL (NACL) is stateless and allows all inbound traffic from any source, including the internet. While the security group (SG) denies the unexpected traffic (since it only allows traffic from the EC2 security group and on-premises CIDR), the NACL permits it. VPC Flow Logs capture traffic at the network interface level after NACL evaluation but before SG evaluation; thus, even though the SG drops the SYN packets, they are logged by Flow Logs because they pass through the NACL.

Option A is incorrect because the security group explicitly restricts inbound traffic to specific sources, not 0.0.0.0/0. Option B is incorrect because the RDS database is in a private subnet and does not have a public endpoint; a public endpoint would have been configured explicitly. Option C is incorrect because the Site-to-Site VPN is configured for the on-premises network only, and the unexpected IP is not from that CIDR; the VPN itself does not route internet traffic into the VPC.

Full explanation →

1266

MCQeasy

A network engineer needs to capture and analyze traffic crossing a VPC peering connection for troubleshooting. Which AWS service should be used?

A.AWS CloudTrail.

B.VPC Traffic Mirroring.

C.AWS Transit Gateway Network Manager.

D.VPC Flow Logs for the peering connection.

AnswerD

Flow Logs capture IP traffic metadata.

Why this answer

VPC Flow Logs capture IP traffic information for network interfaces, including those attached to a VPC peering connection. They can be published to Amazon CloudWatch Logs or Amazon S3, and the logs contain fields such as source/destination IP, ports, protocol, and packet/byte counts, which are essential for troubleshooting traffic across the peering link. This is the correct service because it directly logs metadata about the traffic traversing the peering connection without requiring any changes to the network path.

Exam trap

The trap here is that candidates confuse VPC Flow Logs (which log traffic metadata) with VPC Traffic Mirroring (which captures full packet payloads), but Traffic Mirroring cannot be applied to a peering connection itself, only to individual ENIs within a VPC.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail records API activity (e.g., who created the peering connection) but does not capture network traffic or packet-level data. Option B is wrong because VPC Traffic Mirroring copies packets from an Elastic Network Interface (ENI) for analysis, but it cannot be applied to a VPC peering connection itself; it only works on source or target ENIs within a VPC. Option C is wrong because AWS Transit Gateway Network Manager provides a central view of network topology and metrics for Transit Gateway-based networks, but it does not capture or analyze traffic crossing a VPC peering connection (which is a direct VPC-to-VPC link, not a Transit Gateway attachment).

Full explanation →

1267

MCQmedium

A company uses AWS WAF to protect its web application from common exploits. The security team notices that a specific IP address is generating a high volume of requests and should be blocked immediately. Which action should be taken?

A.Update the AWS WAF IP set rule to block the IP address

B.Add a rule to the security group to deny traffic from that IP

C.Add a network ACL rule to deny traffic from that IP in the subnet

D.Use AWS CloudFront geo-restriction to block the IP

AnswerA

WAF can block specific IPs at the application layer.

Why this answer

AWS WAF allows creating IP set rules to block specific IP addresses. Therefore, the correct action is to update the IP set rule to include the problematic IP. Option A is correct.

Option B is wrong because security groups operate at the network layer and are not integrated with WAF. Option C is wrong because NACLs are stateless and not suitable for application-layer blocking. Option D is wrong because CloudFront geo-restriction blocks based on geographic location, not individual IPs.

Full explanation →

1268

MCQmedium

A company uses AWS Global Accelerator to improve performance for a web application hosted on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The Global Accelerator has an endpoint group in the us-east-1 Region with the ALB as an endpoint. Users in Asia report high latency. The company creates a new endpoint group in ap-southeast-1 and adds the same ALB (which is still in us-east-1). However, users in Asia still experience high latency. What should the network engineer do to reduce latency for Asian users?

A.Change the endpoint in ap-southeast-1 to use the same ALB but with a cross-Region VPC peering

B.Configure Global Accelerator to use weighted routing to direct more traffic to ap-southeast-1

C.Add an additional ALB in ap-southeast-1 and add it as an endpoint in the ap-southeast-1 endpoint group

D.Use Lambda@Edge to cache content at CloudFront edge locations in Asia

AnswerC

Deploying locally reduces latency.

Why this answer

Global Accelerator routes traffic to the nearest endpoint group based on latency. However, if the endpoint (ALB) is only in us-east-1, traffic from Asia will still be forwarded to us-east-1 after reaching the ap-southeast-1 endpoint group because the endpoint itself is in us-east-1. To reduce latency, the company must deploy the application in ap-southeast-1 and add a local ALB as an endpoint in the ap-southeast-1 endpoint group.

Option C correctly describes this. Option A is incorrect because the ALB cannot be in us-east-1 and serve as an endpoint for ap-southeast-1; endpoint group and endpoint must be in the same Region. Option B is incorrect because weighted routing does not change the physical location of the endpoint; the ALB is still distant.

Option D uses CloudFront, which is a CDN, not a Global Accelerator solution, and does not reduce latency for the Global Accelerator use case.

Exam trap

The trap is that the endpoint group with a different endpoint region cannot leverage the regional proximity; you must deploy the application locally.

Full explanation →

1269

MCQeasy

A security group is configured as shown. An EC2 instance in the same VPC with IP 10.0.1.50 can connect to the instance on port 443. An on-premises client with IP 203.0.113.5 cannot connect. What is the most likely reason?

A.The security group's outbound rules block return traffic

B.The protocol is incorrect; HTTPS uses UDP

C.The security group only allows traffic from the 10.0.0.0/16 CIDR

D.The security group has a deny rule for the on-premises IP

AnswerC

On-premises IP is not in that range.

Why this answer

The security group inbound rule only allows traffic from the 10.0.0.0/16 CIDR block. The on-premises client IP (203.0.113.5) is outside that range, so the connection is implicitly denied. Option A is incorrect because security groups are stateful, so return traffic is allowed automatically.

Option B is incorrect because HTTPS uses TCP, not UDP. Option D is incorrect because security groups do not support explicit deny rules; they only have allow rules, and any traffic not matching an allow rule is implicitly denied.

Full explanation →

1270

Multi-Selecthard

A company is designing a network for a real-time data analytics platform that ingests data from thousands of IoT devices. The devices send data via UDP to a UDP-based collector service running on EC2 instances. The collector service must be highly available and scalable. The data is then processed by a stream processing application. The company wants to minimize latency and jitter. Which TWO architectural choices should they make?

Select 2 answers

A.Use AWS Global Accelerator to provide a static anycast IP address and route traffic to the NLB endpoints

B.Use a Network Load Balancer (NLB) with a UDP listener in front of the collector instances

C.Use an Application Load Balancer (ALB) with a TCP listener and configure the collector to receive TCP

D.Use AWS Global Accelerator with EC2 instances as endpoints directly

E.Deploy an internet-facing NLB with Elastic IP addresses in each Availability Zone

AnswersA, B

Global Accelerator reduces latency by using the AWS global network.

Why this answer

AWS Global Accelerator provides static anycast IP addresses that route traffic over the AWS global network to the optimal NLB endpoint, reducing latency and jitter by avoiding public internet hops and using the AWS backbone. This is ideal for UDP-based real-time analytics where consistent performance is critical.

Exam trap

AWS often tests the misconception that Global Accelerator can directly use EC2 instances as endpoints, but it actually requires an NLB, ALB, or Elastic IP as the endpoint target.

Full explanation →

1271

MCQmedium

A company uses AWS Transit Gateway to connect multiple VPCs. Security requirements mandate that traffic between VPCs must be inspected by a centralized firewall appliance in a dedicated inspection VPC. What is the MOST efficient way to route traffic to the inspection VPC?

A.Deploy AWS Network Firewall in each VPC and configure central logging

B.Use Transit Gateway multicast to replicate traffic to the inspection VPC

C.Configure Transit Gateway route tables with blackhole routes for inter-VPC traffic and a default route pointing to the inspection VPC attachment

D.Create VPC peering connections between all VPCs and the inspection VPC, then configure route tables to send traffic through the peering connection

AnswerC

This is correct because using blackhole routes in Transit Gateway route tables blocks direct inter-VPC communication, and a default route to the inspection VPC attachment ensures all traffic between VPCs is sent through the inspection VPC for centralized inspection.

Why this answer

Configuring Transit Gateway route tables with blackhole routes for inter-VPC traffic forces that traffic to be dropped unless a more specific route exists. By adding a default route pointing to the inspection VPC attachment, all inter-VPC traffic is routed through the inspection VPC for centralized firewall inspection. This approach is efficient and scalable.

Option A is incorrect because deploying AWS Network Firewall in each VPC distributes inspection and does not centralize it. Option B is incorrect because Transit Gateway multicast is designed for one-to-many data replication, not for routing traffic through a central inspection point. Option D is incorrect because VPC peering connections do not provide centralized routing control and do not scale well as the number of VPCs increases.

Full explanation →

1272

MCQmedium

A company has a VPC with a public subnet hosting a web server. The security group for the web server allows inbound HTTP (port 80) from 0.0.0.0/0. The network ACL for the public subnet allows inbound HTTP from 0.0.0.0/0. Users report that they cannot access the website. The engineer verifies that the web server is running and has a public IP. What is the most likely issue?

A.The web server is listening on a different port.

B.The network ACL outbound rule is blocking return traffic.

C.The internet gateway is not attached to the VPC.

D.The security group outbound rule is blocking return traffic.

AnswerB

Network ACLs are stateless, so return traffic on ephemeral ports must be explicitly allowed.

Why this answer

Even if inbound rules allow traffic, if the network ACL's outbound rule (stateless) does not allow return traffic (ephemeral ports), the connection will fail. Security groups are stateful and allow return traffic automatically.

Full explanation →

1273

Multi-Selectmedium

A company is designing a network security architecture for a multi-account AWS environment using AWS Organizations. The security team needs to centrally manage and enforce network security policies across all accounts. Which TWO services or features can be used to centrally enforce network security controls? (Choose TWO.)

Select 2 answers

A.AWS Network Firewall

B.Network ACLs

C.AWS Firewall Manager

D.VPC Flow Logs

E.VPC security groups with cross-account references

AnswersA, C

Network Firewall can be centrally deployed and managed using Firewall Manager.

Why this answer

AWS Network Firewall is a managed, stateful firewall service that provides application-layer filtering and intrusion prevention for VPCs. AWS Firewall Manager offers a centralized dashboard to deploy and manage firewall rules across all accounts in an AWS Organization. Together, they enable consistent, centrally enforced network security policies.

In contrast, Network ACLs (option B) are stateless and must be configured per subnet per account—no central management. VPC Flow Logs (option D) capture traffic metadata but do not enforce any rules. Security groups with cross-account references (option E) allow referencing security groups from other accounts but require per-resource attachment and lack central policy enforcement.

Therefore, the two correct services are AWS Network Firewall (A) and AWS Firewall Manager (C).

Exam trap

AWS often tests the distinction between monitoring tools (like VPC Flow Logs) and enforcement tools (like AWS Network Firewall), leading candidates to mistakenly select VPC Flow Logs as a security control.

Full explanation →

1274

MCQhard

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to peer with another VPC with CIDR 10.0.0.0/16. They plan to use a transit gateway to connect the VPCs. What is the correct approach to handle the overlapping CIDR ranges?

A.Create a new VPC with a non-overlapping CIDR and migrate resources from one of the existing VPCs.

B.Create a VPC peering connection and use a smaller subnet CIDR for traffic filtering.

C.Use a transit gateway with network address translation (NAT) to translate one VPC CIDR to a non-overlapping range.

D.Configure the transit gateway with equal-cost multipath (ECMP) to load balance traffic between the overlapping CIDRs.

AnswerA

This resolves the overlap by eliminating it.

Why this answer

Transit gateways do not perform NAT or resolve overlapping CIDR conflicts between attached VPCs. When two VPCs have identical CIDR blocks (10.0.0.0/16), the transit gateway cannot route traffic correctly because it cannot distinguish between the two networks. The only viable solution is to create a new VPC with a non-overlapping CIDR and migrate resources from one of the existing VPCs, eliminating the conflict at the network layer.

Exam trap

AWS often tests the misconception that a transit gateway can perform NAT or otherwise magically handle overlapping CIDRs, but in reality, AWS transit gateways are pure Layer-3 routers that require unique destination prefixes for correct forwarding.

How to eliminate wrong answers

Option B is wrong because a VPC peering connection also requires non-overlapping CIDRs; using a smaller subnet for filtering does not resolve the fundamental routing conflict, as routes are based on the VPC CIDR, not subnets. Option C is wrong because transit gateways do not provide built-in NAT functionality to translate overlapping CIDRs; any NAT would need to be implemented externally (e.g., via a NAT instance or gateway), and the transit gateway itself cannot perform address translation. Option D is wrong because ECMP is used for load balancing across multiple equal-cost paths, but it cannot resolve the routing ambiguity caused by identical destination CIDRs; the transit gateway would still have no way to differentiate traffic destined for 10.0.0.0/16 in one VPC versus the other.

Full explanation →

1275

Multi-Selectmedium

A company is designing a network architecture for a multi-tier web application. The application consists of web servers, application servers, and database servers. The web servers must be accessible from the internet. The application servers should only be accessible from the web servers. The database servers should only be accessible from the application servers. Which TWO actions should the company take to meet these requirements? (Choose two.)

Select 2 answers

A.Use a NAT gateway to allow the web servers to access the internet

B.Use network ACLs to restrict traffic between the tiers

C.Place the web servers in a public subnet and the application and database servers in private subnets

D.Use security groups to restrict traffic between the tiers

E.Place all servers in public subnets and use security groups to restrict traffic

AnswersC, D

Correct; this provides proper isolation.

Why this answer

The correct answers are C and D. Option C: Placing web servers in a public subnet (with an internet gateway) enables internet access, while placing application and database servers in private subnets prevents direct internet access, ensuring they are only reachable from within the VPC. Option D: Security groups act as stateful firewalls at the instance level, allowing fine-grained control over traffic between tiers (e.g., allowing only HTTP from web to app servers, and only database port from app to database servers).

Option A is incorrect because a NAT gateway provides outbound internet access for private instances, not inbound access for web servers. Option B is incorrect because network ACLs are stateless and less granular; while they can restrict traffic between subnets, security groups are the recommended approach for tier-to-tier access control. Option E is incorrect because placing all servers in public subnets exposes application and database servers to the internet unnecessarily, increasing security risk.

Full explanation →

Page 17 of 22

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

Practice ANS-C01 by domain

Target a specific domain to shore up weak areas.

Network Management and Operations Network Security, Compliance and Governance Network Design Network Implementation

See all domains with question counts →