Knowledge + Practice

AWS Certified Advanced Networking Specialty ANS-C01 (ANS-C01) — Questions 1276–1350

1621 questions total · 22pages · All types, answers revealed

Take a mock exam Exam hub

Page 18 of 22

1276

Multi-Selecteasy

A company is using Amazon S3 to store sensitive data. They want to ensure that data is encrypted at rest and that access is logged. Which TWO services should they enable?

Select 2 answers

A.AWS Config

B.S3 Server Access Logs

C.VPC Flow Logs

D.AWS CloudTrail

E.S3 Server-Side Encryption

AnswersB, E

Logs requests to S3.

Why this answer

And E are correct: S3 Server-Side Encryption (SSE) encrypts data at rest, fulfilling the encryption requirement; S3 Server Access Logs log requests to the bucket, fulfilling the logging requirement. Option A (AWS Config) is incorrect because it monitors configuration changes, not data access. Option C (VPC Flow Logs) is incorrect because it captures network traffic, not S3 requests.

Option D (AWS CloudTrail) is incorrect because CloudTrail logs API calls but S3 Server Access Logs provide more granular object-level logging, and the question asks for access logging, not API call logging.

Full explanation →

1277

MCQhard

A company has a VPC with multiple subnets across Availability Zones. An application uses a Network Load Balancer (NLB) to distribute traffic to instances. The security team notices that traffic from a specific client IP is being dropped. The NLB access logs show the client IP, but the target instances do not receive the traffic. What is the most likely cause?

A.The target group health checks are failing, so the NLB is not sending traffic to those targets

B.The target subnet network ACL blocks the client IP

C.The target instance security group does not allow traffic from the NLB

D.The NLB security group blocks the client IP

AnswerA

If health checks fail, the NLB marks the target as unhealthy and stops sending traffic.

Why this answer

If target group health checks fail, the NLB stops sending traffic to the unhealthy targets, even though the client IP is logged by the NLB. The traffic is dropped because NLB does not forward to unhealthy targets. Options B and C are incorrect because network ACLs or security groups would only affect traffic after NLB sends it, but health check failure prevents traffic from being sent at all.

Option D is incorrect because NLB does not have security groups.

Full explanation →

1278

MCQhard

A company has a hybrid network with an AWS Site-to-Site VPN connection to an on-premises data center. The network team wants to ensure that only encrypted traffic is sent over the internet between the two sites. The VPC has a virtual private gateway attached. When testing, they discover that some traffic is going over the internet without encryption. Which configuration change should be made to enforce encryption?

A.Add a static route in the VPC route table for the on-premises CIDR block pointing to the virtual private gateway.

B.Disable route propagation on the VPC route table to remove any dynamic routes from the VPN.

C.Enable IPsec acceleration on the VPN tunnel to ensure all traffic is encrypted.

D.Replace the virtual private gateway with a transit gateway and attach the VPN connection.

AnswerA

A static route forces traffic destined for on-premises through the VPN tunnel, ensuring encryption.

Why this answer

Adding a static route in the VPC route table for the on-premises CIDR block pointing to the virtual private gateway ensures that all traffic destined for the on-premises network is routed through the VPN tunnel, enforcing encryption. Without this static route, traffic might be sent via an internet gateway if a more specific route exists or if route propagation is not properly configured. Option B is incorrect because disabling route propagation would remove dynamic routes from the VPN, but traffic could still go over the internet if there is a route to an internet gateway.

Option C is incorrect because IPsec acceleration is about improving performance, not ensuring all traffic uses encryption; the tunnel already uses IPsec. Option D is incorrect because replacing the virtual private gateway with a transit gateway is not necessary; the issue is routing, not the gateway type.

Full explanation →

1279

MCQeasy

A company wants to provide internet access to instances in a private subnet without using a NAT Gateway, due to cost constraints. They have a public subnet with a bastion host that has a public IP. They also have a VPC with an Internet Gateway. What is the most cost-effective way to allow outbound internet access for instances in the private subnet?

A.Launch a NAT instance in the public subnet and configure the private subnet route table to point 0.0.0.0/0 to the NAT instance.

B.Use a VPN connection to a third-party internet proxy.

C.Create a VPC endpoint for Amazon S3 and configure the private subnet to use it.

D.Configure the bastion host as a NAT instance by enabling IP forwarding.

AnswerA

NAT instance is a cost-effective alternative to NAT Gateway.

Why this answer

Launch a NAT instance in the public subnet and configure the private subnet route table to point 0.0.0.0/0 to the NAT instance. A NAT instance is a cost-effective alternative to NAT Gateway, as it uses an EC2 instance with IP forwarding enabled and can be run on a low-cost instance type. It requires management but avoids NAT Gateway hourly charges.

Option B is incorrect because a VPN connection to a third-party proxy introduces unnecessary complexity and cost. Option C is incorrect because VPC endpoints only provide access to specific AWS services (e.g., S3), not general internet access. Option D is incorrect because the bastion host is typically used for SSH access, and while it could be configured for NAT, it is not recommended for security reasons; a dedicated NAT instance in a public subnet is the proper approach.

Full explanation →

1280

MCQeasy

A company needs to establish a dedicated, low-latency, and consistent network connection from their on-premises data center to AWS. Which AWS service should they use?

A.AWS Site-to-Site VPN

B.AWS VPN CloudHub

C.VPC peering

D.AWS Direct Connect

AnswerD

Direct Connect provides a dedicated, private, low-latency connection.

Why this answer

AWS Direct Connect provides a dedicated, low-latency, and consistent private network connection from on-premises to AWS, bypassing the internet. Option A (Site-to-Site VPN) uses the public internet and is less consistent. Option B (VPN CloudHub) connects multiple on-premises sites to AWS but still relies on the internet.

Option C (VPC peering) connects VPCs within AWS, not on-premises. Therefore, D is correct.

Full explanation →

1281

MCQmedium

A company is migrating its on-premises data center to AWS. The network team needs to establish connectivity between the on-premises network and multiple VPCs in a single AWS Region. The company has a Direct Connect connection and wants to minimize latency and cost while maximizing bandwidth utilization. Which solution meets these requirements?

A.Provision a separate Direct Connect virtual interface for each VPC.

B.Create a VPN connection over the Direct Connect link to each VPC.

C.Use VPC peering between the on-premises network and each VPC.

D.Use a Direct Connect gateway and associate it with the VPCs.

AnswerD

A Direct Connect gateway allows multiple VPCs to share the same Direct Connect connection.

Why this answer

A Direct Connect gateway allows a single Direct Connect connection to connect to multiple VPCs in the same or different AWS Regions, minimizing latency by using a private, dedicated network path and reducing cost by eliminating the need for separate virtual interfaces or VPN tunnels per VPC. It also maximizes bandwidth utilization by aggregating traffic from multiple VPCs over the same Direct Connect link.

Exam trap

AWS often tests the misconception that VPC peering can be used for on-premises connectivity, but VPC peering only works between VPCs and does not support VPN or Direct Connect attachments from on-premises networks.

How to eliminate wrong answers

Option A is wrong because provisioning a separate Direct Connect virtual interface for each VPC would require multiple VLANs and increase operational complexity and cost, and each virtual interface has a bandwidth limit that may not be fully utilized, leading to inefficient bandwidth usage. Option B is wrong because creating a VPN connection over the Direct Connect link adds unnecessary encryption overhead and latency, and each VPN tunnel consumes bandwidth and requires separate configuration, increasing cost and reducing efficiency. Option C is wrong because VPC peering is designed for connectivity between VPCs within AWS, not for connecting an on-premises network to VPCs; it does not support on-premises endpoints and would require additional VPN or Direct Connect attachments to function.

Full explanation →

1282

MCQeasy

A company is designing a network for a three-tier web application. The web tier must be accessible from the internet, while the application and database tiers must be in private subnets. The company wants to minimize the number of load balancers. Which design should be used?

A.Place an internal Application Load Balancer in a private subnet and use a NAT gateway for internet access.

B.Place an internet-facing Network Load Balancer in a public subnet and use it for all tiers.

C.Place an internet-facing Application Load Balancer in a public subnet, web tier instances in public subnets, and app/database instances in private subnets.

D.Place an internet-facing Application Load Balancer in a private subnet.

AnswerC

Allows direct internet access to web tier; app tier remains private.

Why this answer

An internet-facing Application Load Balancer (ALB) in a public subnet can receive internet traffic and forward it to web tier instances in public subnets, while the application and database tiers remain in private subnets with no direct internet access. This design uses a single load balancer to handle all external traffic, minimizing the number of load balancers while maintaining security boundaries.

Exam trap

The trap here is that candidates assume all internal tiers must be in private subnets and forget that the web tier itself must be in public subnets to receive traffic from the internet-facing ALB, or they mistakenly think an internal ALB can be made internet-facing via a NAT gateway.

How to eliminate wrong answers

Option A is wrong because an internal ALB in a private subnet cannot receive traffic directly from the internet; a NAT gateway provides outbound internet access for private instances, not inbound, so the web tier would be unreachable. Option B is wrong because a Network Load Balancer (NLB) operates at Layer 4 and cannot perform content-based routing or inspect application-layer protocols, making it unsuitable for a three-tier web application that typically requires HTTP/HTTPS path-based routing. Option D is wrong because an internet-facing ALB must be placed in a public subnet to have a public IP address and route traffic from the internet; placing it in a private subnet would prevent it from receiving internet traffic.

Full explanation →

1283

MCQhard

A company is designing a network for a critical application that requires high availability across three Availability Zones in a single AWS Region. The application uses Network Load Balancers (NLBs) and Application Load Balancers (ALBs). The company must ensure that cross-zone load balancing is enabled for the NLBs and that the ALBs have a fixed response timeout. Which combination of settings meets these requirements?

A.Disable cross-zone load balancing on the ALB and set the idle timeout on the NLB.

B.Enable cross-zone load balancing on the NLB (default) and set the idle timeout on the ALB to a fixed value.

C.Disable cross-zone load balancing on the NLB and set the connection timeout on the ALB.

D.Enable cross-zone load balancing on the ALB and set the connection timeout on the NLB.

AnswerB

Correct: NLB cross-zone is on by default; ALB idle timeout is configurable.

Why this answer

Cross-zone load balancing is enabled by default on Network Load Balancers (NLBs) and ensures traffic is distributed evenly across targets in all Availability Zones, which is critical for high availability across three AZs. The idle timeout on an Application Load Balancer (ALB) is a fixed value (default 60 seconds, configurable from 1 to 4000 seconds) that controls how long the ALB keeps a connection open without data transfer, meeting the requirement for a fixed response timeout. This combination satisfies both requirements without conflicting settings.

Exam trap

The trap here is that candidates often confuse the cross-zone load balancing capability of NLBs (which can be toggled) with ALBs (which inherently distribute across AZs via target groups), and they mistakenly think ALBs have a 'connection timeout' setting when the correct term is 'idle timeout'.

How to eliminate wrong answers

Option A is wrong because disabling cross-zone load balancing on the ALB is irrelevant (ALBs do not have a cross-zone load balancing toggle; they always distribute across AZs based on the target group settings), and setting the idle timeout on the NLB does not address the ALB's fixed response timeout requirement. Option C is wrong because disabling cross-zone load balancing on the NLB would prevent even distribution of traffic across AZs, undermining high availability, and the ALB does not have a 'connection timeout' setting (it uses idle timeout). Option D is wrong because the ALB does not have a cross-zone load balancing setting to enable (it is inherent to its operation), and setting a 'connection timeout' on the NLB is not a valid configuration (NLBs use idle timeout, not connection timeout).

Full explanation →

1284

MCQmedium

A company has a transit gateway with multiple VPC attachments and an on-premises VPN connection. The network team is seeing asymmetric routing and packet drops. What should they implement to resolve this?

A.Disable equal-cost multipath (ECMP) routing on the Transit Gateway.

B.Create VPC peering connections between all VPCs.

C.Use BGP ASN prepending on the on-premises routers.

D.Enable route propagation from the Transit Gateway to VPC route tables.

AnswerC

Correct. BGP ASN prepending on the on-premises routers makes the VPN path appear less preferred due to a longer AS path, breaking ECMP and ensuring symmetric routing.

Why this answer

BGP ASN prepending on the on-premises routers can influence the path selection by making one path less preferred, thereby breaking the equal-cost multipath (ECMP) behavior that causes asymmetric routing. AWS Transit Gateway does not support disabling ECMP; it always uses ECMP for equal-cost paths. By prepending ASN, the on-premises side advertises routes with a longer AS path, making the VPN path less attractive and forcing all traffic through a single preferred path, resolving asymmetry.

Option A is incorrect because AWS Transit Gateway does not allow ECMP to be disabled. Option B is incorrect because VPC peering does not address routing through a Transit Gateway. Option D is incorrect because route propagation simply advertises routes and does not affect ECMP behavior.

Full explanation →

1285

MCQhard

A company uses AWS Client VPN for remote access. Users report intermittent disconnections. The network engineer notices that the Client VPN endpoint is associated with a single subnet. What change should be made to improve reliability?

A.Split the client CIDR into smaller ranges for each Availability Zone.

B.Associate the Client VPN endpoint with subnets in at least two Availability Zones.

C.Create multiple route tables for the same subnet.

D.Increase the subnet CIDR size to accommodate more clients.

AnswerB

Provides redundancy if one AZ fails.

Why this answer

Associating the Client VPN endpoint with subnets in at least two Availability Zones provides high availability for the VPN tunnel endpoints. If a single subnet (and its underlying AZ) fails or experiences network issues, the Client VPN endpoint can still route traffic through the other AZ's subnet, preventing the intermittent disconnections users are experiencing.

Exam trap

The trap here is that candidates often confuse scaling (increasing CIDR or route tables) with high availability, failing to recognize that a single subnet creates a single point of failure for the entire Client VPN endpoint.

How to eliminate wrong answers

Option A is wrong because splitting the client CIDR into smaller ranges per AZ does not address the single point of failure; the Client VPN endpoint itself remains tied to one subnet, and client CIDR allocation is unrelated to endpoint resilience. Option C is wrong because creating multiple route tables for the same subnet does not add redundancy; route tables control traffic forwarding within a VPC, not the availability of the VPN endpoint. Option D is wrong because increasing the subnet CIDR size only allows more concurrent client connections, but does not mitigate the risk of a single Availability Zone failure causing disconnections.

Full explanation →

1286

Multi-Selecthard

A company is designing a VPC with a CIDR block of 10.0.0.0/16. The VPC must support IPv6 and have subnets in three Availability Zones. The company plans to use an AWS Transit Gateway to connect multiple VPCs. Which TWO actions are required to enable IPv6 communication between VPCs through the Transit Gateway?

Select 2 answers

A.Associate an IPv6 CIDR block with the VPC and enable IPv6 on subnets.

B.Enable IPv6 support on the Transit Gateway and configure route tables to propagate IPv6 routes.

C.Use VPC endpoints to route IPv6 traffic between VPCs.

D.Attach an egress-only internet gateway to the Transit Gateway.

E.Create a NAT gateway and attach it to the Transit Gateway.

AnswersA, B

Required for IPv6 functionality.

Why this answer

To use IPv6 in a VPC, you must associate an IPv6 CIDR block (e.g., a /56 from Amazon's IPv6 pool) with the VPC and enable IPv6 on the subnets by assigning an IPv6 CIDR to each subnet. This ensures that resources in those subnets can have IPv6 addresses. Option B is also correct because to route IPv6 traffic between VPCs through a Transit Gateway, you need to configure the Transit Gateway route tables to include IPv6 routes.

Transit Gateway supports IPv6 natively; there is no separate 'enable IPv6' setting, but the route tables must have entries for the IPv6 CIDRs of the attached VPCs. Without these routes, IPv6 packets will not be forwarded. Options C, D, and E are incorrect because VPC endpoints do not route traffic between VPCs, egress-only internet gateways only allow outbound IPv6 internet access, and NAT gateways are for IPv4 only.

Exam trap

The trap here is that candidates assume Transit Gateway requires a special 'IPv6 enablement' setting or that NAT gateways or egress-only internet gateways are needed for IPv6 inter-VPC routing, when in fact IPv6 routing through Transit Gateway works identically to IPv4 routing—just with IPv6 routes in the route tables.

Full explanation →

1287

MCQeasy

A network engineer is creating an IAM policy for a DevOps team. The team needs to manage VPN connections. What is the effect of this policy?

A.Denies deletion of VPN connections.

B.Allows full management of VPN connections and associated resources.

C.Restricts access to only VPN connections.

D.Allows read-only access to VPN configurations.

AnswerB

All actions are allowed on all resources.

Why this answer

The IAM policy grants the `ec2:*` action on VPN-related resources (`*vpn*`), which includes all VPN connection operations (create, modify, delete, describe) and associated resources like VPN gateways and customer gateways. This full wildcard on VPN resources enables complete lifecycle management, making option B correct.

Exam trap

AWS often tests the misconception that a wildcard resource ARN like `*vpn*` only covers VPN connections, but it actually includes all VPN-related resources (gateways, customer gateways), and the `ec2:*` action allows all operations, not just read or limited management.

How to eliminate wrong answers

Option A is wrong because the policy does not explicitly deny deletion; it allows all actions on VPN resources, including deletion. Option C is wrong because the policy uses a wildcard (`*vpn*`) that covers VPN connections, VPN gateways, and customer gateways, not just VPN connections. Option D is wrong because the policy grants full management actions (e.g., `CreateVpnConnection`, `DeleteVpnConnection`), not just read-only access like `DescribeVpnConnections`.

Full explanation →

1288

MCQmedium

A company has a VPC with public and private subnets. They launch an EC2 instance in a private subnet and need it to access the internet. Which combination of components is required?

A.A NAT Gateway in a public subnet and a default route (0.0.0.0/0) in the private subnet's route table pointing to the NAT Gateway

B.A NAT instance in the private subnet with a route to an Internet Gateway

C.A VPC Gateway Endpoint for S3 in the private subnet

D.An Internet Gateway (IGW) attached to the VPC and a default route (0.0.0.0/0) in the private subnet's route table pointing to the IGW

AnswerA

This allows instances in private subnets to initiate outbound internet traffic through the NAT Gateway.

Why this answer

A NAT Gateway in a public subnet provides outbound-only internet access for instances in private subnets. A default route (0.0.0.0/0) in the private subnet's route table pointing to the NAT Gateway ensures traffic destined for the internet is forwarded to the NAT Gateway, which then translates the source IP to its own Elastic IP and sends the traffic through the Internet Gateway (IGW) attached to the public subnet. This combination allows the EC2 instance to initiate outbound connections (e.g., for software updates) while remaining unreachable from the internet.

Exam trap

The trap here is that candidates often confuse a NAT Gateway with a NAT instance, assuming both can be placed in any subnet, or they incorrectly think a default route to an IGW in a private subnet provides outbound-only access, not realizing the IGW enables bidirectional traffic and thus exposes the instance.

How to eliminate wrong answers

Option B is wrong because a NAT instance must be placed in a public subnet (not a private subnet) to have a route to an Internet Gateway; placing it in a private subnet would prevent it from reaching the internet. Option C is wrong because a VPC Gateway Endpoint for S3 only provides private connectivity to S3 and DynamoDB, not general internet access. Option D is wrong because a default route to an Internet Gateway in a private subnet would directly expose the instance to the internet (since the IGW allows bidirectional traffic), violating the security requirement of keeping the instance private.

Full explanation →

1289

Multi-Selectmedium

A company is designing a network architecture for a critical application that must be highly available across AWS Regions. The application uses an Application Load Balancer (ALB) in each Region, and the company wants to use a global DNS name that automatically routes traffic to the healthy Region with the lowest latency. The company also needs to be able to perform planned failover for maintenance. Which THREE components are required to meet these requirements?

Select 3 answers

A.Amazon Route 53 geolocation routing policy

B.Amazon Route 53 failover routing policy

C.Amazon Route 53 weighted routing policy for each ALB endpoint

D.Amazon Route 53 latency-based routing policy

E.Amazon Route 53 health checks for each ALB endpoint

AnswersC, D, E

Weighted records allow manual traffic shifting for maintenance.

Why this answer

The correct components are a latency-based routing policy to automatically route to the lowest latency healthy region, health checks to determine endpoint health, and a weighted routing policy to enable planned failover by adjusting weights. While latency and weighted routing policies cannot be used simultaneously on the same record set, the question tests the knowledge of the required policies: latency for automatic routing, health checks for failover, and weighted for manual traffic shifting during maintenance. In practice, you would implement latency-based routing with health checks, and for planned maintenance, you would temporarily change the routing policy to weighted or use a separate record.

Exam trap

The ANS-C01 exam often tests the misconception that you can combine multiple routing policies (like latency and weighted) on the same Route 53 record set, but in reality, you cannot. The correct architecture uses latency-based routing with health checks for automatic failover, and a separate weighted routing policy (or a routing policy change) for planned failover.

Full explanation →

1290

Multi-Selectmedium

A network engineer is designing a hybrid network architecture that connects an on-premises data center to AWS using AWS Direct Connect and a VPN connection as a backup. The on-premises network uses BGP to advertise routes to AWS. Which of the following are best practices for this setup? (Choose TWO.)

Select 2 answers

A.Advertise the same routes over both connections with identical BGP attributes.

B.Use different BGP ASNs for the Direct Connect and VPN connections.

C.Use the VPN connection as the primary path and Direct Connect as the backup.

D.Use the same BGP ASN for both the Direct Connect and VPN connections.

E.Configure BGP attributes to ensure that the Direct Connect path is preferred over the VPN path.

AnswersB, E

Different ASNs prevent routing loops and allow proper path selection.

Why this answer

Using different BGP ASNs for the Direct Connect and VPN connections prevents BGP from treating the two connections as a single eBGP session, which would cause routing loops or suboptimal path selection. This separation allows AWS to distinguish between the two paths and apply independent routing policies. Option E is correct because configuring BGP attributes (such as AS path prepending or MED) on the Direct Connect path ensures it is preferred over the VPN backup, aligning with the design goal of using Direct Connect as the primary link.

Exam trap

The trap here is that candidates often think using the same BGP ASN simplifies configuration, but in a dual-connection design, it actually breaks path independence and can cause routing instability or suboptimal failover behavior.

Full explanation →

1291

MCQeasy

A company is deploying a hybrid network architecture with an AWS Site-to-Site VPN connection between its on-premises network and a VPC. The on-premises network uses BGP to advertise routes to the VPN connection. After the VPN is established, the on-premises network cannot reach EC2 instances in the VPC. The VPC route table has a route for the on-premises CIDR block pointing to the VPN gateway. What is the most likely cause of this issue?

A.The VPN connection is not using the correct pre-shared key.

B.The security group attached to the EC2 instances does not allow inbound traffic from the on-premises CIDR.

C.The on-premises network is advertising a default route (0.0.0.0/0) via BGP, which is overriding the VPC's local route.

D.The VPC's network ACLs are blocking inbound traffic from the on-premises network.

AnswerC

BGP route propagation can cause the VPC route table to learn a default route from on-premises, which may cause traffic destined for the VPC CIDR to be sent back to the VPN gateway instead of staying local.

Why this answer

When the on-premises network advertises a default route (0.0.0.0/0) via BGP over the VPN connection, the VPC propagates that route into its route tables (if route propagation is enabled). This default route can override the VPC's local route for the on-premises CIDR, causing traffic destined for the on-premises network to be sent back out the VPN gateway instead of being delivered locally, effectively breaking connectivity to EC2 instances.

Exam trap

The trap here is that candidates often focus on security group or NACL misconfigurations, but the real issue is a routing conflict caused by BGP advertising a default route that overrides the VPC's local route, a classic hybrid networking pitfall.

How to eliminate wrong answers

Option A is wrong because an incorrect pre-shared key would prevent the VPN tunnel from establishing at all, but the question states the VPN is established. Option B is wrong because security groups are stateful and, by default, allow all outbound traffic; the issue is about inbound traffic not reaching the instances, but the root cause is a routing problem, not a firewall rule. Option D is wrong because network ACLs are stateless and, by default, allow all inbound and outbound traffic unless explicitly modified; the question does not indicate any custom NACL changes, so they are not blocking traffic.

Full explanation →

1292

MCQhard

A company needs to securely connect an on-premises data center to AWS using multiple VPN tunnels. The security team requires that all traffic between the VPC and on-premises be encrypted and that the tunnels use a second authentication mechanism beyond pre-shared keys. Which solution meets these requirements?

A.Use AWS Client VPN with mutual authentication

B.Use AWS Transit Gateway with VPN attachments and configure pre-shared keys

C.Use AWS VPN CloudHub with multiple VPN connections and configure certificate-based authentication for each tunnel

D.Use AWS Direct Connect with a public VIF and establish an IPsec VPN over the Direct Connect connection

AnswerC

CloudHub supports multiple tunnels and certificate-based authentication for enhanced security.

Why this answer

AWS VPN CloudHub allows multiple VPN connections with BGP routing and supports certificate-based authentication (mutual TLS) for each tunnel, providing a second authentication mechanism beyond pre-shared keys. Option A is incorrect because AWS Client VPN is designed for individual remote users, not for site-to-site connectivity between an on-premises data center and a VPC. Option B is incorrect because AWS Transit Gateway with VPN attachments uses pre-shared keys by default and does not support certificate-based authentication for the VPN tunnels.

Option D is incorrect because while AWS Direct Connect with a public VIF and an IPsec VPN over it can provide encrypted traffic, the VPN itself typically relies on pre-shared keys, not a second authentication factor.

Full explanation →

1293

Multi-Selectmedium

A company is migrating a legacy application to AWS. The application requires multicast traffic between EC2 instances in the same VPC. Which AWS service can support this requirement?

Select 1 answer

A.AWS VPC Lattice

B.Network Load Balancer (NLB)

C.Application Load Balancer (ALB)

D.Gateway Load Balancer (GWLB)

E.AWS Transit Gateway multicast domain

AnswersE

Correct. AWS Transit Gateway multicast domains allow multicast traffic between EC2 instances in the same VPC or across attached VPCs.

Why this answer

AWS Transit Gateway multicast domains are the only native AWS service that supports multicast traffic between EC2 instances within a VPC. AWS VPC Lattice does not support multicast; it provides service-to-service connectivity using HTTP/HTTPS and TCP. NLB, ALB, and GWLB are load balancers that distribute traffic but do not support multicast.

Exam trap

A common trap is assuming that VPC Lattice supports multicast because it handles service-to-service communication, but it only supports unicast. Another trap is thinking that load balancers can handle multicast. Only Transit Gateway multicast domains provide native multicast support in AWS.

Full explanation →

1294

MCQmedium

A company has a VPC with two subnets: a public subnet with a NAT Gateway and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance has a security group that allows all outbound traffic. The private subnet's route table has a default route (0.0.0.0/0) pointing to the NAT Gateway. However, the instance cannot reach the internet. What is the most likely issue?

A.The security group does not allow inbound traffic from the internet.

B.The NAT Gateway is deployed in a private subnet.

C.The network ACL on the private subnet blocks outbound traffic.

D.The instance's DNS resolution is not configured correctly.

AnswerB

NAT Gateway requires a public subnet with an Internet Gateway to function.

Why this answer

The NAT Gateway must be deployed in a public subnet with an Internet Gateway (IGW) attached to its route table to translate private IP addresses to the IGW's public IP. If the NAT Gateway is in a private subnet, it has no route to the internet, so traffic from the private EC2 instance reaches the NAT Gateway but cannot be forwarded to the internet. This is the most likely issue because the route table correctly points to the NAT Gateway, but the gateway itself lacks internet connectivity.

Exam trap

The ANS-C01 exam often tests the misconception that a NAT Gateway can be placed in any subnet as long as the private subnet's route table points to it, but the trap is that the NAT Gateway must be in a public subnet with an IGW route to function.

How to eliminate wrong answers

Option A is wrong because the security group allows all outbound traffic, and outbound traffic from the instance to the internet does not require inbound rules from the internet; security groups are stateful, so return traffic is automatically allowed. Option C is wrong because the question states the private subnet's route table has a default route to the NAT Gateway, and network ACLs are stateless, but the issue is not about ACLs blocking traffic—the problem is the NAT Gateway's placement, not ACL rules. Option D is wrong because DNS resolution is not required for reaching the internet via a NAT Gateway; the instance can use IP addresses directly, and DNS configuration would not prevent connectivity if the NAT Gateway is misconfigured.

Full explanation →

1295

MCQmedium

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team needs to implement a centralized inspection architecture where all traffic between VPCs must be inspected by a security appliance (e.g., firewall) deployed in a dedicated inspection VPC. Currently, traffic flows directly between VPCs using the Transit Gateway. Which architecture change would enforce that all inter-VPC traffic passes through the inspection VPC?

A.Create VPC peering connections between each VPC and the inspection VPC, and remove the Transit Gateway attachments.

B.Configure the Transit Gateway to use separate route tables for each VPC attachment, with a default route pointing to the inspection VPC's attachment. Then, in the inspection VPC, route traffic back to the Transit Gateway for final delivery.

C.Use AWS Direct Connect Gateway to route traffic through the inspection VPC.

D.Deploy a Network Load Balancer in each VPC and configure it to forward traffic to the inspection VPC.

AnswerB

This design forces all inter-VPC traffic to traverse the inspection VPC for firewall inspection.

Why this answer

By using Transit Gateway route tables, you can create separate route tables for each VPC attachment and propagate only a default route pointing to the inspection VPC. This forces all traffic to go through the inspection VPC. Option A is incorrect because VPC peering does not integrate with Transit Gateway.

Option C is incorrect because Direct Connect Gateway is for on-premises connectivity, not for inter-VPC routing. Option D is incorrect because Network Load Balancer does not provide routing control.

Full explanation →

1296

MCQmedium

A company is setting up a Direct Connect connection to AWS. The on-premises router is configured with a BGP ASN of 64511. The AWS side uses a public ASN of 64512. Which configuration change is required for BGP peering to establish?

A.Increase the eBGP multihop TTL to 2.

B.Configure the BGP peer with a public ASN on the customer side.

C.Enable BGP authentication with MD5 password.

D.Change the customer ASN to a value in the 64512-65534 range.

AnswerD

Direct Connect requires private ASNs for the customer side.

Why this answer

The customer's BGP ASN 64511 is not within the private ASN range 64512-65534 required by AWS Direct Connect. Therefore, the customer must change their ASN to a value in that range to establish BGP peering.

Exam trap

The trap here is that candidates assume any ASN is acceptable for BGP peering, but AWS Direct Connect specifically requires the customer ASN to be in the private range 64512–65534 unless a special request is made to use a public ASN.

How to eliminate wrong answers

Option A is wrong because eBGP multihop TTL is not relevant for Direct Connect; the BGP peers are directly connected over the VLAN, so the default TTL of 1 is sufficient. Option B is wrong because AWS does not require the customer to use a public ASN; in fact, AWS recommends using a private ASN from the 64512–65534 range for the customer side. Option C is wrong because BGP authentication with MD5 is optional and not required for BGP peering to establish; it is a security feature, not a prerequisite.

Full explanation →

1297

MCQhard

A network engineer ran the command shown in the exhibit to check VPC peering connections. Two peering connections are active. The engineer wants to verify that routes are correctly configured. What additional step is needed to ensure that instances in vpc-11111111 can communicate with instances in vpc-33333333?

A.Configure security groups to allow traffic between the VPCs.

B.Enable DNS resolution for the peering connection.

C.Add a route in the route table of vpc-11111111 pointing to vpc-33333333 via the peering connection, and a route in vpc-33333311 pointing to vpc-11111111 via the same peering connection.

D.Ensure that the peering connection is in the 'active' state.

AnswerC

Routes are needed in both VPCs.

Why this answer

For VPC peering to enable communication between instances in different VPCs, route tables in each VPC must have routes pointing to the peering connection. Specifically, vpc-11111111 needs a route to the CIDR of vpc-33333333 via the peering connection, and vpc-33333333 needs a route to the CIDR of vpc-11111111 via the same peering connection. Option A is incorrect because security groups are stateful and allow return traffic, but they do not replace the need for routing.

Option B is incorrect because DNS resolution is optional and not required for IP-based communication. Option D is incorrect because the peering connection is already active, as stated.

Full explanation →

1298

MCQhard

A network engineer is troubleshooting an issue where an on-premises server cannot reach an EC2 instance in a VPC over a Site-to-Site VPN. The VPN tunnel is up, and BGP is established. The engineer checks the route tables and sees the on-premises CIDR in the VPC route table pointing to the virtual private gateway. What is the most likely cause?

A.The VPN tunnel is not passing traffic due to a mismatch in pre-shared keys.

B.The on-premises router does not have a route back to the VPC CIDR pointing to the VPN tunnel.

C.The network ACLs in the VPC are blocking the traffic.

D.The security group attached to the EC2 instance is blocking inbound traffic from the on-premises CIDR.

AnswerB

Without a return route, the on-premises server cannot send traffic back to the EC2 instance.

Why this answer

Although the VPN tunnel is up and BGP is established, the on-premises router must have a route pointing back to the VPC CIDR through the VPN tunnel for return traffic. Without this route, traffic from the EC2 instance to the on-premises server cannot be routed back, causing a one-way connectivity issue. Option A is incorrect because a mismatch in pre-shared keys would prevent the tunnel from coming up.

Option C is incorrect because network ACLs are stateless and would affect traffic in both directions if misconfigured, not just one-way. Option D is incorrect because security group rules affect inbound traffic only; the issue here is return traffic from the EC2 instance, which is outbound from the VPC perspective, and the security group does not control outbound traffic in this context.

Full explanation →

1299

MCQmedium

A company is using AWS Transit Gateway with multiple VPC attachments. They need to ensure that traffic between two specific VPCs is encrypted in transit. The VPCs are in the same AWS region. What is the SIMPLEST solution?

A.Enable encryption on the Transit Gateway route tables

B.Use AWS PrivateLink to connect the VPCs

C.Create a VPN attachment on the Transit Gateway and route traffic through it

D.Use VPC peering instead of Transit Gateway and enable encryption

AnswerC

VPN provides encryption.

Why this answer

Creating a VPN attachment on the Transit Gateway and routing traffic through it provides encryption in transit between VPCs. The VPN attachment establishes an IPsec VPN tunnel over the AWS network, ensuring encryption. Option A is incorrect because Transit Gateway route tables do not provide encryption.

Option B is incorrect because AWS PrivateLink is designed for accessing services, not for VPC-to-VPC encryption. Option D is incorrect because VPC peering does not encrypt traffic by default and is not the simplest solution.

Full explanation →

1300

MCQhard

A company runs a critical application on EC2 instances in an Auto Scaling group across two Availability Zones. The application is fronted by an Application Load Balancer (ALB). The network team recently migrated from a transit VPC to a transit gateway for inter-VPC connectivity. After the migration, users experience intermittent connectivity failures. The team checks the ALB target group and sees that health checks are passing. However, from an EC2 instance in the same VPC, they can reach the ALB but not the application. They notice that the application sends traffic to an internal DNS server that is in a different VPC, and the application depends on that DNS resolution. The transit gateway route tables are configured to propagate routes from attached VPCs. The DNS server is reachable from the application VPC over the transit gateway. What is the MOST likely cause of the intermittent failures?

A.The transit gateway route tables have a blackhole route for the DNS server's VPC.

B.The Auto Scaling group is scaling in and out frequently, causing application instances to be terminated during DNS resolution.

C.The DNS server returns different IP addresses for the same DNS name, and some IPs are not reachable due to route table misconfiguration.

D.The ALB security group does not allow traffic from the application instances on the ephemeral ports.

AnswerC

DNS changes with TTL can cause intermittent reachability to specific IPs.

Why this answer

If the DNS server returns different IP addresses for the same DNS name due to DNS round-robin or time-to-live (TTL) caching, the application may get an IP address that is not reachable (e.g., from a different VPC or a terminated instance). The health check may pass because the target group health check uses the ALB's IP, not the application's DNS resolution. Option A is plausible but less likely because the DNS server is reachable.

Option B could cause total failure, not intermittent. Option D would affect all traffic, not just intermittent.

Full explanation →

1301

MCQhard

A multinational corporation is using AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Direct Connect and VPN. The network team is experiencing asymmetric routing for traffic between two VPCs that both have routes to the same on-premises network. Which feature should the team implement to resolve this issue?

A.Deploy a NAT Gateway in each VPC to force symmetric traffic.

B.Use AS_PATH prepending on the BGP advertisements from the on-premises router to influence route preference.

C.Create a Transit Gateway peering attachment between the two VPCs.

D.Enable VPC Flow Logs to detect and alert on asymmetric flows.

AnswerB

AS_PATH prepending makes one path less preferred, ensuring symmetric routing.

Why this answer

AS_PATH prepending allows the on-premises router to artificially lengthen the AS_PATH for specific BGP routes, making those routes less preferred. This influences route selection in the Transit Gateway and VPC route tables, ensuring that traffic from each VPC takes a consistent path and eliminating asymmetric routing.

Exam trap

The trap here is that candidates often confuse AS_PATH prepending with a general routing policy tool, but the key is that it directly influences BGP best-path selection to break ties and enforce path preference, which is exactly what is needed to fix asymmetric routing in a multi-homed Transit Gateway design.

How to eliminate wrong answers

Option A is wrong because a NAT Gateway is used for outbound-only traffic to the internet and does not enforce symmetric routing between VPCs or between VPCs and on-premises networks; it would also break return traffic from on-premises. Option C is wrong because a Transit Gateway peering attachment connects two Transit Gateways, not two VPCs directly, and does not resolve routing asymmetry caused by equal-cost paths to the same on-premises destination. Option D is wrong because VPC Flow Logs only provide visibility into traffic flows for monitoring and troubleshooting; they do not actively influence routing decisions to fix asymmetric routing.

Full explanation →

1302

MCQmedium

A company uses AWS Organizations with SCPs to restrict access. The security team wants to ensure that no IAM user or role can disable AWS Shield Advanced protections. Which SCP effect should be used?

A.Deny in the IAM policy

B.Deny

C.Allow

D.Block

AnswerB

Deny in an SCP explicitly prohibits the specified actions.

Why this answer

(Deny) is correct because the Deny effect in an SCP explicitly prohibits specified actions, overriding any Allow statements in IAM policies. Option A (Deny in IAM policy) is not an SCP effect; SCPs are separate from IAM policies. Option C (Allow) permits actions but does not restrict, so it cannot be used to enforce prohibitions.

Option D (Block) is invalid; AWS SCPs use Deny, not Block.

Full explanation →

1303

MCQhard

A network engineer is troubleshooting high latency on a VPN connection between an on-premises network and AWS. The VPN uses two tunnels to a virtual private gateway. The engineer notices that traffic is only using one tunnel, and the other tunnel is idle. What should the engineer do to ensure both tunnels are utilized?

A.Create two separate site-to-site VPN connections to two different virtual private gateways and enable ECMP.

B.Configure BGP MED values to prefer the idle tunnel.

C.Configure static routes with equal metrics on both tunnels.

D.Use a transit gateway with equal cost multipath routing.

AnswerA

Using ECMP across multiple VPN connections allows both tunnels to be used simultaneously.

Why this answer

Creating two separate site-to-site VPN connections, each to a different virtual private gateway, and enabling ECMP (Equal Cost Multipath Routing) allows traffic to be load-balanced across both tunnels. AWS site-to-site VPN connections by default operate in active/passive mode, using only one tunnel at a time. To achieve active/active usage, you need multiple VPN connections with ECMP.

Option B (BGP MED) is incorrect because MED influences path selection but cannot force both tunnels to be used simultaneously when the underlying VPN is active/passive. Option C (static routes with equal metrics) is incorrect because static routes do not enable ECMP for a single VPN connection; AWS still treats tunnels as active/passive. Option D (transit gateway with ECMP) is incorrect because while a transit gateway can use ECMP across multiple VPN connections, the original scenario describes a single VPN connection to a virtual private gateway, not a transit gateway.

Full explanation →

1304

MCQeasy

A company is setting up AWS Client VPN to allow remote employees to access resources in a VPC. The VPC has a CIDR block of 10.0.0.0/16. The Client VPN endpoint is associated with a subnet 10.0.1.0/24. The company wants to assign client IP addresses from a different CIDR range than the VPC to avoid overlap. Which client CIDR range should the company specify?

A.172.16.0.0/12

B.10.0.0.0/16

C.10.0.0.0/8

D.192.168.0.0/16

AnswerA, D

172.16.0.0/12 is a private RFC 1918 range that does not overlap with the VPC CIDR (10.0.0.0/16). It is a valid client CIDR range.

Why this answer

The client CIDR range must not overlap with the VPC CIDR (10.0.0.0/16) or any on-premises networks. Both 172.16.0.0/12 (A) and 192.168.0.0/16 (D) are private RFC 1918 ranges that do not overlap, making them valid choices. Options B and C overlap with the VPC CIDR and are invalid.

Note: This question accepts multiple correct answers (multi-select).

Exam trap

Candidates may mistakenly assume only one specific private range is allowed, but any non-overlapping RFC 1918 range works. The trap is focusing on size rather than the overlap condition.

How to eliminate wrong answers

Option A is wrong because 172.16.0.0/12 is a valid private range but is not the only correct answer; more importantly, the question asks for a specific client CIDR, and 172.16.0.0/12 is a large range that could overlap with other networks, but the primary reason it is not the best answer is that it is not explicitly required to be a /16 as per the correct answer. Option B is wrong because 10.0.0.0/16 directly overlaps with the VPC CIDR (10.0.0.0/16), which would cause routing conflicts and is explicitly prohibited by AWS Client VPN design. Option C is wrong because 10.0.0.0/8 is a superset of the VPC CIDR and would also overlap, leading to the same routing issues; AWS requires the client CIDR to be distinct from the VPC CIDR.

Full explanation →

1305

Multi-Selecteasy

A company is deploying a web application that must be accessible over HTTPS only. They are using an Application Load Balancer (ALB) with an SSL certificate from AWS Certificate Manager (ACM). Which TWO configurations are necessary to ensure that only HTTPS traffic reaches the application?

Select 2 answers

A.Configure the security group for the ALB to allow inbound traffic on port 80 from 0.0.0.0/0.

B.Configure the ALB listener to accept traffic on port 80.

C.Configure the security group for the ALB to allow inbound traffic on port 443 from 0.0.0.0/0.

D.Configure the ALB to redirect HTTP traffic to HTTPS.

E.Configure the ALB listener to accept traffic on port 443 using the SSL certificate.

AnswersC, E

This allows HTTPS traffic from the internet.

Why this answer

To ensure only HTTPS traffic reaches the application, the security group for the ALB should allow inbound traffic on port 443 from anywhere (option C), and the ALB listener must be configured to accept traffic on port 443 using the SSL certificate from ACM (option E). Option A is incorrect because allowing port 80 would permit HTTP traffic. Option B is incorrect because an HTTP listener would accept unencrypted traffic.

Option D is incorrect because redirecting HTTP to HTTPS still allows HTTP traffic to reach the ALB initially; the proper approach is to not accept HTTP at all.

Full explanation →

1306

MCQeasy

A company is using AWS Organizations to manage multiple accounts. The security team wants to enforce that all S3 buckets across the organization are encrypted with SSE-S3. Which control mechanism should they use?

A.Assign an IAM policy to all users that requires SSE-S3.

B.Configure a bucket policy on each bucket to deny writes without SSE-S3.

C.Create a service control policy (SCP) that denies PutBucketEncryption if the encryption is not SSE-S3.

D.Use AWS CloudTrail to monitor and alert on non-compliant bucket creations.

AnswerC

SCPs can enforce policies across all accounts in the organization.

Why this answer

A service control policy (SCP) in AWS Organizations can deny PutBucketEncryption unless SSE-S3 is specified, enforcing encryption across all accounts. Option A is wrong because IAM policies are account-level and cannot enforce across all accounts in an organization. Option B is wrong because bucket policies are per-bucket and would require manual configuration on each bucket.

Option D is wrong because CloudTrail is a logging service that does not enforce compliance; it only provides monitoring after the fact.

Full explanation →

1307

MCQmedium

A company is setting up an AWS Site-to-Site VPN connection between its on-premises network and a VPC. The VPC has a virtual private gateway (VGW) attached, and the VPN connection uses two tunnels for redundancy. The on-premises customer gateway (CGW) is configured with the public IP address of the on-premises VPN device. The VPN tunnels are up and BGP sessions are established. However, the company cannot ping an EC2 instance in the VPC from an on-premises server. The security group for the EC2 instance allows ICMP from the on-premises network CIDR. What is the MOST likely cause of the issue?

A.The route tables of the VPC subnets do not have a route for the on-premises CIDR pointing to the virtual private gateway.

B.The customer gateway is configured with an incorrect private IP address.

C.The VPN connection's security group is blocking ICMP traffic.

D.The BGP session is not advertising the on-premises routes to the VGW.

AnswerA

Without a route, traffic from VPC to on-premises is dropped.

Why this answer

The VPC subnet route tables must have a route pointing to the VGW for the on-premises CIDR. Option B is incorrect because BGP is established. Option C is incorrect because the CGW is configured correctly.

Option D is incorrect because the VPN connection does not have a security group.

Full explanation →

1308

MCQeasy

A company monitors its VPC using VPC Flow Logs. The logs are sent to CloudWatch Logs. The security team wants to detect traffic to known malicious IP addresses. Which AWS service can be used to analyze the flow logs in near real-time?

A.AWS WAF

B.AWS CloudTrail

C.Amazon Athena

D.Amazon Kinesis Data Analytics

AnswerD

Can process streaming flow logs in real-time and detect patterns.

Why this answer

Amazon Athena can query VPC Flow Logs stored in S3, but for near real-time analysis, Amazon Kinesis Data Analytics (or Kinesis Data Firehose with Lambda) can process streaming logs. However, the simplest managed service for real-time pattern matching is Amazon Kinesis Data Analytics with SQL.

Full explanation →

1309

MCQeasy

A company has a VPC with public and private subnets. The private subnets need internet access for software updates. The company wants to minimize costs and management overhead. Which solution should they use?

A.Use a VPC endpoint for S3 and CloudFront

B.Attach an internet gateway to the VPC and add a default route to the private subnet route table pointing to the internet gateway

C.Create a NAT gateway in a public subnet and add a route to the private subnet route table pointing to the NAT gateway

D.Launch a NAT instance on an EC2 instance in a public subnet

AnswerC

Managed service, low overhead.

Why this answer

A NAT gateway deployed in a public subnet allows instances in private subnets to initiate outbound traffic to the internet for software updates while preventing inbound internet traffic, and it is a fully managed service requiring minimal overhead. Option A (VPC endpoints) only provides access to specific AWS services like S3 and CloudFront, not general internet. Option B (attaching an IGW and adding a default route to private subnets) would make the private subnets effectively public, allowing unsolicited inbound connections and violating security best practices.

Option D (NAT instance) requires manual configuration, patching, and scaling, increasing management overhead compared to a NAT gateway.

Full explanation →

1310

MCQmedium

A company uses AWS Direct Connect with a private virtual interface (VIF) to connect its data center to a VPC. The network team needs to ensure high availability and failover in case the primary connection fails. Which solution provides the most cost-effective high availability?

A.Use a VPN connection over the internet as a backup

B.Provision a second Direct Connect connection at a different AWS Direct Connect location and configure BGP with AS_PATH prepending

C.Use a VPN connection over the same Direct Connect connection as backup

D.Provision a second private virtual interface on the same Direct Connect connection

AnswerB

Provides diverse path and failover.

Why this answer

Provisioning a second Direct Connect connection at a different AWS Direct Connect location provides geographic redundancy, and configuring BGP with AS_PATH prepending on the secondary connection ensures the primary connection is preferred under normal conditions. This offers high availability without relying on internet-based VPN, which, while cheaper, introduces variability and lower reliability. Option A (VPN over internet) is less costly but does not guarantee the same level of performance or reliability for hybrid networking.

Option C (VPN over same Direct Connect) fails because it shares the same physical connection, creating a single point of failure. Option D (second private VIF on same connection) also shares the same physical infrastructure, so it does not provide true redundancy.

Full explanation →

1311

MCQmedium

A network engineer is designing a hybrid network architecture that connects an on-premises data center to AWS using AWS Direct Connect. The company requires high availability and wants to minimize operational overhead. The on-premises network uses BGP to advertise routes to AWS. Which design meets these requirements?

A.Provision two Direct Connect connections to two different Direct Connect locations, each with a private VIF to the same VPC. Use BGP over the VIFs.

B.Provision one Direct Connect connection with a private VIF and a site-to-site VPN connection as a backup.

C.Provision one Direct Connect connection with two virtual interfaces (VIFs) to the same AWS device.

D.Provision two Direct Connect connections to the same Direct Connect location, both with private VIFs to the same VPC.

AnswerA

This provides physical and logical diversity, achieving high availability with minimal operational overhead.

Why this answer

Provisioning two Direct Connect connections to two different Direct Connect locations ensures physical and path diversity, eliminating single points of failure. Using BGP over the private VIFs allows dynamic route advertisement and automatic failover, meeting high availability requirements while minimizing operational overhead through managed BGP sessions.

Exam trap

AWS often tests the misconception that multiple VIFs on a single connection or connections to the same location provide sufficient redundancy, but true high availability requires physical and geographic diversity at the connection level.

How to eliminate wrong answers

Option B is wrong because a site-to-site VPN backup over the internet introduces higher latency, lower reliability, and additional operational overhead compared to a second Direct Connect connection, and it does not meet the requirement to minimize operational overhead. Option C is wrong because two VIFs on the same Direct Connect connection share the same physical link and AWS device, creating a single point of failure that violates high availability. Option D is wrong because two Direct Connect connections to the same location share the same facility and potential upstream failures, lacking the geographic diversity needed for true high availability.

Full explanation →

1312

Multi-Selecthard

A company is using AWS Direct Connect with a private VIF to connect its on-premises network to a VPC. The VPC has a CIDR 10.0.0.0/16. The on-premises network uses 192.168.0.0/16. The company wants to enable communication between on-premises and the VPC, and also allow the VPC to access the internet via an internet gateway. Which TWO of the following configurations are necessary?

Select 2 answers

A.A route in the on-premises router for the VPC CIDR (10.0.0.0/16) pointing to the AWS Direct Connect router.

B.A route in the VPC route table for 0.0.0.0/0 pointing to the internet gateway.

C.A route in the VPC route table for 0.0.0.0/0 pointing to the virtual private gateway.

D.A route in the VPC route table for the on-premises CIDR (192.168.0.0/16) pointing to the internet gateway.

E.A route in the VPC route table for the on-premises CIDR (192.168.0.0/16) pointing to the virtual private gateway.

AnswersB, E

Required for VPC internet access.

Why this answer

An internet gateway (IGW) provides internet access for a VPC, and the VPC's main route table must include a default route (0.0.0.0/0) pointing to the IGW for outbound internet traffic. This allows instances in the VPC to reach the internet, which is a stated requirement. Without this route, traffic destined for the internet would have no path.

Exam trap

The ANS-C01 exam often tests the misconception that a default route (0.0.0.0/0) should point to the virtual private gateway when using Direct Connect, but the correct configuration for internet access is to point it to the internet gateway, while the on-premises CIDR route points to the VGW.

Full explanation →

1313

MCQmedium

A company is implementing a network for a three-tier application in a VPC. They need to ensure that the web tier can communicate with the application tier, but the application tier cannot initiate connections to the web tier. Which configuration should be used?

A.Use network ACLs on the application tier subnets to allow inbound from web tier and block outbound to web tier

B.Use a transit gateway with route tables to control traffic flow

C.Place a reverse proxy between the tiers

D.Use security groups on the application tier instances to allow inbound from the web tier security group, and do not allow inbound from application tier in the web tier security group

AnswerD

Stateful security groups allow responses and block unwanted initiation.

Why this answer

Security groups are stateful and can be configured to allow inbound traffic from the web tier security group to the application tier instances, while the web tier security group only allows inbound from the application tier's security group on specific ports (if needed) and does not allow inbound from the application tier. This prevents the application tier from initiating connections to the web tier. Option A is wrong because network ACLs are stateless and would require explicit inbound and outbound rules to control the direction, but they do not track connection state and are more complex to configure for this requirement.

Option B is wrong because a transit gateway is used for connecting multiple VPCs or on-premises networks, not for controlling traffic direction between tiers within the same VPC. Option C is wrong because a reverse proxy is used to forward requests from clients to servers, not to restrict initiation of connections.

Full explanation →

1314

MCQeasy

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to peer with another VPC that has CIDR 10.0.0.0/16. What is the issue and how can it be resolved?

A.The VPCs can be peered if you enable DNS resolution.

B.The VPCs have overlapping CIDRs, so they cannot be directly peered. You must re-IP one VPC or use a NAT solution.

C.Use a Transit Gateway to connect the VPCs, which supports overlapping CIDRs.

D.Use a Direct Connect Gateway to connect the VPCs, which ignores CIDR overlap.

AnswerB

Correct: Overlapping CIDRs are not allowed.

Why this answer

VPC peering requires non-overlapping CIDR blocks because the route tables in each VPC must have distinct destination prefixes to route traffic correctly. When both VPCs use 10.0.0.0/16, the routes are identical, causing ambiguity and preventing the peering connection from being established. The only resolution is to change the CIDR of one VPC or use a NAT-based solution to translate addresses.

Exam trap

The trap here is that candidates assume a Transit Gateway or Direct Connect Gateway can magically handle overlapping CIDRs, but AWS requires unique CIDRs for direct routing between VPCs unless you introduce NAT or translation layers.

How to eliminate wrong answers

Option A is wrong because enabling DNS resolution does not resolve CIDR overlap; DNS resolution only allows private DNS hostname resolution across peered VPCs, not address space conflicts. Option C is wrong because AWS Transit Gateway also requires non-overlapping CIDRs for direct routing between attached VPCs; it does not support overlapping CIDRs without additional NAT or translation mechanisms. Option D is wrong because a Direct Connect Gateway is used for connecting on-premises networks to multiple VPCs, not for VPC-to-VPC peering, and it does not ignore CIDR overlap—overlapping CIDRs still cause routing conflicts.

Full explanation →

1315

MCQmedium

A company wants to enforce that all outbound traffic from its VPC flows through a centralized inspection VPC for security monitoring. The VPCs are connected via Transit Gateway. Which set of actions should a network engineer take to ensure that traffic from application VPCs is routed to the inspection VPC before reaching the internet?

A.Create VPC peering connections between each application VPC and the inspection VPC, and add routes pointing to the peering connection.

B.Attach an internet gateway to each application VPC and add a default route pointing to the inspection VPC's NAT gateway.

C.Attach an internet gateway to each application VPC and add default route pointing to it.

D.Create a TGW route table with a blackhole route for 0.0.0.0/0 and associate it with application VPC attachments; attach the inspection VPC to a different TGW route table that has a route to the internet via an egress VPC.

AnswerD

This enforces traffic flow through inspection VPC.

Why this answer

It uses separate Transit Gateway route tables to enforce traffic isolation: the application VPC attachments use a route table with a blackhole for 0.0.0.0/0, preventing direct internet access, while the inspection VPC uses a different route table with a route to an egress VPC that has an internet gateway. This ensures all outbound traffic from application VPCs must first traverse the inspection VPC for security monitoring before reaching the internet.

Exam trap

The trap here is that candidates often assume VPC peering or direct internet gateway attachments can be combined with Transit Gateway for centralized inspection, but they fail to recognize that Transit Gateway route tables are required to enforce traffic isolation and prevent direct internet access from application VPCs.

How to eliminate wrong answers

Option A is wrong because VPC peering does not support transitive routing; each peering connection is a one-to-one link, so traffic from one application VPC cannot be routed through the inspection VPC to another VPC or the internet without additional complex routing. Option B is wrong because an internet gateway attached to an application VPC would allow direct outbound traffic, bypassing the inspection VPC; the default route pointing to the inspection VPC's NAT gateway is invalid because a NAT gateway cannot be reached across a Transit Gateway without proper routing and the NAT gateway itself is not a routing target for a VPC's default route. Option C is wrong because attaching an internet gateway to each application VPC and adding a default route pointing to it directly sends traffic to the internet, completely bypassing the centralized inspection VPC.

Full explanation →

1316

MCQhard

A company is migrating its on-premises data center to AWS. The network team needs to establish a site-to-site VPN connection with dynamic routing using BGP. The on-premises router supports BGP but does not support BGP communities. The VPN connection is established, but the VPC does not learn the on-premises routes. What is the most likely cause?

A.The VPN tunnel uses pre-shared keys instead of certificates

B.The VPC route table needs a static route to the on-premises CIDR

C.The VPN tunnel is not in a UP state

D.The on-premises router is not advertising any prefixes over BGP

AnswerD

Without advertisement, no routes are learned.

Why this answer

For the VPC to learn on-premises routes via BGP, the on-premises router must advertise its prefixes over the BGP session. Without any route advertisement, the VPC cannot learn the routes regardless of VPN tunnel status. Option A is incorrect because authentication method (pre-shared keys vs certificates) does not affect route advertisement.

Option B is incorrect because with dynamic routing using BGP, a static route is not required; BGP automatically exchanges routes if both peers advertise them. Option C is incorrect because the scenario states the VPN connection is established, implying the tunnel is UP.

Full explanation →

1317

MCQhard

A company has a VPC with a CIDR block of 10.0.0.0/16. The VPC has three subnets: 10.0.1.0/24, 10.0.2.0/24, and 10.0.3.0/24. An EC2 instance in subnet 10.0.1.0/24 needs to send traffic to an on-premises server at 10.0.0.5/32 via a VPN connection. The VPC route table has a route to the VPN gateway for 10.0.0.0/8. What is the expected behavior?

A.Traffic to 10.0.0.5 is sent to the internet gateway.

B.Traffic to 10.0.0.5 is routed through the VPN gateway.

C.Traffic to 10.0.0.5 stays within the VPC.

D.Traffic to 10.0.0.5 is dropped because there is no matching route.

AnswerC

The VPC's local route matches 10.0.0.5.

Why this answer

The VPC's CIDR is 10.0.0.0/16, and the destination 10.0.0.5/32 falls within this range. AWS VPCs use the most specific route that matches the destination IP, and the local route (10.0.0.0/16) is automatically added to all VPC route tables. Since 10.0.0.5/32 is a subset of 10.0.0.0/16, the local route takes precedence over the VPN route (10.0.0.0/8) because it is more specific (longer prefix length).

Therefore, traffic destined to 10.0.0.5 stays within the VPC and is not sent to the VPN gateway.

Exam trap

The ANS-C01 exam often tests the misconception that a route to a larger CIDR (like 10.0.0.0/8) will override a more specific local route (like 10.0.0.0/16), but AWS always uses the longest prefix match, so the local route takes precedence.

How to eliminate wrong answers

Option A is wrong because the route table does not have a route to an internet gateway for 10.0.0.5, and the destination is a private IP within the VPC CIDR, so traffic is not sent to the internet gateway. Option B is wrong because although there is a VPN route for 10.0.0.0/8, the local route for 10.0.0.0/16 is more specific (longer prefix length), so the VPN route is not used for destinations within the VPC CIDR. Option D is wrong because there is a matching route: the local route for 10.0.0.0/16, which covers the destination 10.0.0.5/32, so traffic is not dropped.

Full explanation →

1318

MCQeasy

A company wants to securely store and manage secrets such as database passwords and API keys. They need to automatically rotate secrets every 30 days and ensure that only specific IAM roles can access them. Which AWS service should they use?

A.AWS Systems Manager Parameter Store

B.AWS Key Management Service (KMS)

C.AWS Secrets Manager

D.AWS CloudHSM

AnswerC

Secrets Manager is designed for storing secrets with built-in rotation capability and fine-grained access control using IAM policies.

Why this answer

AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, managing, and automatically rotating secrets such as database passwords and API keys. It supports native rotation with AWS Lambda, enforces fine-grained access control via IAM roles, and can rotate secrets on a schedule (e.g., every 30 days) without custom scripting.

Exam trap

The trap here is that candidates often confuse AWS Systems Manager Parameter Store (which can store secrets securely but lacks native rotation) with AWS Secrets Manager, leading them to choose Parameter Store when automatic rotation is explicitly required.

How to eliminate wrong answers

Option A is wrong because AWS Systems Manager Parameter Store does not support automatic rotation of secrets; it requires custom solutions (e.g., Lambda) to rotate values and lacks native secret rotation scheduling. Option B is wrong because AWS Key Management Service (KMS) is a key management service for encryption keys, not a secret store; it does not store secrets or provide rotation capabilities for passwords or API keys. Option D is wrong because AWS CloudHSM provides dedicated hardware security modules (HSMs) for cryptographic operations and key storage, but it does not store or manage application secrets like database passwords or API keys, nor does it offer automatic rotation.

Full explanation →

1319

Multi-Selecthard

A company is designing a network for a global application that requires low latency between users and application servers. They plan to use multiple AWS regions and want to route users to the nearest healthy endpoint. Which THREE services should they use together? (Select THREE.)

Select 3 answers

A.Amazon CloudFront

B.Amazon Route 53 with latency-based routing

C.AWS Global Accelerator

D.AWS WAF

E.Application Load Balancer in each region

AnswersA, B, C

Correct: Caches content at edge, reducing latency.

Why this answer

Amazon CloudFront is correct because it provides a global content delivery network (CDN) that caches static and dynamic content at edge locations, reducing latency by serving users from the nearest edge. It integrates with AWS origins (like ALBs) and can route requests to the closest healthy origin, supporting low-latency delivery for global applications.

Exam trap

The ANS-C01 exam often tests the misconception that a single service (like CloudFront or Route 53 alone) can solve global latency, but the correct answer requires combining three complementary services—CloudFront for caching, Route 53 for DNS-based routing, and Global Accelerator for network path optimization—to fully address the requirement of routing users to the nearest healthy endpoint.

Full explanation →

1320

MCQeasy

A network engineer is troubleshooting connectivity from an EC2 instance in a private subnet to an S3 bucket. The VPC has a VPC endpoint for S3 configured. The instance can access the internet via a NAT Gateway. Which configuration is MOST likely causing the connection to S3 to fail?

A.The S3 VPC endpoint is in a different Availability Zone than the instance.

B.The route table for the private subnet is missing a route to the S3 VPC endpoint.

C.The S3 bucket policy does not allow access from the VPC endpoint.

D.The EC2 instance does not have a public IP address.

AnswerB

Without a route to the endpoint, traffic goes via NAT Gateway, which may be blocked.

Why this answer

For an EC2 instance in a private subnet to use a VPC endpoint for S3, the subnet's route table must include a route with the S3 endpoint's prefix list as the destination and the VPC endpoint ID as the target. Without this route, traffic destined for S3 will be sent to the NAT Gateway instead, which may fail if the instance lacks a public IP or if the NAT Gateway's route table or security groups block the traffic. Option B correctly identifies this missing route as the most likely cause.

Exam trap

The ANS-C01 exam often tests the misconception that a VPC endpoint automatically routes traffic without a route table entry, leading candidates to overlook the required route and instead blame the bucket policy or the instance's public IP.

How to eliminate wrong answers

Option A is wrong because VPC endpoints for S3 are horizontally scaled and redundant across all Availability Zones in the region; they are not tied to a single AZ, so the instance's AZ does not affect connectivity. Option C is wrong because while an S3 bucket policy can restrict access, the question states the VPC endpoint is configured, and the most common cause of failure is a missing route, not a policy issue—unless explicitly stated, the default bucket policy allows access from the endpoint. Option D is wrong because the instance is in a private subnet and uses a NAT Gateway for internet access; a public IP is not required for outbound traffic via a NAT Gateway, and the VPC endpoint for S3 does not require a public IP at all.

Full explanation →

1321

MCQhard

A company has a Direct Connect connection with a private VIF to a VPC. The VPC has a virtual private gateway attached. The on-premises network advertises a specific route 10.0.0.0/16, but the VPC uses the same CIDR 10.0.0.0/16. The company requires connectivity to the VPC from on-premises but cannot change the VPC CIDR. What is the most cost-effective solution?

A.Use VPC peering between the on-premises network and the VPC.

B.Set up a Direct Connect Gateway and attach the VPC and on-premises networks.

C.Create a Transit Gateway with a VPN attachment to on-premises and use route table separation.

D.Create a new VPC with a different CIDR and migrate workloads.

AnswerC

Transit Gateway can manage overlapping CIDRs with multiple route tables.

Why this answer

A Transit Gateway with a VPN attachment allows you to use route table separation to isolate the overlapping CIDR (10.0.0.0/16) between the on-premises network and the VPC. By creating separate route tables for the VPN attachment and the VPC attachment, you can control traffic flow and avoid routing conflicts without changing the VPC CIDR. This is the most cost-effective solution as it leverages existing VPN connectivity and avoids the expense of migrating workloads or provisioning additional infrastructure.

Exam trap

AWS often tests the misconception that Direct Connect or VPC peering can handle overlapping CIDRs, but the trap here is that only a Transit Gateway with route table separation (or a similar overlay mechanism like VPN with BGP communities) can resolve CIDR conflicts without changing the network addressing.

How to eliminate wrong answers

Option A is wrong because VPC peering requires non-overlapping CIDR blocks; overlapping CIDRs (10.0.0.0/16 on both sides) prevent VPC peering from being established. Option B is wrong because a Direct Connect Gateway does not resolve overlapping CIDR conflicts; it simply extends connectivity and would still cause routing ambiguity between the on-premises network and the VPC. Option D is wrong because creating a new VPC and migrating workloads is not cost-effective; it incurs significant operational overhead and downtime, whereas a Transit Gateway with route table separation provides a cheaper, less disruptive solution.

Full explanation →

1322

MCQeasy

A company is deploying a multi-region Active-Active application using Amazon Route 53 latency-based routing. The application runs on EC2 instances behind Network Load Balancers (NLBs) in two AWS regions. The health checks are configured for the NLBs. What should the company do to ensure that traffic is sent only to healthy endpoints?

A.Use Route 53 latency-based routing and associate health checks.

B.Use Route 53 geolocation routing and associate health checks.

C.Use Route 53 weighted routing and associate health checks.

D.Use Route 53 failover routing with primary and secondary records.

AnswerA

Latency routing combined with health checks sends traffic only to healthy endpoints with the lowest latency.

Why this answer

Route 53 latency-based routing directs traffic to the region with the lowest latency for the user. By associating health checks with the latency records, Route 53 automatically excludes any endpoint that fails its health check (e.g., an unhealthy NLB) from DNS responses, ensuring traffic is sent only to healthy endpoints. This meets the requirement for an Active-Active multi-region setup where both regions serve traffic simultaneously.

Exam trap

The trap here is that candidates often confuse latency-based routing with failover routing, assuming failover is required for health checks, but latency-based routing with health checks supports Active-Active while failover routing is strictly Active-Passive.

How to eliminate wrong answers

Option B is wrong because geolocation routing directs traffic based on the user's geographic location, not latency, and does not inherently support Active-Active failover across regions; it can still send traffic to an unhealthy endpoint if health checks are not properly associated, but the core issue is that it doesn't optimize for latency. Option C is wrong because weighted routing distributes traffic based on assigned weights, not latency, and while it can use health checks, it does not provide the latency-based optimization required for an Active-Active multi-region application. Option D is wrong because failover routing is designed for Active-Passive setups, where only one endpoint is active at a time; it does not support Active-Active traffic distribution across multiple regions.

Full explanation →

1323

MCQeasy

A company uses AWS Direct Connect to connect its on-premises network to a VPC. The security team wants to ensure that traffic between the on-premises network and the VPC is encrypted using IPSec. Which solution meets this requirement?

A.Establish an IPSec VPN connection over the Direct Connect public virtual interface using a customer gateway and a virtual private gateway.

B.Use a private virtual interface (VIF) on the Direct Connect connection and enable encryption at the physical layer.

C.Use VPC endpoints (Gateway Endpoints) for all traffic between on-premises and the VPC.

D.Attach the Direct Connect virtual interface to a Transit Gateway and enable multicast.

AnswerA

This combination provides encrypted IPSec tunnels over the Direct Connect connection.

Why this answer

It establishes an IPSec VPN tunnel over a Direct Connect public virtual interface (VIF), which encrypts traffic between the on-premises network and the VPC. The customer gateway and virtual private gateway create a site-to-site VPN connection that uses IPSec to secure all data traversing the Direct Connect link, meeting the encryption requirement without relying on physical-layer security.

Exam trap

The trap here is that candidates assume a private virtual interface inherently provides encryption, but Direct Connect private VIFs are unencrypted by default, and IPSec must be explicitly layered over a public VIF or via a VPN appliance.

How to eliminate wrong answers

Option B is wrong because private virtual interfaces do not support encryption at the physical layer; Direct Connect operates at Layer 2 and does not provide native encryption, and enabling encryption at the physical layer (e.g., MACsec) is not supported on Direct Connect private VIFs. Option C is wrong because VPC Gateway Endpoints (e.g., for S3 or DynamoDB) only provide private connectivity to specific AWS services, not general IPSec encryption for all traffic between on-premises and the VPC. Option D is wrong because attaching a Direct Connect virtual interface to a Transit Gateway and enabling multicast does not provide IPSec encryption; multicast is a separate feature for one-to-many communication, not for securing traffic.

Full explanation →

1324

Multi-Selecthard

A company is using AWS Site-to-Site VPN to connect its on-premises network to a VPC. The network team wants to ensure high availability and failover. Which three actions should they take? (Choose THREE.)

Select 3 answers

A.Configure both tunnels as active/active.

B.Enable BGP on the VPN connections.

C.Use two Customer Gateway devices in different locations.

D.Use static routes instead of BGP.

E.Configure two VPN tunnels to the same Customer Gateway.

AnswersA, B, C

Both tunnels carry traffic; if one fails, traffic shifts to the other.

Why this answer

For high availability, use two tunnels (both active/active or active/passive), use two Customer Gateway devices for redundancy, and configure BGP for dynamic routing and fast failover. Static routes require manual intervention. A single tunnel is not redundant.

Full explanation →

1325

MCQhard

Refer to the exhibit. The IAM policy above is attached to a user in account A (123456789012). The user needs to create a VPC peering connection with account B and accept it. The user in account A can create the peering request, but the accept fails with an 'UnauthorizedOperation' error. What is the MOST likely reason?

A.The user does not have permission to create routes in the VPC

B.The 'ec2:CreateVpcPeeringConnection' action requires a specific VPC ARN

C.The user does not have permission to accept the peering connection from the other account

D.The 'ec2:AcceptVpcPeeringConnection' action is not allowed in the policy

AnswerC

The policy does not grant cross-account accept.

Why this answer

The 'AcceptVpcPeeringConnection' action is allowed on all resources ('*'), but the specific ARN for the peering connection is not granted for the accept action. The second statement allows actions only on peering connections in account A, but the accept action is performed on the requester's side? Actually, the accept is done by the accepter (account B). The user in account A is trying to accept? The scenario says 'the user in account A can create the peering request, but the accept fails'.

Actually, the accept is done by account B. So the user in account A cannot accept a peering connection that belongs to account B. The policy allows accept on 'ec2:AcceptVpcPeeringConnection' with resource '*', but the accept action is performed on the resource in the accepter account.

The second statement restricts to peering connections in account A. The accept action is not covered by the second statement because it's not in the action list of the second statement. Wait, the first statement allows accept on all resources.

So why would it fail? The issue is that the accept action is called on the peering connection resource in the accepter account, which is not in account A. The policy does not have permissions for resources in other accounts. The correct answer is that the user does not have permission to accept the peering connection because the resource ARN in the second statement only covers peering connections in account A.

But the first statement allows accept on all resources. However, the 'ec2:AcceptVpcPeeringConnection' action requires permission on the resource of the peering connection in the accepter account. Since the user is in account A, they cannot accept a peering connection that is owned by account B.

The most likely reason is that the user lacks permissions to accept the peering connection in the other account. Option C captures this.

Full explanation →

1326

MCQhard

A security engineer is configuring Network Access Control Lists (NACLs) for a VPC with multiple subnets. The engineer wants to block SSH access (port 22) from a specific IP range 10.0.0.0/8 to the entire VPC CIDR (172.16.0.0/16). What is the most effective approach?

A.Add inbound and outbound NACL rules denying SSH from 10.0.0.0/8

B.Add a security group rule to deny inbound SSH from 10.0.0.0/8

C.Add an inbound NACL rule denying SSH from 10.0.0.0/8

D.Add an outbound security group rule denying SSH to 10.0.0.0/8

AnswerA

Correct. NACLs are stateless, so to block SSH traffic from 10.0.0.0/8 to the VPC CIDR, you must add both an inbound rule denying SSH from that source and an outbound rule denying SSH to that source as return traffic will be seen as a new flow.

Why this answer

NACLs are stateless, so to block SSH from 10.0.0.0/8 to the entire VPC, both inbound and outbound rules are needed. Option A correctly adds both rules. Option B is incorrect because security groups are stateful and only allow traffic; they cannot deny.

Option C is incorrect because an inbound rule alone does not block return traffic. Option D is incorrect because security groups cannot block outbound traffic based on destination IP effectively.

Full explanation →

1327

MCQhard

A company is deploying a multi-tier web application across multiple Availability Zones in a single Region. The web tier must be fault-tolerant and distribute traffic across EC2 instances. The application tier uses an Auto Scaling group of EC2 instances that need to be accessed by the web tier using a static IP address. Which combination of AWS services meets these requirements?

A.Classic Load Balancer for the web tier and Application Load Balancer for the application tier

B.Application Load Balancer for the web tier and Network Load Balancer for the application tier

C.AWS Global Accelerator for the web tier and Classic Load Balancer for the application tier

D.Network Load Balancer for the web tier and Application Load Balancer for the application tier

AnswerB

ALB provides content-based routing for web tier; NLB provides static IP for application tier.

Why this answer

The web tier requires fault tolerance and traffic distribution across EC2 instances, which is best handled by an Application Load Balancer (ALB) operating at Layer 7 with path-based routing and health checks. The application tier needs a static IP address for the web tier to access it, which is a key feature of a Network Load Balancer (NLB) — it preserves the client IP and provides static IP addresses per Availability Zone, unlike ALBs which use dynamic IPs. This combination meets both requirements: ALB for web traffic distribution and NLB for static IP access to the application tier.

Exam trap

The trap here is that candidates often assume a load balancer for the web tier must be a Network Load Balancer for static IPs, but the requirement for static IPs applies to the application tier, not the web tier, and they overlook that ALBs are the standard for Layer 7 web traffic distribution.

How to eliminate wrong answers

Option A is wrong because a Classic Load Balancer (CLB) is a legacy option that lacks advanced Layer 7 features and does not provide static IP addresses for the application tier, making it unsuitable for modern multi-tier architectures. Option C is wrong because AWS Global Accelerator is designed for global traffic optimization and static IP assignment at the edge, not for distributing traffic across EC2 instances within a single Region's web tier; additionally, a Classic Load Balancer for the application tier does not provide static IP addresses. Option D is wrong because a Network Load Balancer for the web tier is unnecessary — it operates at Layer 4 and does not offer the Layer 7 features (e.g., path-based routing, host-based routing) typically required for a web tier, while an Application Load Balancer for the application tier does not provide static IP addresses, which is the explicit requirement.

Full explanation →

1328

Multi-Selectmedium

A company has a VPC with a public subnet and a private subnet. The public subnet has a bastion host (EC2) with a security group that allows SSH from a specific IP range. The private subnet has an RDS instance. The company wants to enable the bastion host to connect to the RDS instance. Which TWO steps are required?

Select 2 answers

A.Configure the RDS instance to use a custom DB parameter group with SSL enabled.

B.Add a rule to the NACL for the private subnet to allow inbound traffic from the bastion host's IP.

C.Assign a public IP address to the RDS instance.

D.Create a route in the public subnet's route table to the RDS instance.

E.Add a rule to the RDS security group that allows inbound traffic from the bastion host's security group.

AnswersB, E

NACL must allow inbound traffic from the bastion to the RDS port.

Why this answer

The bastion host needs network-level access to the RDS instance. The RDS security group must allow inbound from the bastion's security group, and the bastion must be in the same VPC or have network connectivity. The NACL must allow the traffic.

Full explanation →

1329

MCQeasy

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC are allowed. The bucket policy should deny requests that do not originate from the VPC. Which condition key should be used in the bucket policy?

A.aws:SourceVpc

B.aws:VpcSourceIp

C.aws:Referer

D.aws:SourceIp

AnswerA

This condition key restricts access to a specific VPC.

Why this answer

The correct condition key is `aws:SourceVpc`, which allows you to restrict access to an S3 bucket based on the VPC from which the request originates. When used in a bucket policy with a Deny effect, it ensures that only requests coming from the specified VPC ID are allowed, and all other requests are denied. This key is specifically designed for VPC-based access control in S3 bucket policies.

Exam trap

AWS often tests the distinction between `aws:SourceVpc` and `aws:SourceIp` — the trap here is that candidates mistakenly choose `aws:SourceIp` thinking they can restrict by VPC by using the VPC's CIDR range, but this fails because requests from within the VPC may have different source IPs (e.g., private IPs or NAT public IPs) and cannot reliably identify the VPC.

How to eliminate wrong answers

Option B (`aws:VpcSourceIp`) is wrong because this condition key does not exist in AWS IAM; the correct key for VPC-based IP restrictions is `aws:VpcSourceIp` is not a valid condition key, and AWS uses `aws:SourceIp` for IP address-based restrictions, not VPC-level control. Option C (`aws:Referer`) is wrong because it is used to restrict access based on the HTTP Referer header, typically for preventing hotlinking from unauthorized websites, not for VPC-based access control. Option D (`aws:SourceIp`) is wrong because it restricts access based on the source IP address of the requester, which is not VPC-specific and cannot enforce that the request originates from a particular VPC, especially when traffic may come through NAT gateways or VPNs.

Full explanation →

1330

MCQmedium

A company is designing a hybrid network architecture that requires a dedicated, private, and consistent connection between its on-premises data center and AWS. The connection must support multiple VLANs and provide a service-level agreement (SLA) of 99.99% availability. Which AWS service should be used to meet these requirements?

A.AWS Direct Connect

B.AWS Transit Gateway

C.AWS Client VPN

D.AWS Site-to-Site VPN

AnswerA

Correct; AWS Direct Connect provides a dedicated, private, high-bandwidth connection with support for multiple VLANs and an SLA.

Why this answer

AWS Direct Connect is the correct choice because it provides a dedicated, private, and consistent network connection from an on-premises data center to AWS, bypassing the public internet. It supports multiple VLANs via 802.1Q tagging over a single physical connection, and offers a 99.99% service-level agreement (SLA) when configured with redundant connections at separate Direct Connect locations.

Exam trap

AWS often tests the misconception that AWS Transit Gateway itself provides the dedicated connection, but it is only a logical aggregation point and requires Direct Connect or VPN as the underlying transport to meet the physical connectivity and SLA requirements.

How to eliminate wrong answers

Option B (AWS Transit Gateway) is wrong because it is a network transit hub that interconnects VPCs and on-premises networks, but it does not provide the physical dedicated connection itself; it relies on an underlying transport like Direct Connect or VPN. Option C (AWS Client VPN) is wrong because it is a managed remote access VPN solution for individual clients, not a dedicated site-to-site connection, and it does not support multiple VLANs or offer a 99.99% SLA. Option D (AWS Site-to-Site VPN) is wrong because it uses the public internet and IPsec tunnels, which cannot guarantee a 99.99% SLA and does not provide a dedicated, private connection with consistent latency.

Full explanation →

1331

MCQmedium

A company has deployed a web application across multiple AWS Regions using Application Load Balancers (ALBs) and EC2 instances. They want to use AWS Global Accelerator to improve performance and provide a fixed entry point. The Global Accelerator is configured with endpoints pointing to the ALBs. However, users are experiencing intermittent failures. What is the most likely cause?

A.Client IP address preservation is enabled on the Global Accelerator for cross-Region endpoints.

B.Global Accelerator does not support multiple endpoints in different Regions.

C.The ALBs are not configured with health checks.

D.The Global Accelerator is not configured for IPv6 traffic.

AnswerA

When using cross-region endpoints, client IP address preservation must be disabled, otherwise traffic fails.

Why this answer

When client IP address preservation is enabled on Global Accelerator for cross-Region endpoints, the accelerator preserves the original client IP address in the packets sent to the Application Load Balancers. However, ALBs are layer-7 load balancers that require traffic to originate from the Global Accelerator's static IP addresses, not the client's IP, for proper routing and health check responses. This mismatch causes the ALBs to reject or mishandle traffic, leading to intermittent failures.

Exam trap

AWS often tests the misconception that client IP preservation is always beneficial, but the trap here is that enabling it for ALB endpoints in cross-Region setups breaks the expected traffic flow because ALBs require the source IP to be the Global Accelerator's IPs, not the client's.

How to eliminate wrong answers

Option B is wrong because Global Accelerator explicitly supports multiple endpoints in different Regions, allowing traffic to be routed to the closest healthy endpoint. Option C is wrong because health checks are configured on the Global Accelerator itself, not on the ALBs; ALBs have their own health checks, but the absence of ALB health checks would not cause intermittent failures from Global Accelerator. Option D is wrong because Global Accelerator supports both IPv4 and IPv6 traffic, and the question does not indicate any IPv6-related issue; the failure is unrelated to IP version support.

Full explanation →

1332

MCQhard

A company has a VPC with a CIDR of 10.0.0.0/16. The VPC has a public subnet 10.0.1.0/24 and a private subnet 10.0.2.0/24. An EC2 instance in the private subnet needs to download patches from the internet. Which configuration is required to provide outbound internet access to the private instance while preventing inbound internet traffic?

A.Attach an Internet Gateway to the private subnet and add a default route to the Internet Gateway in the private route table

B.Assign an Elastic IP to the private instance and update the security group to allow outbound traffic

C.Add an Internet Gateway to the VPC and create a route in the private subnet to 0.0.0.0/0 via the Internet Gateway

D.Deploy a NAT Gateway in the public subnet and add a default route in the private subnet route table pointing to the NAT Gateway

AnswerD

NAT Gateway enables outbound-only internet access for private instances.

Why this answer

A NAT Gateway, deployed in a public subnet with an Internet Gateway, allows instances in a private subnet to initiate outbound traffic to the internet (e.g., to download patches) while preventing any unsolicited inbound traffic from the internet. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway ID. This design ensures the private instance's traffic is source-NATed to the NAT Gateway's Elastic IP, and the Internet Gateway only accepts responses to established outbound connections.

Exam trap

The ANS-C01 exam often tests the misconception that an Internet Gateway can be used in a private subnet route table to provide outbound-only access, but the trap here is that an Internet Gateway is a symmetric gateway that allows inbound traffic unless explicitly blocked by a network ACL, which still does not prevent direct inbound connections to the instance's private IP.

How to eliminate wrong answers

Option A is wrong because an Internet Gateway cannot be attached directly to a subnet; it is attached to the VPC, and a private subnet with a default route to an Internet Gateway would expose the instance to inbound internet traffic, violating the requirement to prevent inbound traffic. Option B is wrong because assigning an Elastic IP to a private instance and allowing outbound traffic in the security group still makes the instance directly reachable from the internet (since the Elastic IP is public), and a private subnet lacks a direct route to an Internet Gateway, so outbound traffic would fail. Option C is wrong because adding a default route to the Internet Gateway in the private subnet route table would allow inbound traffic from the internet to reach the private instance (since the Internet Gateway is a two-way gateway), which does not prevent inbound internet traffic.

Full explanation →

1333

Multi-Selecthard

Which TWO options are valid methods to connect a VPC to an on-premises network? (Choose two.)

Select 2 answers

A.AWS Site-to-Site VPN

B.Internet Gateway

C.AWS Direct Connect

D.VPC endpoint

E.VPC peering

AnswersA, C

Creates a secure VPN tunnel over the internet.

Why this answer

AWS Site-to-Site VPN creates an encrypted tunnel between a virtual private gateway or transit gateway in your VPC and a customer gateway device in your on-premises network. It uses IPsec (IKEv1 or IKEv2) to secure traffic over the public internet, making it a valid and common method for hybrid connectivity.

Exam trap

The ANS-C01 exam often tests the misconception that an Internet Gateway can be used for private on-premises connectivity, but it only provides public internet access; similarly, candidates confuse VPC endpoints or VPC peering as methods to reach on-premises networks, which they are not.

Full explanation →

1334

Multi-Selectmedium

A company is designing a VPC with the following requirements: (1) Ability to connect to on-premises via AWS Direct Connect with BGP, (2) Ability to route traffic between multiple VPCs, (3) Centralized inspection of traffic between VPCs. Which AWS services should the company use? (Choose TWO.)

Select 2 answers

A.VPC peering connections

B.VPC endpoints

C.AWS Transit Gateway

D.Direct Connect Gateway

E.AWS Site-to-Site VPN

AnswersC, D

Central hub for inter-VPC routing and inspection.

Why this answer

AWS Transit Gateway (C) is correct because it acts as a central hub to interconnect multiple VPCs and on-premises networks, enabling transitive routing between all attached networks. It supports centralized traffic inspection by routing VPC-to-VPC traffic through a shared inspection VPC (e.g., with a firewall appliance) using route tables and attachments.

Exam trap

AWS often tests the misconception that VPC peering can be used for transitive routing or centralized inspection, but peering is non-transitive and requires full-mesh connectivity, making Transit Gateway the correct hub solution.

Full explanation →

1335

Multi-Selecthard

A company is configuring a site-to-site VPN connection between its on-premises network and AWS. The VPN tunnel is up, but traffic is not passing. The company has verified that routes are correct on both sides. Which TWO actions should the company take to troubleshoot the issue?

Select 2 answers

A.Verify that the virtual private gateway is attached to the VPC.

B.Ensure that the on-premises firewall is configured to allow IPSec traffic.

C.Check the security group rules for the EC2 instances in the VPC.

D.Verify that the VPN tunnel is using the correct encryption algorithm.

E.Check the network ACLs for the subnets.

AnswersC, E

Security groups can block traffic.

Why this answer

Security groups act as a virtual firewall for EC2 instances, controlling inbound and outbound traffic at the instance level. Even if the VPN tunnel is up and routes are correct, the security group rules must allow the desired traffic (e.g., from the on-premises network CIDR) to reach the EC2 instances. Without proper inbound rules, traffic will be dropped at the instance level, preventing communication.

Exam trap

The ANS-C01 exam often tests the distinction between security groups (stateful, instance-level) and network ACLs (stateless, subnet-level), and candidates may overlook that both must be correctly configured for traffic to pass, especially when the VPN tunnel itself is operational.

Full explanation →

1336

MCQmedium

A company is using AWS Direct Connect to connect its on-premises network to VPCs in multiple AWS accounts. The company wants to ensure that traffic from the on-premises network can only access specific VPCs based on the source IP address. Which AWS service should be used to enforce this segmentation?

A.VPC Peering

B.AWS Transit Gateway

C.AWS PrivateLink

D.Security Groups

AnswerB

Transit Gateway with route tables can enforce segmentation based on source IP.

Why this answer

The correct answer because AWS Transit Gateway provides the connectivity hub between Direct Connect and multiple VPCs, and its route tables can be used to isolate traffic based on the Direct Connect virtual interface. However, Transit Gateway route tables are destination-based, not source-based. To enforce segmentation based on source IP address, you must combine Transit Gateway with a firewall service such as AWS Network Firewall or a third-party firewall appliance.

The other options are incorrect: VPC Peering does not support source IP filtering and does not scale to many VPCs; AWS PrivateLink is for accessing services within a VPC; and Security Groups apply at the instance level, not to traffic from Direct Connect.

Full explanation →

1337

MCQmedium

A company is deploying a multi-tier web application across three Availability Zones in a single AWS Region. The web tier must be fault-tolerant and scale horizontally. Which network design provides the highest availability and scalability?

A.Deploy a single EC2 instance in one Availability Zone with an Elastic IP address.

B.Use an Application Load Balancer in front of an Auto Scaling group spanning three Availability Zones.

C.Deploy EC2 instances in a single Availability Zone and use Route 53 weighted routing.

D.Use a Network Load Balancer with a single EC2 instance in each AZ.

AnswerB

ALB distributes traffic across multiple AZs and instances, providing fault tolerance and scalability.

Why this answer

An Application Load Balancer (ALB) distributes incoming HTTP/HTTPS traffic across multiple targets, and when combined with an Auto Scaling group that spans three Availability Zones, it provides both horizontal scalability and fault tolerance. If one AZ fails, the ALB automatically routes traffic only to healthy instances in the remaining AZs, ensuring high availability. This design meets the requirement for a multi-tier web application that must scale horizontally and tolerate failures.

Exam trap

The trap here is that candidates may choose Option D thinking a Network Load Balancer is always better for performance, but they overlook that the question requires horizontal scalability and fault tolerance, which an ALB with Auto Scaling provides, whereas a static single-instance-per-AZ design cannot scale dynamically.

How to eliminate wrong answers

Option A is wrong because a single EC2 instance with an Elastic IP address in one Availability Zone is a single point of failure; if the instance or AZ fails, the application becomes unavailable, and it cannot scale horizontally. Option C is wrong because deploying EC2 instances in a single Availability Zone with Route 53 weighted routing does not provide fault tolerance; if that AZ fails, all instances are lost, and weighted routing cannot reroute traffic to other AZs. Option D is wrong because a Network Load Balancer with a single EC2 instance per AZ does not provide horizontal scalability; each AZ has only one instance, so you cannot scale out by adding more instances within an AZ, and the design lacks the elasticity of an Auto Scaling group.

Full explanation →

1338

MCQeasy

A company is using AWS Direct Connect to connect its on-premises data center to AWS. The company wants to ensure that traffic to the VPC uses the Direct Connect connection instead of the internet. Which configuration is required?

A.Create a VPC peering connection to the on-premises network.

B.Add a route in the VPC route table pointing to the on-premises CIDR via the virtual private gateway.

C.Use a NAT gateway in the VPC.

D.Add a route in the VPC route table pointing to the on-premises CIDR via the internet gateway.

AnswerB

This directs traffic to the Direct Connect connection.

Why this answer

To ensure traffic uses Direct Connect, the route table in the VPC must have a route to the on-premises CIDR via the virtual private gateway (VGW) attached to the Direct Connect. Additionally, on the on-premises side, routes must point to the Direct Connect. The VPC route table should have a more specific route or a default route pointing to the VGW.

Full explanation →

1339

MCQhard

A global company is designing a multi-region Active-Active application using Amazon Route 53 latency-based routing. Each region has an Application Load Balancer (ALB) fronting Auto Scaling groups. The application requires sticky sessions based on the user's source IP. The network team notices that users are frequently switched to a different region mid-session, causing errors. What should the team do to resolve this issue?

A.Configure Route 53 health checks with a low threshold to quickly detect failures

B.Enable stickiness on each ALB using a cookie generated by the ALB

C.Use a custom origin header in the Route 53 latency policy to route based on the user's IP address and enable ALB stickiness

D.Switch to geolocation routing policy with a bias to maintain sessions

AnswerD

Geolocation routing policy routes traffic based on the geographic location of the user's IP address, ensuring that users consistently reach the same region. This maintains session stickiness. A bias can be added to adjust routing for specific locations or to handle edge cases. This is the correct approach to prevent mid-session region switches.

Why this answer

The issue is that latency-based routing can change the selected region mid-session due to fluctuating latency, breaking sticky sessions. Geolocation routing policy routes users to a region based on their source IP address, ensuring that the same user always reaches the same region, thus maintaining session stickiness. Using a bias allows fine-tuning to adjust routing for specific locations.

Option C is not valid because Route 53 latency-based routing does not support custom origin headers; this is not a feature available in AWS. Option A only affects health checks and does not influence session persistence. Option B enables stickiness within a region but does not prevent Route 53 from switching regions.

Therefore, switching to geolocation routing is the correct solution.

Full explanation →

1340

MCQmedium

A company is using Amazon VPC with a public subnet and a private subnet. The public subnet has a NAT gateway. The private subnet has an Amazon RDS for MySQL database. The security team wants to ensure that the database is not accessible from the internet, but they need to allow a specific on-premises network (IP range 203.0.113.0/24) to connect to the database for maintenance. The company also wants to restrict outbound traffic from the database to only necessary AWS services (e.g., S3 for backups) and deny all other outbound traffic. Which configuration should the security team implement?

A.Create a security group for the database that allows inbound from the on-premises network using a prefix list for 203.0.113.0/24. Create a VPC endpoint for S3 and allow outbound traffic to the endpoint. Keep the private subnet's network ACL default (allow all outbound).

B.Set up a Site-to-Site VPN between the on-premises network and the VPC. Modify the route tables to route 203.0.113.0/24 through the VPN. Place the database in a private subnet and allow inbound from the VPN CIDR. Use an internet gateway for outbound traffic to S3.

C.Modify the database security group to allow inbound TCP 3306 from 203.0.113.0/24. Create a VPC endpoint for S3. Update the private subnet's network ACL to deny all outbound traffic except to the S3 VPC endpoint prefix list.

D.Place the database in a public subnet and use a security group that allows inbound from 203.0.113.0/24. Use the NAT gateway for outbound traffic to S3. Configure the public subnet's network ACL to deny all outbound traffic except to S3.

AnswerC

This directly permits the required on-premises access and restricts outbound traffic to only S3 via VPC endpoint, which is secure and efficient.

Why this answer

This configuration allows inbound access from the specific on-premises CIDR (203.0.113.0/24) directly via the database security group, which is secure and avoids the complexity of a VPN. Creating a VPC endpoint for S3 enables private connectivity to S3 without traversing the internet. Updating the private subnet's network ACL to deny all outbound traffic except to the S3 VPC endpoint prefix list restricts outbound traffic as required.

Option A is incorrect because a security group cannot reference a prefix list for on-premises IPs; prefix lists are used for AWS services or specific VPC resources. Option B is incorrect because a Site-to-Site VPN adds unnecessary complexity for a single on-premises CIDR, and using an internet gateway for outbound traffic to S3 bypasses the requirement to restrict outbound traffic. Option D is incorrect because placing the database in a public subnet would expose it to the internet, and using a NAT gateway for outbound traffic to S3 is not as secure as a VPC endpoint.

Exam trap

The trap is to assume that a VPN is required for on-premises access, but a direct security group rule with the on-premises CIDR is simpler and sufficient. Also, confusing network ACLs with security groups: security groups are stateful and allow return traffic automatically, while network ACLs are stateless and require explicit rules for return traffic.

Full explanation →

1341

Multi-Selectmedium

A company is designing a network security solution for a VPC that hosts a multi-tier web application. The web servers are in a public subnet, and the application servers are in a private subnet. The company wants to ensure that the web servers can only be accessed on port 443 from the internet, and the application servers can only be accessed from the web servers on port 3306. Which THREE components should be configured?

Select 3 answers

A.Network ACL on the public subnet allowing inbound 443 from 0.0.0.0/0

B.Network ACL on the public subnet allowing inbound 443 from 0.0.0.0/0 and outbound ephemeral ports

C.Network ACL on the private subnet allowing inbound 3306 from the public subnet CIDR

D.Security group for application servers allowing inbound 3306 from the web server security group

E.Security group for web servers allowing inbound 443 from 0.0.0.0/0

AnswersB, D, E

NACL on public subnet provides stateless filtering for inbound HTTPS and outbound responses.

Why this answer

The correct components are: a security group for web servers allowing inbound 443 from 0.0.0.0/0 (E), a security group for application servers allowing inbound 3306 from the web server security group (D), and a network ACL on the public subnet allowing inbound 443 and outbound ephemeral ports (B) to add a stateless filtering layer. Option A is incorrect because the NACL rule lacks an outbound rule for return traffic, making it incomplete. Option C is unnecessary because the access control for the private subnet is best achieved with security groups, and a NACL is not required for this purpose.

Full explanation →

1342

Multi-Selectmedium

A company is deploying a new application across multiple Availability Zones in a single region. The application requires low-latency communication between instances in different AZs. Which TWO design choices help achieve high availability and low latency? (Select TWO.)

Select 2 answers

A.Use a spread placement group for the instances.

B.Use larger instance sizes to handle traffic spikes.

C.Launch EC2 instances in at least two Availability Zones.

D.Use a single NAT Gateway to provide internet access.

E.Use an Application Load Balancer to distribute traffic across AZs.

AnswersC, E

Correct. Launching instances in at least two AZs eliminates a single point of failure and keeps traffic within the region, supporting both high availability and low latency.

Why this answer

To achieve high availability and low-latency communication between instances in different Availability Zones, you should launch instances in at least two AZs (C) to avoid a single point of failure, and use an Application Load Balancer (E) to distribute traffic and perform health checks. A spread placement group (A) is not recommended for low latency; it spreads instances across distinct hardware, which can increase latency. Larger instance sizes (B) only increase capacity and do not improve availability or latency.

A single NAT Gateway (D) introduces a single point of failure and does not affect inter-AZ latency.

Full explanation →

1343

MCQeasy

A network engineer is designing a hybrid network using AWS Direct Connect. The company requires high availability and wants to use a single AWS Direct Connect location with two connections from different customer routers. Which solution meets the high availability requirement?

A.Use a single AWS Direct Connect connection with multiple VLANs

B.Use a single AWS Direct Connect connection with two BGP sessions

C.Use two AWS Direct Connect connections from the same location, each connected to a different customer router, and configure BGP sessions over both connections

D.Use a single AWS Direct Connect connection with Bidirectional Forwarding Detection (BFD) enabled

AnswerC

Two connections from different routers provide router-level redundancy.

Why this answer

It provides two physically separate AWS Direct Connect connections from the same location, each terminating on a different customer router. This architecture eliminates single points of failure at both the connection and router level. By configuring BGP sessions over both connections, the network can use BGP path selection and failover mechanisms (e.g., AS_PATH prepending or MED) to achieve high availability.

This design meets the requirement for a single location while ensuring redundancy against a router or connection failure.

Exam trap

The ANS-C01 exam often tests the misconception that multiple VLANs or BGP sessions on a single physical connection provide high availability, but the trap here is that true redundancy requires separate physical paths and devices, not just logical separation or faster detection protocols like BFD.

How to eliminate wrong answers

Option A is wrong because a single AWS Direct Connect connection with multiple VLANs provides logical separation (e.g., for different VPCs or services) but does not offer physical redundancy; a single cable or port failure takes down all VLANs. Option B is wrong because a single AWS Direct Connect connection with two BGP sessions still relies on a single physical link; both BGP sessions would fail if the connection or the customer router fails. Option D is wrong because enabling BFD on a single connection only speeds up failure detection (sub-second convergence) but does not provide any physical or path redundancy; it cannot recover from a complete link or device outage.

Full explanation →

1344

Multi-Selectmedium

A network engineer is troubleshooting connectivity issues between an EC2 instance and an RDS database in the same VPC. The EC2 instance can connect to the database, but the connection is slow. Which TWO actions should the engineer take to diagnose the issue? (Choose TWO.)

Select 2 answers

A.Verify the route table for the database subnet to ensure there is a default route to the internet.

B.Check the network ACL for the database subnet to ensure it is stateful.

C.Verify that the security group for the EC2 instance allows outbound traffic on the database port, and the database security group allows inbound from the EC2 instance.

D.Check VPC Flow Logs to analyze traffic patterns and identify drops or latency.

E.Check the route propagation settings on the VPC.

AnswersC, D

Security group misconfigurations can cause slow connections.

Why this answer

Options C and D are correct. Checking security group rules (C) ensures proper allow rules for communication between the EC2 instance and RDS database. Reviewing VPC Flow Logs (D) can reveal dropped packets or latency issues.

Option A is wrong because the default route to the internet is not relevant to internal VPC traffic. Option B is wrong because network ACLs are stateless and require explicit rules for both inbound and outbound traffic, but statefulness is not the issue here. Option E is wrong because route propagation is for VPN/Direct Connect, not for this connectivity.

Full explanation →

1345

Multi-Selectmedium

A company is designing a hybrid network using AWS Direct Connect. They want to ensure high availability and minimize downtime. Which TWO actions should they take?

Select 2 answers

A.Set up a site-to-site VPN as a backup for the Direct Connect connection

B.Use a single customer router for both connections

C.Provision a single Direct Connect connection with two virtual interfaces

D.Provision Direct Connect connections at two different Direct Connect locations

E.Use the same BGP ASN on both Direct Connect connections

AnswersA, D

VPN provides a backup path if Direct Connect fails.

Why this answer

A site-to-site VPN provides a cost-effective, encrypted backup path over the internet if the Direct Connect connection fails. This ensures high availability by maintaining connectivity through an alternate path, which is a best practice for hybrid network designs.

Exam trap

The trap here is that candidates often think a single Direct Connect connection with multiple virtual interfaces provides redundancy, but it does not protect against physical link failure; true high availability requires diverse physical connections and a backup path like VPN.

Full explanation →

1346

Multi-Selecthard

A network engineer is designing a highly available VPN connectivity between an on-premises data center and AWS. The company has two AWS Direct Connect connections terminated on two different AWS Direct Connect locations for redundancy. The company wants to use AWS Site-to-Site VPN as a backup for Direct Connect. The VPN connections will terminate on a single Virtual Private Gateway (VGW) attached to a VPC. The on-premises network has two customer gateways (CGWs) each with a unique BGP ASN. Which TWO actions should the engineer take to ensure automatic failover and load balancing? (Choose two.)

Select 2 answers

A.Configure the VPN connections to use BGP dynamic routing.

B.Set up a CloudWatch alarm to trigger an AWS Lambda function that changes route table entries upon VPN failure.

C.Configure the VPN connections to use static routes with equal cost multipath (ECMP).

D.Use a single customer gateway with two separate tunnels to the virtual private gateway.

E.Create two VPN connections, each from a different customer gateway to the same virtual private gateway.

AnswersA, E

BGP allows automatic route propagation and failover.

Why this answer

Using BGP dynamic routing for the VPN connections allows automatic failover and load balancing. BGP enables the VPN connections to advertise routes dynamically, and with two VPN connections from different CGWs to the same VGW, BGP can perform active/active load balancing by establishing multiple BGP sessions. If one Direct Connect or VPN connection fails, BGP withdraws the routes, and traffic automatically shifts to the remaining active paths without manual intervention.

Exam trap

The trap here is that candidates often think a single customer gateway with two tunnels provides sufficient redundancy, but the question requires two separate customer gateways (each with a unique BGP ASN) to match the two Direct Connect locations and achieve true path diversity and automatic failover.

Full explanation →

1347

Multi-Selecteasy

A company wants to protect its web application running on Amazon EC2 behind an Application Load Balancer (ALB) from common web exploits like SQL injection and cross-site scripting (XSS). Which THREE AWS services should be used together to provide comprehensive protection?

Select 3 answers

A.AWS WAF

B.Amazon Route 53

C.AWS Shield

D.Amazon CloudFront

E.Application Load Balancer (ALB)

AnswersA, C, E

WAF helps protect against SQL injection, XSS, and other web exploits.

Why this answer

AWS WAF (Option A) protects against web exploits like SQL injection and XSS. AWS Shield (Option C) provides DDoS protection. The Application Load Balancer (Option E) is the target for the web application and can be integrated with WAF and Shield for comprehensive protection.

Amazon Route 53 (Option B) is a DNS service and does not directly provide security against web exploits. Amazon CloudFront (Option D) is a CDN that can be used with WAF, but it is not required since the ALB is already in place; the question asks for three services that together provide comprehensive protection, and the combination of WAF, Shield, and ALB covers web application firewall, DDoS protection, and traffic distribution.

Full explanation →

1348

MCQeasy

A company wants to ensure that traffic between two VPCs in the same region is encrypted and does not traverse the public internet. Which solution meets these requirements?

A.Configure VPC Peering between the two VPCs

B.Create VPC Endpoints in each VPC for the other VPC's CIDR

C.Use an AWS Transit Gateway to route traffic between the VPCs

D.Establish an AWS Site-to-Site VPN connection between the VPCs [CORRECT]

AnswerD

A Site-to-Site VPN uses IPsec encryption and stays within AWS's private network, meeting both requirements.

Why this answer

A Site-to-Site VPN connection (Option D) is correct because it uses IPsec tunnels to encrypt traffic between VPCs, and the traffic stays within AWS's private network infrastructure, never traversing the public internet. VPC Peering (Option A) does not encrypt traffic; it only provides a private Layer 3 connection with no encryption. Transit Gateway (Option C) routes traffic but lacks built-in encryption without additional VPN attachments.

VPC Endpoints (Option B) are used for accessing AWS services privately, not for inter-VPC routing.

Exam trap

A common mistake is selecting VPC Peering because it provides a private connection, but it does not encrypt traffic. The question requires encryption, so VPC Peering alone is insufficient.

How to eliminate wrong answers

Option B is wrong because VPC Endpoints (Gateway or Interface endpoints) are used to privately connect a VPC to AWS services (like S3 or DynamoDB) or to other VPCs via PrivateLink, not to route traffic between two VPCs' CIDR blocks; they cannot replace a peering or transit routing function. Option C is wrong because AWS Transit Gateway provides centralized routing between VPCs but does not inherently encrypt traffic; it only routes traffic over the AWS backbone, and encryption would require an additional VPN attachment or IPsec configuration. Option D is wrong because an AWS Site-to-Site VPN connection is designed to connect an on-premises network to a VPC, not to connect two VPCs directly; using it for VPC-to-VPC connectivity would require complex, non-standard configurations and still relies on internet gateways or virtual private gateways, potentially exposing traffic to the public internet.

Full explanation →

1349

MCQmedium

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download patches from the internet. The company wants to ensure that all outbound traffic is logged and that only specific destinations are allowed. Which solution meets these requirements?

A.Deploy a NAT gateway in a public subnet and enable VPC Flow Logs

B.Deploy a proxy server in a public subnet and configure the EC2 instance to use it

C.Deploy a NAT instance in a public subnet and enable VPC Flow Logs

D.Attach an internet gateway to the VPC and assign a public IP to the EC2 instance

AnswerA

NAT gateway provides outbound internet access and VPC Flow Logs capture traffic metadata for logging.

Why this answer

A NAT gateway in a public subnet allows outbound internet access from private instances, and VPC Flow Logs can capture traffic metadata. Option B is wrong because a proxy server in a public subnet requires additional configuration and is not the default AWS solution. Option C is wrong because a NAT instance can also work but requires manual management and does not inherently provide logging; Flow Logs still need to be enabled.

Option D is wrong because an internet gateway alone does not provide private subnet access.

Full explanation →

1350

MCQeasy

A company has a VPC with a CIDR block of 10.0.0.0/16. They have a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). They have an internet gateway attached to the public subnet. They deploy a web server on an EC2 instance in the public subnet and a database on an EC2 instance in the private subnet. The database should only be accessible from the web server. The company wants to secure the database by not assigning a public IP address to it. Which configuration will allow the web server to connect to the database?

A.Create a VPC Peering connection between the public and private subnets

B.Assign a public IP address to the database instance and configure the security group to allow inbound traffic from the web server's public IP

C.Keep the database instance in the private subnet with no public IP, and configure the security group of the database to allow inbound traffic from the web server's security group on the database port

D.Set up a VPN connection between the web server and the database

AnswerC

Instances can communicate via private IPs within the same VPC.

Why this answer

Security groups in AWS can reference other security groups as a source, allowing traffic from any instance associated with the source security group. By configuring the database's security group to allow inbound traffic on the database port from the web server's security group, the web server can connect to the database without the database needing a public IP address. This leverages AWS's built-in security group chaining, which works across subnets within the same VPC.

Exam trap

AWS often tests the misconception that subnets in the same VPC need explicit routing or peering to communicate, but in reality, all subnets within a VPC are implicitly routable via the VPC's main route table, so security group configuration is the correct approach for access control.

How to eliminate wrong answers

Option A is wrong because VPC Peering connects separate VPCs, not subnets within the same VPC; subnets in the same VPC are already routable via the VPC's route tables. Option B is wrong because assigning a public IP to the database violates the requirement to not assign a public IP, and it exposes the database to the internet unnecessarily, increasing the attack surface. Option D is wrong because a VPN connection is used to connect on-premises networks or remote clients to a VPC, not to connect two instances within the same VPC, and it adds unnecessary complexity and latency.

Full explanation →

Page 18 of 22

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

Practice ANS-C01 by domain

Target a specific domain to shore up weak areas.

Network Management and Operations Network Security, Compliance and Governance Network Design Network Implementation

See all domains with question counts →