Courseiva

AWS Certified Advanced Networking Specialty ANS-C01 (ANS-C01) — Questions 1351–1425

1621 questions total · 22pages · All types, answers revealed

Take a mock examExam hub
Page 18

Page 19 of 22

Page 20
1351
MCQhard

A network engineer is designing a hybrid network using AWS Transit Gateway with multiple VPCs and an on-premises data center connected via AWS Direct Connect. The VPCs need to communicate with each other and with on-premises, but must isolate development VPCs from production VPCs. What is the MOST scalable and cost-effective approach?

A.Use a single Transit Gateway with one route table for all VPCs and on-premises, and use network ACLs for isolation.
B.Create VPC peering connections between all VPCs and a Direct Connect gateway for on-premises connectivity.
C.Use a VPN connection from each VPC to on-premises over Direct Connect, and allow VPC communication via VPN.
D.Use a single Transit Gateway with separate route tables for development and production VPCs, and a shared route table for on-premises attachment.
AnswerD

Separate route tables enforce isolation; shared table allows on-premises access.

Why this answer

A single Transit Gateway with separate route tables allows you to isolate development and production VPCs from each other while sharing a common route table for the Direct Connect attachment to reach on-premises. This design is highly scalable (no mesh of peering connections) and cost-effective (no per-VPN-tunnel charges), leveraging Transit Gateway’s native segmentation and centralized routing.

Exam trap

The trap here is that candidates assume a single Transit Gateway cannot isolate traffic, but AWS Transit Gateway supports multiple route tables per gateway, enabling logical segmentation without separate transit gateways or complex ACLs.

How to eliminate wrong answers

Option A is wrong because using a single route table for all attachments would allow traffic to flow between development and production VPCs, and network ACLs are stateless, cumbersome to manage at scale, and cannot provide the same isolation as separate route tables. Option B is wrong because VPC peering creates a full mesh that does not scale (O(n²) connections) and does not natively support transitive routing, requiring a Direct Connect gateway for on-premises but still lacking isolation between VPCs without complex route table manipulation. Option C is wrong because establishing a VPN from each VPC to on-premises over Direct Connect adds unnecessary cost and complexity (per-VPN tunnel charges, BGP configuration), and does not provide a mechanism for VPC-to-VPC communication without additional transit or peering.

Full explanation →
1352
MCQmedium

A network engineer is troubleshooting high latency between two EC2 instances in the same VPC but in different Availability Zones. The instances are in the same security group and have proper rules. Which configuration is most likely causing the latency?

A.The instances are using jumbo frames.
B.The instances are in a cluster placement group.
C.The instances have Enhanced Networking enabled.
D.The instances are in different Availability Zones.
AnswerD

Inter-AZ traffic has higher latency.

Why this answer

The primary cause of higher latency between EC2 instances in different Availability Zones is the physical distance and the additional network hops required to traverse the AZ boundary. Even within the same VPC, traffic between AZs must pass through AWS's regional network infrastructure, which introduces a baseline latency of 1-2 milliseconds, whereas instances in the same AZ can communicate with sub-millisecond latency. The question explicitly states the instances are in different AZs, making this the most likely source of the latency issue.

Exam trap

The trap here is that candidates often assume all instances in the same VPC have identical latency regardless of AZ placement, overlooking the fundamental physical and network architecture differences between intra-AZ and inter-AZ communication.

How to eliminate wrong answers

Option A is wrong because jumbo frames (MTU 9001) reduce latency by enabling larger payloads per packet, decreasing overhead and improving throughput; they do not cause high latency. Option B is wrong because a cluster placement group is designed to provide the lowest possible latency and maximum packet-per-second performance by placing instances in a single AZ, so using it would reduce, not cause, latency. Option C is wrong because Enhanced Networking (using SR-IOV or ENA) provides higher bandwidth, lower jitter, and lower per-packet latency; it is a performance optimization, not a source of latency.

Full explanation →
1353
MCQmedium

A company is designing a multi-region active-active architecture for a web application using Application Load Balancers (ALBs) and AWS Global Accelerator. The application must provide low-latency access to users worldwide and automatically route traffic to healthy endpoints. Which design should be used?

A.Use Amazon CloudFront with multiple origins pointing to ALBs in each region and configure origin failover.
B.Use Amazon Route 53 latency-based routing with health checks to route traffic to ALBs in each region.
C.Deploy a single ALB with multiple target groups across regions using cross-zone load balancing.
D.Deploy Global Accelerator with endpoints in each region (ALBs) and configure health checks to route traffic to healthy endpoints.
AnswerD

Global Accelerator uses anycast IPs and health checks for optimal routing to healthy endpoints.

Why this answer

Global Accelerator uses the AWS global network and Anycast IPs to direct traffic to the nearest healthy endpoint, providing low-latency access and automatic failover across regions. By configuring ALBs as endpoints in each region with health checks, Global Accelerator ensures traffic is routed only to healthy endpoints, meeting the active-active multi-region requirement.

Exam trap

The ANS-C01 exam often tests the misconception that DNS-based routing (Route 53) can achieve the same low-latency and fast failover as Global Accelerator, but candidates overlook the impact of DNS TTLs and client-side caching on failover speed and routing consistency.

How to eliminate wrong answers

Option A is wrong because CloudFront with multiple origins and origin failover is designed for static and dynamic content delivery with failover, but it does not provide the low-latency, active-active traffic routing across regions that Global Accelerator offers; CloudFront's origin failover is primarily for origin redundancy, not real-time multi-region load balancing. Option B is wrong because Route 53 latency-based routing with health checks can route traffic to the region with the lowest latency, but it relies on DNS caching and TTLs, which can cause delayed failover and inconsistent routing, making it unsuitable for the sub-second failover and active-active requirements of this architecture. Option C is wrong because a single ALB cannot have target groups across different regions; cross-zone load balancing only distributes traffic across targets within the same region and Availability Zone, not across regions.

Full explanation →
1354
MCQmedium

A company has multiple AWS accounts and wants to centralize VPC flow logs for analysis. The flow logs are published to Amazon S3 in each account. A central account needs to access these logs. Which solution meets the requirements with the least operational overhead?

A.Set up AWS Glue jobs to copy logs to a central S3 bucket
B.Use AWS Transit Gateway to centralize network traffic and capture logs
C.Use VPC peering to connect the accounts and access the S3 buckets directly
D.Use S3 bucket policies in each account to grant the central account access
AnswerD

Simplest and most scalable.

Why this answer

Using S3 bucket policies with cross-account permissions allows the central account to access the flow logs directly from the S3 buckets in each account without additional infrastructure. Option A is incorrect because AWS Glue jobs would add unnecessary operational overhead for copying data. Option B is incorrect because AWS Transit Gateway handles network traffic routing, not S3 access.

Option C is incorrect because VPC peering provides network connectivity between VPCs but does not grant access to S3 buckets; S3 access is managed via IAM and bucket policies.

Exam trap

Candidates may mistakenly assume that network connectivity (via Transit Gateway or VPC peering) is required to access S3 buckets across accounts. However, S3 bucket policies can grant cross-account access directly without any network-level configuration.

Full explanation →
1355
MCQhard

A network engineer is troubleshooting connectivity issues between two VPCs connected via a VPC peering connection. The VPCs are in different AWS accounts and regions. The engineer can ping the private IP of an instance in the peered VPC from one side, but not from the other. What is the most likely cause?

A.Route tables in one VPC do not have a route to the peered VPC CIDR
B.The security group in the peered VPC is blocking ICMP traffic
C.The VPC CIDR blocks overlap
D.The VPC peering connection is in a 'pending-acceptance' state
AnswerA

A missing route in one VPC prevents return traffic, causing one-way connectivity.

Why this answer

The most likely cause is that the route tables in one VPC lack a route pointing to the peered VPC's CIDR block. For a VPC peering connection to function bidirectionally, each VPC must have a route in its route table that directs traffic destined for the other VPC's CIDR to the peering connection (pcx-*). Without this route, packets from the source VPC to the peered VPC will be dropped, even if the peering connection itself is active and the security groups allow traffic.

Exam trap

The ANS-C01 exam often tests the misconception that security groups or network ACLs are the primary cause of one-way connectivity issues, but the real trap is that route table misconfiguration is the most common reason for asymmetric traffic flow in VPC peering scenarios.

How to eliminate wrong answers

Option B is wrong because the security group in the peered VPC would block traffic from both directions equally; since the engineer can ping from one side, the security group is not the issue. Option C is wrong because overlapping CIDR blocks would prevent the VPC peering connection from being established or cause asymmetric routing, but the question states the connection exists and one direction works, so overlap is not the cause. Option D is wrong because a 'pending-acceptance' state would mean the peering connection is not yet active, so no traffic would flow in either direction, contradicting the fact that one side can ping successfully.

Full explanation →
1356
MCQeasy

A company wants to block inbound traffic from a specific IP address range (203.0.113.0/24) at the VPC level using AWS WAF. Which resource should the AWS WAF web ACL be associated with?

A.Application Load Balancer
B.Network Load Balancer
C.VPC peering connection
D.Security group
AnswerA

AWS WAF can be associated with ALB to filter web traffic.

Why this answer

AWS WAF can be associated with an Application Load Balancer to filter HTTP/HTTPS traffic. Option B is wrong because NLB does not support AWS WAF. Option C is wrong because VPC peering does not have a web ACL.

Option D is wrong because a security group is used for stateful filtering, but AWS WAF is a separate service for web traffic.

Full explanation →
1357
MCQeasy

A company wants to allow an EC2 instance in a private subnet to download files from an S3 bucket without traversing the internet. Which AWS service should be used?

A.Establish an AWS Direct Connect connection to the VPC.
B.Attach an internet gateway and route through a NAT gateway.
C.Create a VPC Interface Endpoint for S3.
D.Create a VPC Gateway Endpoint for S3.
AnswerD

Gateway Endpoint provides private connectivity to S3 without internet.

Why this answer

A VPC Gateway Endpoint for S3 allows instances in a private subnet to access S3 without traversing the internet by routing traffic through AWS's internal network. It uses prefix lists and route table entries to direct S3 traffic to the endpoint, avoiding the need for NAT gateways or internet gateways.

Exam trap

The ANS-C01 exam often tests the distinction between Gateway Endpoints and Interface Endpoints, where candidates mistakenly choose Interface Endpoint for S3 because they confuse it with services like DynamoDB or API Gateway, or assume all AWS services use the same endpoint type.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect is a dedicated network connection from on-premises to AWS, not a solution for EC2-to-S3 access within the same region; it would still require a gateway endpoint or interface endpoint for private subnet access. Option B is wrong because attaching an internet gateway and routing through a NAT gateway forces traffic to traverse the internet, violating the requirement to avoid internet traversal; this also incurs NAT gateway costs and adds latency. Option C is wrong because a VPC Interface Endpoint for S3 is not supported; S3 only supports Gateway Endpoints (and optionally, PrivateLink for S3 via interface endpoints in some regions, but the standard and most cost-effective method is a Gateway Endpoint, which is the intended correct answer).

Full explanation →
1358
MCQhard

A company has a VPC with a CIDR of 10.0.0.0/16 and has enabled VPC Flow Logs to capture all traffic. The logs show that an EC2 instance (10.0.1.10) is sending outbound traffic to an external IP (203.0.113.50) on port 443, but the traffic is being rejected. The instance's security group allows outbound HTTPS to 0.0.0.0/0, and the subnet's NACL allows outbound traffic on port 443. The VPC has an internet gateway attached, and the route table directs 0.0.0.0/0 to the internet gateway. What is the most likely cause of the rejection?

A.The NACL inbound rules are blocking the return traffic.
B.The security group does not allow inbound HTTPS traffic.
C.The internet gateway is not attached to the VPC.
D.The route table does not have a route to the internet gateway.
AnswerA

NACLs are stateless and require explicit inbound rules for return traffic.

Why this answer

The outbound traffic from the EC2 instance is allowed by the security group and NACL outbound rules, but the return traffic (responses from 203.0.113.50:443 back to 10.0.1.10) must also be permitted by the subnet's NACL inbound rules. Since the NACL is stateless, it requires explicit inbound rules for ephemeral ports (typically 1024-65535) to allow the return traffic. If those inbound rules are missing, the return packets are dropped, causing the outbound traffic to appear as rejected in VPC Flow Logs.

Exam trap

AWS often tests the distinction between stateful security groups and stateless NACLs, specifically that NACLs require explicit inbound rules for return traffic while security groups automatically allow it.

How to eliminate wrong answers

Option B is wrong because the security group is stateful, so inbound HTTPS rules are not required for return traffic; the stateful nature of security groups automatically allows response traffic for outbound connections. Option C is wrong because the question explicitly states the VPC has an internet gateway attached. Option D is wrong because the route table directs 0.0.0.0/0 to the internet gateway, so the route is correctly configured.

Full explanation →
1359
MCQmedium

A company has a VPC with public and private subnets. They have a NAT gateway in a public subnet. They want to provide internet access to instances in private subnets. The NAT gateway is configured with an Elastic IP. The private instances still cannot access the internet. The route table for the private subnets has a default route (0.0.0.0/0) pointing to the NAT gateway. What is missing?

A.The network ACL for the private subnet allows outbound traffic
B.The private subnet route table is missing a route to the NAT gateway
C.The security group for the instances allows outbound traffic
D.The route table for the public subnet where the NAT gateway resides does not have a default route to an internet gateway
AnswerD

The NAT gateway needs internet access itself to forward traffic.

Why this answer

The private instances can't access the internet because the NAT gateway itself is in a public subnet that lacks a route to an internet gateway. The route table for the public subnet where the NAT gateway resides must have a default route (0.0.0.0/0) pointing to an internet gateway for the NAT gateway to reach the internet. Without this, the NAT gateway cannot forward traffic from the private instances to the internet.

Option A is not the best answer because network ACLs are stateless and by default allow outbound traffic, but they could be misconfigured; however, the most common missing piece is the public subnet's route table. Option B is incorrect because the private subnet route table already has the default route to the NAT gateway. Option C is incorrect because security groups are stateful and automatically allow outbound traffic if inbound is allowed, so they are not blocking.

Full explanation →
1360
MCQhard

A company is designing a hub-and-spoke network in AWS. The security team requires that all traffic between VPCs in different spokes must be inspected by a third-party firewall deployed in the hub VPC. Which architecture meets this requirement with minimal complexity?

A.Create VPC peering connections between each spoke VPC and configure security groups to enforce inspection.
B.Use AWS PrivateLink to connect all spoke VPCs to a central service in the hub.
C.Use a Transit Gateway with separate route tables for each spoke VPC, and configure the spoke route tables to route all inter-spoke traffic through the hub VPC firewall.
D.Set up AWS Direct Connect between all VPCs and route through a central firewall.
AnswerC

This forces traffic through the inspection firewall.

Why this answer

Transit Gateway with separate route tables allows you to configure routes so that traffic between spoke VPCs is directed through the hub VPC firewall for inspection. Option A is incorrect because VPC peering does not centralize traffic inspection; it creates direct connectivity without forcing traffic through the hub. Option B is incorrect because AWS PrivateLink is designed for accessing services privately, not for routing inter-VPC traffic.

Option D is incorrect because AWS Direct Connect is used for on-premises connectivity, not for inter-VPC routing within AWS.

Full explanation →
1361
Multi-Selectmedium

A company is designing a VPC with multiple subnets. They want to ensure that EC2 instances in a private subnet can access S3 buckets without going through a NAT Gateway or Internet Gateway. Which TWO methods can accomplish this?

Select 2 answers
A.Set up a VPN connection to S3
B.Create a Gateway VPC Endpoint for S3
C.Use AWS Direct Connect to access S3
D.Create an Interface VPC Endpoint for S3
E.Attach an Internet Gateway and use a NAT Gateway
AnswersB, D

Allows private subnet instances to access S3 without internet.

Why this answer

A Gateway VPC Endpoint for S3 allows EC2 instances in a private subnet to access S3 buckets privately using AWS’s internal network, without requiring an Internet Gateway or NAT Gateway. It uses prefix lists and route table entries to direct S3 traffic through the endpoint, leveraging the AWS global network for secure, low-latency access.

Exam trap

AWS often tests the misconception that only Gateway VPC Endpoints can access S3 privately, but Interface VPC Endpoints are also valid and are the correct answer when the question specifies 'multiple subnets' or 'on-premises connectivity' as a requirement.

Full explanation →
1362
MCQmedium

A company has a VPC with multiple subnets. They want to capture and analyze network traffic between EC2 instances in the same VPC for troubleshooting. Which AWS service should be used?

A.VPC Flow Logs
B.AWS CloudTrail
C.AWS Config
D.Amazon CloudWatch Metrics
AnswerA

Captures network traffic metadata for analysis.

Why this answer

VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet/byte counts) at the VPC, subnet, or network interface level, enabling detailed analysis of traffic between EC2 instances within the same VPC. This is the correct service because it provides the network-level visibility needed for troubleshooting traffic flows without requiring agents or changes to the instances.

Exam trap

The trap here is that candidates confuse VPC Flow Logs with CloudTrail, thinking CloudTrail captures network traffic because it logs 'events,' but CloudTrail only logs AWS API calls, not the data-plane traffic between instances.

How to eliminate wrong answers

Option B (AWS CloudTrail) is wrong because it records API calls and management events, not network traffic flows; it cannot capture the actual IP packets or metadata between EC2 instances. Option C (AWS Config) is wrong because it evaluates resource configurations and compliance rules, not network traffic; it tracks changes to resources like security groups but does not log traffic flows. Option D (Amazon CloudWatch Metrics) is wrong because it collects performance metrics (e.g., CPU, network throughput) but does not capture per-flow metadata such as source/destination IPs, ports, or protocols needed for traffic analysis.

Full explanation →
1363
MCQhard

A company has a VPC with public and private subnets. The private subnets use a NAT gateway for outbound internet access. The security team notices that some EC2 instances in the private subnets are able to reach the internet, but others are not. All instances have the same security group and are in the same private subnet. What is the most likely cause?

A.The route table associated with the private subnet is missing a default route to the NAT gateway.
B.The network ACL is blocking outbound traffic on ephemeral ports.
C.The NAT gateway's security group is blocking traffic from some instances.
D.The internet gateway is not attached to the VPC.
AnswerC

Correct. The NAT gateway has an elastic network interface with a security group. If that security group is configured to allow traffic only from specific instances (e.g., based on private IP addresses or security group IDs), it can selectively permit or deny outbound internet access for instances in the same private subnet.

Why this answer

The most likely cause is that the NAT gateway's security group (attached to its elastic network interface) is blocking traffic from some instances. Although all EC2 instances are in the same private subnet and have the same security group, the NAT gateway's own security group can be configured to allow outbound traffic only from specific source IPs or security groups. If the NAT gateway's security group only permits traffic from certain instances' private IPs (or security groups) within the subnet, it would allow some instances to reach the internet while blocking others.

Option A is incorrect because a missing route would affect all instances in that subnet equally. Option B is incorrect because a network ACL applies to the entire subnet and would block all instances. Option D is incorrect because the internet gateway is attached to the VPC, not directly to private subnets, and its absence would prevent all internet access.

Exam trap

Candidates might assume that all subnet-level configurations (route tables, NACLs) affect all instances uniformly, but they overlook that the NAT gateway's security group can filter traffic from specific sources, causing differential access within the same subnet.

Full explanation →
1364
Multi-Selecthard

A company has a VPC with a CIDR of 10.0.0.0/16. They have created a VPC peering connection with another VPC (CIDR 10.1.0.0/16). They want to enable DNS resolution between the VPCs. Which TWO actions must be taken?

Select 2 answers
A.The requester must accept the peering connection with the 'Enable DNS Resolution' option checked.
B.Both VPCs must have the 'Enable DNS Resolution' attribute set to true in their VPC settings.
C.Ensure both VPCs are in the same AWS region.
D.The accepter must modify the peering connection to enable DNS resolution from their side.
E.The route tables must include a route for the peered VPC's CIDR.
AnswersB, D

Correct. Both VPCs must have the EnableDnsHostnames and EnableDnsSupport attributes set to true to support DNS resolution.

Why this answer

To enable DNS resolution across a VPC peering connection, two conditions must be met. First, both VPCs must have the 'Enable DNS Resolution' attribute set to true in their VPC settings, which requires both EnableDnsHostnames and EnableDnsSupport to be enabled (Option B). Second, the VPC peering connection itself must have DNS resolution enabled.

This can be done by the accepter when accepting the peering connection or later by modifying the peering connection (Option D). Option A is incorrect because the requester does not accept the peering connection; the accepter does. Option C is not required for DNS resolution.

Option E (route table entries) is necessary for connectivity but not specifically for DNS resolution.

Exam trap

A common pitfall is assuming the requester can enable DNS resolution by checking the option when creating the peering connection. In reality, the accepter must enable it when accepting or later. Also, candidates may forget to enable the VPC DNS attributes.

Full explanation →
1365
MCQeasy

A company is deploying a new application in a VPC with public and private subnets. The application servers in the private subnets need to access the internet to download patches. Which configuration meets this requirement without allowing inbound internet traffic?

A.Attach an internet gateway to the private subnets and configure route tables accordingly.
B.Create a NAT gateway in a public subnet and add a route to the NAT gateway from the private subnets' route tables.
C.Establish a site-to-site VPN connection to an on-premises internet gateway.
D.Configure a VPC endpoint for the internet in the private subnets.
AnswerB

A NAT gateway allows outbound internet traffic from private subnets while preventing unsolicited inbound connections.

Why this answer

A NAT gateway in a public subnet allows instances in private subnets to initiate outbound connections to the internet (e.g., for patch downloads) while preventing unsolicited inbound traffic from the internet. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT gateway's elastic network interface. This is the standard AWS pattern for outbound-only internet access from private subnets.

Exam trap

The trap here is that candidates confuse a NAT gateway with an internet gateway, assuming both provide internet access, but an internet gateway enables bidirectional traffic (including inbound), while a NAT gateway strictly enforces outbound-only access from private subnets.

How to eliminate wrong answers

Option A is wrong because attaching an internet gateway directly to private subnets would expose them to inbound internet traffic, violating the requirement to block inbound traffic; internet gateways allow bidirectional communication. Option C is wrong because a site-to-site VPN connects to an on-premises network, not the internet, and would not provide general internet access for patch downloads unless the on-premises network has its own internet breakout, which is not stated. Option D is wrong because VPC endpoints provide private connectivity to specific AWS services (e.g., S3, DynamoDB) via AWS PrivateLink, not general internet access; they cannot reach arbitrary internet hosts.

Full explanation →
1366
MCQhard

A company is deploying a web application across multiple AWS Regions using an Application Load Balancer (ALB) in each Region. The company wants to use AWS Global Accelerator to provide a static IP address and accelerate traffic. The application requires that client IP addresses be preserved in the backend logs. Which configuration should the network engineer use?

A.Use Network Load Balancers as endpoints in Global Accelerator.
B.Use VPC endpoints and AWS PrivateLink to route traffic through the Global Accelerator.
C.Use Amazon CloudFront in front of the ALBs with origin protocol policy set to HTTPS.
D.Use Application Load Balancers as endpoints and enable X-Forwarded-For header logging.
AnswerA

NLB preserves source IP addresses when used as a Global Accelerator endpoint.

Why this answer

AWS Global Accelerator preserves the client IP address when using a Network Load Balancer (NLB) as an endpoint. Global Accelerator uses the Proxy Protocol v2 to pass the original client IP to the NLB, which then forwards it to the backend targets. This meets the requirement for client IP preservation in backend logs.

Exam trap

The trap here is that candidates often assume Application Load Balancers can preserve client IPs via X-Forwarded-For headers, but Global Accelerator's architecture changes the source IP at the network layer, making Proxy Protocol with an NLB the only way to preserve the original client IP in the packet itself.

How to eliminate wrong answers

Option B is wrong because VPC endpoints and AWS PrivateLink are used for private connectivity to services over the AWS network, not for providing static IP addresses or accelerating traffic with Global Accelerator. Option C is wrong because Amazon CloudFront does not provide static IP addresses; it uses a distributed network of edge locations with dynamic IPs, and it does not preserve the original client IP by default without additional configuration like X-Forwarded-For headers, which are not sufficient for backend log preservation in this context. Option D is wrong because Application Load Balancers as endpoints in Global Accelerator do not preserve the client IP address; Global Accelerator terminates the original client connection and replaces the source IP with its own, and while X-Forwarded-For headers can carry the client IP, the requirement is for the actual source IP to be preserved in the packet, which ALBs cannot achieve with Global Accelerator.

Full explanation →
1367
Multi-Selectmedium

A company is implementing a network security solution for a VPC that contains a web application. The application uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances in private subnets. The company wants to protect against common web exploits and also filter outbound traffic from the instances. Which TWO services should be used together?

Select 2 answers
A.AWS Shield Advanced
B.AWS WAF
C.AWS Network Firewall
D.Network ACLs
E.Amazon GuardDuty
AnswersB, C

WAF can be associated with the ALB to filter web requests.

Why this answer

To protect against common web exploits, AWS WAF (Option B) should be used with the ALB to filter incoming HTTP/HTTPS requests. For filtering outbound traffic from the EC2 instances, AWS Network Firewall (Option C) provides stateful inspection of both inbound and outbound traffic. Option A (AWS Shield Advanced) is a DDoS protection service, not for web exploit filtering.

Option D (Network ACLs) are stateless and cannot perform content-based filtering. Option E (Amazon GuardDuty) is a threat detection service, not a firewall.

Full explanation →
1368
MCQhard

A company has a large VPC with multiple workloads. They need to isolate development and production environments within the same VPC, but allow limited communication between them via specific ports. Which approach meets these requirements?

A.Place dev and prod in the same subnet and use security groups to filter traffic.
B.Use a single subnet and rely on network ACLs to separate traffic.
C.Create separate subnets for dev and prod, use network ACLs to allow only specific ports between them.
D.Create two VPCs and use VPC peering to allow communication.
AnswerC

Network ACLs are stateless and can control traffic between subnets effectively.

Why this answer

Placing development and production workloads in separate subnets allows you to apply stateless network ACLs at the subnet boundary. Network ACLs can explicitly allow only specific ports (e.g., TCP 443) between the subnets while blocking all other traffic, providing a clear isolation boundary within the same VPC. Security groups alone cannot enforce inter-subnet filtering because they are stateful and applied at the instance level, not at the subnet edge.

Exam trap

The trap here is that candidates often confuse the stateless behavior of network ACLs with the stateful behavior of security groups, leading them to choose Option A or B, thinking that security groups can enforce subnet-level isolation or that a single subnet with ACLs can separate internal traffic.

How to eliminate wrong answers

Option A is wrong because placing dev and prod in the same subnet and relying on security groups does not provide subnet-level isolation; security groups are stateful and applied per instance, so they cannot prevent traffic between instances in the same subnet that are not associated with the security group, and they do not filter traffic at the subnet boundary. Option B is wrong because using a single subnet with network ACLs is ineffective; network ACLs are applied at the subnet level, but if all instances are in the same subnet, the ACL applies equally to all traffic entering or leaving that subnet, so it cannot differentiate between dev and prod traffic within the same subnet. Option D is wrong because creating two VPCs with VPC peering is an over-engineered solution that adds complexity (e.g., route table entries, cross-account considerations) and does not meet the requirement of isolating environments within the same VPC; VPC peering also does not provide native filtering—you would still need separate ACLs or security groups to limit communication.

Full explanation →
1369
MCQhard

A company uses AWS Shield Advanced for DDoS protection. During an attack, they notice that legitimate traffic is being throttled. Which configuration change should be made to reduce false positives while maintaining protection?

A.Reduce the rate limit in the Shield Advanced configuration.
B.Increase the rate limit threshold in the associated AWS WAF rate-based rule.
C.Disable the AWS WAF rate-based rule for the duration of the attack.
D.Increase the sensitivity of the AWS WAF web ACL.
AnswerB

A higher threshold allows more legitimate traffic before throttling.

Why this answer

Increasing the rate limit threshold in the associated AWS WAF rate-based rule can reduce false positives by allowing more legitimate traffic while still providing protection. Option A is incorrect because reducing the rate limit would increase false positives. Option C is incorrect because disabling the rule removes protection.

Option D is incorrect because increasing sensitivity of the web ACL is not a direct setting; rate limits are set per rule.

Full explanation →
1370
MCQmedium

A company is designing a VPC with public and private subnets. They need to allow instances in the private subnet to access the internet for software updates while preventing inbound internet traffic. Which AWS service should they use?

A.NAT Gateway
B.AWS Direct Connect
C.VPC Peering
D.Internet Gateway
AnswerA

NAT Gateway enables outbound traffic to the internet from private subnets.

Why this answer

(NAT Gateway) is correct because a NAT Gateway allows instances in a private subnet to initiate outbound internet traffic (e.g., for software updates) while preventing any inbound traffic from the internet. Option B (AWS Direct Connect) is a dedicated private connection between on-premises and AWS, not for internet access. Option C (VPC Peering) connects VPCs privately, not providing internet access.

Option D (Internet Gateway) allows both inbound and outbound traffic, which would expose private instances to inbound internet traffic, violating the requirement.

Full explanation →
1371
MCQhard

A network engineer is troubleshooting a VPN connection between an AWS Virtual Private Gateway and an on-premises Cisco ASA. The tunnel status shows 'UP' but no traffic passes. The engineer checks the route tables and finds the correct static routes on both sides. What should the engineer check next?

A.Review the IPsec phase 2 settings, including the traffic selectors.
B.Check the IKE phase 1 parameters (e.g., encryption, hash).
C.Verify that the pre-shared keys match.
D.Confirm that the VPC route table has a route to the on-premises subnet.
AnswerA

Phase 2 parameters or mismatched encryption domains could cause the tunnel to be UP but not pass traffic.

Why this answer

If the tunnel is up but no traffic passes, the issue is often phase 2 IPsec security associations (SAs) or mismatch in encryption domains. Unlike phase 1, phase 2 can fail silently.

Full explanation →
1372
MCQeasy

A company is using AWS WAF to protect a web application behind an Application Load Balancer. They want to block requests from a specific IP address range. Which component should they use?

A.Security group associated with the ALB
B.IP set match condition in AWS WAF
C.AWS Shield Advanced
D.Network ACL on the ALB's subnets
AnswerB

AWS WAF uses IP sets to match IP addresses and can block them.

Why this answer

AWS WAF includes IP set match conditions that allow you to specify IP addresses to block or allow, which directly addresses the requirement to block requests from a specific IP address range. Option A is wrong because security groups are stateful firewalls for EC2 instances and cannot be directly associated with an ALB to filter web requests. Option C is wrong because AWS Shield Advanced provides DDoS protection but does not offer granular IP-based blocking.

Option D is wrong because network ACLs operate at the subnet level and are not integrated with ALB for web request filtering.

Full explanation →
1373
MCQeasy

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC endpoint are allowed. Which type of policy should they use?

A.S3 bucket policy with aws:SourceVpce condition
B.S3 bucket policy with aws:SourceIp condition
C.IAM policy
D.VPC endpoint policy
AnswerA

Bucket policies can restrict access based on VPC endpoint ID.

Why this answer

S3 bucket policies can use the aws:SourceVpce condition key to restrict access to requests originating from a specific VPC endpoint. Option B is incorrect because aws:SourceIp condition is not effective for traffic coming through a VPC endpoint, as the source IP is the endpoint's private IP, not the client's IP. Option C is incorrect because IAM policies control user and role permissions, not network-level access control.

Option D is incorrect because VPC endpoint policies control what actions can be performed via the endpoint, but they do not replace bucket policies for restricting access to the S3 bucket itself.

Full explanation →
1374
MCQmedium

A security team wants to block traffic from a specific IP address (203.0.113.5) from reaching an EC2 instance. The instance is in a public subnet with a security group that allows all traffic from the internet. A network ACL is associated with the subnet. The team adds a DENY rule for the IP in the network ACL. However, traffic from that IP still reaches the instance. What is the most likely reason?

A.The network ACL has an ALLOW rule with a lower rule number that matches the IP, so the DENY rule is never evaluated.
B.The security group allows traffic from the IP, overriding the network ACL.
C.The network ACL is applied to the wrong subnet.
D.The internet gateway is ignoring the network ACL.
AnswerA

Network ACLs are processed in rule number order; the first matching rule is applied.

Why this answer

Network ACLs are stateless and evaluated in order by rule number, from lowest to highest. If an ALLOW rule with a lower rule number (e.g., 100) matches the source IP 203.0.113.5 before the DENY rule (e.g., 200) is reached, the ALLOW rule will be applied and the traffic permitted. The DENY rule is never evaluated because the first matching rule determines the action.

Exam trap

The trap here is that candidates assume a DENY rule in a network ACL will always block traffic, forgetting that network ACLs are evaluated in rule-number order and the first matching rule wins, so a lower-numbered ALLOW rule can permit the traffic before the DENY rule is even considered.

How to eliminate wrong answers

Option A is correct as described. Option B is wrong because security groups are stateful and can only allow traffic; they cannot override a network ACL deny, but in this case the network ACL's ALLOW rule is permitting the traffic before the DENY rule is evaluated. Option C is wrong because if the network ACL were applied to the wrong subnet, traffic from the IP would either be blocked or allowed based on that ACL's rules, but the question states the ACL is associated with the subnet and the team added a DENY rule, so misapplication would not cause the specific symptom of the DENY rule being ignored.

Option D is wrong because an internet gateway does not evaluate network ACLs; it forwards traffic to the subnet, where the subnet's network ACL is evaluated by the VPC router.

Full explanation →
1375
MCQmedium

A company has a VPC with public and private subnets in three Availability Zones. They want to provide outbound internet access to instances in private subnets while preventing inbound traffic from the internet. Which solution meets these requirements with the least operational overhead?

A.Deploy a NAT instance in a public subnet and configure the private subnet route table to point to it.
B.Attach an Internet Gateway to the VPC and add a default route to it in the private subnet route table.
C.Create a NAT Gateway in a public subnet and add a default route in the private subnet route table pointing to the NAT Gateway.
D.Create a VPC Gateway Endpoint for Amazon S3 and route outbound traffic through it.
AnswerC

NAT Gateway is a managed service, reduces operational overhead.

Why this answer

A NAT Gateway is a fully managed AWS service that provides outbound internet access for instances in private subnets while blocking unsolicited inbound connections. By placing the NAT Gateway in a public subnet and adding a default route (0.0.0.0/0) in the private subnet route table pointing to the NAT Gateway, traffic from private instances is source NATed to the NAT Gateway's Elastic IP, ensuring inbound traffic from the internet cannot reach the private instances. This solution offers the least operational overhead as AWS handles scaling, patching, and availability, unlike a self-managed NAT instance.

Exam trap

The trap here is that candidates often confuse a NAT Gateway with a NAT instance, assuming both offer similar operational overhead, or mistakenly think that an Internet Gateway can be used directly in private subnets, ignoring that it would allow inbound traffic from the internet.

How to eliminate wrong answers

Option A is wrong because a NAT instance requires manual management (e.g., patching, scaling, failover) and introduces higher operational overhead compared to a managed NAT Gateway, contradicting the 'least operational overhead' requirement. Option B is wrong because attaching an Internet Gateway and adding a default route to it in the private subnet route table would directly expose private instances to the internet, allowing unsolicited inbound traffic and violating the requirement to prevent inbound traffic. Option D is wrong because a VPC Gateway Endpoint for Amazon S3 only provides private connectivity to S3, not general outbound internet access to other destinations (e.g., HTTP/HTTPS to the internet), so it does not meet the requirement for outbound internet access.

Full explanation →
1376
MCQeasy

A company has a web application running on EC2 instances behind an Application Load Balancer (ALB). The application stores files in an S3 bucket. The security team wants to ensure that the EC2 instances can only access the specific S3 bucket and no other AWS services. They have created an IAM role for the EC2 instances with a policy that grants s3:PutObject and s3:GetObject on the specific bucket. They have also attached a VPC endpoint for S3 to the VPC and added a bucket policy that allows access only from the VPC endpoint. Despite this, the EC2 instances can still access other S3 buckets. What is the most likely reason?

A.The VPC endpoint does not have a route table associated with the private subnets.
B.The security group on the VPC endpoint is allowing all traffic.
C.The VPC endpoint policy does not restrict access to the specific S3 bucket.
D.The IAM role does not have a trust policy that allows EC2 to assume it.
AnswerC

Without a restrictive endpoint policy, the VPC endpoint allows access to any S3 bucket, and if the instances have any other IAM policies (even default), they could access other buckets.

Why this answer

The most likely reason is that the VPC endpoint policy is not restricting access to the specific S3 bucket (Option C). Even though the IAM role only grants permissions on the specific bucket, the VPC endpoint policy defaults to allowing access to all S3 resources. Without a restrictive endpoint policy, the EC2 instances can access other S3 buckets if they have any IAM permissions that allow it (e.g., from another attached policy).

Option A is incorrect because the VPC endpoint does not require a route table association to function; rather, the route table must have a route pointing to the endpoint for traffic to use it. Option B is incorrect because the security group on the endpoint controls network traffic, not access to S3 buckets. Option D is incorrect because the IAM role must have a trust policy allowing EC2 to assume it, but that is a prerequisite and would not cause the described issue by itself.

Full explanation →
1377
Drag & Dropmedium

Arrange the steps to configure a site-to-site VPN connection between an AWS Virtual Private Gateway and an on-premises Cisco ASA in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First, define the customer gateway, then create the VPN connection, apply the configuration, verify the tunnel, and finally configure routing.

Full explanation →
1378
MCQeasy

A company is designing a network for a highly available application across multiple AWS regions. The application requires low-latency communication between regions and uses IP addresses that cannot change. Which AWS service should be used to connect the VPCs in different regions?

A.AWS Direct Connect
B.VPC Endpoints
C.VPC Peering
D.Internet Gateway
AnswerC

VPC peering supports inter-region connectivity.

Why this answer

VPC Peering is the correct choice because it establishes a direct, private network connection between two VPCs in different AWS regions using AWS's global backbone, enabling low-latency communication without requiring public internet traversal. It supports inter-region peering (since 2017) and allows the use of private IP addresses that remain unchanged, satisfying the requirement for fixed IPs.

Exam trap

The ANS-C01 exam often tests the misconception that VPC Peering is only for same-region VPCs, but AWS has supported inter-region VPC Peering since 2017, making it a valid and recommended solution for cross-region private connectivity with fixed IPs.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect is a dedicated on-premises to AWS connection service, not designed for VPC-to-VPC connectivity across regions; it would require additional transit VPC or VPN setups and does not natively connect VPCs. Option B is wrong because VPC Endpoints (Gateway or Interface) enable private access to AWS services (e.g., S3, DynamoDB) from within a VPC, not connectivity between VPCs in different regions. Option D is wrong because an Internet Gateway allows a VPC to communicate with the public internet, not private inter-VPC communication, and would expose traffic to public transit, violating the fixed IP and low-latency requirements.

Full explanation →
1379
MCQmedium

A company is deploying a multi-tier web application on AWS. The web tier runs on EC2 instances behind an Application Load Balancer (ALB), and the application tier runs on EC2 instances that connect to an RDS MySQL Multi-AZ DB instance. The application tier must be isolated from the internet and only accessible from the web tier. Which network implementation meets these requirements with the LEAST administrative overhead?

A.Place the web tier in a public subnet and the application tier in a private subnet, and configure security groups to allow inbound traffic to the application tier only from the web tier's security group.
B.Create two VPCs: one for the web tier with a public subnet, and one for the application tier with a private subnet, and connect them using VPC peering.
C.Place the web tier in a public subnet and the application tier in a private subnet with a NAT gateway for outbound access, and use security groups to allow traffic from the web tier.
D.Place both tiers in the same public subnet, and use a network ACL to restrict traffic from the web tier to the application tier.
AnswerA

This achieves isolation with minimal overhead.

Why this answer

Placing the web tier in a public subnet and the application tier in a private subnet, then using a security group rule that references the web tier's security group as the source, provides a stateful, application-layer firewall that allows traffic only from the web tier to the application tier. This design isolates the application tier from the internet while requiring no additional infrastructure like NAT gateways or VPC peering, minimizing administrative overhead. The security group reference automatically scales with the web tier's instances, eliminating the need to manage IP addresses.

Exam trap

The trap here is that candidates often over-engineer the solution by adding unnecessary components like NAT gateways or VPC peering, misunderstanding that security group references can securely allow traffic from a public subnet to a private subnet within the same VPC without internet gateway or NAT involvement.

How to eliminate wrong answers

Option B is wrong because using two separate VPCs with VPC peering introduces unnecessary complexity and administrative overhead (e.g., managing route tables, peering connections, and cross-VPC security group references) compared to a single VPC with public and private subnets. Option C is wrong because a NAT gateway is not required for the application tier to be accessible from the web tier; the web tier initiates traffic to the private subnet, and the application tier does not need outbound internet access for this requirement. Option D is wrong because placing both tiers in the same public subnet exposes the application tier to the internet, violating the isolation requirement, and network ACLs are stateless, requiring explicit rules for return traffic, which increases administrative overhead and risk of misconfiguration.

Full explanation →
1380
MCQhard

A global e-commerce company uses a hub-and-spoke network topology with a transit VPC in us-east-1. Each spoke VPC has an AWS Site-to-Site VPN connection to its respective on-premises office. Users report intermittent connectivity issues when accessing a web application hosted in a spoke VPC in eu-west-1 from an on-premises office in ap-southeast-1. The network engineer checks the VPN connection and finds it is up. Which design change would MOST likely resolve the issue?

A.Change the VPN connection from static to dynamic routing.
B.Enable jumbo frames on the transit VPC's EC2-based virtual appliances.
C.Enable BGP route propagation on the transit VPC's route tables.
D.Deploy a new transit VPC in eu-west-1.
AnswerB

Jumbo frames reduce overhead and improve throughput for large packets.

Why this answer

The issue is intermittent connectivity between an on-premises office in ap-southeast-1 and a spoke VPC in eu-west-1, traversing a transit VPC in us-east-1. The VPN is up, so the problem is likely packet fragmentation or MTU mismatch across the long-haul path. Enabling jumbo frames on the transit VPC's EC2-based virtual appliances (e.g., firewall or router instances) increases the maximum transmission unit, reducing fragmentation and improving performance for large packets, which is a common cause of intermittent issues in hub-and-spoke topologies.

Exam trap

The trap here is that candidates assume a 'VPN is up' means the issue is routing-related (e.g., BGP propagation or static vs. dynamic), but the real culprit is often subtle packet-level problems like MTU mismatch or fragmentation across a multi-region hub-and-spoke design.

How to eliminate wrong answers

Option A is wrong because changing from static to dynamic routing (e.g., BGP) addresses routing protocol convergence and failover, not intermittent connectivity caused by MTU or fragmentation; the VPN is already up, so routing is functional. Option C is wrong because enabling BGP route propagation on the transit VPC's route tables would only affect route advertisement and learning, not packet-level issues like fragmentation; the routes are already in place since the VPN is established. Option D is wrong because deploying a new transit VPC in eu-west-1 would add complexity and cost without addressing the root cause; the existing transit VPC in us-east-1 can handle cross-region traffic, and the problem is likely MTU-related, not latency or regional proximity.

Full explanation →
1381
MCQmedium

A company is designing a multi-region active-active architecture with an Application Load Balancer in each region. Which service can route traffic to the closest ALB based on latency?

A.AWS Global Accelerator
B.Amazon Route 53 latency-based routing
C.Application Load Balancer cross-zone load balancing
D.Amazon CloudFront
AnswerB

Route 53 latency routing directs users to the region with lowest latency.

Why this answer

Amazon Route 53 latency-based routing directs traffic to the AWS region that provides the lowest latency for the end user, based on historical latency measurements between the user's ISP and each region. This makes it the correct choice for routing users to the closest Application Load Balancer in a multi-region active-active architecture.

Exam trap

The trap here is that candidates often confuse AWS Global Accelerator's 'nearest endpoint' behavior with latency-based routing, but Global Accelerator uses Anycast to direct traffic to the closest edge location, not to the region with the lowest application latency, making Route 53 latency-based routing the correct answer for this specific use case.

How to eliminate wrong answers

Option A is wrong because AWS Global Accelerator uses Anycast IPs and the AWS global network to route traffic to the nearest healthy endpoint, but it does not use latency measurements to select the closest ALB; it relies on edge location proximity and endpoint health. Option C is wrong because Application Load Balancer cross-zone load balancing distributes traffic evenly across targets within a single region, not across regions. Option D is wrong because Amazon CloudFront is a content delivery network that caches content at edge locations and does not route traffic to the closest ALB based on latency; it uses DNS and edge caches to serve content, not dynamic latency-based routing to origin ALBs.

Full explanation →
1382
MCQmedium

A company's VPC has an internet gateway and a NAT Gateway in a public subnet. The private subnet route table has a default route pointing to the NAT Gateway. EC2 instances in the private subnet can access the internet, but cannot access an on-premises network connected via AWS Site-to-Site VPN. What is the most likely cause?

A.The private subnet route table does not have a route to the on-premises network via the virtual private gateway.
B.The NAT Gateway is not configured to route traffic to the VPN.
C.The internet gateway is not attached to the VPC.
D.The VPN connection is not advertising the on-premises CIDR via BGP.
AnswerA

The default route to NAT Gateway takes precedence over VPN routes.

Why this answer

The private subnet route table has a default route (0.0.0.0/0) pointing to the NAT Gateway, which allows outbound internet traffic. However, traffic destined for the on-premises network must be routed via the Virtual Private Gateway (VGW) attached to the VPC. Since the route table lacks a specific route (e.g., 10.0.0.0/8) pointing to the VGW, packets to the on-premises CIDR are instead sent to the NAT Gateway, which drops them because it has no route or interface for the on-premises network.

Exam trap

AWS often tests the misconception that a NAT Gateway can forward traffic to a VPN or that the internet gateway is responsible for VPN routing, when in fact the route table's destination-based forwarding is the sole determinant of where traffic goes.

How to eliminate wrong answers

Option B is wrong because the NAT Gateway is a Layer 3 device that forwards traffic based on route tables; it does not perform routing decisions or have a configuration to 'route traffic to the VPN' — the route table controls where traffic goes. Option C is wrong because the internet gateway is correctly attached (the private instances can access the internet), so its attachment status is not the issue. Option D is wrong because even if the VPN connection is not advertising the on-premises CIDR via BGP, the VPC route table must still have a static or propagated route to the VGW; the absence of BGP advertisement would prevent route propagation, but the core problem is the missing route in the private subnet route table.

Full explanation →
1383
MCQeasy

A company wants to ensure that traffic between two VPCs in the same region is encrypted in transit. The VPCs are connected via a VPC peering connection. What should the network engineer do to meet this requirement?

A.Create an AWS Site-to-Site VPN between the VPCs and disable the VPC peering connection.
B.Use TLS or IPsec at the application layer between instances.
C.Replace the VPC peering connection with a Transit Gateway and enable VPN encryption.
D.Enable encryption on the VPC peering connection.
AnswerB

Application-layer encryption provides encryption over the peering connection.

Why this answer

VPC peering connections do not support native encryption of traffic. To meet the requirement for encryption in transit between two VPCs connected via a VPC peering connection, you must implement encryption at the application layer using TLS or IPsec between the instances. This ensures that traffic is encrypted end-to-end, independent of the underlying network path.

Exam trap

The trap here is that candidates often assume VPC peering connections are inherently encrypted because they use the AWS private network, but AWS does not encrypt traffic over VPC peering; encryption must be implemented at the application or instance layer.

How to eliminate wrong answers

Option A is wrong because creating an AWS Site-to-Site VPN between the VPCs would require a virtual private gateway and a customer gateway in each VPC, which is not supported for VPC-to-VPC connections without a Transit Gateway or a third-party appliance; additionally, disabling the VPC peering connection is unnecessary and does not solve the encryption requirement. Option C is wrong because replacing the VPC peering connection with a Transit Gateway does not inherently enable VPN encryption; you would need to attach VPN attachments to the Transit Gateway, which adds complexity and cost, and the question specifically states the VPCs are already connected via a VPC peering connection. Option D is wrong because VPC peering connections do not support enabling encryption natively; there is no toggle or setting to encrypt traffic over a VPC peering connection.

Full explanation →
1384
Multi-Selecthard

A company is designing a network security architecture for a multi-account environment using AWS Organizations. They need to centrally manage and enforce security policies across all accounts. Which THREE services should they consider?

Select 3 answers
A.AWS Direct Connect
B.AWS Firewall Manager
C.AWS Security Hub
D.Amazon Route 53 Resolver DNS Firewall
E.AWS CloudTrail
AnswersB, C, E

Central management of firewall rules.

Why this answer

Options B, C, and E are correct: AWS Firewall Manager centrally manages firewall rules across accounts; AWS Security Hub provides a unified view of security alerts and compliance checks; AWS CloudTrail logs API calls across accounts for auditing and monitoring. Option A is wrong because AWS Direct Connect is a dedicated network connection service, not a policy enforcement service. Option D is wrong because Amazon Route 53 Resolver DNS Firewall is a DNS-layer filtering service, but the question asks for central policy enforcement and management across accounts, which is not its primary function.

Full explanation →
1385
MCQeasy

A company is setting up a Direct Connect connection between its on-premises data center and AWS. The company wants to use a single virtual interface (VIF) to access multiple VPCs in the same AWS Region. Which AWS service should be used to achieve this?

A.Direct Connect gateway
B.VPC peering connection
C.AWS VPN CloudHub
D.Transit VPC
AnswerA

A Direct Connect gateway enables a single virtual interface to connect to multiple VPCs.

Why this answer

A Direct Connect gateway allows you to associate multiple Virtual Private Clouds (VPCs) in the same AWS Region with a single Direct Connect virtual interface (VIF). This is achieved by creating a Direct Connect gateway and attaching it to the VIF, then associating the desired VPCs with the gateway via virtual private gateways (VGWs) or transit gateways. This enables centralized, private connectivity from on-premises to multiple VPCs without needing separate VIFs per VPC.

Exam trap

The trap here is that candidates often confuse a Direct Connect gateway with a Transit Gateway, but the question explicitly asks for the service to use with a single VIF, and a Direct Connect gateway is the correct component that directly attaches to the VIF, whereas a Transit Gateway is a separate construct that can also be used but requires additional configuration and is not the direct answer for 'using a single VIF to access multiple VPCs'.

How to eliminate wrong answers

Option B is wrong because VPC peering connections provide connectivity between two VPCs but do not integrate with Direct Connect to allow a single VIF to reach multiple VPCs; peering is a point-to-point connection and cannot be used to extend on-premises access to multiple VPCs via a single VIF. Option C is wrong because AWS VPN CloudHub is a hub-and-spoke VPN model that connects multiple on-premises sites to a single VPC using VPN tunnels, not a solution for using a single Direct Connect VIF to access multiple VPCs. Option D is wrong because Transit VPC is a legacy architecture that uses software VPN appliances in a central VPC to route traffic to other VPCs, but it does not leverage a Direct Connect gateway and is not the recommended AWS-native service for this purpose; the modern equivalent is a Transit Gateway, but the question specifically asks for the service to use with a single VIF, which is the Direct Connect gateway.

Full explanation →
1386
Multi-Selecthard

A company is designing a VPC with IPv6. Which components are required to enable IPv6 communication between instances in the VPC and the internet? (Select TWO.)

Select 2 answers
A.An egress-only internet gateway
B.A route in the subnet route table to ::/0 to the internet gateway
C.A VPC peering connection to a VPC with internet access
D.An internet gateway
E.A NAT Gateway
AnswersB, D

This route enables IPv6 traffic to and from the internet.

Why this answer

To enable IPv6 communication between instances in a VPC and the internet, you need an internet gateway (IGW) attached to the VPC, and a route in the subnet's route table that directs IPv6 traffic (destination ::/0) to that internet gateway. The IGW performs NAT for IPv6 (using eUI-64 addresses) and allows bidirectional traffic, so both components are required.

Exam trap

The trap here is that candidates often confuse the egress-only internet gateway (for outbound-only IPv6) with the internet gateway (for bidirectional IPv6), or mistakenly think a NAT Gateway supports IPv6, when in fact NAT Gateways are IPv4-only and IPv6 requires an internet gateway for full internet access.

Full explanation →
1387
MCQmedium

Refer to the exhibit. A security engineer applies this SCP to an AWS account. What is the effect of this policy?

A.All API calls over HTTPS will be allowed
B.Only S3 API calls will be affected
C.The policy requires multi-factor authentication
D.All API calls that are not made over HTTPS will be denied
AnswerD

The condition aws:SecureTransport false triggers a Deny on all actions.

Why this answer

The SCP uses a Deny effect with a condition that blocks all API calls when the request is not made over HTTPS (i.e., aws:SecureTransport is false). This effectively denies any API call that uses HTTP instead of HTTPS. Option A is incorrect because the policy denies non-HTTPS calls, not allows them.

Option B is incorrect because the policy applies to all AWS services, not just S3. Option C is incorrect because the condition checks for transport security, not multi-factor authentication. Option D correctly states that all API calls not made over HTTPS will be denied.

Full explanation →
1388
MCQmedium

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The connection uses a private virtual interface (VIF) and BGP. The network team recently added a new CIDR block (10.0.3.0/24) to the VPC. They updated the VPC's route table to include a route to the on-premises network. However, the on-premises network cannot reach resources in the new subnet. The BGP session is up, and the Direct Connect gateway is configured. What should the network team do to resolve the issue?

A.Add a static route in the on-premises router pointing to the Direct Connect interface.
B.Set up a new VPN connection as a backup and route traffic over VPN.
C.Add the new CIDR block (10.0.3.0/24) to the Direct Connect gateway's allowed prefixes.
D.Create a new private VIF for the new CIDR block.
AnswerC

This allows the Direct Connect gateway to advertise the new prefix to the on-premises network via BGP.

Why this answer

When a new CIDR block is added to an existing VPC connected via Direct Connect, the Direct Connect gateway must be updated to include the new prefix in its allowed prefixes list. By default, the Direct Connect gateway only advertises prefixes that are explicitly allowed. The on-premises network cannot reach the new subnet because the gateway is not advertising the 10.0.3.0/24 route via BGP.

Option C is correct: add the new CIDR to the Direct Connect gateway's allowed prefixes. Option A is incorrect because adding a static route on the on-premises router does not affect BGP advertisements from the AWS side; the gateway must advertise the route. Option B is unnecessary and adds complexity; the issue is with prefix propagation, not with connectivity.

Option D is incorrect because a new private VIF is not needed; the existing VIF can handle multiple prefixes if allowed.

Full explanation →
1389
Multi-Selecthard

A network engineer is diagnosing a connectivity issue between two VPCs connected via VPC peering. The engineer has confirmed that the route tables in both VPCs have appropriate routes and the security groups allow traffic. However, traffic from VPC A to VPC B fails. Which TWO steps should the engineer take to troubleshoot? (Select TWO.)

Select 2 answers
A.Check the network ACL of the subnet in VPC B where the target instance resides.
B.Confirm that both VPCs are in the same AWS account.
C.Verify the VPC peering connection status is active.
D.Check the operating system firewall on the target instance.
E.Enable VPC Flow Logs on both VPCs to analyze traffic.
AnswersA, D

NACLs are stateless and may block inbound traffic.

Why this answer

Checking the network ACL (NACL) of the subnet in VPC B where the target instance resides can reveal if inbound traffic is blocked by the stateless NACL. Option D is correct because verifying the operating system firewall on the target instance in VPC B can block traffic even if AWS network rules are open. Option B is wrong because VPC peering can work across different AWS accounts, so being in the same account is not necessary.

Option C is wrong because the engineer should already have verified the peering connection status as part of initial checks; if it were inactive, the problem would be obvious, so it is not a likely next step. Option E is wrong because while VPC Flow Logs are useful for deep analysis, they are not the first step for a basic connectivity check; direct checks like NACLs and OS firewalls are more immediate.

Full explanation →
1390
MCQhard

A network engineer is designing a VPC with private subnets for workloads that must not have direct internet access. However, the workloads need to download patches from a specific third-party vendor's IP range. Which solution minimizes the attack surface?

A.Create a managed prefix list for the vendor's IPs and add a route in the private subnet route table to a NAT gateway, with the prefix list as destination
B.Configure a VPC endpoint for the vendor's service
C.Deploy a proxy server in a public subnet and configure the workloads to use it for all internet traffic
D.Establish a VPN connection to the vendor's network and route all traffic to the vendor through the VPN
AnswerA

Restricts egress to only vendor IPs.

Why this answer

Using a managed prefix list for the vendor's IPs and adding a route to a NAT gateway in the private subnet route table allows traffic only to those specific IPs, minimizing attack surface by avoiding direct internet access. Option B (VPC endpoint) is for AWS services only, not third-party. Option C (proxy server) would allow all internet traffic, not just to the vendor, increasing exposure.

Option D (VPN) introduces complexity and potential trust issues, and still might allow other traffic if not carefully restricted.

Full explanation →
1391
MCQeasy

A company has a VPC with CIDR 10.0.0.0/16 and needs to connect to an on-premises network using AWS Direct Connect. The on-premises CIDR is 10.1.0.0/16. To enable communication between the VPC and on-premises, which component must be configured?

A.Attach an Internet Gateway to the VPC and configure a NAT gateway
B.Create a VPC peering connection between the VPC and the on-premises network
C.Attach a Virtual Private Gateway to the VPC and update route tables
D.Create a Transit Gateway and attach the VPC and Direct Connect
AnswerC

A Virtual Private Gateway is required for Direct Connect connectivity, and appropriate routes must be added in the VPC route tables to route traffic to the on-premises network via the VGW.

Why this answer

To connect a VPC to an on-premises network over AWS Direct Connect, you must attach a Virtual Private Gateway (VGW) to the VPC. The VGW serves as the VPN concentrator on the AWS side, terminating the Direct Connect virtual interface (VIF) and enabling BGP peering for route exchange. You then update the VPC route tables to point the on-premises CIDR (10.1.0.0/16) to the VGW, allowing traffic to flow between the VPC and the on-premises network.

Exam trap

AWS often tests the misconception that a Transit Gateway is always required for Direct Connect, but the exam trap here is that a Virtual Private Gateway is the fundamental component for terminating a Direct Connect private VIF to a single VPC.

How to eliminate wrong answers

Option A is wrong because an Internet Gateway (IGW) and NAT gateway are used for internet-bound traffic, not for private connectivity to on-premises networks via Direct Connect. Option B is wrong because VPC peering connects two VPCs within AWS, not a VPC to an on-premises network; it cannot extend beyond the AWS cloud. Option D is wrong because while a Transit Gateway can simplify multi-VPC and Direct Connect attachments, it is not strictly required for a single VPC connection; the question asks for the component that must be configured, and a VGW is the mandatory component for Direct Connect private VIF connectivity.

Full explanation →
1392
Multi-Selecthard

Which TWO of the following are best practices for securing a VPC with AWS Network Firewall? (Choose two.)

Select 2 answers
A.Deploy firewall endpoints in at least two Availability Zones for high availability.
B.Use only stateless rules to minimize processing overhead.
C.Configure stateful rule groups to inspect traffic at the application layer.
D.Use Network Firewall only for outbound traffic filtering.
E.Deploy the firewall in the same subnet as the workload for low latency.
AnswersA, C

Ensures resilience.

Why this answer

Deploying AWS Network Firewall endpoints in at least two Availability Zones ensures high availability and fault tolerance. If one AZ or firewall endpoint fails, traffic can be routed through the other, preventing a single point of failure. This aligns with AWS best practices for resilient network architectures.

Exam trap

The trap here is that candidates often assume stateless rules are sufficient for security or that Network Firewall is only for outbound filtering, but the exam tests the understanding that stateful inspection and multi-AZ deployment are critical for comprehensive protection and high availability.

Full explanation →
1393
MCQmedium

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all Amazon S3 buckets in the organization are encrypted at rest. Which policy should be attached to the root organizational unit to enforce this requirement?

A.Configure AWS Config rules to mark non-compliant buckets and trigger a Lambda function to add encryption.
B.Create an IAM role in each account that requires encryption for any S3 operation.
C.Use an S3 bucket policy on every existing and future bucket to deny unencrypted uploads.
D.Attach a service control policy (SCP) that denies s3:CreateBucket unless the bucket has default encryption enabled.
AnswerD

SCPs can enforce encryption at the organizational level.

Why this answer

A service control policy (SCP) attached to the root OU can deny the s3:CreateBucket action unless the bucket is configured with default encryption, thereby enforcing encryption at rest across all accounts in the organization. Option D is correct. Option A is incorrect because AWS Config rules can detect non-compliance but cannot enforce policies in real time; they are detective, not preventive.

Option B is incorrect because IAM roles are account-specific and cannot enforce encryption across all accounts centrally. Option C is incorrect because S3 bucket policies apply only to individual buckets and cannot be applied to future buckets or across accounts without manual configuration.

Full explanation →
1394
MCQeasy

A company is designing a multi-region application with active-active configuration. They need a global DNS service that can route users to the nearest healthy endpoint and automatically failover to another region if an endpoint becomes unhealthy. Which AWS service should be used?

A.Amazon CloudFront
B.Elastic Load Balancer
C.Amazon Route 53 with latency-based routing and health checks
D.AWS Global Accelerator
AnswerC

Route 53 latency routing directs traffic to the region with the lowest latency, and health checks enable failover.

Why this answer

Amazon Route 53 with latency-based routing and health checks is the correct choice because it provides global DNS resolution that directs users to the endpoint with the lowest latency, while health checks automatically detect endpoint failures and trigger failover to a healthy region. This satisfies the active-active multi-region requirement by distributing traffic across multiple regions and ensuring automatic failover without manual intervention.

Exam trap

The ANS-C01 exam often tests the distinction between DNS-based routing (Route 53) and network-layer acceleration (Global Accelerator), where candidates mistakenly choose Global Accelerator because it also supports health checks and failover, but the question explicitly asks for a 'global DNS service' which is Route 53's core function, not Global Accelerator's.

How to eliminate wrong answers

Option A is wrong because Amazon CloudFront is a content delivery network (CDN) that caches content at edge locations and does not provide DNS-level routing or health-check-based failover for arbitrary endpoints; it is designed for static and dynamic content acceleration, not for global DNS routing with active-active failover. Option B is wrong because Elastic Load Balancer (ELB) operates within a single AWS region and cannot route traffic globally across multiple regions or perform DNS-based latency routing; it distributes traffic only within a single VPC or set of targets in one region. Option D is wrong because AWS Global Accelerator uses Anycast IP addresses and the AWS global network to improve performance, but it does not provide DNS-level routing policies like latency-based routing; it relies on static IP addresses and health checks for endpoint failover, but the question specifically asks for a global DNS service, which is Route 53's domain.

Full explanation →
1395
MCQmedium

An application running on EC2 instances needs to access a DynamoDB table. The security team requires that traffic does not traverse the internet. Which solution should be used?

A.Create a VPC Gateway Endpoint for DynamoDB.
B.Create a VPC Interface Endpoint for DynamoDB.
C.Attach an Internet Gateway to the VPC.
D.Deploy a NAT gateway and update the route table.
AnswerA

Correct. A VPC Gateway Endpoint for DynamoDB allows private access to DynamoDB from within the VPC without going over the internet.

Why this answer

A VPC Gateway Endpoint for DynamoDB provides private connectivity without traversing the internet. Option B is incorrect because VPC Interface Endpoints are typically used for services like API Gateway, but DynamoDB does not support Interface Endpoints in the same way; DynamoDB uses Gateway Endpoints. Option C is incorrect because an Internet Gateway provides internet access, which violates the security requirement.

Option D is incorrect because a NAT Gateway also enables internet outbound traffic, not private access to DynamoDB.

Full explanation →
1396
Matchingmedium

Match each BGP attribute to its role in route selection.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Cisco-proprietary attribute, highest weight preferred

Used to influence outbound traffic from an AS

Shorter path is preferred

Used to influence inbound traffic to an AS

IP address of the next router to reach the destination

Why these pairings

BGP attributes influence route selection in a specific order: Weight, LOCAL_PREF, AS_PATH, MED, and others. AS_PATH measures path length, LOCAL_PREF directs outbound traffic, MED directs inbound traffic, and Weight is a Cisco-proprietary local preference.

Full explanation →
1397
MCQhard

A company is deploying an AWS Network Firewall in a centralized inspection VPC and needs to send traffic from multiple VPCs through it. The VPCs are attached to a Transit Gateway. What configuration is required to route traffic to the firewall?

A.Create a Transit Gateway route table with a route to the Network Firewall endpoint and attach the VPCs to it.
B.Create a VPC Gateway Endpoint for the firewall service.
C.Add a route in each VPC's subnet routing table pointing to the firewall's elastic network interface.
D.Configure a NAT gateway in each VPC and route traffic through it.
AnswerA

This ensures traffic is routed through the firewall.

Why this answer

The Transit Gateway route table must have a route pointing to the Network Firewall endpoint, and the VPCs attached to that route table will have their traffic inspected by the firewall. Options B, C, and D are incorrect: VPC Gateway Endpoints are for accessing AWS services, not for routing traffic through a firewall; adding routes directly to the firewall's ENI in each VPC subnet is not supported without an endpoint; and NAT gateways are used for outbound internet traffic, not for routing to a firewall.

Full explanation →
1398
MCQhard

A company has a Direct Connect connection with a private VIF to a VPC. They want to extend connectivity to an on-premises data center that does not support BGP. What is the simplest way to achieve this?

A.Use AWS Site-to-Site VPN with static routing to a Transit Gateway
B.Create a VPC peering connection between the VPC and the on-premises network
C.Create a Direct Connect Gateway and attach the VPC
D.Set up a VPN CloudHub with multiple VPN connections
AnswerA

Transit Gateway supports VPN attachments with static routes, which does not require BGP on the on-premises side.

Why this answer

The on-premises data center does not support BGP, so a static routing approach is required. AWS Site-to-Site VPN with static routing to a Transit Gateway allows you to extend connectivity from the existing Direct Connect VPC to the non-BGP data center by using the Transit Gateway as a central hub, which can route traffic between the Direct Connect VIF and the VPN connection without requiring BGP on the data center side.

Exam trap

The trap here is that candidates often assume Direct Connect Gateway alone can solve any on-premises routing issue, but it still requires BGP for route exchange, so the correct approach is to use a Transit Gateway with a static VPN to bypass the BGP requirement on the data center side.

How to eliminate wrong answers

Option B is wrong because VPC peering connections cannot extend connectivity to on-premises networks; they only connect VPCs within AWS and do not support VPN or Direct Connect attachments. Option C is wrong because creating a Direct Connect Gateway and attaching the VPC does not solve the problem of the on-premises data center lacking BGP support; a Direct Connect Gateway still requires BGP for routing between the on-premises network and AWS. Option D is wrong because VPN CloudHub is designed for connecting multiple remote networks (e.g., branch offices) using dynamic BGP routing, not for extending a single Direct Connect VPC to a non-BGP data center, and it does not integrate with the existing Direct Connect connection.

Full explanation →
1399
MCQhard

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance has a NAT Gateway in the public subnet. However, the instance cannot reach the internet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway. What is the most likely cause?

A.The NAT Gateway does not have an Elastic IP address attached.
B.The security group for the EC2 instance blocks outbound traffic.
C.The network ACL for the private subnet blocks outbound traffic.
D.The private subnet route table does not have a route to the internet gateway.
AnswerA

Without EIP, NAT Gateway cannot communicate with internet.

Why this answer

A NAT Gateway requires an Elastic IP address to translate private IP addresses to a public IP for internet access. Without it, outbound traffic cannot be routed to the internet. Option B is incorrect because the private subnet route table correctly has a default route pointing to the NAT Gateway.

Option C is incorrect because the security group is stateful and allows return traffic; outbound traffic would only be blocked if explicitly denied. Option D is incorrect because network ACLs are stateless but the question does not indicate any blocking rules; the default NACL allows all outbound traffic.

Full explanation →
1400
MCQeasy

A network engineer runs the above command and sees that VPC Flow Logs are configured for a VPC. The engineer wants to analyze rejected traffic to troubleshoot a connectivity issue. Which field in the flow log records should they examine?

A.protocol
B.action
C.srcaddr
D.dstport
AnswerB

Shows whether traffic was accepted or rejected.

Why this answer

The 'action' field in VPC Flow Logs indicates ACCEPT or REJECT. Option A is wrong because 'srcaddr' is source IP. Option C is wrong because 'dstport' is destination port.

Option D is wrong because 'protocol' is the protocol number.

Full explanation →
1401
Multi-Selectmedium

A company is designing a highly available network in AWS. They have two Direct Connect connections from different providers to two different AWS Direct Connect locations. They want to use BGP as the routing protocol. Which TWO actions should be taken to ensure high availability?

Select 2 answers
A.Use the same BGP community values for both connections
B.Advertise the same on-premises prefixes over both connections with different AS_PATH prepend values
C.Enable jumbo frames on both connections
D.Configure multiple virtual interfaces on a single Direct Connect connection
E.Configure separate BGP sessions for each Direct Connect connection
AnswersB, E

Allows path selection and failover.

Why this answer

Options B and E are correct. B: Advertising the same on-premises prefixes over both connections with different AS_PATH prepend values allows you to influence inbound traffic path selection, favoring the connection with the shorter AS_PATH (less prepending). E: Configuring separate BGP sessions for each Direct Connect connection ensures that if one connection or BGP session fails, the other remains active, providing redundancy.

Option A is wrong because BGP community values do not directly influence path selection; they are used for tagging and policy. Option C is wrong because jumbo frames affect MTU, not high availability. Option D is wrong because multiple virtual interfaces on a single connection create a single point of failure; separate connections are needed for high availability.

Full explanation →
1402
MCQhard

A company is deploying a multi-region application using two AWS Regions. They want to use an AWS Transit Gateway to interconnect VPCs within each region, and they need to interconnect the Transit Gateways across regions. Which is the most scalable and reliable approach?

A.Use Transit Gateway peering attachments between the Transit Gateways in each region.
B.Create a VPC peering connection between VPCs in different regions and attach them to the Transit Gateways.
C.Use AWS Site-to-Site VPN connections between the Transit Gateways in each region.
D.Set up a Direct Connect gateway with virtual interfaces in each region and propagate routes.
AnswerA

Transit Gateway peering is the native, scalable, and reliable method to interconnect Transit Gateways across regions.

Why this answer

AWS Transit Gateway supports inter-region peering, which is the recommended method for connecting Transit Gateways across regions. Option A is correct. Option B is incorrect because VPC peering does not natively interconnect Transit Gateways.

Option C is incorrect because using AWS Site-to-Site VPN connections adds complexity, reduces bandwidth, and is less reliable compared to Transit Gateway peering. Option D is incorrect because a Direct Connect gateway is designed for connecting on-premises networks to AWS, not for interconnecting Transit Gateways across regions.

Full explanation →
1403
MCQhard

Based on the following VPC Flow Logs entry, which of the following statements is correct? - source IP: 10.0.2.10 - source port: 443 - destination IP: 10.0.1.20 - destination port: 80 - protocol: TCP

A.The destination port is 443
B.The protocol used is UDP
C.The source IP address is 10.0.2.10
D.The traffic originated from a web server (port 443) and was sent to a client (port 80)
AnswerD

Source port 443 indicates the server is sending data to a client on port 80.

Why this answer

Based on the VPC Flow Logs entry (which shows source IP 10.0.2.10, source port 443, destination IP 10.0.1.20, destination port 80, protocol TCP), the traffic originated from a web server (listening on port 443) and was sent to a client (listening on port 80). The direction is from the source (10.0.2.10) to the destination (10.0.1.20). Therefore, option D is correct.

Exam trap

The trap here is that candidates often assume the destination port is always the server's listening port, but in this flow log, the server (10.0.2.10) is the source using port 443, and the client (10.0.1.20) is the destination using port 80, so the traffic is from server to client.

How to eliminate wrong answers

Option A is wrong because the destination port is 80, not 443; the flow log shows 'dstport=80'. Option B is wrong because the protocol is TCP (protocol number 6), not UDP; UDP is protocol 17. Option C is wrong because the source IP address is 10.0.2.10, not 10.0.2.10; the flow log shows 'srcaddr=10.0.2.10', which matches the option, but the question asks for the correct statement, and Option D is the only fully accurate description of the traffic flow.

Full explanation →
1404
MCQeasy

A company uses AWS Transit Gateway to connect multiple VPCs and an on-premises network via Direct Connect. The on-premises network can reach some VPCs but not others. All VPCs are attached to the same Transit Gateway. What should the engineer check first?

A.The VPC flow logs for the unreachable VPCs.
B.The Transit Gateway route tables and associations.
C.The Direct Connect virtual interface status.
D.The BGP session between the on-premises router and the Direct Connect router.
AnswerB

Route tables determine the connectivity between attachments; misconfiguration is the likely cause.

Why this answer

The Transit Gateway route tables control which VPCs and attachments can communicate. If some VPCs are in a different route table or if propagation is not configured, traffic may not be routed correctly.

Full explanation →
1405
MCQhard

A company has a Direct Connect connection with a private VIF and a public VIF. The private VIF is used to access VPC resources, and the public VIF is used to access AWS public services. Recently, the company enabled AWS Global Accelerator for its application. The network team notices that traffic to the application via Global Accelerator is not using the Direct Connect connection but is going over the internet. What should the team do to ensure traffic uses the Direct Connect public VIF?

A.Configure a VPN connection over the Direct Connect public VIF to route Global Accelerator traffic
B.Advertise the Global Accelerator IP addresses on the on-premises router to route traffic via the public VIF
C.Attach a Direct Connect gateway to the Global Accelerator
D.Create a private VIF for Global Accelerator traffic
AnswerA

Use a VPN over the public VIF to control routing, but Global Accelerator traffic typically goes over internet; however, using a VPN can force traffic via Direct Connect.

Why this answer

Global Accelerator uses static anycast IP addresses that are not directly reachable over a Direct Connect public VIF. The public VIF provides access to AWS public services via the Direct Connect connection, but Global Accelerator IPs are not advertised over the BGP session. To route on-premises traffic to Global Accelerator through Direct Connect, you must establish a VPN connection over the public VIF.

This VPN tunnel encapsulates the traffic and sends it over the Direct Connect link, ensuring it does not traverse the public internet. Option B is incorrect because you cannot advertise Global Accelerator IPs from your on-premises router; they are owned and advertised by AWS. Option C is incorrect because a Direct Connect gateway is used for private VIFs and does not integrate with Global Accelerator.

Option D is incorrect because a private VIF is for accessing VPC resources, not public services like Global Accelerator.

Full explanation →
1406
MCQmedium

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. The network team notices that traffic between two VPCs in different regions is being dropped intermittently. What is the most likely cause?

A.Transit Gateway cannot route traffic between VPCs in different regions without inter-region peering
B.Security groups in the source VPC are blocking traffic
C.Route tables in the Transit Gateway are not propagating routes correctly
D.NAT Gateway in the source VPC is causing asymmetric routing
AnswerA

Transit Gateway is regional; inter-region connectivity requires explicit peering.

Why this answer

AWS Transit Gateway is a regional resource. To route traffic between VPCs in different regions, you must explicitly configure Transit Gateway inter-region peering. Without it, Transit Gateway cannot route traffic across regions, causing intermittent drops if traffic attempts to traverse regions.

Option B is incorrect because security groups are stateful and would not cause intermittent drops. Option C is incorrect because route propagation issues typically cause persistent failures, not intermittent drops. Option D is incorrect because NAT Gateway is used for outbound internet traffic, not inter-VPC traffic.

Full explanation →
1407
MCQeasy

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. It needs to add an additional non-overlapping CIDR for new workloads. Which CIDR should be used?

A.10.0.0.0/24
B.10.1.0.0/16
C.10.0.1.0/24
D.10.0.0.0/8
AnswerB

This CIDR is outside the existing 10.0.0.0/16 range.

Why this answer

(10.1.0.0/16) is correct because it provides a non-overlapping CIDR block that does not conflict with the existing VPC CIDR of 10.0.0.0/16. In AWS, when adding a secondary CIDR to a VPC, the new block must not overlap with the existing VPC CIDR or any of its subnets. The 10.1.0.0/16 range is entirely separate from 10.0.0.0/16, satisfying this requirement.

Exam trap

The trap here is that candidates often assume any non-overlapping private IP range is acceptable, but they overlook that the new CIDR must also be from the same RFC 1918 address space and not conflict with any existing subnets, not just the VPC CIDR itself.

How to eliminate wrong answers

Option A is wrong because 10.0.0.0/24 is a subnet of the existing 10.0.0.0/16 CIDR, which would cause an overlap and is not allowed when adding a secondary CIDR to a VPC. Option C is wrong because 10.0.1.0/24 is also a subnet within the existing 10.0.0.0/16 range, resulting in an overlap. Option D is wrong because 10.0.0.0/8 is a supernet that contains the existing 10.0.0.0/16 CIDR, causing an overlap and violating the non-overlapping requirement for VPC CIDR blocks.

Full explanation →
1408
MCQhard

A company is designing a network architecture for a critical application that requires high availability and low latency. The application will be deployed on EC2 instances in an Auto Scaling group across three Availability Zones in a single region. The instances will communicate with an Amazon RDS database. Which configuration will provide the MOST resilient and performant network connectivity?

A.Launch a single RDS instance in a public subnet and use Route 53 latency-based routing to direct traffic.
B.Use a Network Load Balancer in front of the RDS instance to distribute connections across Availability Zones.
C.Place the RDS instance in a single Availability Zone and use a read replica in another AZ for failover.
D.Create an RDS Multi-AZ cluster with one writer and two reader instances in different AZs, and use the cluster endpoint for writes and reader endpoint for reads.
AnswerD

Multi-AZ cluster provides automatic failover and low-latency reads across AZs.

Why this answer

A Multi-AZ cluster with one writer and two reader instances provides both high availability and low latency. The cluster endpoint automatically routes write traffic to the primary instance, while the reader endpoint distributes read traffic across the reader instances in different Availability Zones, reducing latency and improving resilience. This architecture ensures that if one Availability Zone fails, the database remains available without manual intervention, meeting the critical application's requirements.

Exam trap

The ANS-C01 exam often tests the misconception that a Network Load Balancer can be used to distribute traffic to an RDS database, but RDS does not support load balancers for database connections, and the correct approach is to use Multi-AZ cluster endpoints for high availability and read scaling.

How to eliminate wrong answers

Option A is wrong because launching a single RDS instance in a public subnet exposes the database to the internet, compromising security, and Route 53 latency-based routing cannot provide automatic failover or high availability for a single database instance. Option B is wrong because a Network Load Balancer cannot be placed in front of an RDS instance; RDS does not support load balancers for direct database connections, and the NLB operates at Layer 4, which cannot handle database-specific connection routing or failover. Option C is wrong because placing the RDS instance in a single Availability Zone creates a single point of failure; a read replica in another AZ provides read scalability but does not offer automatic failover for writes, and the primary instance failure would still cause downtime.

Full explanation →
1409
MCQmedium

A company has a Direct Connect connection with a private virtual interface (VIF) attached to a Virtual Private Gateway (VGW) that is associated with a single VPC (10.0.0.0/16). The on-premises network uses BGP to exchange routes. The company has recently acquired another company and needs to connect to their VPC (172.16.0.0/16) in the same region. They want to use the existing Direct Connect connection to access both VPCs. The network engineer creates a Transit Gateway, attaches both VPCs, and creates a transit virtual interface (VIF) to the Transit Gateway. The engineer also deletes the private VIF. However, after the change, on-premises users cannot reach either VPC. What should the engineer do to restore connectivity?

A.Configure BGP on the on-premises router to peer with the Transit Gateway over the transit VIF.
B.Attach the VPCs to the Transit Gateway with different route tables.
C.Create a new private VIF to each VPC.
D.Enable route propagation on the Transit Gateway route tables.
AnswerA

BGP must be configured for route exchange.

Why this answer

When the private VIF was replaced with a transit VIF to the Transit Gateway, the on-premises router lost its BGP peering with the VGW. To restore connectivity, the on-premises router must be configured to establish BGP peering with the Transit Gateway over the transit VIF. This allows route exchange between on-premises and both VPCs attached to the Transit Gateway.

Option A is correct. Option B is incorrect because attaching VPCs with different route tables is not the issue; the VPCs are already attached. Option C is incorrect because creating separate private VIFs would be unnecessary and defeats the purpose of using a Transit Gateway.

Option D is incorrect because route propagation is already enabled by default when VPCs are attached to a Transit Gateway; the missing piece is the BGP session from on-premises.

Full explanation →
1410
MCQhard

A company is designing a hybrid network with multiple AWS Direct Connect connections to multiple on-premises data centers. They want to maximize availability and use all available bandwidth. They have two Direct Connect connections terminated at two different Direct Connect locations. They plan to use a single Virtual Private Gateway (VGW) for each VPC. Which configuration should be used to meet these requirements?

A.Create two VGWs and attach each to a separate Direct Connect connection. Use a Transit Gateway to connect the VGWs to the VPC.
B.Create a Direct Connect Gateway. Attach both Direct Connect connections to the Direct Connect Gateway. Associate the Direct Connect Gateway with the VGW. Configure the on-premises routers to use BGP with equal-cost multipath (ECMP).
C.Create two Virtual Private Gateways, one for each Direct Connect connection. Attach each VGW to the VPC. Configure BGP on both connections for active-active.
D.Create a single virtual interface and associate it with both Direct Connect connections. Attach the virtual interface to the VGW.
AnswerB

This configuration allows both connections to be active-active, using all bandwidth and providing redundancy.

Why this answer

It uses a Direct Connect Gateway to aggregate multiple Direct Connect connections into a single logical endpoint, allowing both connections to be associated with a single VGW. By configuring BGP with ECMP on the on-premises routers, traffic is load-balanced across both connections, maximizing bandwidth utilization while providing high availability through redundant paths.

Exam trap

The trap here is that candidates often think multiple VGWs can be attached to a single VPC (Option C) or that a single virtual interface can span multiple physical connections (Option D), but AWS enforces a one-VGW-per-VPC limit and each virtual interface is tied to a single Direct Connect connection.

How to eliminate wrong answers

Option A is wrong because creating two VGWs and connecting them via a Transit Gateway adds unnecessary complexity and does not allow both Direct Connect connections to be used with a single VGW as required; it also introduces additional latency and cost. Option C is wrong because a single VPC cannot have two VGWs attached simultaneously; each VPC supports only one VGW, making this configuration invalid. Option D is wrong because a single virtual interface cannot be associated with two separate Direct Connect connections; each virtual interface is tied to one physical connection, and this setup would not provide redundancy or load balancing.

Full explanation →
1411
MCQmedium

A company has deployed a Network Load Balancer (NLB) in front of a fleet of EC2 instances in a VPC. The NLB is configured with a TCP listener on port 443. Clients are experiencing timeouts. The target group health checks are passing. What is the most likely cause?

A.Cross-zone load balancing is disabled.
B.Deletion protection is enabled on the NLB.
C.The security group for the EC2 instances does not allow traffic from the NLB.
D.The target group is using an incorrect health check path.
AnswerC

NLB uses its own IP addresses; security group must allow them.

Why this answer

Security groups must allow traffic from the NLB's private IP addresses. Option A is incorrect because cross-zone load balancing affects distribution, not timeouts. Option B is incorrect because health checks passing means targets are healthy.

Option D is incorrect because deletion protection prevents accidental deletion, not timeouts.

Full explanation →
1412
MCQmedium

A company has an AWS Lambda function that needs to access an S3 bucket in the same AWS account. The Lambda function is configured to use the VPC default execution role. The S3 bucket policy denies all principals except those explicitly allowed. The Lambda function cannot access the bucket. What should be done to resolve this issue?

A.Add an IAM policy to the Lambda execution role that allows s3:GetObject on the bucket
B.Remove the bucket policy that denies all principals
C.Attach an internet gateway to the VPC and a public IP to the Lambda function
D.Create a VPC endpoint for S3 and attach it to the Lambda function's VPC
AnswerA

The Lambda execution role must have the necessary S3 permissions to access the bucket.

Why this answer

The Lambda execution role needs an IAM policy that allows s3:GetObject (or appropriate actions) on the S3 bucket. In this scenario, the bucket policy denies all principals except those explicitly allowed. Since the Lambda function is supposed to access the bucket, the bucket policy already explicitly allows the Lambda role.

Therefore, only the IAM permission is missing. Adding the IAM policy (Option A) resolves the issue. Option B is wrong because removing the bucket policy would allow all principals, violating the security intent.

Option C is wrong because Lambda functions in a VPC do not require internet gateways or public IPs to reach S3, and it does not address permissions. Option D is wrong because a VPC endpoint provides network connectivity but does not grant IAM permissions; the Lambda execution role still needs the IAM policy.

Full explanation →
1413
MCQmedium

A company has deployed a web application using an Application Load Balancer (ALB) in front of EC2 instances in an Auto Scaling group. The application experiences intermittent high latency. The network team suspects that the ALB is being overwhelmed by traffic. Which metrics should be analyzed in Amazon CloudWatch to determine if the ALB is the bottleneck?

A.ActiveConnectionCount and NewConnectionCount
B.SurgeQueueLength and SpilloverCount
C.RequestCount and TargetResponseTime
D.HealthyHostCount and UnhealthyHostCount
AnswerB

SurgeQueueLength shows pending requests, and SpilloverCount shows dropped requests when the ALB is overloaded.

Why this answer

SurgeQueueLength and SpilloverCount are the correct metrics to analyze because they directly indicate whether the ALB is overwhelmed. SurgeQueueLength measures the number of requests waiting to be routed to a target, and SpilloverCount tracks requests that were rejected because the queue was full. If these metrics are consistently high or non-zero, the ALB is the bottleneck, as it cannot keep up with incoming traffic.

Exam trap

The trap here is that candidates confuse metrics that show traffic or backend performance (like RequestCount or TargetResponseTime) with metrics that specifically measure ALB internal congestion, leading them to overlook SurgeQueueLength and SpilloverCount.

How to eliminate wrong answers

Option A is wrong because ActiveConnectionCount and NewConnectionCount show traffic volume but do not reveal whether the ALB is overwhelmed; they are normal operational metrics. Option C is wrong because RequestCount and TargetResponseTime measure load and backend performance, not ALB capacity; high TargetResponseTime could indicate slow targets, not an overloaded ALB. Option D is wrong because HealthyHostCount and UnhealthyHostCount track target health, not ALB internal queuing or rejection; they would not show if the ALB itself is saturated.

Full explanation →
1414
Multi-Selectmedium

A company wants to monitor network traffic between its VPC and on-premises data center over a Direct Connect private VIF. The network team needs to capture the source and destination IP addresses, protocols, and packet counts. Which THREE AWS services or features should they use together? (Choose three.)

Select 3 answers
A.Amazon CloudWatch Logs
B.VPC Flow Logs
C.AWS CloudTrail
D.AWS Config
E.Amazon CloudWatch Contributor Insights
AnswersA, B, E

Can store and query flow logs.

Why this answer

VPC Flow Logs (option B) capture IP traffic metadata including source and destination IP addresses, protocols, and packet counts. Amazon CloudWatch Logs (option A) can store and analyze these flow logs. Amazon CloudWatch Contributor Insights (option E) can analyze flow log data to identify top talkers and other patterns.

AWS CloudTrail (option C) records API calls, not network traffic. AWS Config (option D) tracks resource configuration changes, not network flows.

Full explanation →
1415
Multi-Selecteasy

A security engineer needs to capture and analyze network traffic between two EC2 instances in the same VPC for troubleshooting. The engineer wants to capture full packets and store them for later analysis. Which TWO AWS services can be used together to accomplish this? (Choose TWO.)

Select 2 answers
A.Amazon S3
B.AWS Config
C.VPC Flow Logs
D.Traffic Mirroring
E.Amazon CloudWatch Logs
AnswersA, D

Can store the mirrored traffic for analysis.

Why this answer

Options A (Amazon S3) and D (Traffic Mirroring) are correct. Traffic Mirroring captures full packets and sends them to a target, such as a Network Load Balancer or an EC2 instance, which can then store the captured traffic in Amazon S3. Option B (AWS Config) is incorrect because it tracks configuration changes, not network traffic.

Option C (VPC Flow Logs) is incorrect because it captures only metadata (IP headers, ports, etc.), not full packets. Option E (Amazon CloudWatch Logs) is incorrect because it is designed for log storage and monitoring, not for storing full packet captures.

Full explanation →
1416
MCQhard

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. They want to inspect traffic between VPCs using a centralized network virtual appliance (NVA) in a security VPC. What is the most scalable and highly available design to achieve this?

A.Place a single NVA in the Transit Gateway and route all inter-VPC traffic through it.
B.Create VPC peering connections between each VPC and the security VPC, then configure the NVAs to route traffic.
C.Attach all VPCs to a Transit Gateway, use separate route tables for inspection, and deploy NVAs behind a Gateway Load Balancer in the security VPC.
D.Use Direct Connect to connect all VPCs to a central location and route through NVAs there.
AnswerC

Transit Gateway provides transitive routing; GWLB provides HA and scale for NVAs.

Why this answer

It uses Transit Gateway with separate route tables to isolate inspection traffic, and deploys NVAs behind a Gateway Load Balancer (GWLB) in the security VPC. GWLB provides automatic scaling and health checks across multiple NVAs, ensuring high availability and scalability for inter-VPC traffic inspection without introducing a single point of failure or manual routing complexity.

Exam trap

The trap here is that candidates often assume a single NVA in the Transit Gateway (Option A) is feasible, but Transit Gateway is a managed service that cannot host customer appliances, and they overlook that VPC peering (Option B) lacks transitive routing, making it unsuitable for centralized inspection in a multi-VPC environment.

How to eliminate wrong answers

Option A is wrong because placing a single NVA in the Transit Gateway is not possible—Transit Gateway is a managed service that does not host customer NVAs; routing all traffic through a single NVA creates a single point of failure and a scalability bottleneck. Option B is wrong because VPC peering does not support transitive routing, so each VPC would need a separate peering connection to the security VPC, and traffic between non-security VPCs would require complex routing through the security VPC, which is not scalable and violates the hub-and-spoke design intent. Option D is wrong because Direct Connect connects on-premises networks to AWS, not VPCs to each other; using Direct Connect to interconnect VPCs would require additional VPNs or transit VIFs and does not provide a scalable or highly available inspection architecture for inter-VPC traffic.

Full explanation →
1417
Multi-Selecteasy

A company wants to monitor network traffic between two VPCs connected via a Transit Gateway. Which THREE AWS services can be used to capture and analyze this traffic?

Select 3 answers
A.VPC Flow Logs
B.AWS Config
C.Third-party network monitoring appliance deployed in a VPC
D.Transit Gateway Flow Logs
E.AWS CloudTrail
AnswersA, C, D

Captures IP traffic for VPCs.

Why this answer

Options A, C, and D are correct. VPC Flow Logs capture IP traffic for network interfaces, Transit Gateway Flow Logs capture traffic through the transit gateway, and third-party network monitoring appliances deployed in a VPC can capture and analyze traffic. Option B is incorrect because AWS Config records configuration changes, not traffic.

Option E is incorrect because AWS CloudTrail logs API calls, not network traffic.

Full explanation →
1418
MCQmedium

A company is using AWS Direct Connect to connect its on-premises data center to AWS. The connection is up, but the network team cannot reach resources in a VPC. The virtual interface is in the 'available' state, and BGP session is established. What should the team check next?

A.Check the on-premises firewall rules
B.Check the BGP authentication
C.Check the VPC route tables for propagated routes
D.Check the Direct Connect physical link status
AnswerC

The Direct Connect virtual interface routes must be propagated to the VPC route tables.

Why this answer

Since the Direct Connect physical link is up, the virtual interface is available, and the BGP session is established, the issue lies in the routing of traffic within AWS. The most likely cause is that the VPC route tables do not contain the necessary routes (either static or propagated from the Direct Connect virtual private gateway) to direct traffic back to the on-premises network. Checking the VPC route tables for propagated routes is the correct next step to ensure the on-premises CIDR is being advertised and accepted.

Exam trap

The trap here is that candidates assume a working BGP session guarantees end-to-end connectivity, but BGP only ensures the routing protocol is exchanging prefixes; the VPC route table must still have the propagated routes or a static route to direct traffic to the virtual private gateway.

How to eliminate wrong answers

Option A is wrong because on-premises firewall rules would affect outbound traffic from the data center, but the question states the network team cannot reach resources in a VPC, implying the issue is on the AWS side or the routing path; the BGP session is established, so the underlying connectivity is fine. Option B is wrong because BGP authentication is already verified as the BGP session is established; if authentication were misconfigured, the session would not reach the established state. Option D is wrong because the Direct Connect physical link status is already confirmed as up, and the virtual interface is available, so the physical layer is not the problem.

Full explanation →
1419
MCQmedium

A company wants to restrict access to its S3 bucket so that only objects uploaded with server-side encryption using AWS KMS (SSE-KMS) are allowed. Which bucket policy condition should be used?

A.s3:x-amz-server-side-encryption-aws-kms-key-id
B.s3:x-amz-server-side-encryption
C.kms:ViaService
D.kms:EncryptionContext
AnswerA

This condition key allows you to enforce that a specific KMS key is used for encryption.

Why this answer

The s3:x-amz-server-side-encryption-aws-kms-key-id condition key allows you to require that objects uploaded to the bucket are encrypted with a specific KMS key, thus enforcing SSE-KMS. Option B (s3:x-amz-server-side-encryption) only checks for any server-side encryption, not a specific key. Option C (kms:ViaService) is a condition key for KMS key policies, not S3 bucket policies.

Option D (kms:EncryptionContext) is used in KMS policies to restrict encryption contexts, not applicable to S3 bucket policies.

Full explanation →
1420
MCQmedium

A company uses AWS Organizations with SCPs to restrict access. The security team needs to prevent users in the 'Developers' OU from disabling AWS Config or modifying its rules. Which SCP effect should be used?

A.Block
B.Deny
C.Allow
D.NotAction
AnswerB

Deny explicitly prohibits specified actions.

Why this answer

A Deny effect explicitly blocks the action, overriding any Allow. Option A is wrong because Allow would not prevent the action. Option C is wrong because SCPs don't have a Block effect.

Option D is wrong because NotAction is a condition element, not an effect.

Full explanation →
1421
MCQhard

A company is deploying a critical application across multiple AWS accounts. The network team wants to simplify IP address management and ensure that VPCs in different accounts can communicate securely. The company has a centralized network account with a transit gateway. Which architecture should the company use?

A.Use AWS Resource Access Manager to share the transit gateway in the network account with other accounts and attach their VPCs.
B.Create VPC peering connections between each VPC in different accounts.
C.Configure VPC endpoints in each account to communicate through the network account.
D.Set up AWS Direct Connect between accounts and route through the network account.
AnswerA

RAM enables cross-account sharing of transit gateways.

Why this answer

AWS Resource Access Manager (RAM) allows you to share a transit gateway from a centralized network account with other AWS accounts, enabling VPCs in those accounts to attach to the shared transit gateway. This simplifies IP address management by providing a single hub for inter-VPC routing and avoids the complexity of managing multiple VPC peering connections. The transit gateway supports transitive routing, so VPCs in different accounts can communicate securely through the centralized gateway without needing direct peering.

Exam trap

The trap here is that candidates often confuse VPC peering (which requires full mesh for transitive routing) with transit gateway (which provides transitive routing natively), or mistakenly think VPC endpoints can be used for inter-VPC communication instead of their intended purpose of private access to AWS services.

How to eliminate wrong answers

Option B is wrong because VPC peering connections do not support transitive routing; each pair of VPCs requires a separate peering connection, which does not scale well and complicates IP address management for multiple accounts. Option C is wrong because VPC endpoints (Gateway Endpoints or Interface Endpoints) are designed for private connectivity to AWS services (e.g., S3, DynamoDB) and do not provide inter-VPC routing or communication between VPCs in different accounts. Option D is wrong because AWS Direct Connect provides dedicated private connectivity from on-premises to AWS, not between VPCs in different accounts; routing through the network account would require additional complex configurations and does not inherently enable secure VPC-to-VPC communication.

Full explanation →
1422
Multi-Selecthard

A company has a VPC with multiple subnets across three Availability Zones. They deploy an Amazon RDS for MySQL Multi-AZ DB instance. The application tier consists of EC2 instances in private subnets. To improve read performance, the company wants to add read replicas. Which THREE design considerations are important for network connectivity? (Choose THREE.)

Select 3 answers
A.Read replicas can be placed in different Availability Zones than the primary DB instance
B.The application EC2 instances must be in the same VPC as the RDS instance
C.A security group rule must allow inbound traffic from the application subnets on port 3306
D.Read replicas must be in public subnets with public IP addresses
E.Read replicas must be in the same Region as the primary DB instance
AnswersA, B, C

Read replicas can be in different AZs to improve availability and fault tolerance.

Why this answer

Amazon RDS read replicas can be placed in different Availability Zones than the primary DB instance. This improves read performance by distributing read traffic across multiple AZs and provides fault isolation, as replicas remain in the same Region but can be in a different AZ for better availability.

Exam trap

The ANS-C01 exam often tests the misconception that read replicas require public IPs or must be in public subnets, but in reality, they can be deployed in private subnets with proper VPC routing and security group rules.

Full explanation →
1423
MCQhard

A company has a Direct Connect connection with multiple virtual interfaces (VIFs). They notice that traffic from on-premises to a VPC is being dropped. The VPC is associated with a private VIF. The on-premises router has a BGP route to the VPC's CIDR. The VPC's route table has a route to the virtual private gateway. What is the MOST likely cause of the dropped traffic?

A.The VPC route table does not have a route pointing to the virtual private gateway for the on-premises CIDR
B.The MTU size on the Direct Connect connection is too small
C.The BGP session is not established
D.The allowed prefixes on the virtual private gateway do not include the on-premises CIDR
AnswerA

Return traffic is dropped without a route.

Why this answer

For traffic to flow from on-premises to the VPC, the VPC must have a route back to the on-premises CIDR pointing to the virtual private gateway. Without that route, the return traffic will be dropped. Option B is incorrect because MTU issues typically cause packet fragmentation or loss, not complete drop due to missing routes.

Option C is incorrect because the BGP session is established (as indicated by the BGP route being present). Option D is incorrect because allowed prefixes on the virtual private gateway control which routes can be advertised over BGP, not the return path in the VPC route table.

Full explanation →
1424
MCQhard

Refer to the exhibit. A network engineer created a NAT gateway in a public subnet, but its state shows 'failed'. What is the most likely cause?

A.The subnet does not have a route to an internet gateway
B.The subnet is private
C.The NAT gateway is still being created
D.The Elastic IP is already associated with another instance
AnswerD

A NAT gateway requires an unassociated Elastic IP.

Why this answer

A NAT gateway requires an Elastic IP that is not associated with any other resource. If the Elastic IP is already associated with another instance or NAT gateway, the NAT gateway creation fails. Option A is incorrect because the subnet must have a route to an internet gateway to be public, but that is not the cause of the failure.

Option B is incorrect because the NAT gateway is explicitly placed in a public subnet. Option C is incorrect because the state 'failed' indicates the creation did not succeed, not that it is still pending.

Full explanation →
1425
MCQmedium

A company has a VPC with public and private subnets. An Amazon EC2 instance in a private subnet needs to download patches from the internet. The company wants to ensure that the instance cannot be directly initiated from the internet. Which design should be used?

A.Attach a NAT Gateway to the public subnet and add a route to the NAT Gateway in the private subnet's route table
B.Launch a NAT instance in the public subnet and add a route in the private subnet's route table
C.Use a VPC endpoint for Amazon S3 and route patch traffic through it
D.Add a route to the internet gateway in the private subnet's route table
AnswerA

NAT Gateway enables outbound internet access from private subnets and does not allow inbound connections.

Why this answer

A NAT Gateway in a public subnet allows outbound internet traffic from private subnets while preventing unsolicited inbound connections. Adding a route in the private subnet's route table pointing to the NAT Gateway enables the EC2 instance to download patches without being directly reachable from the internet.

Exam trap

The ANS-C01 exam often tests the misconception that a NAT instance is equivalent to a NAT Gateway, but the exam emphasizes that a NAT Gateway is a managed service with automatic scaling and higher availability, making it the preferred design for production workloads.

How to eliminate wrong answers

Option B is wrong because a NAT instance, while functional, is a single point of failure and requires manual management (e.g., disabling Source/Destination Check), whereas a NAT Gateway is a managed service with higher availability and bandwidth. Option C is wrong because a VPC endpoint for Amazon S3 only provides private connectivity to S3, not general internet access for downloading patches from arbitrary internet sources. Option D is wrong because adding a route to the internet gateway in the private subnet's route table would allow direct outbound traffic but also expose the instance to inbound traffic from the internet, violating the requirement that the instance cannot be directly initiated from the internet.

Full explanation →
Page 18

Page 19 of 22

Page 20

All pages

12345678910111213141516171819202122

Practice ANS-C01 by domain

Target a specific domain to shore up weak areas.

Network Management and OperationsNetwork Security, Compliance and GovernanceNetwork DesignNetwork Implementation
See all domains with question counts →