Courseiva

AWS Certified Advanced Networking Specialty ANS-C01 (ANS-C01) — Questions 76–150

1621 questions total · 22pages · All types, answers revealed

Take a mock examExam hub
Page 1

Page 2 of 22

Page 3
76
Multi-Selectmedium

Which THREE of the following are considerations when designing a VPC with multiple Availability Zones for high availability? (Choose THREE.)

Select 3 answers
A.Use an Application Load Balancer to distribute traffic across instances in different Availability Zones.
B.Create a single public subnet that spans all Availability Zones.
C.Deploy NAT gateways in each Availability Zone for redundancy.
D.Create separate subnets in each Availability Zone for the application tier.
E.Use a single NAT gateway in one Availability Zone to reduce cost.
AnswersA, C, D

ALB can route traffic to multiple AZs.

Why this answer

An Application Load Balancer (ALB) distributes incoming traffic across multiple targets, such as EC2 instances, in different Availability Zones (AZs). By registering instances from multiple AZs with the ALB, you ensure that if one AZ becomes unavailable, the ALB can route traffic to healthy instances in another AZ, thereby maintaining high availability. This aligns with the AWS Well-Architected Framework's recommendation to deploy workloads across multiple AZs and use a load balancer to handle failover.

Exam trap

The ANS-C01 exam often tests the misconception that a single subnet can span multiple Availability Zones, but AWS strictly requires each subnet to be confined to one AZ, and candidates may also incorrectly assume that a single NAT gateway is sufficient for high availability if they overlook the single point of failure risk.

Full explanation →
77
MCQmedium

A company is using AWS Organizations to manage multiple accounts. The security team wants to enforce that all S3 buckets have server-side encryption enabled. Which SCP should be applied to the root OU?

A.Create an IAM policy that allows s3:PutBucketEncryption only with specific conditions
B.Attach an IAM policy to each S3 bucket requiring encryption
C.Deny s3:PutBucketEncryption unless encryption settings include AES256 or aws:kms
D.Use AWS Config rules to auto-enable encryption on existing buckets
AnswerC

Correct SCP approach to enforce encryption.

Why this answer

A Service Control Policy (SCP) applied to the root OU can deny the s3:PutBucketEncryption action unless specific encryption settings (AES256 or aws:kms) are used. This prevents any account in the organization from creating or modifying S3 buckets without encryption. Option A is wrong because IAM policies are attached to principals (users/roles), not to OUs, and cannot enforce encryption across all accounts.

Option B is wrong because SCPs are applied to OUs or accounts, not to individual resources like S3 buckets. Option D is wrong because AWS Config rules can detect non-compliance but do not enforce via SCPs; they would require an automated remediation action.

Full explanation →
78
MCQeasy

A company has an Amazon Route 53 private hosted zone associated with a VPC. The company wants to resolve custom domain names for resources within that VPC. Which configuration is required for EC2 instances in the VPC to resolve these private hosted zone records?

A.Configure a Route 53 Resolver inbound endpoint in the VPC
B.Create a Route 53 Resolver outbound endpoint in the VPC
C.Ensure that the VPC has the enableDnsHostnames and enableDnsSupport attributes set to true
D.Establish a VPC peering connection with the Route 53 hosted zone
AnswerC

These settings enable DNS resolution within the VPC using the Route 53 Resolver, allowing instances to resolve private hosted zone records.

Why this answer

For EC2 instances in a VPC to resolve records in a Route 53 private hosted zone, the VPC must have both the `enableDnsHostnames` and `enableDnsSupport` attributes set to `true`. These settings enable the VPC's built-in DNS resolver (the Amazon-provided DNS server at the VPC's base CIDR +2 address) to query the private hosted zone and return the custom domain names to instances. Without these attributes, the VPC DNS resolver cannot perform resolution for private hosted zones, even if the zone is associated with the VPC.

Exam trap

The trap here is that candidates often assume a private hosted zone automatically works for all instances in the VPC, overlooking the mandatory VPC DNS attributes (`enableDnsHostnames` and `enableDnsSupport`) that must be enabled for the VPC's DNS resolver to query the private hosted zone.

How to eliminate wrong answers

Option A is wrong because a Route 53 Resolver inbound endpoint is used to allow DNS queries from on-premises networks into a VPC, not to enable EC2 instances within the VPC to resolve private hosted zone records. Option B is wrong because a Route 53 Resolver outbound endpoint is used to forward DNS queries from the VPC to on-premises DNS servers, which is unrelated to resolving private hosted zones within the same VPC. Option D is wrong because VPC peering connections do not automatically enable DNS resolution across peered VPCs; even if peering is established, the private hosted zone must be explicitly associated with the peered VPC, and the VPC's DNS attributes must still be enabled for resolution to work.

Full explanation →
79
Multi-Selectmedium

A security engineer is designing a security group configuration for a web application that consists of an Application Load Balancer (ALB), Amazon EC2 instances in an Auto Scaling group, and an Amazon RDS database. Which TWO actions should the engineer take to follow security best practices? (Choose TWO.)

Select 2 answers
A.Configure the RDS security group to allow inbound traffic on port 3306 from 0.0.0.0/0.
B.Configure the EC2 instance security group to allow inbound traffic on port 443 from the ALB security group.
C.Configure the RDS security group to allow inbound traffic on port 3306 from the EC2 instance security group.
D.Configure the ALB security group to allow inbound traffic on port 443 from the security group of the EC2 instances.
E.Configure the ALB security group to allow inbound traffic on port 80 from the security group of the EC2 instances.
AnswersB, C

Best practice: reference security group instead of CIDR.

Why this answer

Referencing the ALB security group as the source in the EC2 security group rule ensures that only traffic originating from the ALB (and not any other source) is allowed on port 443. This follows the security best practice of using security group references instead of IP ranges, providing a tighter, more dynamic access control that automatically scales with the ALB's elastic network interfaces.

Exam trap

AWS often tests the misconception that security groups should be configured with IP ranges (e.g., 0.0.0.0/0) for simplicity, rather than using security group references to enforce least-privilege access between tiers.

Full explanation →
80
MCQmedium

A company has a VPC with an IPv6 CIDR block and wants to provide internet access to instances in a private subnet using an egress-only internet gateway. Which of the following must be configured correctly?

A.Configure NAT64 on the VPC to translate IPv6 to IPv4.
B.Enable route propagation for the egress-only internet gateway in the route table.
C.Add a default route (::/0) in the private subnet's route table pointing to the egress-only internet gateway.
D.Assign an IPv6 address to the egress-only internet gateway.
AnswerC

This allows IPv6 traffic from the private subnet to reach the internet outbound.

Why this answer

An egress-only internet gateway (EIG) is a horizontally scaled, redundant VPC component that allows outbound-only IPv6 traffic from instances in a private subnet to the internet, while preventing unsolicited inbound connections. To use it, you must add a default route (::/0) in the private subnet's route table pointing to the EIG, which directs all outbound IPv6 traffic through the gateway. This configuration ensures that instances can initiate outbound IPv6 connections (e.g., to download updates) but cannot be reached from the internet.

Exam trap

The ANS-C01 exam often tests the misconception that an egress-only internet gateway requires an IPv6 address assignment or that it behaves like a NAT gateway for IPv6, leading candidates to choose Option D or Option A, when in fact it is a stateless gateway that only requires a route table entry.

How to eliminate wrong answers

Option A is wrong because NAT64 is used to translate IPv6 traffic to IPv4 for communication with IPv4-only endpoints, but the question specifies IPv6-only internet access via an egress-only internet gateway, which does not require any IPv4 translation. Option B is wrong because route propagation is a feature for dynamic routing protocols (e.g., BGP) with virtual private gateways or Direct Connect, not for egress-only internet gateways, which are static and do not support route propagation. Option D is wrong because an egress-only internet gateway is a logical gateway that does not require an IPv6 address assignment; it operates at the VPC level and uses the VPC's IPv6 CIDR block for routing, not a specific IP address on the gateway itself.

Full explanation →
81
MCQhard

A company is designing a multi-account AWS environment using AWS Organizations. They need to centralize VPC flow logs and network traffic inspection across all accounts. Which architecture meets these requirements with minimal operational overhead?

A.Deploy a central inspection VPC with AWS Network Firewall and use Transit Gateway to route traffic from all VPCs through it.
B.Use AWS Network Firewall in each VPC and aggregate logs centrally.
C.Enable VPC flow logs in each account and send them to a central S3 bucket. Use Network Access Analyzer for inspection.
D.Create VPC peering connections between all VPCs and deploy a third-party firewall in one VPC.
AnswerA

Centralized inspection with AWS Network Firewall and Transit Gateway is recommended.

Why this answer

It uses a central inspection VPC with AWS Network Firewall and Transit Gateway to route traffic from all VPCs through a single inspection point. This architecture centralizes both VPC flow logs and traffic inspection with minimal operational overhead, as Transit Gateway simplifies network connectivity and AWS Network Firewall provides managed, scalable inspection without per-account firewall management.

Exam trap

The ANS-C01 exam often tests the misconception that VPC peering can replace Transit Gateway for centralized inspection, but VPC peering is non-transitive and requires a full mesh, making it unscalable and operationally heavy — Transit Gateway is the correct service for transitive routing with minimal overhead.

How to eliminate wrong answers

Option B is wrong because deploying AWS Network Firewall in each VPC increases operational overhead significantly, as each firewall must be individually managed, updated, and scaled, and it does not inherently centralize flow logs or inspection — logs would still need to be aggregated separately. Option C is wrong because enabling VPC flow logs and sending them to a central S3 bucket only centralizes log storage, not traffic inspection; Network Access Analyzer is a static analysis tool for identifying unintended network access, not a real-time traffic inspection solution. Option D is wrong because creating VPC peering connections between all VPCs creates a full-mesh topology that does not scale and introduces transitive routing limitations (VPC peering is non-transitive), and deploying a third-party firewall in one VPC requires manual routing configuration and does not provide centralized, managed inspection across all VPCs.

Full explanation →
82
MCQeasy

A company is using a Network Load Balancer (NLB) to distribute traffic to a fleet of EC2 instances. The NLB is configured with a target group that has health checks enabled. Some instances are marked as unhealthy even though they are running and responding to requests on the health check port. What is a likely cause?

A.The route table for the NLB subnet does not have a route to the internet.
B.The security group for the EC2 instances does not allow inbound traffic from the VPC CIDR on the health check port.
C.The internet gateway is not attached to the VPC.
D.The health check is being blocked by a network ACL that allows inbound traffic only from the internet.
AnswerB

NLB health checks come from the VPC CIDR; security group must allow that traffic.

Why this answer

When a Network Load Balancer performs health checks, it sends requests from its private IP addresses within the NLB subnet to the target instances. The security group on the EC2 instances must explicitly allow inbound traffic from the VPC CIDR (or the NLB subnet CIDR) on the health check port. If the security group only allows traffic from the internet or a different source, the health check packets are dropped, causing the instances to be marked unhealthy even though they are running and responding to other traffic.

Exam trap

The trap here is that candidates often focus on internet-facing connectivity (IGW, route tables) or network ACLs, but the most direct and common cause for health check failures with NLB is the security group on the target instances not allowing traffic from the NLB's subnet.

How to eliminate wrong answers

Option A is wrong because the NLB operates within the VPC and does not require a route to the internet for health checks; health check traffic stays within the VPC. Option C is wrong because an internet gateway is not required for NLB health checks; the NLB and targets can be in a private subnet with no internet access. Option D is wrong because a network ACL that allows inbound traffic only from the internet would block health check traffic from the NLB's private IPs, but the question states the health check is being blocked; however, the more common and direct cause is the security group, and network ACLs are stateless and would need explicit rules for the NLB subnet, but the security group is the first line of defense and the typical misconfiguration.

Full explanation →
83
MCQhard

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They need to ensure that traffic between VPCs is inspected by a security appliance in a centralized inspection VPC. How should they configure the Transit Gateway route tables?

A.Create a route table for the inspection VPC and add blackhole routes for all other VPCs
B.Use one route table with all VPC attachments and enable route propagation for all attachments
C.Create separate route tables for each VPC and add a static route to the inspection VPC
D.Associate all VPCs with a single route table that has a default route pointing to the inspection VPC attachment, and enable route propagation from the inspection VPC
AnswerD

This forces inter-VPC traffic to go through the inspection VPC.

Why this answer

Using separate route tables for each VPC with a blackhole route pointing to the inspection VPC is not standard; the correct approach is to have a shared route table that propagates routes and uses a static route to the inspection VPC. Option D is correct: associate all VPCs with a single route table that has a default route pointing to the inspection VPC's attachment, and enable route propagation from the inspection VPC. Option A is wrong because it does not force traffic through the inspection VPC.

Option B is wrong because it only inspects traffic from one VPC. Option C is wrong because a blackhole route drops traffic.

Full explanation →
84
MCQmedium

A company has multiple VPCs connected via a Transit Gateway. The security team wants to centrally inspect all traffic between VPCs using a third-party firewall appliance. The appliance must be deployed in a single VPC and all inter-VPC traffic must be routed through it. Which architecture should be used?

A.Configure the Transit Gateway with a central inspection VPC that hosts the firewall appliance
B.Create a Network Load Balancer in each VPC and point to the firewall
C.Deploy AWS Network Firewall in each VPC
D.Use VPC peering connections between all VPCs and route traffic through the inspection VPC
AnswerA

Transit Gateway supports central inspection by routing traffic through a dedicated inspection VPC.

Why this answer

A Transit Gateway supports centralised inspection by attaching a dedicated inspection VPC that hosts the third‑party firewall appliance. By adjusting the Transit Gateway route tables, all inter‑VPC traffic can be forced through the inspection VPC using static routes or a default route pointing to the firewall’s elastic network interface, enabling full traffic inspection without modifying individual VPC route tables.

Exam trap

The ANS-C01 exam often tests the misconception that VPC peering can be used for transitive routing, but in AWS, VPC peering does not support transitive routing, so traffic cannot be routed through a third VPC without a Transit Gateway or a more complex hub‑and‑spoke design.

How to eliminate wrong answers

Option B is wrong because a Network Load Balancer (NLB) distributes traffic to targets but does not enforce routing; it cannot force all inter‑VPC traffic through a single inspection point without complex, unsupported routing changes. Option C is wrong because deploying AWS Network Firewall in each VPC creates a distributed inspection model, not a centralised one, and fails to meet the requirement of a single inspection VPC. Option D is wrong because VPC peering does not support transitive routing; traffic between two peered VPCs cannot be routed through a third VPC unless you use a Transit Gateway or a more complex hub‑and‑spoke design with multiple peering connections and custom routing, which is not scalable or recommended.

Full explanation →
85
MCQmedium

A security engineer reviews the CloudTrail log entry above. What security concern does this event raise?

A.The root user is being used to perform administrative actions.
B.The security group was created with a permissive name.
C.The event took place in a region that is not used by the company.
D.The event originated from an external IP address.
AnswerA

Root user should not be used for daily operations; IAM users should be used.

Why this answer

The event shows the AWS root user creating a security group. Best practice is to not use root for daily tasks. The source IP is external, but that is not necessarily a concern.

The security group name is not the issue. The region is us-east-1, not a concern.

Full explanation →
86
MCQhard

A company has a multi-account AWS environment using AWS Organizations. They need to enforce that all newly created S3 buckets are encrypted with SSE-KMS using a specific KMS key. Which policy should they use?

A.S3 bucket policy on each bucket
B.IAM policy in each account
C.AWS Config rule with auto-remediation
D.SCP in AWS Organizations
AnswerD

SCPs can centrally deny actions across accounts, such as creating buckets without encryption.

Why this answer

A Service Control Policy (SCP) in AWS Organizations can be attached to the root or an OU to deny the creation of S3 buckets that do not use a specific KMS key for encryption. This is a preventive control that applies across all accounts in the organization. Option A (S3 bucket policy) is incorrect because bucket policies are applied at the bucket level after creation and cannot prevent the creation of the bucket.

Option B (IAM policy) is incorrect because IAM policies are per-account and cannot be enforced centrally across all accounts. Option C (AWS Config rule with auto-remediation) is incorrect because Config rules are detective and can only trigger remediation after a non-compliant bucket is created, not prevent the creation.

Full explanation →
87
Multi-Selecteasy

A company wants to encrypt all data in transit between its on-premises data center and AWS. Which two services or features can provide encryption for data in transit?

Select 2 answers
A.AWS PrivateLink
B.VPC peering
C.AWS Site-to-Site VPN
D.AWS Transit Gateway
E.AWS Direct Connect with MACsec
AnswersC, E

IPsec encryption.

Why this answer

AWS Site-to-Site VPN uses IPsec to encrypt traffic between on-premises and AWS, providing encryption in transit. AWS Direct Connect with MACsec provides encryption at Layer 2. Options C and E are correct.

Option A is wrong because AWS PrivateLink does not encrypt traffic between on-premises and AWS; it only provides private connectivity within AWS. Option B is wrong because VPC peering does not inherently encrypt traffic. Option D is wrong because AWS Transit Gateway is a network transit hub and does not provide encryption by itself.

Full explanation →
88
MCQmedium

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to add an IPv6 CIDR block and ensure that traffic from the internet to the IPv6-enabled resources is allowed. Which configuration is required?

A.Attach a NAT gateway to the VPC and update route tables.
B.Attach an internet gateway and update route tables for IPv6.
C.Create a Virtual Private Gateway and attach the VPC.
D.Create a Transit Gateway and attach the VPC.
AnswerB

IGW supports IPv6 traffic.

Why this answer

To enable IPv6 communication from the internet to resources in a VPC, you must associate an IPv6 CIDR block with the VPC, attach an internet gateway, and update the route tables to include a default route (::/0) pointing to the internet gateway for IPv6 traffic. Option B correctly describes this configuration, as the internet gateway handles both IPv4 and IPv6 traffic, and route tables must be explicitly updated for IPv6.

Exam trap

The trap here is that candidates often confuse the internet gateway's role with NAT or VPN devices, assuming IPv6 requires a separate gateway or translation mechanism, when in fact the internet gateway natively handles IPv6 with proper route table entries.

How to eliminate wrong answers

Option A is wrong because a NAT gateway is used for outbound-only IPv4 traffic from private subnets to the internet, not for inbound IPv6 traffic from the internet. Option C is wrong because a Virtual Private Gateway is used for site-to-site VPN or Direct Connect connections, not for internet-facing IPv6 traffic. Option D is wrong because a Transit Gateway is used for inter-VPC or on-premises network connectivity, not for direct internet access to VPC resources.

Full explanation →
89
MCQeasy

A company needs to ensure that all traffic between their VPC and on-premises network is encrypted. Which solution meets this requirement?

A.AWS Direct Connect with a private VIF
B.VPC Peering connection
C.AWS Internet Gateway
D.AWS Site-to-Site VPN
AnswerD

Site-to-Site VPN creates IPsec encrypted tunnels over the internet.

Why this answer

AWS Site-to-Site VPN creates an encrypted IPsec tunnel between the VPC and on-premises network, ensuring all traffic is encrypted over the public internet. This meets the requirement for mandatory encryption, unlike unencrypted options such as Direct Connect or VPC Peering.

Exam trap

The ANS-C01 exam often tests the misconception that Direct Connect alone provides encryption, but it does not; encryption must be explicitly added, and the trap is that candidates assume 'private' equals 'encrypted'.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect with a private VIF provides a private, dedicated network connection but does not inherently encrypt traffic; encryption must be added separately (e.g., over a VPN or MACsec). Option B is wrong because VPC Peering connects VPCs within AWS using the AWS backbone and does not support encryption of traffic between the VPC and an on-premises network. Option C is wrong because an Internet Gateway allows outbound and inbound internet traffic but does not provide encrypted connectivity to an on-premises network.

Full explanation →
90
MCQmedium

A company has a VPC peering connection between VPC A (10.0.0.0/16) and VPC B (10.1.0.0/16). Both VPCs have route tables that include routes to each other's CIDR blocks via the peering connection. Instances in VPC A can ping instances in VPC B, but traffic to an Application Load Balancer (ALB) in VPC B fails. The ALB is in public subnets with internet-facing scheme. What is the most likely cause?

A.The VPC peering connection does not support transitive routing for ALBs
B.The ALB is internet-facing and cannot be accessed from a peered VPC
C.The route tables in VPC B do not have a route back to VPC A
D.The ALB security group does not allow inbound traffic from VPC A
AnswerD

The security group must allow inbound traffic from the peered VPC's CIDR.

Why this answer

The most likely cause is that the ALB's security group does not allow inbound traffic from VPC A. Even though the VPC peering connection is properly configured and ICMP traffic (ping) works, HTTP/HTTPS traffic to the ALB is controlled by security groups. The ALB's security group must explicitly permit inbound traffic from the CIDR block of VPC A (10.0.0.0/16) or from the security group of the instances in VPC A.

Without this rule, the ALB will drop the traffic, even though the network path is functional.

Exam trap

The trap here is that candidates assume that because ping works, all traffic should work, overlooking that security groups operate at Layer 4 and must explicitly permit the specific protocol and port (e.g., TCP/80 or TCP/443) from the source VPC's CIDR.

How to eliminate wrong answers

Option A is wrong because VPC peering does support traffic to an ALB; transitive routing is irrelevant here as there are only two VPCs directly peered, and ALBs can be accessed via a peering connection as long as security groups and route tables allow it. Option B is wrong because an internet-facing ALB can indeed be accessed from a peered VPC; the 'internet-facing' scheme only means it has public IPs and routes to the internet, but it does not restrict access from private IPs in a peered VPC. Option C is wrong because the question states that route tables in both VPCs include routes to each other's CIDR blocks via the peering connection, and ping works, confirming that return routing is properly configured.

Full explanation →
91
MCQmedium

A network engineer is troubleshooting an EC2 instance that cannot connect to S3 via a VPC endpoint. The describe-vpc-endpoints output shows the endpoint is associated with a route table but no subnets. What is the likely issue?

A.The DNS entry for the endpoint is not resolving.
B.The VPC endpoint policy denies access to S3.
C.The VPC endpoint state is not available.
D.The subnet's route table does not include a route for the S3 prefix list via the endpoint.
AnswerD

Gateway Endpoints rely on route table entries; the subnet must have the route.

Why this answer

The VPC endpoint for S3 is a Gateway Endpoint, which is associated with a route table, not a subnet. For the EC2 instance to connect to S3 via the endpoint, the route table associated with the instance's subnet must include a route that directs traffic to the S3 prefix list through the endpoint. If the endpoint is associated with a route table that is different from the subnet's route table, or if the subnet's route table lacks the route, traffic will not use the endpoint.

Therefore, the likely issue is that the subnet's route table does not contain the required route for the S3 prefix list via the endpoint. Option A is incorrect because DNS resolution is not the primary issue; the endpoint DNS names should resolve. Option B is incorrect because the endpoint policy defaults to allow all, and there is no indication of a deny.

Option C is incorrect because the endpoint state is available as per the output.

Full explanation →
92
MCQhard

A company has a VPC with a Transit Gateway (TGW) connected to multiple VPCs and an on-premises network via Direct Connect. The network team wants to implement centralized inspection of all traffic between VPCs and between VPCs and on-premises. Which architecture should they use?

A.Attach a Direct Connect Gateway to the Transit Gateway and configure route propagation.
B.Use AWS Network Firewall in each VPC.
C.Create a Gateway Load Balancer (GWLB) in a dedicated inspection VPC and attach it to the Transit Gateway.
D.Deploy a third-party firewall in each VPC and use VPC peering.
AnswerC

GWLB with appliances allows centralized inspection. TGW routes traffic through the inspection VPC.

Why this answer

Centralized inspection is achieved by using a Gateway Load Balancer with appliances in a dedicated inspection VPC. Transit Gateway route tables direct traffic to the inspection VPC. AWS Network Firewall can also be used but is placed in a VPC.

Direct Connect gateway does not provide inspection.

Full explanation →
93
MCQmedium

A company is deploying a VPC with public and private subnets in two Availability Zones. The private subnets need outbound internet access for software updates but must not be reachable from the internet. Which AWS service should be used to achieve this?

A.VPC Peering
B.Virtual Private Gateway
C.NAT Gateway
D.Internet Gateway
AnswerC

NAT Gateway provides outbound internet access for private subnets without allowing unsolicited inbound connections.

Why this answer

A NAT Gateway enables instances in private subnets to initiate outbound IPv4 traffic to the internet (e.g., for software updates) while preventing the internet from initiating connections back to those instances. It resides in a public subnet with an Elastic IP and uses source network address translation (SNAT) to translate private source IPs to the gateway's public IP, ensuring the private instances remain unreachable from external hosts.

Exam trap

The trap here is that candidates often confuse a NAT Gateway with an Internet Gateway, mistakenly thinking an Internet Gateway can be placed in a private subnet to provide outbound-only access, but an Internet Gateway is a VPC-level construct that always allows bidirectional traffic if a route to it exists.

How to eliminate wrong answers

Option A is wrong because VPC Peering connects two VPCs privately using AWS's internal infrastructure; it does not provide internet access and cannot route traffic to or from the internet. Option B is wrong because a Virtual Private Gateway is used to establish a VPN or Direct Connect connection between a VPC and an on-premises network, not for outbound internet access from private subnets. Option D is wrong because an Internet Gateway allows bidirectional communication between a VPC and the internet; attaching it directly to a private subnet would make instances reachable from the internet, violating the requirement that they must not be reachable from the internet.

Full explanation →
94
MCQeasy

A company is implementing a hybrid network using AWS Site-to-Site VPN. The on-premises firewall requires that the VPN tunnels use IKEv2 with pre-shared keys and that the tunnels are always active. Which VPN configuration should be used?

A.Two VPN tunnels in active/passive mode
B.Two VPN tunnels with static routing
C.One VPN tunnel with static routing
D.Two VPN tunnels in active/active mode with BGP
AnswerD

Active/active tunnels with BGP provide high availability and always-on connectivity.

Why this answer

IKEv2 with pre-shared keys and always-active tunnels require both tunnels to be in active/active mode, which is achieved by using BGP to advertise the same routes over both tunnels. BGP enables dynamic routing and ensures both tunnels are used simultaneously, meeting the requirement for continuous active connectivity.

Exam trap

The trap here is that candidates often assume active/passive mode is required for redundancy, but the question explicitly states 'tunnels are always active,' which mandates active/active mode with BGP to keep both tunnels up and forwarding traffic simultaneously.

How to eliminate wrong answers

Option A is wrong because active/passive mode means only one tunnel is active at a time, which does not satisfy the requirement that both tunnels are always active. Option B is wrong because static routing does not support active/active operation; with static routing, one tunnel typically becomes the primary and the other remains passive, and failover is not dynamic. Option C is wrong because a single VPN tunnel provides no redundancy and cannot be 'always active' in the sense of having two active tunnels as required.

Full explanation →
95
MCQmedium

A company has a production VPC with a public subnet and a private subnet. The private subnet hosts a database instance that should be accessible only from the application servers in the same VPC. The security team has configured the database security group to allow inbound traffic on port 3306 from the application security group. However, the application servers cannot connect to the database. The network ACLs are configured with default allow all rules. What is the MOST likely cause?

A.The database instance does not have an IAM role assigned.
B.The database security group does not allow outbound traffic for the response.
C.The network ACL on the private subnet has an inbound deny rule for port 3306.
D.The VPC is peered with another VPC that has overlapping CIDR.
AnswerC

NACLs are stateless; a deny rule on port 3306 inbound would block traffic from the application servers to the database, overriding the security group allow.

Why this answer

The most likely cause is that the network ACL (NACL) on the private subnet has an inbound deny rule for port 3306. NACLs are stateless and evaluate rules in order; even though the default NACL allows all traffic, a custom NACL applied to the subnet could have a deny rule that overrides the default allow. This would block the inbound traffic from the application servers to the database on port 3306, preventing connectivity.

Option B is incorrect because security groups are stateful; outbound rules do not affect return traffic for allowed inbound connections. Options A and D are irrelevant to the connectivity issue.

Exam trap

A common misconception is that security groups need outbound rules for return traffic, but they are stateful and automatically allow it. Instead, the issue lies with stateless NACLs, which can block traffic if configured with deny rules.

Full explanation →
96
MCQeasy

A network engineer is monitoring network performance and needs to collect and analyze network metrics from multiple AWS services in a centralized dashboard. Which AWS service should be used to aggregate and visualize these metrics?

A.AWS VPC Flow Logs
B.AWS CloudTrail
C.Amazon CloudWatch Dashboards
D.AWS Config
AnswerC

CloudWatch Dashboards aggregate and visualize metrics.

Why this answer

Amazon CloudWatch Dashboards provide a centralized view of metrics from various AWS services, allowing you to create custom dashboards for monitoring and analysis. Option A is wrong because VPC Flow Logs capture IP traffic information but are not designed for aggregating metrics from multiple services. Option B is wrong because AWS CloudTrail logs API activity for auditing, not performance metrics.

Option D is wrong because AWS Config tracks resource configuration changes, not metrics.

Full explanation →
97
MCQmedium

A company uses AWS Shield Advanced for DDoS protection. They want to receive near real-time notifications when a DDoS attack is detected. Which AWS service should be used to trigger the notification?

A.Amazon EventBridge
B.AWS Lambda
C.Amazon Simple Queue Service (SQS)
D.Amazon Simple Notification Service (SNS)
AnswerD

CloudWatch Alarm can send a notification to SNS when Shield detects an attack.

Why this answer

AWS Shield Advanced integrates with CloudWatch to send metrics and alarms. Shield can send events to EventBridge, but for near real-time notifications, CloudWatch Alarms are typically used to trigger SNS topics. Lambda and SQS are not direct notification services for Shield events.

Full explanation →
98
MCQeasy

A company wants to enforce that all Amazon S3 buckets in an AWS account are encrypted at rest. Which AWS service can be used to automatically detect and report unencrypted buckets?

A.AWS CloudTrail
B.Amazon GuardDuty
C.AWS Config
D.Amazon Inspector
AnswerC

AWS Config can use managed rules to check S3 bucket encryption.

Why this answer

AWS Config can evaluate resources against rules. The 's3-bucket-server-side-encryption-enabled' managed rule checks for encryption. CloudTrail logs API calls, GuardDuty detects threats, and Inspector assesses vulnerabilities.

Full explanation →
99
MCQeasy

A network engineer is troubleshooting high latency on an AWS Direct Connect connection. The engineer checks the CloudWatch metrics for the virtual interface and sees that 'ConnectionBpsEgress' and 'ConnectionBpsIngress' are both below 50% of the provisioned bandwidth. Which additional metric should be examined to identify potential bufferbloat?

A.CRAM (Challenge-Response Authentication Mechanism) handshake failures
B.Latency metrics from Amazon CloudWatch
C.PauseFrames (802.3x flow control frames)
D.CRC errors on the physical connection
AnswerC

High pause frames indicate congestion and bufferbloat.

Why this answer

(PauseFrames) is correct because PauseFrames indicate that the link is being flow-controlled due to congestion, which can cause bufferbloat. High pause frame counts suggest the local device is forcing the remote device to pause transmission, leading to increased latency. Option A is incorrect because CRAM is a security protocol, not a network metric.

Option B is incorrect because detailed latency metrics are not available for Direct Connect virtual interfaces. Option D is incorrect because CRC errors indicate physical layer issues, not bufferbloat.

Full explanation →
100
MCQhard

Refer to the exhibit. An AWS IAM policy is attached to an IAM role used by a network administrator. The policy is intended to allow the role to accept a VPC peering connection request only if the accepter VPC is vpc-0abcdef1234567890. However, the administrator reports that the policy does not work as expected. What is the most likely reason?

A.The policy does not include the ec2:Describe* action, which is required to accept a peering connection
B.The resource ARN should include the specific peering connection ID instead of a wildcard
C.The condition key is misspelled; it should be ec2:AccepterVpc (with capital A)
D.The Principal element must specify the AWS account ID instead of the IAM role ARN
AnswerC

The condition key is case-sensitive; the correct key is ec2:AccepterVpc (capital A).

Why this answer

AWS condition keys are case-sensitive. The correct condition key for restricting the accepter VPC is `ec2:AccepterVpc` (with capital A and V). A common mistake is using `ec2:accepterVpc` (lowercase 'a'), which causes the condition to be ignored and the policy to not work as intended.

The other options are incorrect: the `ec2:AcceptVpcPeeringConnection` action does not require `ec2:Describe*` permissions; a wildcard in the resource ARN is permissible when the condition restricts access to a specific VPC; and identity-based policies attached to a role do not include a Principal element.

Full explanation →
101
MCQhard

A network engineer is troubleshooting connectivity to a VPC endpoint service. The engineer runs the CLI command shown in the exhibit. The output shows two service names. Which statement is correct based on this output?

A.The engineer can create an interface VPC endpoint to the services
B.The services are Gateway VPC endpoints
C.The services are VPC peering connections
D.The services are Gateway Load Balancer endpoint services
AnswerA

Correct; the command returns interface endpoint services, which can be used to create interface VPC endpoints.

Why this answer

The CLI command `aws ec2 describe-vpc-endpoint-services` returns a list of AWS services that support VPC endpoints. The output shows two service names, which are AWS-managed services (e.g., `com.amazonaws.vpce.us-east-1.s3`). These services can be accessed via interface VPC endpoints, which use Elastic Network Interfaces (ENIs) with private IP addresses to route traffic privately within the VPC.

Therefore, the engineer can create an interface VPC endpoint to these services.

Exam trap

AWS often tests the distinction between Gateway VPC endpoints and Interface VPC endpoints, and the trap here is that candidates may assume any service name returned by `describe-vpc-endpoint-services` is a Gateway endpoint, but the command lists all endpoint services, and the correct interpretation depends on the service name format and the type of endpoint supported.

How to eliminate wrong answers

Option B is wrong because Gateway VPC endpoints are used for services like Amazon S3 and DynamoDB, and they are identified by service names starting with `com.amazonaws.<region>.s3` or `com.amazonaws.<region>.dynamodb`, not by the generic service names shown in the output. Option C is wrong because VPC peering connections are not listed by `describe-vpc-endpoint-services`; they are managed via `ec2 describe-vpc-peering-connections` and are not endpoint services. Option D is wrong because Gateway Load Balancer endpoint services are identified by service names that include `com.amazonaws.vpce.<region>.gateway-load-balancer-endpoint`, and the output does not contain such a pattern; also, Gateway Load Balancer endpoints are a type of VPC endpoint service but the question's output does not indicate that.

Full explanation →
102
MCQhard

A company has a Direct Connect connection to AWS with a private VIF to a VPC. They also have a VPN connection as a backup. The BGP sessions are established. They want to ensure that traffic from on-premises to the VPC prefers the Direct Connect path over the VPN. The on-premises router is advertising the same prefix to both connections. What should the network engineer configure on the AWS side?

A.Set a higher local preference value on the on-premises router for the Direct Connect route.
B.Update the VPC route table to give higher priority to the Direct Connect route.
C.Set a lower MED value on the Direct Connect virtual interface.
D.Configure the on-premises router to prepend AS path for routes advertised over the VPN connection.
AnswerD

Correct: AS path prepending makes VPN path less preferred.

Why this answer

To prefer the Direct Connect path over the VPN for traffic from on-premises to the VPC, the on-premises router should prepend its AS number multiple times for the routes advertised over the VPN connection. This increases the AS path length, making the Direct Connect path more preferred. AWS does not allow manipulation of BGP attributes on the customer side of the Direct Connect or VPN connections, so the change must be made on the on-premises router.

Option A is incorrect because local preference is a Cisco-specific feature and affects outbound traffic, not inbound. Option B is incorrect because VPC route tables only apply to traffic inside the VPC, not to BGP path selection. Option C is incorrect because MED is typically used to influence outbound traffic from AWS to on-premises and is not as effective as AS path prepending for this scenario.

Full explanation →
103
MCQeasy

A company needs to provide internet access to instances in a private subnet. The instances must not be directly accessible from the internet. Which AWS service should be used?

A.VPC Peering
B.AWS Direct Connect
C.Internet Gateway
D.NAT Gateway
AnswerD

Provides outbound internet access for private instances.

Why this answer

A NAT Gateway enables instances in a private subnet to initiate outbound IPv4 traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet. It resides in a public subnet with an Elastic IP and uses source network address translation (SNAT) to translate the private IPs of the instances to the gateway's public IP, ensuring the instances remain inaccessible from the outside.

Exam trap

AWS often tests the misconception that an Internet Gateway can be used in a private subnet by simply not assigning public IPs, but the trap is that an IGW in a private subnet's route table would still allow direct inbound traffic if the instance has a public IP or if the IGW is misconfigured, whereas a NAT Gateway explicitly blocks unsolicited inbound connections by design.

How to eliminate wrong answers

Option A is wrong because VPC Peering connects two VPCs privately using AWS's internal infrastructure and does not provide internet access; it is used for inter-VPC communication, not for outbound internet connectivity. Option B is wrong because AWS Direct Connect establishes a dedicated private network connection from on-premises to AWS, but it does not inherently provide internet access; it bypasses the public internet and requires additional routing or a separate internet gateway for internet-bound traffic. Option C is wrong because an Internet Gateway (IGW) allows both inbound and outbound internet traffic to instances in a public subnet, but it would directly expose instances to the internet if attached to a private subnet, violating the requirement that instances must not be directly accessible from the internet.

Full explanation →
104
MCQmedium

A company uses AWS Organizations with multiple accounts and wants to centrally manage VPC security group rules. They need to enforce that no security group allows inbound SSH (port 22) from 0.0.0.0/0. Which service should they use to automatically detect and remediate noncompliant security groups?

A.AWS Config
B.Amazon GuardDuty
C.AWS Firewall Manager
D.AWS CloudTrail
AnswerA

AWS Config can evaluate security group rules against desired configurations and trigger automatic remediation via AWS Systems Manager Automation.

Why this answer

AWS Config with managed rules like restricted-ssh can detect noncompliant security groups, and AWS Config remediation actions can automatically remediate them. AWS Firewall Manager can also centrally manage security group rules across accounts, but it is more about enforcement and policy management. Option A is correct because AWS Config is the primary service for compliance monitoring and remediation.

Option C (AWS Firewall Manager) is also a valid service but is more for policy-based management across accounts; however, the question asks for detection and automatic remediation, which AWS Config does directly. Option D (AWS CloudTrail) is for auditing API calls, not for enforcement. Option B (Amazon GuardDuty) is for threat detection, not security group compliance.

Full explanation →
105
Multi-Selectmedium

A company is designing a network for a high-traffic web application that must be highly available across multiple AWS Regions. The application uses Application Load Balancers (ALBs) in each region. Which TWO actions should be taken to route traffic to the nearest healthy endpoint?

Select 2 answers
A.Use Amazon Route 53 weighted routing
B.Use Amazon Route 53 latency-based routing with health checks
C.Use Amazon Route 53 multi-value answer routing
D.Use AWS Global Accelerator with endpoint groups in each region
E.Use Amazon Route 53 failover routing
AnswersB, D

Latency routing sends traffic to the region with lowest latency, and health checks ensure only healthy ALBs receive traffic.

Why this answer

Route 53 latency-based routing directs traffic to the region with the lowest latency for the end user, and when combined with health checks, it ensures traffic is only sent to healthy ALBs. This meets the requirement of routing to the nearest healthy endpoint across multiple AWS Regions.

Exam trap

The trap here is that candidates often confuse latency-based routing with weighted routing or multi-value answer routing, assuming any DNS-based routing with health checks will automatically route to the nearest healthy endpoint, but only latency-based routing (or Global Accelerator) considers proximity.

Full explanation →
106
MCQeasy

A company has a VPC with public and private subnets. The public subnets have a NAT gateway for outbound internet access. The private subnets route all 0.0.0.0/0 traffic to the NAT gateway. The network team wants to centrally log all outbound internet traffic from the private subnets. They enable VPC Flow Logs and publish them to Amazon S3. However, they notice that the flow logs are capturing only traffic between instances within the VPC, not the NAT gateway traffic. What should the team do to capture outbound internet traffic?

A.Enable VPC Flow Logs specifically for the NAT gateway's elastic network interface.
B.Enable VPC Flow Logs for all subnets in the VPC.
C.Use AWS CloudTrail to log NAT gateway traffic.
D.Enable VPC Flow Logs for the VPC and publish to CloudWatch Logs instead of S3.
AnswerA

Captures traffic through the NAT gateway.

Why this answer

VPC Flow Logs capture traffic at the network interface level. Traffic from private subnets to the NAT gateway is captured by flow logs on the private subnet instances' ENIs, but the NAT gateway's outbound traffic goes through its own ENI. To log the actual outbound internet traffic, you must enable flow logs on the NAT gateway's ENI.

Option A correctly identifies this. Option B would not capture NAT gateway egress because flow logs are per-ENI. Option C (CloudTrail) logs API calls, not network traffic.

Option D is incorrect because the destination (S3 vs CloudWatch) does not affect what traffic is captured.

Full explanation →
107
MCQeasy

A company wants to centrally manage and enforce security rules for all VPCs in a multi-account environment. Which AWS service should be used?

A.Amazon GuardDuty
B.AWS Shield
C.AWS Firewall Manager
D.AWS WAF
AnswerC

Centrally manages firewall rules across accounts and VPCs.

Why this answer

AWS Firewall Manager is the correct choice because it provides centralized management of firewall rules across multiple accounts and VPCs in an AWS Organization. It allows you to enforce a common set of security policies, such as AWS WAF rules, AWS Shield Advanced protections, and VPC security group rules, ensuring consistent governance across all VPCs in the multi-account environment.

Exam trap

AWS often tests the distinction between a service that provides centralized policy management (Firewall Manager) versus a service that provides a specific security function (like WAF or Shield), leading candidates to choose the more familiar service without recognizing the need for multi-account governance.

How to eliminate wrong answers

Option A is wrong because Amazon GuardDuty is a threat detection service that monitors for malicious activity using anomaly detection and threat intelligence, not a service for centrally managing or enforcing security rules across VPCs. Option B is wrong because AWS Shield is a managed Distributed Denial of Service (DDoS) protection service, designed to safeguard applications against DDoS attacks, not for centrally managing firewall rules across multiple VPCs. Option D is wrong because AWS WAF is a web application firewall that protects web applications from common exploits, but it operates at the application layer and does not provide centralized policy management across multiple accounts and VPCs; that capability is provided by AWS Firewall Manager.

Full explanation →
108
MCQmedium

A network engineer is configuring AWS Client VPN for remote access. The engineer creates a Client VPN endpoint and associates it with a target network (subnet) in the VPC. After associating, clients can connect to the VPN but cannot access resources in the VPC. The security groups and network ACLs allow all traffic. What is the most likely issue?

A.The Client VPN endpoint is not associated with a subnet in the VPC
B.The client CIDR range overlaps with the VPC CIDR
C.The Client VPN endpoint does not have an authorization rule to allow access to the VPC CIDR
D.The Client VPN endpoint's route table does not include a route to the VPC CIDR
AnswerD

A route must be added to direct traffic to the VPC.

Why this answer

The Client VPN endpoint's route table must include a route to the VPC CIDR for traffic from clients to reach VPC resources. Without this route, packets are not forwarded to the VPC. Option A is incorrect because the subnet association is properly done; the endpoint is associated with a subnet.

Option B is incorrect because a client CIDR overlap would cause routing conflicts, but the question states clients can connect but cannot access resources, indicating the VPN tunnel is established. Option C is incorrect because authorization rules control access to specific networks (e.g., security groups), but if no route exists, traffic won't reach the VPC even with authorization rules.

Full explanation →
109
Multi-Selectmedium

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to another VPC with CIDR 10.0.0.0/16 via VPC Peering. They encounter an error because of overlapping CIDRs. Which TWO actions can resolve this issue?

Select 2 answers
A.Use a subnet-level peering connection
B.Create a new VPC with a non-overlapping CIDR and peer with that
C.Modify the CIDR of one VPC to a non-overlapping range
D.Use AWS Transit Gateway with separate route tables
E.Use a NAT Gateway to translate IPs
AnswersB, D

New VPC can be peered.

Why this answer

Creating a new VPC with a non-overlapping CIDR and establishing a VPC peering connection resolves the conflict. VPC peering requires that the CIDR blocks of the two VPCs do not overlap, as overlapping ranges prevent proper route table entries and cause routing ambiguity. By using a non-overlapping CIDR, you enable direct connectivity between the VPCs without IP address conflicts.

Exam trap

The trap here is that candidates often think they can modify a VPC's CIDR after creation or use subnet-level peering, but AWS does not support either, and they may overlook Transit Gateway as a valid solution for overlapping CIDRs.

Full explanation →
110
MCQmedium

An organization has multiple VPCs connected to a common Transit Gateway. The network team wants to centrally manage and enforce routing policies, such as allowing or denying traffic between specific VPCs based on tags. Which AWS feature should be used to implement this requirement?

A.AWS Transit Gateway Network Manager
B.AWS Direct Connect Gateway
C.Amazon Route 53 Resolver
D.VPC Peering with route tables
AnswerA

Correct; Network Manager provides centralized visibility and policy-based management for Transit Gateway.

Why this answer

AWS Transit Gateway Network Manager provides a central dashboard to manage and monitor transit gateways, on-premises networks, and attached VPCs. It supports defining and enforcing routing policies based on tags, enabling the network team to centrally allow or deny traffic between specific VPCs without manually managing individual route tables.

Exam trap

The trap here is that candidates often confuse Transit Gateway Network Manager with basic Transit Gateway route tables, assuming manual route table configuration is sufficient, but the question specifically requires centralized, tag-based policy enforcement which only Network Manager provides.

How to eliminate wrong answers

Option B is wrong because AWS Direct Connect Gateway is used to connect on-premises networks to multiple VPCs via Direct Connect, not for centrally managing routing policies between VPCs based on tags. Option C is wrong because Amazon Route 53 Resolver is a DNS service that resolves domain names across VPCs and on-premises networks, not a routing policy enforcement mechanism. Option D is wrong because VPC Peering with route tables requires manual, point-to-point peering connections and route table updates, lacking centralized policy management and tag-based enforcement across multiple VPCs.

Full explanation →
111
MCQmedium

A network engineer created an IAM policy for a user to manage VPC Flow Logs. The user reports they cannot create flow logs and receive an 'AccessDenied' error. What is the MOST likely reason?

A.The ec2:CreateFlowLogs action is missing.
B.The logs:CreateLogGroup resource ARN is too restrictive.
C.The logs:PutLogEvents action is missing.
D.The iam:PassRole action is missing for the flow logs role.
AnswerB

The resource ARN limits log group creation to names starting with '/aws/vpc-flow-logs/', but the user might be using a different name.

Why this answer

The logs:CreateLogGroup action is required to create a log group for VPC Flow Logs. If the IAM policy grants this action but restricts the resource ARN to a specific log group name (e.g., arn:aws:logs:us-east-1:123456789012:log-group:my-log-group:*), the user will get an AccessDenied error when trying to create a flow log that would create a log group with a different name. Options A, C, and D are less likely because the policy may include those actions but the resource restriction on logs:CreateLogGroup is the most common cause.

Full explanation →
112
Multi-Selectmedium

Which TWO options are valid ways to monitor network traffic in an AWS environment? (Choose 2.)

Select 2 answers
A.AWS Config
B.AWS CloudTrail
C.VPC Traffic Mirroring
D.Amazon Inspector
E.VPC Flow Logs
AnswersC, E

Copies traffic for deep packet inspection.

Why this answer

VPC Traffic Mirroring (Option C) is a valid way to monitor network traffic because it captures and copies network packets from Elastic Network Interfaces (ENIs) in a VPC and forwards them to monitoring appliances for deep packet inspection, security analysis, or troubleshooting. This allows you to inspect traffic content, including payloads, without impacting the source or destination of the traffic.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (which logs API calls) with network traffic monitoring, but CloudTrail does not capture data-plane packets or payloads, making VPC Flow Logs and VPC Traffic Mirroring the only correct options for actual network traffic monitoring.

Full explanation →
113
MCQmedium

A company has a VPC with a CIDR of 10.0.0.0/16. They need to connect to a partner's VPC with CIDR 10.0.0.0/16 using a VPC peering connection. What is the issue with this configuration?

A.The company has reached the maximum number of VPC peering connections
B.VPC peering is only supported within the same region
C.VPC peering does not support transitive routing
D.Overlapping CIDR ranges are not supported for VPC peering
AnswerD

VPC peering requires non-overlapping CIDR blocks to enable routing between them.

Why this answer

VPC peering requires that the CIDR blocks of the peered VPCs do not overlap. In this case, both VPCs use 10.0.0.0/16, which creates an identical address space. When routes are added to the route tables for the peering connection, the destination CIDR would be ambiguous, and the VPC cannot distinguish between local resources and those in the peered VPC, leading to routing conflicts.

AWS explicitly rejects peering requests between VPCs with overlapping or identical CIDR ranges.

Exam trap

The ANS-C01 exam often tests the overlapping CIDR restriction for VPC peering, and the trap here is that candidates may focus on transitive routing or regional limitations instead of recognizing that the fundamental prerequisite of non-overlapping IP ranges is violated.

How to eliminate wrong answers

Option A is wrong because the question does not mention any existing peering connections, and the default limit for VPC peering connections per VPC is 125 (which can be increased), so reaching the maximum is not the issue here. Option B is wrong because VPC peering supports cross-region peering (inter-region VPC peering) as well as same-region peering, so the statement that it is only supported within the same region is incorrect. Option C is wrong while it is true that VPC peering does not support transitive routing, that is not the primary issue in this scenario; the core problem is the overlapping CIDR ranges, which prevents the peering connection from being established at all.

Full explanation →
114
MCQhard

A company uses AWS Direct Connect with a private VIF to access a VPC. They also have a site-to-site VPN as backup. They notice that during Direct Connect maintenance, the VPN does not take over traffic as expected. All routes are advertised over BGP. What is the most likely reason?

A.The Direct Connect virtual interface is still in the 'available' state even though the physical link is down.
B.The VPN tunnel is using a different BGP ASN than the Direct Connect.
C.The VPN BGP advertisements have a longer AS PATH than the Direct Connect advertisements, making them less preferred.
D.The VPN is configured with a higher local preference than Direct Connect.
AnswerC

BGP prefers the shortest AS PATH, so VPN routes with longer AS PATH are not used when Direct Connect is available. During maintenance, they should become active but may be delayed.

Why this answer

BGP path selection prefers routes with the shortest AS_PATH. During normal operation, the Direct Connect private VIF advertises routes with a shorter AS_PATH than the VPN backup. When the Direct Connect physical link goes down, the BGP session over the private VIF also goes down, and the VPN routes should take over.

However, if the VPN BGP advertisements have a longer AS_PATH, they remain less preferred in the BGP routing table, and the router may still try to use the now-unreachable Direct Connect routes until they are withdrawn, causing traffic to drop instead of failing over to the VPN.

Exam trap

The trap here is that candidates assume BGP failover is automatic based on reachability, but BGP path selection is deterministic and based on attribute comparison; without explicit tuning (e.g., local preference or AS_PATH prepending), the backup path with a longer AS_PATH will never be used as long as the primary path's routes are still in the routing table, even if the primary path is down.

How to eliminate wrong answers

Option A is wrong because if the physical link is down, the Direct Connect virtual interface will transition to the 'down' or 'error' state, not remain 'available'; the 'available' state indicates the logical configuration is valid but the physical layer status is separate. Option B is wrong because using a different BGP ASN for the VPN than Direct Connect is normal and does not prevent failover; BGP allows different ASNs as long as the customer ASN is consistent or allowed by the provider. Option D is wrong because a higher local preference on the VPN would actually make the VPN routes more preferred, which would cause the VPN to take over traffic, not fail to take over; the problem is the opposite—the VPN is less preferred.

Full explanation →
115
Multi-Selectmedium

A company has a VPC with public and private subnets. The security team wants to implement a web application firewall to protect against common web exploits. Which TWO AWS services can be used together to achieve this?

Select 2 answers
A.Application Load Balancer (ALB)
B.Network Load Balancer (NLB)
C.AWS WAF
D.NAT Gateway
E.Amazon CloudFront
AnswersA, C

ALB can be associated with AWS WAF to inspect HTTP/HTTPS traffic.

Why this answer

An Application Load Balancer (ALB) operates at Layer 7 and can be associated with AWS WAF to inspect HTTP/HTTPS traffic for common web exploits. AWS WAF provides a managed rule set that blocks SQL injection, cross-site scripting (XSS), and other OWASP Top 10 threats. Together, they form a web application firewall (WAF) solution that protects resources in the VPC's private subnets.

Exam trap

AWS often tests the misconception that any load balancer can integrate with AWS WAF, but only Layer 7 load balancers (ALB) support this integration, not Layer 4 (NLB).

Full explanation →
116
MCQmedium

A network engineer needs to create a set of IAM permissions for a DevOps team to monitor network resources. The policy above is proposed. What critical missing permission is required to allow the team to list and describe VPCs?

A.ec2:DescribeVpcPeeringConnections
B.ec2:DescribeVpcs
C.ec2:DescribeSubnets
D.ec2:CreateVpc
AnswerB

The policy does not include describe for VPCs; it only allows DescribeInstances and DescribeSecurityGroups.

Why this answer

The correct permission to list and describe VPCs is `ec2:DescribeVpcs`. This API call returns information about one or more VPCs, including their CIDR blocks, state, and tags. Without this specific permission, the DevOps team cannot retrieve VPC details, even if they have other EC2 describe permissions.

Exam trap

AWS often tests the distinction between read and write permissions, and the trap here is that candidates confuse `ec2:CreateVpc` (a write action) with the ability to list VPCs, or assume that broader EC2 describe permissions like `ec2:Describe*` are implicitly granted.

How to eliminate wrong answers

Option A is wrong because `ec2:DescribeVpcPeeringConnections` only lists VPC peering connections, not the VPCs themselves. Option C is wrong because `ec2:DescribeSubnets` lists subnets within a VPC, but does not provide VPC-level information. Option D is wrong because `ec2:CreateVpc` is a write action that creates a new VPC, not a read action for listing or describing existing VPCs.

Full explanation →
117
MCQeasy

A company is deploying a multi-tier application on AWS and needs to ensure that traffic between the web tier and the application tier does not traverse the internet. Both tiers are deployed in the same VPC but in different subnets. What is the MOST secure way to meet this requirement?

A.Use an Internet Gateway to route traffic between subnets
B.Use VPC Peering between the subnets
C.Use a NAT Gateway in each subnet for inter-subnet communication
D.Use route tables and security groups to allow traffic within the VPC
AnswerD

Correct; local routes already enable communication within a VPC; security groups and NACLs provide security.

Why this answer

The most secure way to ensure that traffic between the web tier and the application tier does not traverse the internet is to use route tables and security groups to allow traffic within the VPC. Both tiers are in the same VPC but in different subnets, so traffic stays within the VPC by default if routing is configured correctly. Route tables direct traffic between subnets, and security groups act as virtual firewalls to control inbound and outbound traffic.

Option D is correct. Option A is wrong because an Internet Gateway is used for internet access, not for routing within a VPC. Option B is wrong because VPC Peering connects different VPCs, not subnets within the same VPC.

Option C is wrong because a NAT Gateway is for outbound internet access from private subnets, not for inter-subnet communication.

Full explanation →
118
Multi-Selectmedium

A company is implementing a hybrid network architecture with an AWS Transit Gateway connecting multiple VPCs and an on-premises data center via AWS Direct Connect. The company needs to ensure that traffic between VPCs is inspected by a centralized security appliance running on EC2 instances in a dedicated inspection VPC. To achieve this, traffic must be routed through the inspection VPC before reaching its destination. Which TWO configurations are required? (Choose two.)

Select 2 answers
A.Enable route propagation for all VPC attachments in the Transit Gateway route table.
B.Create a blackhole route in the Transit Gateway route table for the VPC CIDR blocks that are destined for other VPCs.
C.Add a static route in the inspection VPC route tables pointing to the Transit Gateway for all other VPC CIDRs.
D.Configure a VPC Gateway Endpoint for the inspection VPC to attract traffic.
E.Deploy a NAT gateway in each VPC to route traffic through the inspection VPC.
AnswersB, C

Prevents direct routing between VPCs.

Why this answer

To force traffic between VPCs through a centralized inspection VPC, you need to prevent direct communication between VPCs and instead route traffic via the inspection VPC. Option B creates a blackhole route in the Transit Gateway route table for the VPC CIDR blocks destined for other VPCs. This drops traffic that would otherwise be directly forwarded between VPCs, forcing it to go through the inspection VPC.

Option C adds a static route in the inspection VPC's route tables pointing to the Transit Gateway for all other VPC CIDRs. This ensures that traffic entering the inspection VPC is forwarded to the Transit Gateway and then to the destination VPC. Option A is incorrect because enabling route propagation would automatically advertise VPC routes, allowing direct VPC-to-VPC communication.

Option D is incorrect because a VPC Gateway Endpoint is used for private access to AWS services (like S3 or DynamoDB), not for inter-VPC traffic inspection. Option E is incorrect because a NAT gateway is used for outbound internet traffic, not for routing traffic between VPCs.

Full explanation →
119
MCQhard

A company is migrating a legacy on-premises application to AWS. The application requires multicast traffic between instances within a VPC. The network engineer must design a solution that supports multicast without modifying the application. Which AWS service or feature should be used?

A.AWS Transit Gateway with multicast domain.
B.VPC peering connections between all instance subnets.
C.Application Load Balancer with UDP listener.
D.AWS Site-to-Site VPN connections with multicast routing enabled.
AnswerA

Transit Gateway supports multicast domains for forwarding multicast traffic.

Why this answer

AWS Transit Gateway supports multicast through the creation of a multicast domain, which allows multicast traffic to flow between instances in different subnets within the same VPC or across attached VPCs without modifying the application. This is the only native AWS service that provides multicast forwarding, making it the correct choice for this requirement.

Exam trap

The trap here is that candidates often assume VPC peering or VPN can handle multicast because they support general IP routing, but AWS explicitly blocks multicast and broadcast traffic on these connections, making Transit Gateway the only viable option.

How to eliminate wrong answers

Option B is wrong because VPC peering does not support multicast traffic; it only allows unicast traffic between peered VPCs and does not forward broadcast or multicast frames. Option C is wrong because an Application Load Balancer (ALB) operates at Layer 7 and only supports HTTP/HTTPS traffic; it does not have a UDP listener and cannot handle multicast traffic. Option D is wrong because AWS Site-to-Site VPN connections do not support multicast routing; they are designed for unicast IPsec tunnels and cannot forward multicast traffic without additional overlay solutions like GRE tunnels.

Full explanation →
120
MCQeasy

A company wants to securely connect an on-premises data center to an AWS VPC over the internet using IPsec. Which AWS service should be used?

A.AWS Transit Gateway
B.AWS Direct Connect
C.AWS Client VPN
D.AWS Site-to-Site VPN
AnswerD

It creates IPsec tunnels over the internet.

Why this answer

WS Site-to-Site VPN, which creates IPsec tunnels over the internet to securely connect an on-premises data center to an AWS VPC. Option A (AWS Transit Gateway) is a network transit hub that can interconnect multiple VPCs and VPNs, but it is not the VPN service itself. Option B (AWS Direct Connect) provides a dedicated physical connection, not over the internet.

Option C (AWS Client VPN) is for individual remote users, not for site-to-site connections.

Full explanation →
121
MCQeasy

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company has created a NAT gateway in the public subnet and added a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway. However, the EC2 instance cannot reach the internet. The network engineer verifies that the NAT gateway has an Elastic IP address, the security group and network ACLs allow outbound traffic, and the route table for the public subnet has a route to an internet gateway. What is the most likely cause of the issue?

A.The security group for the EC2 instance does not allow outbound traffic.
B.The route table associated with the NAT gateway's subnet does not have a route to an internet gateway.
C.The route table for the private subnet does not have a route to the NAT gateway.
D.The NAT gateway does not have an Elastic IP address assigned.
AnswerC

Correct: If the private subnet's route table does not have a route pointing 0.0.0.0/0 to the NAT gateway, traffic from the EC2 instance cannot reach the NAT gateway. Despite the engineer adding a route, it may not be correctly associated or configured.

Why this answer

The scenario states that a route pointing 0.0.0.0/0 to the NAT gateway was added to the private subnet's route table, but if that route table is not properly associated with the private subnet, or if the route was added but the target is incorrect (e.g., pointing to the wrong NAT gateway ID), the EC2 instance will not be able to send traffic through the NAT gateway. The verification that the route exists might have been insufficient. Option C points out that the route table for the private subnet does not have a route to the NAT gateway, which would directly cause the issue.

The other options are contradicted by the verification steps performed by the engineer.

Exam trap

The engineer verified that the public subnet's route table has a route to the IGW, but the problem might be that the private subnet's route table is missing the route to the NAT gateway, or the route is misconfigured. Always check that the route table associated with the private subnet has a default route pointing to the NAT gateway's ID.

Full explanation →
122
Multi-Selecthard

A company uses AWS Transit Gateway with multiple VPC attachments and a VPN attachment to an on-premises network. The on-premises network advertises the same prefix via two separate VPN connections for redundancy. The TGW route table shows both routes as active. Traffic from a VPC to on-premises is not load-balanced and prefers one connection. Which THREE actions would help achieve active-active load balancing? (Choose 3.)

Select 3 answers
A.Configure BGP AS_PATH prepending on the preferred VPN connection to make it less preferred
B.Enable equal-cost multi-path (ECMP) routing on the Transit Gateway route table
C.Set a higher BGP weight on the less preferred connection
D.Use static routes for both VPN connections instead of BGP
E.Adjust the BGP Multi-Exit Discriminator (MED) attribute on the on-premises routers
AnswersA, B, E

AS_PATH prepending can make one path appear longer.

Why this answer

BGP AS_PATH prepending artificially increases the AS path length for routes advertised over the preferred VPN connection, making them less preferred by BGP's path selection algorithm. This causes the Transit Gateway to prefer the other VPN connection for those prefixes, enabling active-active load balancing when combined with ECMP.

Exam trap

The trap here is that candidates assume BGP weight (a Cisco-proprietary attribute) can be used on AWS Transit Gateway, but AWS only supports standard BGP attributes and does not implement weight, making option C a distractor.

Full explanation →
123
MCQeasy

A company is designing a VPC with public and private subnets for a three-tier web application. The web tier must be accessible from the internet, the application tier must only be accessible from the web tier, and the database tier must only be accessible from the application tier. Which combination of route tables and security groups achieves this?

A.Public subnet route table: 0.0.0.0/0 -> Internet Gateway. Web SG: allow 0.0.0.0/0 on port 443. App SG: allow from Web SG. DB SG: allow from App SG.
B.Public subnet route table: 0.0.0.0/0 -> NAT Gateway. Web SG: allow 0.0.0.0/0 on port 443. App SG: allow from Web SG. DB SG: allow from App SG.
C.Private subnet route table: 0.0.0.0/0 -> Internet Gateway. Web SG: allow 0.0.0.0/0 on port 443. App SG: allow from Web SG. DB SG: allow from App SG.
D.Public subnet route table: 0.0.0.0/0 -> Internet Gateway. Web SG: allow 0.0.0.0/0 on port 443. App SG: allow from Web SG. DB SG: allow from 0.0.0.0/0 on port 3306.
AnswerA

This follows best practices for tiered security and routing.

Why this answer

It uses an Internet Gateway (IGW) in the public subnet route table to enable inbound internet traffic to the web tier, and security groups (SGs) are referenced by logical ID (Web SG, App SG, DB SG) to enforce strict, stateful traffic flow: Web SG allows HTTPS from 0.0.0.0/0, App SG allows traffic only from Web SG, and DB SG allows traffic only from App SG. This layered SG approach ensures that each tier can only be reached from the preceding tier, meeting the access requirements without relying on network ACLs or routing.

Exam trap

AWS often tests the distinction between Internet Gateway and NAT Gateway in route tables, and the trap here is that candidates mistakenly associate a NAT Gateway with inbound internet access or place an IGW route in a private subnet, confusing outbound-only connectivity with inbound public access.

How to eliminate wrong answers

Option B is wrong because it specifies a NAT Gateway in the public subnet route table for 0.0.0.0/0; a NAT Gateway is used for outbound internet access from private subnets, not for inbound internet traffic to a public subnet, so the web tier would not be reachable from the internet. Option C is wrong because it places the 0.0.0.0/0 route to an Internet Gateway in the private subnet route table; private subnets must not have a direct IGW route for inbound internet traffic, as this would expose private resources directly to the internet and break the tier isolation. Option D is wrong because the DB SG allows traffic from 0.0.0.0/0 on port 3306 (MySQL), which would permit any internet host to access the database directly, violating the requirement that the database tier must only be accessible from the application tier.

Full explanation →
124
MCQhard

A company is implementing a hybrid network using AWS Direct Connect and VPN backup. The company has two Direct Connect connections from different providers and a site-to-site VPN as a backup. The company wants to ensure that traffic is always routed through the Direct Connect connections when they are healthy, and only fails over to the VPN if both Direct Connect connections fail. Which BGP configuration should be used on the customer gateway device (CGW) to achieve this?

A.Set a lower BGP Local Preference value for routes received from the VPN connection.
B.Apply a BGP community tag to routes received over the VPN to signal less preference.
C.Set a higher BGP Multi-Exit Discriminator (MED) value for routes advertised over the VPN.
D.Prepend AS_PATH on routes advertised over the Direct Connect connections.
AnswerA

Lower Local Preference makes the VPN routes less preferred, so Direct Connect routes are used when available.

Why this answer

BGP Local Preference is a well-known mandatory attribute used to influence outbound traffic from the AS. By setting a lower Local Preference value for routes received from the VPN connection, the customer gateway device (CGW) will prefer routes learned via Direct Connect (which have a default or higher Local Preference) over those learned via VPN. This ensures traffic is routed through Direct Connect connections when they are healthy, and only fails over to the VPN if both Direct Connect connections fail.

Exam trap

The ANS-C01 exam often tests the confusion between BGP attributes that influence outbound vs. inbound traffic; the trap here is that candidates mistakenly apply MED or AS_PATH prepending (which affect inbound path selection) when the question explicitly asks for controlling outbound traffic from the customer side.

How to eliminate wrong answers

Option B is wrong because BGP community tags are not directly used to influence route preference in a standardized way; they are often used for tagging and filtering, and while some providers may interpret specific communities to adjust preference, this is not a reliable or standard method for controlling outbound traffic preference on the CGW. Option C is wrong because the Multi-Exit Discriminator (MED) is used to influence inbound traffic (how other ASes enter your network), not outbound traffic from your AS; setting a higher MED on routes advertised over the VPN would affect how the AWS side chooses paths, not how the CGW chooses which path to use. Option D is wrong because prepending AS_PATH on routes advertised over Direct Connect would make those routes appear less preferred to external peers (inbound direction), but the goal is to influence the CGW's outbound path selection; AS_PATH prepending does not affect the CGW's own route preference for received routes.

Full explanation →
125
MCQmedium

A company uses AWS CloudWAN to build a global network connecting multiple VPCs and on-premises sites. The network team has configured a core network with a segment that includes VPCs in us-east-1 and eu-west-1. The team notices that traffic between VPCs in different regions is taking a suboptimal path, going through the internet instead of staying within the AWS global network. The team has verified that the core network attachments are correctly configured and that the route tables are propagated. What should the team do to ensure traffic stays within the AWS global network?

A.Establish a VPC peering connection between the two VPCs.
B.Set up an AWS Direct Connect gateway to route traffic between regions.
C.Ensure both VPCs are attached to the same CloudWAN segment.
D.Create a transit gateway in each region and peer them together.
AnswerC

Correct: Same segment ensures traffic stays within CloudWAN and uses AWS global backbone.

Why this answer

CloudWAN uses segments to control routing. If both VPCs are attached to the same segment, traffic between them will use the AWS global network. Option A is wrong because VPC peering creates a direct connection but does not leverage CloudWAN's global backbone and may lead to suboptimal routing.

Option B is wrong because AWS Direct Connect is designed for on-premises connectivity, not inter-region VPC traffic. Option D is wrong because transit gateway peering is unnecessary when using CloudWAN, which already provides inter-region routing via its core network.

Full explanation →
126
Multi-Selectmedium

A network engineer is troubleshooting connectivity issues between two VPCs connected via a Transit Gateway. The VPCs are in the same region and have proper route tables. Which TWO actions should the engineer perform to diagnose the problem?

Select 2 answers
A.Verify that the VPC route tables have routes pointing to the Transit Gateway attachment.
B.Check the security groups of the Transit Gateway.
C.Ping the Transit Gateway to verify its status.
D.Examine the network ACLs for the Transit Gateway.
E.Review VPC Flow Logs for the subnets to see if traffic is being blocked.
AnswersA, E

Missing routes would prevent traffic from reaching the Transit Gateway.

Why this answer

For traffic to flow from a VPC to a Transit Gateway, the VPC's route tables must include a route pointing to the Transit Gateway attachment (e.g., 10.0.0.0/16 -> tgw-xxx). Without this route, the VPC has no path to send traffic into the Transit Gateway, causing connectivity failure regardless of other configurations.

Exam trap

The ANS-C01 exam often tests the misconception that Transit Gateway has its own security groups or NACLs, leading candidates to incorrectly select options B or D, when in fact these constructs only exist at the VPC/subnet level.

Full explanation →
127
MCQmedium

A company has a VPC with multiple subnets. They have an Application Load Balancer (ALB) in a public subnet and a web server fleet in private subnets. The security team wants to ensure that only the ALB can communicate with the web servers. Which security group configuration should be used?

A.Set the web server security group inbound rule to allow traffic from the ALB's security group.
B.Set the web server security group inbound rule to allow traffic from the public subnet CIDR.
C.Set the web server security group inbound rule to allow traffic from the VPC CIDR.
D.Set the web server security group inbound rule to allow traffic from 0.0.0.0/0.
AnswerA

This restricts inbound traffic to only the ALB.

Why this answer

Referencing the ALB's security group as the source allows only traffic from instances or resources associated with that security group, strictly limiting access to the web servers. This follows the principle of least privilege. Option B is wrong because allowing traffic from the public subnet CIDR is too broad and would permit any instance in that subnet, not just the ALB.

Option C is wrong because allowing traffic from the VPC CIDR permits any resource in the VPC, which is overly permissive. Option D is wrong because allowing traffic from 0.0.0.0/0 exposes the web servers to the internet.

Exam trap

A common pitfall is using source CIDR blocks (e.g., subnet or VPC CIDR) instead of security group IDs, which grants broader access than intended.

Full explanation →
128
MCQeasy

A security engineer is troubleshooting why an EC2 instance cannot communicate with the internet. The instance is in a private subnet with a route table that has a default route (0.0.0.0/0) pointing to a NAT gateway. The security group for the instance allows all outbound traffic. What should the engineer check NEXT?

A.Verify that the security group inbound rules allow return traffic
B.Verify that the NAT gateway has an Elastic IP
C.Check the network ACL associated with the private subnet
D.Enable VPC Flow Logs to analyze traffic
AnswerC

Network ACLs are stateless and must allow inbound ephemeral ports for return traffic.

Why this answer

Network ACLs are stateless and must allow both inbound and outbound traffic for the response. Option A is wrong because security group already allows outbound. Option B is wrong because the route is configured.

Option D is wrong because flow logs are for analysis, not a next step in troubleshooting connectivity.

Full explanation →
129
MCQeasy

A company is using AWS Direct Connect to connect to its VPC. The network team wants to encrypt all traffic between the on-premises data center and the VPC. Which solution provides encryption?

A.Enable MACsec on the Direct Connect connection.
B.Use an IPsec VPN over the Direct Connect virtual interface.
C.Use AWS Client VPN to connect on-premises to VPC.
D.Enable encryption on the Direct Connect virtual interface.
AnswerB

IPsec VPN over Direct Connect provides an encrypted tunnel for all traffic, ensuring end-to-end encryption between on-premises and VPC.

Why this answer

IPsec VPN over Direct Connect provides encryption for all traffic between on-premises and VPC. Direct Connect itself does not encrypt traffic. MACsec is supported on dedicated Direct Connect connections and provides Layer 2 encryption, but it only encrypts the link between the customer device and AWS, not end-to-end traffic.

AWS Client VPN is for individual clients, not site-to-site. Direct Connect virtual interfaces do not support native encryption. Therefore, the correct solution is to use an IPsec VPN over the Direct Connect virtual interface.

Full explanation →
130
MCQmedium

A network engineer is troubleshooting an AWS Lambda function that needs to create and manage ENIs in a VPC. The Lambda function is unable to create ENIs. The IAM policy attached to the Lambda execution role is shown in the exhibit. What is the issue?

A.The policy restricts the resource to a specific VPC.
B.The policy does not allow the ec2:CreateNetworkInterface action.
C.The policy does not allow the ec2:DeleteNetworkInterface action.
D.The policy is missing the ec2:AttachNetworkInterface action.
AnswerD

Lambda also needs ec2:AttachNetworkInterface to attach the ENI.

Why this answer

The policy includes permissions for ec2:CreateNetworkInterface, ec2:DescribeNetworkInterfaces, and ec2:DeleteNetworkInterface, but it is missing ec2:AttachNetworkInterface. Without this action, the Lambda function cannot attach an ENI to the VPC, which is necessary for Lambda to manage ENIs. Option A is incorrect because the resource restriction in the policy is not the issue; the actions are allowed on any resource.

Option B is incorrect because the policy does include ec2:CreateNetworkInterface. Option C is incorrect because it states the policy does not allow ec2:DeleteNetworkInterface, but it does.

Full explanation →
131
MCQeasy

A company is migrating a legacy application to AWS. The application requires multicast traffic between EC2 instances. Which AWS service can support multicast within a VPC?

A.VPC native multicast
B.Amazon CloudFront
C.Application Load Balancer
D.Transit Gateway with multicast domain
AnswerD

Transit Gateway supports multicast.

Why this answer

AWS Transit Gateway supports multicast traffic through the creation of a multicast domain, which allows EC2 instances in different VPCs or subnets to send and receive multicast traffic. This is the only native AWS service that supports multicast within a VPC environment, making it the correct choice for migrating a legacy application that requires multicast.

Exam trap

The trap here is that candidates may assume 'VPC native multicast' exists because of the term 'native' or confuse multicast with broadcast or unicast features, but AWS VPC does not support multicast natively, and Transit Gateway is the required service.

How to eliminate wrong answers

Option A is wrong because AWS VPC does not natively support multicast traffic; multicast is not a feature of standard VPCs. Option B is wrong because Amazon CloudFront is a content delivery network (CDN) that delivers content over HTTP/HTTPS and does not support multicast IP traffic between EC2 instances. Option C is wrong because an Application Load Balancer operates at Layer 7 and handles unicast HTTP/HTTPS traffic; it cannot forward or replicate multicast packets.

Full explanation →
132
MCQeasy

A company is building a serverless application using API Gateway, Lambda, and DynamoDB. The API must be accessible from the internet and be resilient to Regional failures. Which design provides the HIGHEST availability?

A.Deploy in two Regions with API Gateway, Lambda, and DynamoDB global tables. Use Route 53 failover routing with health checks.
B.Deploy API Gateway, Lambda, and DynamoDB in a single Region with multi-AZ.
C.Deploy API Gateway in two Regions behind a Global Accelerator accelerator.
D.Use a single API Gateway with CloudFront distribution in front, and Lambda@Edge for compute.
AnswerA

Active-passive failover across regions provides highest availability.

Why this answer

It combines multi-Region deployment with Route 53 failover routing and health checks, ensuring that if one Region becomes unavailable, traffic is automatically redirected to the healthy Region. API Gateway, Lambda, and DynamoDB global tables provide the necessary cross-Region replication and stateless compute to maintain full functionality during a Regional outage, offering the highest availability.

Exam trap

The ANS-C01 exam often tests the misconception that multi-AZ within a single Region is sufficient for Regional disaster recovery, but the trap here is that multi-AZ only protects against Availability Zone failures, not complete Regional outages.

How to eliminate wrong answers

Option B is wrong because deploying in a single Region, even with multi-AZ, does not protect against a Regional failure—if the entire Region goes down, the application becomes unavailable. Option C is wrong because Global Accelerator alone does not provide active-passive failover with health checks for Regional failures; it primarily improves performance and provides static IP addresses but requires additional routing logic (e.g., cross-Region load balancing) to achieve high availability across Regions. Option D is wrong because using CloudFront and Lambda@Edge still relies on a single Regional API Gateway and DynamoDB instance; Lambda@Edge runs at edge locations but does not replicate the backend database or API Gateway across Regions, so a Regional failure would still break the application.

Full explanation →
133
MCQeasy

A network engineer is troubleshooting high latency between two EC2 instances in the same VPC but different Availability Zones. Which AWS service can provide detailed network performance metrics to identify the source of latency?

A.AWS Config
B.AWS CloudTrail
C.AWS X-Ray
D.VPC Flow Logs
AnswerC

X-Ray traces requests and shows latency between components.

Why this answer

Correct answer: C. AWS X-Ray provides end-to-end tracing and can capture network latency between services, including EC2 instances. It can help identify where delays occur.

Option A (AWS Config) is incorrect because it monitors configuration changes, not performance. Option B (AWS CloudTrail) is incorrect because it records API calls for auditing, not network metrics. Option D (VPC Flow Logs) is incorrect because it captures IP traffic metadata (packet-level) but does not provide latency or performance metrics.

Full explanation →
134
Multi-Selecteasy

A company wants to securely store database credentials and automatically rotate them every 90 days. Which TWO AWS services can work together to achieve this? (Choose TWO.)

Select 2 answers
A.AWS Secrets Manager
B.AWS CloudHSM
C.AWS Key Management Service (KMS)
D.AWS Lambda
E.AWS Systems Manager Parameter Store
AnswersA, D

Secrets Manager stores secrets and has built-in rotation.

Full explanation →
135
MCQeasy

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. They need to add IPv6 support for their application. What is the simplest way to enable IPv6 communication for instances in the VPC?

A.Assign an Amazon-provided IPv6 CIDR block to the VPC and subnets, and create an Egress-Only Internet Gateway for outbound traffic.
B.Create a VPN connection to an external IPv6 network.
C.Configure a NAT Gateway in a public subnet and assign IPv6 addresses to instances.
D.Use an Internet Gateway with NAT for IPv6 traffic.
AnswerA

Correct: Standard IPv6 enablement.

Why this answer

The simplest way to enable IPv6 communication in a VPC is to associate an Amazon-provided IPv6 CIDR block (a /56 from the 2002::/25 range) to the VPC and its subnets, then create an Egress-Only Internet Gateway (EIGW) for outbound-only IPv6 traffic. This allows instances with IPv6 addresses to initiate outbound connections to the internet while preventing inbound connections, which is the default security model for IPv6 in AWS.

Exam trap

The trap here is that candidates often confuse the Internet Gateway (which supports both IPv4 and IPv6) with the need for a NAT-like device for IPv6, not realizing that IPv6 does not use NAT and that an Egress-Only Internet Gateway is the correct AWS service for outbound-only IPv6 access.

How to eliminate wrong answers

Option B is wrong because a VPN connection to an external IPv6 network is overly complex and not the simplest method; it requires on-premises infrastructure and does not natively enable IPv6 within the VPC. Option C is wrong because a NAT Gateway is designed for IPv4 traffic only and cannot translate or route IPv6 traffic; assigning IPv6 addresses to instances alone does not provide internet connectivity without a proper gateway. Option D is wrong because an Internet Gateway (IGW) supports both IPv4 and IPv6 traffic, but using NAT for IPv6 is incorrect—NAT is not used for IPv6; instead, an Egress-Only Internet Gateway is the correct component for outbound-only IPv6 access.

Full explanation →
136
Multi-Selecthard

Which THREE components are necessary to enable encryption in transit for traffic between an on-premises data center and an Amazon VPC over AWS Site-to-Site VPN? (Choose three.)

Select 3 answers
A.A customer gateway (CGW) in the on-premises network
B.An internet gateway (IGW) attached to the VPC
C.An SSL/TLS certificate for the VPN tunnel
D.A virtual private gateway (VGW) in the VPC
E.An IPsec VPN tunnel between the VGW and CGW
AnswersA, D, E

Represents the on-premises VPN device.

Why this answer

The correct answers are A, D, and E. A customer gateway (CGW) represents the on-premises device, a virtual private gateway (VGW) is the AWS endpoint, and an IPsec VPN tunnel between them provides encryption in transit. Option B is wrong because an internet gateway is used for internet connectivity, not VPN.

Option C is wrong because SSL/TLS is not used for Site-to-Site VPN; it uses IPsec with pre-shared keys or certificates.

Full explanation →
137
MCQhard

A company uses AWS Direct Connect with a private VIF to connect to a VPC. They also have a VPN connection as a backup. How should they configure BGP to ensure that the VPN is only used when Direct Connect fails?

A.Use a lower local preference on the Direct Connect BGP session
B.Use a lower AS path prepend on the VPN BGP session
C.Use a higher local preference on the Direct Connect BGP session
D.Use a higher MED on the VPN BGP session
AnswerC

Higher local preference makes the Direct Connect route preferred.

Why this answer

Local preference is a BGP attribute used to influence outbound traffic from an AS. By setting a higher local preference on the Direct Connect BGP session, the router will prefer that path over the VPN session. When Direct Connect fails, the BGP session goes down, and the VPN route becomes the only available path, ensuring seamless failover.

Exam trap

The trap here is that candidates often confuse local preference (influences outbound path selection) with MED (influences inbound path selection) or AS path prepending (also influences inbound selection), leading them to choose options that would not achieve the desired primary/backup behavior for outbound traffic.

How to eliminate wrong answers

Option A is wrong because a lower local preference on the Direct Connect session would make it less preferred, causing the VPN to be used as the primary path, which contradicts the requirement. Option B is wrong because AS path prepending on the VPN session would make the VPN path less preferred (longer AS path), but the goal is to prefer Direct Connect; prepending on the VPN is unnecessary and could cause suboptimal routing if Direct Connect fails. Option D is wrong because MED (Multi-Exit Discriminator) is used to influence inbound traffic from a neighboring AS, not outbound traffic from the local AS; it does not affect which path the local router chooses for outbound traffic.

Full explanation →
138
MCQeasy

A company wants to audit all changes to security group rules in a VPC. Which AWS service should be used to record these changes?

A.AWS CloudTrail
B.AWS Config
C.VPC Flow Logs
D.Amazon CloudWatch
AnswerA

CloudTrail records API calls for auditing.

Why this answer

AWS CloudTrail records API calls made to the AWS environment, including calls to modify security group rules (such as AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress, etc.). This provides a detailed audit trail of who made the change, when, and from where. AWS Config can record resource configuration changes and can provide a history of security group rule changes, but it is not the primary service for auditing API calls; it focuses on configuration compliance and resource relationships.

VPC Flow Logs capture metadata about network traffic, not configuration changes. CloudWatch monitors performance metrics and logs. Therefore, CloudTrail is the correct answer.

Full explanation →
139
MCQmedium

A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application experiences intermittent timeouts during peak hours. The network team suspects that the security group or network ACL is misconfigured. They enable VPC Flow Logs and notice that outbound traffic from the ALB to the EC2 instances on port 8080 shows 'ACCEPT' records, but the ALB returns 504 errors. The ALB health check is configured to hit the EC2 instances on port 8080/health. What is the most likely cause of the 504 errors?

A.The network ACL for the private subnet is blocking inbound traffic from the ALB.
B.The security group for the EC2 instances is missing an outbound rule to allow traffic from the ALB.
C.The health check path is incorrectly configured, causing the ALB to mark all targets as unhealthy.
D.The ALB idle timeout is set too low, and the application takes longer to respond.
AnswerD

ALB idle timeout default is 60 seconds; if app response exceeds that, 504 occurs.

Why this answer

The ALB idle timeout is set too low. When the application takes longer than the idle timeout to respond, the ALB terminates the connection and returns a 504 error. Flow logs show ACCEPT for traffic from ALB to EC2 on port 8080, indicating no network ACL or security group blocking.

Option A is incorrect because a blocking NACL would show REJECT records. Option B is incorrect because security groups are stateful; outbound rules on the EC2 instance are not needed for returning traffic to the ALB. Option C is incorrect because a misconfigured health check path would cause the ALB to mark targets as unhealthy, leading to 503 errors rather than intermittent 504s.

Full explanation →
140
MCQhard

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. The company wants to use the same Direct Connect connection to access multiple VPCs in the same AWS Region. Which solution should the company implement?

A.Use a public virtual interface and route traffic through the internet.
B.Create a transit virtual interface on the Direct Connect connection and associate it with a Direct Connect gateway.
C.Request a hosted virtual interface from an AWS Direct Connect partner.
D.Create additional private virtual interfaces for each VPC.
AnswerB

Transit VIF enables connectivity to multiple VPCs via Transit Gateway.

Why this answer

A transit virtual interface (VIF) on a Direct Connect connection can be associated with a Direct Connect gateway, which enables connectivity to multiple VPCs in the same AWS Region. The Direct Connect gateway acts as a hub, allowing the single physical connection to route traffic to multiple VPCs via the transit VIF, without needing separate private VIFs for each VPC.

Exam trap

The trap here is that candidates often assume you need a separate private virtual interface for each VPC, not realizing that a Direct Connect gateway with a transit VIF can aggregate multiple VPCs under a single physical connection, which is a key design pattern tested in the ANS-C01 exam.

How to eliminate wrong answers

Option A is wrong because a public virtual interface is used for accessing public AWS services (e.g., S3, DynamoDB) and routes traffic over the internet, not for private connectivity to VPCs; it does not provide secure, private access to multiple VPCs. Option C is wrong because a hosted virtual interface is provisioned by an AWS Direct Connect partner for a customer to connect to a single VPC or Direct Connect gateway, but it does not inherently solve the requirement of using the same Direct Connect connection to access multiple VPCs; it is typically used when the customer does not own the physical connection. Option D is wrong because creating additional private virtual interfaces for each VPC would require separate VLANs and BGP sessions, but a single Direct Connect connection can support only one private VIF per VPC (or per Direct Connect gateway) and cannot directly attach to multiple VPCs without a Direct Connect gateway; this approach would also exceed the maximum number of private VIFs per connection (typically 50) and is less scalable.

Full explanation →
141
MCQhard

A company has a VPC with a CIDR block of 10.0.0.0/16. They have an AWS Site-to-Site VPN connection to an on-premises network with a CIDR of 192.168.0.0/16. The VPN is configured with dynamic routing (BGP). The on-premises network advertises a route to 192.168.0.0/16 via BGP. The VPC route table has a static route to 192.168.0.0/16 pointing to a virtual private gateway. The company also has a Direct Connect connection to the same on-premises network advertising the same CIDR. The VPC route table has a propagated route to 192.168.0.0/16 pointing to a Direct Connect virtual interface, learned via BGP. Which route will be used for traffic destined to 192.168.0.0/16?

A.Traffic will use the VPN connection because the static route to the virtual private gateway takes precedence over the propagated route from Direct Connect.
B.Traffic will use the VPN connection because the static route to the virtual private gateway has a lower prefix.
C.Traffic will use the Direct Connect connection because it is a more reliable connection.
D.Traffic will be load-balanced between VPN and Direct Connect.
AnswerA

In AWS route tables, static routes have a higher priority than propagated routes. Therefore, the static route to the VPN wins.

Why this answer

In AWS, when a VPC route table has both a static route and a propagated route (learned via BGP) for the same destination, the static route takes precedence regardless of the gateway type. In this scenario, the VPN route is a static route pointing to the virtual private gateway, while the Direct Connect route is a propagated route automatically added via BGP from the Direct Connect virtual interface. Therefore, the static route to the VPN gateway is used.

Note that AWS does not allow two static routes with the same destination in the same route table; thus the Direct Connect route must be propagated.

Full explanation →
142
MCQmedium

A company is designing a multi-Region Active-Active architecture with an Application Load Balancer (ALB) in us-east-1 and us-west-2. They want to route users to the nearest healthy endpoint using a custom domain name. Which AWS service should they use to accomplish this with the lowest latency and minimal operational overhead?

A.Use Amazon Route 53 latency-based routing with health checks.
B.Use Amazon Route 53 geolocation routing policy.
C.Use AWS Global Accelerator with endpoint groups in each region.
D.Use Amazon Route 53 weighted routing policy.
AnswerA

Latency-based routing directs traffic to the region with the lowest latency, and health checks ensure availability.

Why this answer

Amazon Route 53 latency-based routing directs user traffic to the AWS region that provides the lowest latency for the end user, based on latency measurements between DNS resolvers and AWS endpoints. Combined with health checks, it automatically routes users away from unhealthy ALBs, meeting the requirement for nearest healthy endpoint with minimal operational overhead since it is a fully managed DNS service with no additional infrastructure to deploy.

Exam trap

AWS often tests the distinction between latency-based routing (which optimizes for actual network performance) and geolocation routing (which optimizes for geographic compliance or content localization), leading candidates to confuse the two when the requirement is 'nearest healthy endpoint' rather than 'route by location.'

How to eliminate wrong answers

Option B is wrong because geolocation routing routes traffic based on the geographic location of the user's IP address, not the lowest latency, which can result in suboptimal routing if the nearest region is not the user's geographic region (e.g., a user in Europe might be routed to us-east-1 instead of a closer region). Option C is wrong because AWS Global Accelerator, while providing low latency via Anycast IPs and endpoint groups, introduces additional operational overhead (managing accelerator, listeners, endpoint groups) and cost compared to Route 53 latency-based routing, which is simpler for this ALB-only scenario. Option D is wrong because weighted routing distributes traffic based on assigned weights, not latency or health, so it cannot dynamically route users to the nearest healthy endpoint.

Full explanation →
143
MCQmedium

A company has a VPC with public and private subnets. The public subnet hosts a NAT gateway. The private subnet hosts EC2 instances that need to download patches from the internet. The EC2 instances have a security group that allows outbound HTTPS to 0.0.0.0/0. What additional configuration is required?

A.Attach an internet gateway to the private subnet.
B.Move the NAT gateway to the private subnet.
C.Add a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway.
D.Create a VPC endpoint for S3.
AnswerC

This directs internet traffic through the NAT gateway.

Why this answer

EC2 instances in a private subnet need a route in their route table that directs internet traffic (0.0.0.0/0) to the NAT gateway to access the internet for patch downloads. Option A is incorrect because an internet gateway is attached to the VPC, not a subnet, and private subnets should not have direct internet access. Option B is incorrect because the NAT gateway must be in a public subnet to have internet access via the internet gateway.

Option D is incorrect because a VPC endpoint for S3 is used for private connectivity to S3, not for general internet access.

Full explanation →
144
MCQmedium

Refer to the exhibit. A route table shows routes for a VPC. What is the correct interpretation of this route table?

A.The VPC has CIDR 10.0.0.0/16, an internet gateway, and a VPC peering connection to a VPC with CIDR 192.168.0.0/16
B.The VPC has CIDR 10.0.0.0/16, a NAT gateway, and a VPN connection to 192.168.0.0/16
C.The VPC has CIDR 192.168.0.0/16, an internet gateway, and a VPC peering connection to 10.0.0.0/16
D.The VPC has CIDR 10.0.0.0/16, a virtual private gateway, and a peering connection
AnswerA

Local route indicates VPC CIDR, default route to IGW, and peering route to peer CIDR.

Why this answer

The route table shows a local route for 10.0.0.0/16, which is the VPC's CIDR, a default route (0.0.0.0/0) pointing to an internet gateway (igw-xxx), and a specific route for 192.168.0.0/16 pointing to a VPC peering connection (pcx-xxx). This configuration allows traffic destined for the peered VPC's CIDR to be routed over the peering connection, while all other internet-bound traffic goes through the internet gateway.

Exam trap

AWS often tests the distinction between internet gateway, NAT gateway, and virtual private gateway in route table entries, and the trap here is confusing the target of the default route (0.0.0.0/0) with the type of gateway used for internet access versus VPN or peering connections.

How to eliminate wrong answers

Option B is wrong because the default route points to an internet gateway, not a NAT gateway; a NAT gateway would be used for outbound-only internet access from private subnets, and the route to 192.168.0.0/16 points to a VPC peering connection, not a VPN connection. Option C is wrong because the VPC's CIDR is 10.0.0.0/16 (as indicated by the local route), not 192.168.0.0/16, and the peering connection is to a VPC with CIDR 192.168.0.0/16, not the other way around. Option D is wrong because the default route points to an internet gateway, not a virtual private gateway, and the route to 192.168.0.0/16 points to a VPC peering connection, not a peering connection to an unspecified target.

Full explanation →
145
MCQmedium

A network engineer is troubleshooting an issue where an EC2 instance launched in VPC vpc-0abcd1234efgh5678 cannot resolve DNS names for other instances using their private DNS names. The VPC has DHCP options set with domain-name-servers=AmazonProvidedDNS. What is the most likely cause?

A.The VPC attribute 'enableDnsHostnames' is set to false
B.VPC Flow Logs are not enabled
C.The security group on the instances blocks DNS traffic
D.The DHCP options set is not using AmazonProvidedDNS
AnswerA

Without hostnames, instances cannot resolve private DNS names.

Why this answer

For an EC2 instance to resolve private DNS names using the Amazon-provided DNS server, the VPC must have both enableDnsSupport and enableDnsHostnames set to true. The DHCP options are correctly set to AmazonProvidedDNS, so the most likely cause is that enableDnsHostnames is false. Option B is incorrect because VPC Flow Logs are used for monitoring network traffic, not DNS resolution.

Option C is incorrect because security groups by default allow all outbound traffic, and DNS traffic (UDP/53) is not blocked unless explicitly denied. Option D is incorrect because the DHCP options are already set to AmazonProvidedDNS as stated in the stem.

Full explanation →
146
MCQhard

Refer to the exhibit. An EC2 instance in a VPC is assigned a public IP via an Elastic IP address. The instance is not reachable from the internet, although it has a security group allowing inbound HTTP traffic from 0.0.0.0/0. The VPC has an Internet Gateway attached to the route table of the subnet. What is the MOST likely cause?

A.The subnet route table does not have a default route (0.0.0.0/0) to the Internet Gateway
B.The source/destination check is enabled and should be disabled
C.The security group is blocking inbound traffic
D.The Elastic IP is not correctly associated with the instance
AnswerA

For an instance with a public Elastic IP to be reachable from the internet, the subnet’s route table must contain a default route (0.0.0.0/0) pointing to the Internet Gateway. Without this route, outbound traffic from the instance cannot reach the internet, and inbound response traffic cannot return, even though the security group permits HTTP from 0.0.0.0/0 and the Internet Gateway is attached.

Why this answer

The most likely cause is that the subnet's route table lacks a default route (0.0.0.0/0) pointing to the Internet Gateway (IGW). Without this route, traffic destined for the internet from the instance has no path to the IGW, and return traffic from the internet cannot reach the instance. Even with a public Elastic IP and a permissive security group, the VPC's routing logic prevents internet-bound packets from being forwarded to the IGW.

Exam trap

The ANS-C01 exam often tests the misconception that a public IP and a permissive security group alone guarantee internet connectivity, ignoring the critical requirement of a default route to the Internet Gateway in the subnet's route table.

How to eliminate wrong answers

Option B is wrong because the source/destination check is relevant for NAT or routing instances, not for a standard EC2 instance that is the source or destination of its own traffic; disabling it is unnecessary for internet reachability. Option C is wrong because the security group explicitly allows inbound HTTP traffic from 0.0.0.0/0, so it is not blocking the traffic. Option D is wrong because if the Elastic IP were not correctly associated, the instance would not have a public IP at all, but the question states it is assigned an Elastic IP, and the issue is routing, not association.

Full explanation →
147
MCQeasy

A company needs to connect multiple VPCs to a common on-premises network through a single AWS Direct Connect connection. Which AWS service should be used to simplify this architecture?

A.AWS VPN CloudHub
B.AWS Transit Gateway
C.VPC peering
D.Virtual Private Gateway (VGW)
AnswerB

Acts as a hub for VPCs and on-premises networks.

Why this answer

AWS Transit Gateway acts as a central hub to interconnect multiple VPCs and on-premises networks through a single Direct Connect connection. It simplifies the architecture by replacing complex mesh or star topologies with a single gateway that manages routing and attachments, reducing operational overhead and cost.

Exam trap

The trap here is that candidates often confuse the Virtual Private Gateway (VGW) as a multi-VPC solution, not realizing it is per-VPC and lacks transitive routing, while Transit Gateway is the correct service for hub-and-spoke connectivity with a single Direct Connect.

How to eliminate wrong answers

Option A is wrong because AWS VPN CloudHub is designed for connecting multiple remote sites (e.g., branch offices) over IPsec VPNs, not for interconnecting VPCs or leveraging a single Direct Connect link. Option C is wrong because VPC peering creates point-to-point connections between VPCs and does not support transitive routing or a single Direct Connect attachment, requiring a full mesh for multiple VPCs. Option D is wrong because a Virtual Private Gateway (VGW) is a single-VPC attachment point for Direct Connect or VPN; it cannot be shared across multiple VPCs without additional complex routing and does not provide a hub-and-spoke architecture.

Full explanation →
148
MCQhard

A company has multiple VPCs connected via AWS Transit Gateway. One VPC contains a shared services endpoint (e.g., Amazon S3) using a VPC Gateway Endpoint. How can other VPCs access this endpoint?

A.Create Gateway Endpoints in each VPC that needs access
B.Use AWS PrivateLink to access the S3 endpoint
C.Configure Direct Connect to access the endpoint
D.Create a route in Transit Gateway pointing to the endpoint
AnswerA

Each VPC must have its own Gateway Endpoint for S3.

Why this answer

A VPC Gateway Endpoint is a regional service that uses route table entries to direct traffic to AWS services like S3 or DynamoDB without leaving the AWS network. Since Gateway Endpoints are not transitive across VPCs, each VPC that needs to access the shared S3 endpoint must have its own Gateway Endpoint created in that VPC, with the appropriate route table entries pointing to the endpoint. The Transit Gateway does not propagate Gateway Endpoint routes, so other VPCs cannot reach the endpoint through the Transit Gateway alone.

Exam trap

The trap here is that candidates assume Transit Gateway can route traffic to a Gateway Endpoint in another VPC, but Gateway Endpoints are not transitive and cannot be used as a target in Transit Gateway route tables, requiring each VPC to have its own endpoint.

How to eliminate wrong answers

Option B is wrong because AWS PrivateLink (powered by Network Load Balancers and interface endpoints) is used for accessing services via private IP addresses, but S3 does not support interface endpoints in all regions and Gateway Endpoints are the native, cost-free method for S3 access; PrivateLink would add unnecessary complexity and cost. Option C is wrong because Direct Connect is a dedicated network connection from on-premises to AWS, not a mechanism to share a VPC Gateway Endpoint between VPCs; it does not solve the transitive access problem across VPCs. Option D is wrong because Transit Gateway route tables cannot have a route pointing to a Gateway Endpoint—Gateway Endpoints are not a routable target in Transit Gateway route tables; they are only associated with VPC route tables via prefix lists.

Full explanation →
149
Multi-Selectmedium

A company is designing a multi-tier application in a VPC. The web tier must be accessible from the internet, while the application tier must only be accessible from the web tier. The database tier must be isolated from all other tiers except the application tier. Which TWO network architectures meet these requirements? (Choose TWO.)

Select 2 answers
A.Use a single public subnet for all tiers and control access with security groups.
B.Use private subnets for all tiers and a NAT gateway for internet access from the web tier. Use security groups to control traffic.
C.Use a public subnet for an Application Load Balancer and private subnets for web, app, and database tiers. Use security groups to restrict traffic between tiers.
D.Use a VPN connection from the on-premises network to access all tiers.
E.Use public subnets for the web tier, private subnets for the application tier, and isolated subnets (no route to internet) for the database tier. Use security groups to allow traffic only from the web to app and app to database.
AnswersC, E

The ALB in public subnet provides inbound access; private subnets isolate tiers.

Why this answer

It places the Application Load Balancer in a public subnet to receive internet traffic, while the web, app, and database tiers reside in private subnets. Security groups are used to restrict traffic flows: the ALB security group allows inbound HTTP/HTTPS from the internet, the web tier security group allows inbound only from the ALB, the app tier security group allows inbound only from the web tier, and the database tier security group allows inbound only from the app tier. This ensures the application tier is only accessible from the web tier, and the database tier is isolated except from the application tier.

Exam trap

The ANS-C01 exam often tests the misconception that placing all tiers in private subnets with a NAT gateway can provide inbound internet access, but a NAT gateway only supports outbound-initiated traffic and cannot accept inbound connections from the internet.

Full explanation →
150
MCQeasy

A company is deploying a VPC with both public and private subnets. They have an EC2 instance in a private subnet that needs to access the internet for software updates. Which AWS service should be placed in a public subnet to enable this?

A.Internet gateway
B.VPC endpoint
C.Direct Connect virtual interface
D.NAT gateway
AnswerD

A NAT gateway in a public subnet enables outbound internet access for instances in private subnets.

Why this answer

A NAT gateway is correct because it enables EC2 instances in a private subnet to initiate outbound connections to the internet (e.g., for software updates) while preventing the internet from initiating inbound connections to those instances. The NAT gateway must be placed in a public subnet with an associated Internet Gateway to translate private IP addresses to the public IP of the NAT gateway for outbound traffic.

Exam trap

The ANS-C01 exam often tests the misconception that an Internet Gateway can be 'placed' in a subnet or that it directly provides outbound-only access for private instances, but the key trap is that an Internet Gateway alone cannot perform source NAT—it requires a NAT device (gateway or instance) in a public subnet to enable private instances to reach the internet.

How to eliminate wrong answers

Option A is wrong because an Internet Gateway (IGW) is a horizontally scaled, redundant component that allows communication between a VPC and the internet, but it must be attached to a public subnet's route table; placing an IGW in a subnet is not possible—it is a VPC-level resource, not a subnet resource, and it does not provide outbound-only translation for private instances. Option B is wrong because a VPC endpoint (e.g., Gateway or Interface endpoint) provides private connectivity to AWS services (like S3 or DynamoDB) without traversing the internet, but it cannot be used to reach general internet destinations for software updates. Option C is wrong because a Direct Connect virtual interface establishes a dedicated private network connection from on-premises to AWS, not internet access; it is used for hybrid connectivity, not for enabling internet-bound traffic from a private subnet.

Full explanation →
Page 1

Page 2 of 22

Page 3

All pages

12345678910111213141516171819202122

Practice ANS-C01 by domain

Target a specific domain to shore up weak areas.

Network Management and OperationsNetwork Security, Compliance and GovernanceNetwork DesignNetwork Implementation
See all domains with question counts →