Knowledge + Practice

AWS Certified Advanced Networking Specialty ANS-C01 (ANS-C01) — Questions 1426–1500

1621 questions total · 22pages · All types, answers revealed

Take a mock exam Exam hub

Page 20 of 22

1426

MCQhard

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The network team notices that the BGP session between the on-premises router and the AWS virtual private gateway (VGW) is flapping. The on-premises router is configured to advertise a specific prefix. Which configuration change is MOST likely to stabilize the BGP session?

A.Add ASN prepending to the advertised prefix.

B.Adjust BGP timers (keepalive and hold time) to match between the on-premises router and the VGW.

C.Enable BGP MD5 authentication on both sides.

D.Apply a route-map on the VGW to filter the prefix.

AnswerB

Mismatched timers can cause flapping.

Why this answer

BGP timers mismatch (keepalive and hold time) can cause frequent session resets (flapping). Adjusting them to match between the on-premises router and the VGW stabilizes the session. Option A is incorrect because ASN prepending influences route preference, not session stability.

Option C is incorrect because MD5 authentication is for security, not flapping. Option D is incorrect because VGW does not support route-maps for filtering prefixes (route filtering can be done via allowed prefixes but not route-maps).

Full explanation →

1427

MCQeasy

A company hosts a web application on EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The security team wants to block a list of known malicious IP addresses from accessing the application. They have already created an AWS WAF web ACL and associated it with the ALB. What is the MOST efficient way to block the IP addresses?

A.Place a CloudFront distribution in front of the ALB and use CloudFront's geo-restriction feature.

B.Add an AWS WAF rule to the web ACL that uses the 'IP reputation lists' managed rule group to block malicious IPs.

C.Configure a network ACL on the ALB's subnet to deny inbound traffic from each malicious IP.

D.Add each IP address as an inbound deny rule in the security group of the ALB.

AnswerB

Correct: Managed rule group automatically blocks known malicious IPs.

Why this answer

AWS WAF's managed rule group 'IP reputation lists' automatically blocks known malicious IPs from threat intelligence feeds, providing efficient protection without manual updates. Option A is wrong: CloudFront geo-restriction blocks traffic by geographic location, not specific IP addresses, and adds unnecessary complexity. Option C is wrong: Network ACLs are stateless and operate at the subnet level, not the application layer; managing a large IP list in NACL rules is not scalable.

Option D is wrong: Security groups are stateful but are not designed for large IP blocklists, and ALB does not use security group rules for incoming traffic at the application layer.

Full explanation →

1428

MCQeasy

A network engineer is troubleshooting connectivity from an on-premises network to an EC2 instance in a VPC via a Site-to-Site VPN. The VPN tunnel is up, but the engineer cannot ping the EC2 instance's private IP. What should the engineer check first?

A.The VPN connection status in the AWS console.

B.Security group inbound rules for ICMP on the EC2 instance.

C.IKE version mismatch between the VPN endpoints.

D.Route propagation and route tables in the VPC and on-premises.

AnswerD

Missing routes are a common cause.

Why this answer

The VPN tunnel being up indicates the IPsec/IKE negotiation succeeded, but reachability to the EC2 instance requires proper routing. The most common cause of ping failure when the tunnel is up is missing or incorrect route propagation from the VPN to the VPC route tables, or missing static routes on the on-premises side pointing to the VPN gateway. Without correct routes, traffic from the on-premises network cannot reach the VPC subnets, and return traffic from the EC2 instance cannot reach the on-premises network.

Exam trap

The trap here is that candidates assume a UP tunnel guarantees connectivity, but the tunnel state only confirms Layer 3 encryption is established, not that routing or security group rules allow traffic to flow.

How to eliminate wrong answers

Option A is wrong because the VPN connection status in the AWS console only shows the tunnel state (UP/DOWN), which is already confirmed as UP; checking it again provides no new information about routing or security. Option B is wrong because while security group inbound rules for ICMP could block ping, the question asks what to check first; routing is a prerequisite for any traffic to reach the EC2 instance, so checking security groups before routing is premature. Option C is wrong because an IKE version mismatch would prevent the VPN tunnel from coming up entirely, but the tunnel is already UP, so this cannot be the cause of the connectivity issue.

Full explanation →

1429

Multi-Selectmedium

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team notices that VPC A cannot communicate with VPC B, while all other VPCs communicate normally. The transit gateway route table shows routes from both VPCs. Which TWO actions should the network engineer take to diagnose the issue? (Choose TWO.)

Select 2 answers

A.Check the security groups and network ACLs in VPC A and VPC B.

B.Establish a VPN connection between VPC A and the transit gateway.

C.Create a VPC peering connection between VPC A and VPC B.

D.Verify that the VPCs are associated with the correct transit gateway route table.

E.Configure an AWS Direct Connect virtual interface between the VPCs.

AnswersA, D

Correct: Security group or NACL rules may be blocking traffic between the VPCs.

Why this answer

Security groups and network ACLs in the VPCs can block traffic even if Transit Gateway routes are correct. Option D is correct because the VPCs must be associated with the correct Transit Gateway route table; an incorrect association can prevent communication. Option B is wrong because a VPN connection is not required for VPC-to-VPC communication via Transit Gateway.

Option C is wrong because VPC peering is not necessary when using Transit Gateway; the issue is likely a configuration problem within the Transit Gateway setup. Option E is wrong because AWS Direct Connect is unrelated to inter-VPC routing.

Full explanation →

1430

Multi-Selecthard

Which THREE of the following are best practices for securing a VPC? (Choose three.)

Select 3 answers

A.Enable AWS Shield Advanced for DDoS protection.

B.Use security groups to control inbound and outbound traffic at the instance level.

C.Use network ACLs as a stateless layer of defense for subnets.

D.Allow all outbound traffic from the VPC to the internet.

E.Assign a default security group that allows all traffic.

AnswersA, B, C

AWS Shield Advanced provides enhanced DDoS protection for VPC resources.

Why this answer

Options A, B, and C are correct. Enabling AWS Shield Advanced provides DDoS protection for VPC resources with public endpoints. Security groups act as a virtual firewall at the instance level, controlling inbound and outbound traffic.

Network ACLs provide a stateless layer of defense at the subnet level, complementing security groups. Option D is incorrect because allowing all outbound traffic is not a security best practice; outbound traffic should be restricted to only necessary destinations. Option E is incorrect because the default security group should be restrictive, not allowing all traffic.

Full explanation →

1431

MCQeasy

A company is migrating its on-premises data center to AWS. The network team needs to extend the on-premises network to the cloud and support IP multicast traffic between environments. Which AWS service or feature should be used?

A.AWS Direct Connect with a private virtual interface

B.Site-to-Site VPN connection

C.AWS Transit Gateway with multicast support

D.VPC peering connection

AnswerC

Transit Gateway can handle multicast traffic between VPCs and on-premises via VPN or Direct Connect.

Why this answer

AWS Transit Gateway with multicast support is the correct choice because it is the only AWS service that natively supports IP multicast traffic between VPCs and on-premises networks. It allows you to create multicast domains and associate subnets, enabling multicast sources and receivers to communicate across attached networks, including on-premises via AWS Direct Connect or Site-to-Site VPN.

Exam trap

The trap here is that candidates often assume Direct Connect or VPN can carry multicast traffic natively, but AWS does not forward multicast over these connections without Transit Gateway multicast or a third-party overlay solution.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect with a private virtual interface provides a dedicated network connection but does not natively support IP multicast; multicast traffic is not forwarded over Direct Connect without additional overlay solutions. Option B is wrong because Site-to-Site VPN uses IPsec tunnels which are unicast-only and cannot transport multicast traffic natively; multicast would require additional encapsulation like GRE. Option D is wrong because VPC peering does not support multicast traffic; it only allows unicast communication between VPCs and has no multicast forwarding capability.

Full explanation →

1432

MCQeasy

A company is designing a VPC with both IPv4 and IPv6 CIDR blocks. The VPC must support internet-facing applications accessible via IPv6. Which resource must be configured as IPv6-enabled to allow internet traffic?

A.Internet Gateway

B.VPC Peering connection

C.NAT Gateway

D.Transit Gateway

AnswerA

Internet Gateway supports both IPv4 and IPv6 traffic.

Why this answer

An Internet Gateway (IGW) is the only resource that supports both IPv4 and IPv6 traffic and provides a target in the VPC route table for IPv6 default routes (::/0) to enable direct internet access for IPv6-enabled resources. Unlike IPv4, which often requires NAT for private addressing, IPv6 globally unique addresses allow direct communication through the IGW without translation.

Exam trap

AWS often tests the misconception that a NAT Gateway can handle IPv6 traffic, but NAT is not used for IPv6 due to the abundance of globally unique addresses; the correct resource for IPv6 internet access is always the Internet Gateway.

How to eliminate wrong answers

Option B is wrong because a VPC Peering connection only enables private routing between two VPCs and does not provide internet access; it cannot route traffic to or from the internet. Option C is wrong because a NAT Gateway is designed only for IPv4 traffic to allow private IPv4 instances to initiate outbound internet connections, and it does not support IPv6 at all. Option D is wrong because a Transit Gateway is a central hub for inter-VPC and on-premises connectivity, but it does not natively provide internet access; it requires an IGW attached to a VPC to reach the internet.

Full explanation →

1433

MCQeasy

A company is using AWS Secrets Manager to store database credentials. They want to ensure that the credentials are automatically rotated every 30 days. Which configuration is required?

A.Enable automatic rotation in the secret configuration and provide a Lambda rotation function.

B.Store the secret in AWS Systems Manager Parameter Store and configure a rotation schedule.

C.Store the secret in AWS CloudHSM and use a scheduled Lambda to rotate.

D.Use IAM Access Analyzer to rotate the credentials periodically.

AnswerA

Secrets Manager supports automatic rotation using Lambda functions.

Why this answer

AWS Secrets Manager provides built-in automatic rotation using a Lambda function. Option B is incorrect because AWS Systems Manager Parameter Store does not support automatic rotation of secrets; it is designed for configuration management. Option C is incorrect because AWS CloudHSM is a hardware security module for storing cryptographic keys, not for automating credential rotation.

Option D is incorrect because IAM Access Analyzer analyzes resource policies to identify unintended access, not to rotate credentials.

Full explanation →

1434

Multi-Selectmedium

A company is designing a network for a critical application that requires high availability across multiple Availability Zones. Which TWO design choices ensure that the application remains available if an entire AZ fails?

Select 2 answers

A.Deploy resources in a single Availability Zone.

B.Deploy resources in at least two Availability Zones.

C.Use a Network Load Balancer in a single AZ.

D.Use an Application Load Balancer that spans multiple AZs.

E.Use a single EC2 instance with an Elastic IP address.

AnswersB, D

Multi-AZ deployment provides fault tolerance.

Why this answer

Deploying resources in at least two Availability Zones (AZs) is a foundational design pattern for high availability. If an entire AZ fails, the application can continue serving traffic from the remaining AZ(s). This aligns with AWS best practices for fault isolation and is a core requirement for achieving an SLA-backed multi-AZ architecture.

Exam trap

The ANS-C01 exam often tests the misconception that a single load balancer or a single instance with an Elastic IP is sufficient for high availability, but the trap here is that true AZ-level fault tolerance requires redundant resources in at least two separate Availability Zones, not just a load balancer or an Elastic IP.

Full explanation →

1435

MCQmedium

A company has a VPC with a public subnet and a private subnet. They have a web server in the public subnet and a database in the private subnet. The web server needs to communicate with the database on port 3306. Security groups are configured as follows: Web server SG allows inbound HTTP/HTTPS from 0.0.0.0/0 and outbound to database SG on port 3306. Database SG allows inbound from web server SG on port 3306. However, the web server cannot connect. Network ACLs are default. What is the issue?

A.The network ACL on the private subnet denies inbound traffic on port 3306.

B.Security groups are stateful, so no outbound rule is needed; the issue is something else.

C.The web server security group does not allow outbound traffic to the database.

D.The database security group inbound rule is not correctly referencing the web server security group ID.

AnswerD

Correct: The rule must reference the security group ID, not the instance ID.

Why this answer

The web server can initiate outbound traffic because the web server's security group has an outbound rule allowing traffic to the database security group on port 3306. Security groups are stateful, so the response traffic is automatically allowed. The issue is that the database security group's inbound rule must reference the web server security group ID correctly.

If the rule references a misconfigured or incorrect security group ID, the database will not accept the connection. Network ACLs are default allow, so they are not blocking traffic. Therefore, the correct answer is D.

Full explanation →

1436

MCQhard

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company wants to minimize data transfer costs and avoid exposing the private instance to inbound traffic from the internet. Which solution meets these requirements?

A.Create a VPC Gateway Endpoint for Amazon S3 and ensure the patches are hosted in S3. Route private subnet traffic to the endpoint.

B.Attach an internet gateway to the VPC and route the private subnet's default route to a NAT gateway in the public subnet.

C.Launch a NAT instance in the public subnet and route the private subnet's default route to it.

D.Attach an internet gateway to the VPC and assign a public IP to the EC2 instance.

AnswerA

No NAT cost, no inbound exposure, and uses AWS private network.

Why this answer

A VPC Gateway Endpoint for Amazon S3 provides private connectivity to S3 without traversing the internet, eliminating data transfer costs and avoiding exposure to inbound traffic. Option D is incorrect because assigning a public IP and using an internet gateway would expose the instance to inbound traffic. Option B (NAT gateway) and Option C (NAT instance) incur data transfer costs and are not required when the patches are in S3 and can be accessed via a gateway endpoint.

Full explanation →

1437

MCQhard

A company has a Direct Connect connection with a private VIF to a VPC. The company also has a Site-to-Site VPN connection to the same VPC as a backup. During a failover test, traffic from on-premises to the VPC continues to use the Direct Connect even after it is intentionally failed. The BGP timers are set to default values. What is the most likely cause?

A.The Direct Connect route is more specific than the VPN route.

B.The VPN BGP route has a longer AS path than the Direct Connect route.

C.The VPN route has a lower local preference than the Direct Connect route.

D.The BGP session with the Direct Connect router is still established because the physical link is up, but the link is not forwarding traffic.

AnswerD

If the BGP session remains established, routes are still advertised and the Direct Connect route remains in the routing table, causing traffic to still be sent.

Why this answer

The Direct Connect physical link is still up, so the BGP session remains established even though the link is not forwarding traffic. With default BGP timers (keepalive 60s, hold 180s), the session does not time out, so the VPC continues to receive the Direct Connect route and prefers it over the VPN backup. A failover requires either the BGP session to go down or the route to be withdrawn, neither of which occurs when only the data plane fails.

Exam trap

The ANS-C01 exam often tests the misconception that a physical link failure is required for BGP to withdraw routes, but the trap here is that BGP can remain established even when the data plane is broken, so the backup VPN never activates.

How to eliminate wrong answers

Option A is wrong because route specificity (prefix length) determines BGP best path selection only if both routes are from the same protocol and have equal local preference and AS path length; here, the issue is that the Direct Connect route is still present, not that it is more specific. Option B is wrong because a longer AS path would make the VPN route less preferred, but the problem is that the Direct Connect route is still active and preferred, not that the VPN route has a longer AS path. Option C is wrong because local preference is typically set to 100 by default for both routes, and even if the VPN route had a lower local preference, the Direct Connect route would still be preferred; the core issue is that the Direct Connect route is not being withdrawn.

Full explanation →

1438

MCQmedium

A company has a VPC with a public subnet containing a NAT gateway and a private subnet containing Amazon EC2 instances. The instances in the private subnet need to download patches from the internet. The NAT gateway is in the public subnet and has an Elastic IP address. The private subnet's route table has a default route pointing to the NAT gateway. However, the instances cannot reach the internet. What is the MOST likely cause?

A.The public subnet's route table does not have a route to an internet gateway.

B.The NAT gateway does not have a route back to the private subnet.

C.The NAT gateway is not associated with a security group that allows inbound internet traffic.

D.The security group attached to the EC2 instances does not allow outbound traffic to the internet.

AnswerA

The public subnet must have a route to an internet gateway for the NAT gateway to reach the internet.

Why this answer

The NAT gateway resides in the public subnet, but for it to route traffic to the internet, the public subnet's route table must have a default route (0.0.0.0/0) pointing to an internet gateway (IGW). Without this route, the NAT gateway cannot forward traffic from the private subnet to the internet, even though the private subnet's route table correctly points to the NAT gateway. The missing IGW route in the public subnet breaks the outbound path.

Exam trap

The ANS-C01 exam often tests the misconception that a NAT gateway automatically has internet access if it has an Elastic IP, but the Elastic IP alone does not provide a path to the internet without a route to an internet gateway in the subnet's route table.

How to eliminate wrong answers

Option B is wrong because a NAT gateway does not require a route back to the private subnet; it implicitly knows how to return traffic to the subnet that sent it via the VPC's internal routing. Option C is wrong because NAT gateways do not use security groups; they are controlled by route tables and network ACLs, not security groups. Option D is wrong because the default security group for EC2 instances allows all outbound traffic, and the question does not indicate any custom outbound restriction; the issue is at the network layer, not the instance security group.

Full explanation →

1439

MCQmedium

A financial services company is designing a hybrid network architecture using AWS Direct Connect. They have a Direct Connect connection with a public VIF and a private VIF. The private VIF is associated with a Direct Connect gateway that is attached to a Transit Gateway in us-east-1. The Transit Gateway has attachments to a production VPC and a shared services VPC. The company wants to ensure that all traffic from the on-premises network to the production VPC flows through a centralized inspection appliance in the shared services VPC for security compliance. Additionally, traffic from the production VPC to the internet must use a NAT gateway in the shared services VPC. The inspection appliance in the shared services VPC performs stateful inspection and must see both directions of traffic. The network engineer configured the following route tables: In the Transit Gateway route table associated with the Direct Connect gateway attachment, a static route for 0.0.0.0/0 points to the shared services VPC attachment. In the Transit Gateway route table associated with the production VPC attachment, a static route for the on-premises CIDR (10.0.0.0/8) points to the shared services VPC attachment. In the Transit Gateway route table associated with the shared services VPC attachment, a static route for the on-premises CIDR points to the Direct Connect gateway attachment, and a static route for 0.0.0.0/0 points to the Direct Connect gateway attachment (for outbound internet traffic, the shared services VPC has its own internet gateway and NAT gateway). The production VPC has a default route (0.0.0.0/0) pointing to the Transit Gateway. The shared services VPC has a default route pointing to the NAT gateway. However, traffic from on-premises to the production VPC is not being inspected; it goes directly to the production VPC. What is the most likely reason?

A.The Transit Gateway route table associated with the Direct Connect gateway attachment has propagation enabled, which installs a more specific route for the production VPC CIDR directly to the production VPC attachment, bypassing the shared services VPC.

B.The shared services VPC has a default route pointing to the NAT gateway, which is not a valid next hop for traffic coming from the Transit Gateway.

C.The production VPC route table has a default route pointing to the Transit Gateway, but the NAT gateway is in the shared services VPC, causing asymmetric routing.

D.The Transit Gateway route table associated with the shared services VPC attachment does not have a route for the production VPC CIDR pointing to the production VPC attachment, so return traffic cannot reach production.

AnswerA

Propagation from the production VPC attachment installs a route for the production VPC CIDR pointing to the production VPC attachment, which is more specific than the 0.0.0.0/0 route to shared services. This causes traffic to bypass inspection.

Why this answer

When propagation is enabled on the Transit Gateway route table associated with the Direct Connect gateway attachment, the production VPC CIDR is automatically learned as a more specific route (e.g., 10.1.0.0/16) pointing directly to the production VPC attachment. This more specific route overrides the static 0.0.0.0/0 route that was intended to force traffic through the shared services VPC, causing on-premises traffic to bypass the inspection appliance.

Exam trap

AWS often tests the misconception that static routes always take precedence over propagated routes in Transit Gateway route tables, but in reality, prefix length (specificity) determines priority, not whether the route is static or propagated.

How to eliminate wrong answers

Option B is wrong because the shared services VPC's default route pointing to the NAT gateway is correct for outbound internet traffic from the shared services VPC itself; it does not affect traffic arriving from the Transit Gateway, as the Transit Gateway handles routing independently. Option C is wrong because the production VPC's default route pointing to the Transit Gateway is appropriate for sending traffic to the Transit Gateway; asymmetric routing is not caused by this route but rather by the Transit Gateway route table misconfiguration described in Option A. Option D is wrong because the Transit Gateway route table associated with the shared services VPC attachment does not need a route for the production VPC CIDR pointing to the production VPC attachment; return traffic from the shared services VPC to the production VPC is handled by the Transit Gateway's default behavior of using the most specific route, and the issue is about forward traffic bypassing inspection, not return traffic.

Full explanation →

1440

Multi-Selecthard

A company is implementing a network segmentation strategy using AWS Transit Gateway. They have three VPCs: production, development, and shared services. They need to ensure that production and development VPCs can both access shared services, but cannot communicate with each other. Which THREE configurations are required?

Select 3 answers

A.Create a route table for the shared services VPC that allows routes to both production and development

B.Attach each VPC to the transit gateway

C.Create a separate route table for the production and development VPCs that allows only routes to shared services

D.Create a VPC peering connection between production and development

E.Use a single transit gateway route table for all attachments

AnswersA, B, C

Shared services must be able to send traffic back.

Why this answer

The shared services VPC needs a transit gateway route table with routes to both the production and development VPC attachments so that return traffic from shared services can reach those VPCs. Without these routes, the transit gateway would drop return packets, breaking bidirectional communication.

Exam trap

The trap here is that candidates often assume a single transit gateway route table is sufficient for all attachments, overlooking that separate route tables are required to enforce isolation between specific VPCs while allowing shared access.

Full explanation →

1441

MCQmedium

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from an S3 bucket. The company wants to minimize data transfer costs and avoid traversing the internet. Which solution should be implemented?

A.Use an Interface VPC Endpoint for S3

B.Use AWS Direct Connect

C.Set up a NAT Gateway in the public subnet and route traffic through it

D.Create a Gateway VPC Endpoint for S3

AnswerD

Gateway endpoint provides private, low-cost access to S3.

Why this answer

A Gateway VPC Endpoint for S3 allows EC2 instances in a private subnet to access S3 without traversing the internet, using AWS's internal network. This minimizes data transfer costs because Gateway Endpoints are free and traffic stays within the AWS backbone, avoiding NAT Gateway or internet gateway charges.

Exam trap

The ANS-C01 exam often tests the distinction between Gateway and Interface VPC Endpoints, trapping candidates who assume all endpoints are Interface-based or that NAT Gateway is the only way to access AWS services from private subnets.

How to eliminate wrong answers

Option A is wrong because an Interface VPC Endpoint for S3 incurs hourly charges and data processing costs, and while it avoids internet traversal, it is not the most cost-effective solution compared to a Gateway Endpoint. Option B is wrong because AWS Direct Connect is a dedicated network connection from on-premises to AWS, not designed for VPC-to-S3 traffic within the same region, and it adds unnecessary complexity and cost. Option C is wrong because a NAT Gateway in the public subnet would route traffic to the internet, incurring NAT Gateway hourly and data processing charges, and it does not minimize data transfer costs or avoid internet traversal as effectively as a Gateway Endpoint.

Full explanation →

1442

MCQmedium

A network engineer notices that traffic from an EC2 instance in a public subnet to the internet is not working. The instance has a public IP assigned and is in a public subnet with a route to an internet gateway. The security group allows outbound traffic. What should the engineer check next?

A.Ensure the network ACL allows outbound traffic.

B.Verify that the route table for the subnet has a 0.0.0.0/0 route pointing to the internet gateway.

C.Confirm that the internet gateway is attached to the VPC.

D.Check if the instance has a public IP assigned.

AnswerB

Without this route, traffic cannot reach the internet.

Why this answer

Even if the instance has a public IP, if the subnet's route table does not have a default route (0.0.0.0/0) pointing to the internet gateway, traffic to the internet will fail. This is a common misconfiguration.

Full explanation →

1443

MCQmedium

A company has deployed a web application on EC2 instances behind an Application Load Balancer (ALB). The application is experiencing intermittent timeouts. CloudWatch metrics show that the ALB's RequestCount is within normal limits, but TargetResponseTime occasionally spikes to 10 seconds. What is the most likely cause?

A.The ALB is configured with an incorrect idle timeout value.

B.The ALB's cross-zone load balancing is disabled.

C.The EC2 instances are experiencing high CPU utilization during peak periods.

D.The security group for the EC2 instances is blocking traffic from the ALB.

AnswerC

High CPU leads to slow responses, matching the symptom of occasional spikes in TargetResponseTime.

Why this answer

High CPU utilization on the EC2 instances can cause slow response times, leading to timeouts. The ALB distributes requests, so RequestCount may appear normal while individual instances struggle.

Full explanation →

1444

MCQeasy

A company has deployed a VPC with public and private subnets. They have an Internet Gateway attached to the VPC and a NAT Gateway in the public subnet. The private subnet instances need to download patches from the internet. Which configuration ensures that the private instances can reach the internet while preventing inbound traffic from the internet?

A.Add a VPC Gateway Endpoint for Amazon S3 to the private subnet route table.

B.Add a route in the private subnet route table pointing 0.0.0.0/0 to the Internet Gateway.

C.Add a route in the private subnet route table pointing 0.0.0.0/0 to the NAT Gateway.

D.Create a VPC Peering connection to a public VPC and route traffic through it.

AnswerC

NAT Gateway allows outbound traffic to the internet and blocks unsolicited inbound traffic.

Why this answer

Adding a route in the private subnet route table pointing 0.0.0.0/0 to the NAT Gateway allows private instances to initiate outbound traffic to the internet while preventing inbound connections from the internet. Option A is incorrect because a VPC Gateway Endpoint only provides access to specific AWS services (e.g., S3, DynamoDB), not general internet traffic. Option B is incorrect because routing 0.0.0.0/0 to the Internet Gateway would expose the private instances to inbound traffic from the internet (assuming the route is in the private subnet route table, it would still allow inbound traffic if the instances have public IPs, but more importantly, it bypasses the NAT Gateway's security).

Option D is incorrect because VPC Peering does not provide internet access; it only connects two VPCs.

Full explanation →

1445

MCQeasy

A company is using AWS Direct Connect to connect its on-premises data center to a VPC. The company wants to use private virtual interfaces (VIFs) to access multiple VPCs in the same AWS Region. Which AWS service should be used to simplify this connectivity?

A.Direct Connect gateway

B.Transit VPC solution with EC2-based VPN appliances

C.AWS Site-to-Site VPN

D.VPC peering connection

AnswerA

Direct Connect gateway enables connectivity to multiple VPCs.

Why this answer

A Direct Connect gateway allows you to associate multiple virtual private gateways (VGWs) or transit gateways in the same or different AWS accounts, enabling a single private virtual interface to connect to multiple VPCs in the same AWS Region. This simplifies connectivity by eliminating the need for separate VIFs per VPC and reduces operational overhead.

Exam trap

The ANS-C01 exam often tests the misconception that VPC peering can be used to extend Direct Connect connectivity to multiple VPCs, but peering does not support transitive routing and cannot be used with Direct Connect private VIFs directly.

How to eliminate wrong answers

Option B is wrong because a Transit VPC solution with EC2-based VPN appliances introduces unnecessary complexity, latency, and single points of failure, whereas a Direct Connect gateway provides a native, managed, and scalable solution. Option C is wrong because AWS Site-to-Site VPN operates over the public internet and does not leverage the private, low-latency benefits of Direct Connect; it is a separate connectivity option, not a simplification for Direct Connect. Option D is wrong because VPC peering connections are used for direct VPC-to-VPC connectivity and do not integrate with Direct Connect private VIFs; they cannot simplify the attachment of multiple VPCs to a single Direct Connect connection.

Full explanation →

1446

MCQhard

A company is migrating to AWS and needs to connect its on-premises data center to multiple VPCs across several AWS regions. The on-premises network uses BGP and requires high availability with sub-second failover. The solution must be cost-effective and support traffic segmentation. Which design meets these requirements?

A.Set up a Site-to-Site VPN connection between on-premises and each VPC using a VPN appliance on AWS.

B.Order an AWS Direct Connect connection and create multiple virtual interfaces, each connecting to a different VPC in different regions. Use BGP with Bidirectional Forwarding Detection (BFD) for fast failover.

C.Use AWS Transit Gateway with inter-region peering and attach VPN connections from on-premises to a central Transit Gateway.

D.Use a combination of Direct Connect and VPN as a backup, and route all traffic through a single VPC that acts as a transit hub.

AnswerB

Correct: Direct Connect provides stable latency, and BFD enables sub-second failover.

Why this answer

AWS Direct Connect with multiple virtual interfaces (VIFs) provides dedicated, low-latency connectivity to multiple VPCs across different regions. Using BGP with Bidirectional Forwarding Detection (BFD) enables sub-second failover detection (typically 150ms or less), meeting the high availability requirement. This design is cost-effective compared to multiple VPN connections and supports traffic segmentation through separate VIFs or VLANs.

Exam trap

The trap here is that candidates often assume Transit Gateway (Option C) is always the best choice for multi-VPC connectivity, but fail to recognize that the on-premises VPN attachment still relies on internet-based VPN, which cannot meet the sub-second failover requirement, whereas Direct Connect with BFD provides deterministic fast failover.

How to eliminate wrong answers

Option A is wrong because Site-to-Site VPN connections over the internet cannot guarantee sub-second failover due to variable latency and packet loss, and using a VPN appliance on AWS adds unnecessary cost and complexity without meeting the high availability requirement. Option C is wrong because AWS Transit Gateway with inter-region peering does not inherently provide sub-second failover for the on-premises connection; the VPN attachment from on-premises to the Transit Gateway still relies on internet-based VPN, which cannot achieve sub-second failover reliably. Option D is wrong because routing all traffic through a single VPC as a transit hub creates a single point of failure and bandwidth bottleneck, and the combination of Direct Connect and VPN as backup does not guarantee sub-second failover unless BFD is properly configured on the Direct Connect path, but the design still lacks native support for multiple VPCs across regions without additional complexity.

Full explanation →

1447

MCQeasy

A company is designing a network for a three-tier application that must be PCI DSS compliant. The web tier must be accessible from the internet, the application tier must only be accessible from the web tier, and the database tier must only be accessible from the application tier. All tiers are in the same VPC. What is the MOST secure way to implement this?

A.Use a VPN between the web and application tiers and between application and database tiers.

B.Place all tiers in the same private subnet and use security groups for isolation.

C.Place web tier in public subnets, application and database tiers in private subnets. Use security groups to allow only necessary traffic between tiers.

D.Place all tiers in public subnets and use network ACLs to restrict traffic.

AnswerC

Security groups provide stateful filtering and are best practice for tier isolation.

Why this answer

The most secure because it places the web tier in public subnets (for internet access) and the application and database tiers in private subnets (no direct internet access). Security groups are used to allow only the necessary traffic between tiers: from web to app on specific ports, and from app to db on specific ports. Security groups are stateful, which simplifies rule management and reduces attack surface.

Option A is wrong because a VPN is unnecessary for intra-VPC traffic and adds complexity without improving security. Option B is wrong because placing all tiers in the same private subnet does not provide network isolation between tiers; security groups alone cannot prevent all lateral movement. Option D is wrong because placing all tiers in public subnets exposes the application and database tiers to the internet, and network ACLs are stateless, requiring symmetric rules and increasing management overhead.

Full explanation →

1448

MCQmedium

A company is migrating an on-premises application to AWS. The application uses multicast for discovery. Which AWS service supports multicast traffic within a VPC?

A.AWS Transit Gateway

B.VPC peering

C.Application Load Balancer

D.Amazon CloudFront

AnswerA

Supports multicast groups and routing.

Why this answer

AWS Transit Gateway supports multicast traffic within a VPC by acting as a multicast router. It allows you to create multicast domains and associate subnets, enabling multicast group communication (using IGMP) for applications like service discovery. This makes it the correct choice for migrating an on-premises application that relies on multicast.

Exam trap

The trap here is that candidates often assume VPC peering supports all traffic types, but AWS explicitly does not support multicast or broadcast over VPC peering, making Transit Gateway the only native multicast solution within a VPC.

How to eliminate wrong answers

Option B (VPC peering) is wrong because VPC peering does not support multicast or broadcast traffic; it only allows unicast communication between VPCs. Option C (Application Load Balancer) is wrong because it operates at Layer 7 and handles HTTP/HTTPS traffic, not multicast IP traffic. Option D (Amazon CloudFront) is wrong because it is a content delivery network (CDN) that distributes content via HTTP/HTTPS, not a multicast routing service.

Full explanation →

1449

MCQhard

A company has a VPC with a transit gateway (TGW) connected to multiple VPCs and an on-premises network via AWS Direct Connect. The on-premises network advertises a specific prefix 10.0.0.0/16. A VPC attachment in the same region also advertises the same prefix. The TGW route table has the on-premises route as static and the VPC route as propagated. Which route will be used for traffic destined to 10.0.0.5?

A.The propagated route from VPC

B.The static route to on-premises

C.Both routes will be used with ECMP

D.The route with the shortest AS_PATH

AnswerB

Static routes have higher precedence than propagated.

Why this answer

When a transit gateway (TGW) receives both a static route and a propagated route for the same prefix, the static route takes precedence regardless of the propagation source. This is because static routes have a higher administrative distance (lower priority number) than dynamically learned routes. Therefore, traffic destined to 10.0.0.5 will be forwarded via the Direct Connect attachment to the on-premises network.

Exam trap

The ANS-C01 exam often tests the misconception that propagated routes from VPC attachments are preferred over static routes, or that ECMP applies when two routes for the same prefix exist, but the key trap is that static routes always override propagated routes in a TGW route table regardless of the source.

How to eliminate wrong answers

Option A is wrong because propagated routes are dynamic and have a lower priority than static routes in the TGW route table; the static route to on-premises will override the propagated VPC route. Option C is wrong because ECMP (Equal-Cost Multi-Path) requires multiple routes with identical prefix and equal administrative distance, but here the static and propagated routes have different priorities, so only the static route is active. Option D is wrong because AS_PATH length is a BGP attribute used for route selection in BGP, but TGW static routes are not BGP-learned and are selected based on route table precedence rules, not AS_PATH.

Full explanation →

1450

Multi-Selectmedium

A company is designing a VPC with a public subnet and a private subnet. The private subnet instances need to access the internet for software updates. Which TWO options allow outbound internet access while preventing inbound connections? (Choose two.)

Select 2 answers

A.NAT Gateway in the public subnet

B.Egress-only Internet Gateway

C.Internet Gateway attached to the VPC

D.AWS Site-to-Site VPN connection to on-premises

E.VPC Peering connection to a VPC with internet access

AnswersA, B

Allows outbound IPv4 traffic from private subnet.

Why this answer

A NAT Gateway in the public subnet allows instances in the private subnet to initiate outbound connections to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. The NAT Gateway translates the private IP addresses of the instances to its own Elastic IP address, and because it does not maintain state for inbound traffic that was not initiated from within the VPC, it blocks all inbound connection attempts.

Exam trap

The trap here is that candidates often confuse an Egress-Only Internet Gateway with a NAT Gateway, not realizing that the Egress-Only Internet Gateway is exclusively for IPv6 traffic and does not support IPv4, which is the typical protocol for software updates.

Full explanation →

1451

Multi-Selecthard

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to an on-premises network using AWS Direct Connect and a Site-to-Site VPN. The on-premises network advertises 10.0.0.0/8 over BGP. The company wants to ensure that traffic to the VPC's specific subnet 10.0.1.0/24 is routed via the VPN, while all other traffic to 10.0.0.0/8 uses Direct Connect. Which THREE actions should the network engineer take?

Select 3 answers

A.Set a higher BGP local preference on the VPN routes compared to Direct Connect routes for the same prefix.

B.Advertise a more specific route for 10.0.1.0/24 over the VPN BGP session.

C.Disable route propagation on the VPN connection's route table.

D.Prepend the AS path on the Direct Connect BGP advertisement for the 10.0.1.0/24 prefix to make it less preferred.

E.Delete the VPN connection and rely solely on Direct Connect.

AnswersA, B, D

Higher local preference is preferred.

Why this answer

Setting a higher BGP local preference on the VPN routes makes them more preferred over Direct Connect routes for the same prefix. Since the on-premises network advertises 10.0.0.0/8 over both connections, BGP local preference is the first tiebreaker; a higher value on the VPN side ensures that traffic to 10.0.1.0/24 uses the VPN as desired.

Exam trap

The trap here is that candidates often think AS path prepending alone is sufficient to influence route preference, but they forget that local preference is evaluated before AS path length in BGP path selection, and that a more specific prefix advertisement (10.0.1.0/24) will always be preferred over a less specific one (10.0.0.0/8) regardless of BGP attributes.

Full explanation →

1452

Multi-Selectmedium

A security engineer notices that an EC2 instance in a public subnet is receiving inbound SSH traffic from a range of IP addresses that should be blocked. Which two actions should the engineer take to troubleshoot? (Choose two.)

Select 2 answers

A.Check the instance metadata for IP restrictions

B.Check the route table associated with the subnet

C.Review the Security Group rules attached to the instance

D.Check the Network ACL associated with the subnet

E.Check VPC Flow Logs to identify the source IP addresses

AnswersC, E

Security groups control inbound traffic to the instance.

Why this answer

Options C and E are correct. Reviewing Security Group rules helps determine if the security group is allowing SSH traffic from the unwanted IPs. Checking VPC Flow Logs can reveal the actual source IP addresses of the traffic.

Option A is incorrect because instance metadata does not contain network access rules. Option B is incorrect because the route table determines routing, not access control. Option D is incorrect because while Network ACLs can block traffic, they are stateless and affect the entire subnet; the first check should be the security group attached to the instance.

Full explanation →

1453

Multi-Selecthard

Which THREE components are required to enable AWS Shield Advanced automatic application layer DDoS mitigation for an Application Load Balancer? (Choose three.)

Select 3 answers

A.AWS Shield Advanced subscription

B.Amazon CloudFront distribution in front of the ALB

C.Amazon Route53 DNS configuration

D.An AWS WAF rate-based rule

E.AWS WAF web ACL associated with the ALB

AnswersA, D, E

Required for Advanced features.

Why this answer

Options A, D, and E are correct. AWS Shield Advanced requires an active subscription (A) to enable automatic application layer DDoS mitigation. It integrates with AWS WAF, so a web ACL (E) must be associated with the ALB, and a rate-based rule (D) is needed to trigger automatic mitigation.

Option B (CloudFront) is not required because Shield Advanced can directly protect ALBs without a CDN. Option C (Route53) is also not required for this specific feature.

Full explanation →

1454

MCQhard

A company has a Direct Connect connection with a private VIF connected to a VPC. The network engineer notices that traffic from on-premises to the VPC is being dropped intermittently. The on-premises router shows BGP session is up, but the VPC route table does not have the on-premises prefix. What is the most likely cause?

A.The MTU on the on-premises router is set too high.

B.The BGP session is flapping due to high latency.

C.The on-premises router is advertising a route that is more specific than the allowed prefix list on the Direct Connect gateway.

D.The on-premises router is using AS_PATH prepending.

AnswerC

The allowed prefix list on the Direct Connect gateway may not include the specific prefix, causing the route to be rejected.

Why this answer

The Direct Connect gateway (DXGW) uses allowed prefix lists to control which routes are accepted from the on-premises router via BGP. If the on-premises router advertises a prefix that is more specific (e.g., /28) than the allowed prefix list (e.g., /24), the DXGW will reject the route, causing the VPC route table to lack the on-premises prefix. The BGP session remains up because the session itself is not affected, but the specific route is not installed.

Exam trap

AWS often tests the distinction between BGP session state and route acceptance, trapping candidates who assume a stable BGP session guarantees route installation, when in fact prefix filtering on the DXGW can silently drop specific routes.

How to eliminate wrong answers

Option A is wrong because MTU settings affect packet fragmentation and delivery, not BGP route advertisement or route table population; a high MTU would cause packet drops due to size mismatch, not intermittent route absence. Option B is wrong because if the BGP session were flapping due to high latency, the on-premises router would show the session as up/down, not consistently up; the question states the BGP session is up, ruling out flapping. Option D is wrong because AS_PATH prepending influences route preference and path selection, not route acceptance; it does not cause the VPC route table to miss the prefix entirely.

Full explanation →

1455

MCQmedium

A company has a VPC with both IPv4 and IPv6 CIDR blocks. The application team wants to allow internet traffic to an IPv6-enabled web server. Which resource must be configured?

A.NAT64

B.Egress-Only Internet Gateway

C.NAT Gateway

D.Internet Gateway

AnswerD

Supports IPv6 inbound.

Why this answer

An Internet Gateway (IGW) is required to allow inbound and outbound IPv6 traffic between a VPC and the internet. Unlike IPv4, IPv6 addresses in AWS are globally unique by default, so no NAT is needed; the IGW directly routes traffic for both IPv4 and IPv6 when attached to the VPC and associated with the route table.

Exam trap

The trap here is that candidates often confuse the Egress-Only Internet Gateway with a full-duplex gateway, forgetting that it only supports outbound IPv6 traffic and cannot accept inbound connections from the internet.

How to eliminate wrong answers

Option A is wrong because NAT64 is used to translate IPv6 traffic to IPv4 for communication with IPv4-only endpoints, not to allow direct internet access to an IPv6-enabled web server. Option B is wrong because an Egress-Only Internet Gateway only supports outbound IPv6 traffic from the VPC to the internet and does not allow inbound internet traffic to reach the web server. Option C is wrong because a NAT Gateway is designed for outbound IPv4 traffic from private subnets and does not support IPv6 traffic at all.

Full explanation →

1456

MCQeasy

A company is deploying a VPC with public and private subnets. The private subnets need outbound internet access for updates, but must not be directly reachable from the internet. Which AWS service should be used to achieve this?

A.AWS Site-to-Site VPN

B.AWS Direct Connect

C.Internet Gateway

D.NAT Gateway

AnswerD

NAT Gateway provides outbound internet access for private subnets while blocking inbound internet traffic.

Why this answer

A NAT Gateway enables instances in private subnets to initiate outbound IPv4 traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet. It translates the private source IP to the NAT Gateway's Elastic IP address, so responses return to the gateway, which then forwards them to the private instance. This meets the requirement of outbound-only internet access without direct internet reachability.

Exam trap

The ANS-C01 exam often tests the misconception that an Internet Gateway can be used in a private subnet by simply not assigning public IPs, but the trap is that an Internet Gateway inherently allows inbound traffic from the internet to any instance with a public IP or via its route, making it unsuitable for private subnets that must not be directly reachable.

How to eliminate wrong answers

Option A is wrong because AWS Site-to-Site VPN creates an encrypted tunnel to an on-premises network, not to the public internet; it does not provide outbound internet access for private subnets. Option B is wrong because AWS Direct Connect establishes a dedicated private connection to an on-premises data center, not to the internet, and does not enable outbound internet access. Option C is wrong because an Internet Gateway allows bidirectional communication between VPC instances and the internet; attaching it to a private subnet would make those instances directly reachable from the internet, violating the requirement.

Full explanation →

1457

MCQhard

A company has a hub-and-spoke VPC architecture using AWS Transit Gateway. The hub VPC contains shared services (e.g., Active Directory). Spoke VPCs need to resolve DNS names from the hub VPC. The hub VPC has an Amazon Route 53 Resolver inbound endpoint. What is the correct configuration for the spoke VPCs to use this endpoint?

A.Configure the spoke VPC's DHCP options set to use the hub VPC's CIDR as the domain name server

B.Create an inbound endpoint in each spoke VPC

C.Use VPC peering and configure the spoke VPC's route table to route DNS traffic to the hub VPC

D.Create an outbound endpoint in the spoke VPC and associate a resolver rule that forwards queries to the inbound endpoint in the hub VPC

AnswerD

This configuration allows spoke VPCs to forward DNS queries to the hub's inbound endpoint for resolution.

Why this answer

It uses an outbound endpoint in the spoke VPC to forward DNS queries to the hub VPC's inbound endpoint via a Route 53 Resolver rule. This allows the spoke VPC to resolve private DNS names hosted in the hub VPC without requiring DHCP changes or additional inbound endpoints, leveraging the hub's existing DNS infrastructure.

Exam trap

The ANS-C01 exam often tests the misconception that VPC peering or DHCP options alone can forward DNS traffic, but Route 53 Resolver endpoints are required to intercept and forward DNS queries across VPCs in a hub-and-spoke architecture.

How to eliminate wrong answers

Option A is wrong because configuring the spoke VPC's DHCP options set to use the hub VPC's CIDR as the domain name server would point DNS queries to an IP range, not a specific DNS resolver IP, and the hub VPC's inbound endpoint IP must be explicitly specified; also, DHCP options sets cannot reference CIDR blocks. Option B is wrong because creating an inbound endpoint in each spoke VPC is unnecessary and defeats the purpose of a centralized hub-and-spoke design; inbound endpoints are for on-premises to AWS DNS resolution, not for spoke-to-hub forwarding. Option C is wrong because VPC peering does not natively route DNS traffic; DNS queries use UDP/TCP port 53 and are not forwarded by route tables alone—Route 53 Resolver endpoints are required to intercept and forward DNS traffic.

Full explanation →

1458

MCQmedium

A security engineer reviews the NACL entries above for a subnet. Which statement about incoming SSH traffic (port 22) is correct?

A.SSH traffic is allowed only from the 10.0.0.0/8 range.

B.SSH traffic is allowed from all IP addresses.

C.SSH traffic is allowed from 10.0.0.0/8 and denied from all others.

D.SSH traffic is denied from all IP addresses.

AnswerB

Rule 100 allows all SSH traffic; subsequent rules are not evaluated.

Why this answer

NACLs are stateless and rules are evaluated in order by rule number. Rule 100 allows SSH from all IPs. Rule 200 denies SSH from all IPs, but it is not evaluated because rule 100 already allowed.

Rule 300 allows SSH from 10.0.0.0/8 but is not reached. Since rule 100 allows all, SSH is allowed from all IPs. Therefore, option B is correct.

Full explanation →

1459

MCQeasy

A company is designing a VPC with both IPv4 and IPv6 workloads. The VPC has an internet gateway, and the company wants to allow outbound IPv6 traffic to the internet from instances in a private subnet while blocking inbound IPv6 traffic from the internet. Which configuration should be used?

A.Configure a security group that allows outbound traffic and denies inbound traffic.

B.Configure a virtual private gateway and route traffic through it.

C.Configure an egress-only internet gateway in the VPC and add a route for ::/0 to the egress-only internet gateway in the private subnet's route table.

D.Configure a NAT gateway in a public subnet.

AnswerC

Egress-only internet gateway provides outbound-only IPv6 internet access.

Why this answer

An egress-only internet gateway (EIGW) is a horizontally scaled, redundant component that allows outbound IPv6 traffic from instances in a private subnet to the internet, but prevents the internet from initiating an inbound IPv6 connection to those instances. By adding a default route (::/0) pointing to the EIGW in the private subnet's route table, outbound IPv6 traffic is forwarded to the internet gateway, while the EIGW inherently drops any unsolicited inbound IPv6 traffic. This meets the requirement exactly, as security groups and network ACLs alone cannot fully block inbound IPv6 from the internet when a standard internet gateway is used.

Exam trap

The ANS-C01 exam often tests the misconception that a NAT gateway can handle IPv6 traffic, but NAT is not used with IPv6 by design; the correct solution is an egress-only internet gateway, which is a distinct AWS resource specifically for IPv6 outbound-only access.

How to eliminate wrong answers

Option A is wrong because a security group is stateful; allowing outbound traffic automatically permits the return traffic for that session, but it does not block unsolicited inbound traffic from the internet—it only controls traffic based on rules, and a deny rule is not supported (security groups use allow rules only). Option B is wrong because a virtual private gateway is used for VPN or Direct Connect connections to on-premises networks, not for internet-bound traffic; routing IPv6 traffic through it would not provide internet access and would instead send traffic to a private network. Option D is wrong because a NAT gateway is designed for IPv4 traffic only (it translates private IPv4 addresses to a public IPv4 address) and does not support IPv6; IPv6 traffic cannot be routed through a NAT gateway.

Full explanation →

1460

MCQeasy

A company needs to enforce that all IAM users use multi-factor authentication (MFA) to access the AWS Management Console. Which policy element should be used in an IAM policy to deny access if MFA is not present?

A.Resource

B.Condition

C.Action

D.Effect

AnswerB

Condition can check aws:MultiFactorAuthPresent.

Why this answer

The Condition element in an IAM policy allows you to specify conditions for when a policy is in effect. To deny access if MFA is not present, you use the `aws:MultiFactorAuthPresent` condition key with a Boolean value of `false`. This ensures that only requests authenticated with MFA are allowed, enforcing the security requirement.

Exam trap

The trap here is that candidates often confuse the Condition element with the Resource or Action elements, thinking MFA enforcement is tied to specific resources or actions, rather than understanding it is a contextual check applied via a condition key.

How to eliminate wrong answers

Option A is wrong because the Resource element specifies the AWS resources (e.g., ARNs) the policy applies to, not the authentication context like MFA presence. Option C is wrong because the Action element defines the specific API actions (e.g., ec2:DescribeInstances) that are allowed or denied, not the conditions under which they are evaluated. Option D is wrong because the Effect element only sets whether the policy allows or denies access (e.g., Allow or Deny), but it cannot enforce MFA requirements on its own without a Condition.

Full explanation →

1461

MCQeasy

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16 and needs to connect to an on-premises network using AWS Site-to-Site VPN. The on-premises network uses 10.0.0.0/8. What should be done to avoid overlapping CIDRs?

A.Configure a VPN with overlapping CIDRs, it will still work

B.Use NAT on the customer gateway to translate addresses

C.Create a new VPC with a non-overlapping CIDR and migrate resources

D.Use VPC peering to connect to on-premises

AnswerC

Changing the VPC CIDR requires recreation; a new VPC is the practical solution.

Why this answer

AWS Site-to-Site VPN requires non-overlapping IP CIDRs between the VPC and the on-premises network for proper routing. The VPC uses 10.0.0.0/16, which falls entirely within the on-premises 10.0.0.0/8, causing a conflict that prevents the VPN from establishing routes correctly. Creating a new VPC with a non-overlapping CIDR (e.g., 172.16.0.0/16) and migrating resources resolves the overlap, enabling the VPN connection.

Exam trap

The ANS-C01 exam often tests the misconception that NAT on the customer gateway can solve overlapping CIDR issues in Site-to-Site VPN, but candidates must understand that NAT does not resolve the underlying routing conflict because the VPC still sees the overlapping range as local.

How to eliminate wrong answers

Option A is wrong because configuring a VPN with overlapping CIDRs will not work; AWS Site-to-Site VPN relies on unique IP address spaces to route traffic correctly, and overlapping ranges cause routing conflicts and packet loss. Option B is wrong because NAT on the customer gateway translates source addresses for outbound traffic but does not resolve the fundamental routing conflict; the VPC and on-premises networks still have overlapping CIDRs, and AWS cannot distinguish between local and remote destinations. Option D is wrong because VPC peering is used to connect two VPCs within AWS, not to connect a VPC to an on-premises network; it does not support VPN or Direct Connect connections to external networks.

Full explanation →

1462

MCQmedium

A company has deployed a web application on an EC2 instance that needs to access an S3 bucket and a DynamoDB table. The instance is in a private subnet. Which approach meets the security best practice of avoiding long-lived credentials on the instance?

A.Store IAM user access keys in the application configuration file.

B.Configure security group rules to allow outbound traffic to S3 and DynamoDB endpoints.

C.Use AWS Systems Manager Parameter Store to store credentials and retrieve them at runtime using the instance's IAM role.

D.Create an IAM role with policies granting access to S3 and DynamoDB, and attach the role to the EC2 instance profile.

AnswerD

The instance can obtain temporary credentials from the instance metadata service, eliminating the need for long-lived credentials.

Why this answer

The best practice is to attach an IAM role with the necessary permissions to the EC2 instance. The instance automatically obtains temporary credentials via the instance metadata service, avoiding long-lived credentials. Option D is correct.

Option A (IAM user access keys) is not recommended as they are long-lived. Option B (security group rules) controls network traffic but does not grant access to S3 or DynamoDB. Option C (AWS Systems Manager Parameter Store) still requires credentials to access the parameters, which would not eliminate long-lived credentials.

Full explanation →

1463

MCQeasy

A company wants to allow its VPC to access an S3 bucket securely without traversing the internet. Which AWS resource enables private connectivity between a VPC and S3?

A.Internet Gateway

B.AWS Site-to-Site VPN

C.VPC Gateway Endpoint

D.NAT Gateway

AnswerC

A VPC Gateway Endpoint uses AWS-managed route tables to direct S3 traffic through AWS’s internal network, bypassing the public internet entirely. This satisfies the company’s constraint of private connectivity by enabling access via prefix lists in the VPC’s route table, without requiring a NAT gateway, internet gateway, or VPN. The endpoint operates at the network layer, supporting only S3 and DynamoDB, and does not use private IP addresses or transit through a VPC’s subnet.

Why this answer

A VPC Gateway Endpoint (C) is the correct choice because it provides private, direct connectivity between a VPC and S3 without traversing the internet. It uses AWS PrivateLink to route traffic through the AWS network, using prefix lists in the VPC route table to direct S3 traffic to the endpoint, ensuring data never leaves the AWS backbone.

Exam trap

The trap here is that candidates often confuse Gateway Endpoints with Interface Endpoints, assuming S3 requires an Interface Endpoint, but S3 only supports Gateway Endpoints for private connectivity.

How to eliminate wrong answers

Option A is wrong because an Internet Gateway enables internet-bound traffic from a VPC, which would route S3 traffic over the public internet, violating the requirement for private connectivity. Option B is wrong because AWS Site-to-Site VPN creates an encrypted tunnel over the internet to an on-premises network, not to AWS services like S3, and still involves internet transit. Option D is wrong because a NAT Gateway allows outbound internet traffic from private subnets but does not provide private connectivity to S3; it still routes traffic through the internet gateway and over the public internet.

Full explanation →

1464

MCQhard

A CloudFormation stack created a VPC Gateway Endpoint for S3 with the above policy. An EC2 instance in the VPC is unable to download objects from the S3 bucket using the AWS CLI. The instance has an IAM role with s3:GetObject permission. What is the most likely cause?

A.The security group associated with the VPC Endpoint blocks traffic.

B.The VPC Endpoint policy does not allow s3:GetObject.

C.The VPC Endpoint policy does not allow s3:ListBucket, which is needed for the CLI to list objects.

D.The route table for the private subnet does not have a route to the VPC Endpoint.

AnswerC

The CLI often lists objects first, requiring ListBucket permission.

Why this answer

The VPC Endpoint policy shown in the CloudFormation stack (typically allows only s3:GetObject) does not include s3:ListBucket, which is required by the AWS CLI to list objects in a bucket before downloading them. Even though the IAM role has s3:GetObject, the endpoint policy is an additional layer that must also allow the action. Option A is incorrect because Gateway Endpoints do not use security groups.

Option B is incorrect because the endpoint policy does allow s3:GetObject, but the issue is missing ListBucket. Option D is incorrect because the route table must have a route to the endpoint, but the question implies the endpoint is created and associated; the problem is the policy.

Full explanation →

1465

Multi-Selecthard

A company is designing a network security architecture for a VPC that hosts a multi-tier application. The security team requires that the web tier can only be accessed from the internet, the application tier can only be accessed from the web tier, and the database tier can only be accessed from the application tier. Additionally, the team needs to ensure that no traffic can bypass these controls. Which THREE actions should the team take?

Select 3 answers

A.Use security group rules that reference other security groups as sources.

B.Configure security groups to allow only necessary traffic between tiers.

C.Configure network ACLs (NACLs) to allow only necessary traffic between subnets as a defense-in-depth measure.

D.Enable VPC Flow Logs on all subnets and send logs to Amazon S3.

E.Attach an internet gateway to the VPC and add a default route to the internet gateway in the web tier subnet's route table.

AnswersA, B, C

This allows allowing traffic from instances in another security group, enforcing tier-to-tier access.

Why this answer

Security group rules can reference other security groups as sources, which allows the web tier security group to permit traffic only from the application tier security group, and the application tier security group to permit traffic only from the database tier security group. This creates a logical, stateful firewall that enforces the required traffic flow between tiers without relying on IP addresses, ensuring that no traffic can bypass the controls even if subnet configurations change.

Exam trap

The trap here is that candidates often confuse VPC Flow Logs (a monitoring tool) with a security control, or they mistakenly think that adding an internet gateway alone enforces the tier-to-tier access rules, when in fact the correct actions must directly restrict traffic flow between tiers using security group references, security group rules, and NACLs.

Full explanation →

1466

MCQmedium

Refer to the exhibit. A security engineer applies this S3 bucket policy. What is the result of this policy?

A.All objects must be encrypted with SSE-S3 or SSE-KMS.

B.All PutObject requests must use SSE-KMS encryption.

C.All objects must be encrypted with a specific KMS key.

D.All PutObject requests are allowed regardless of encryption.

AnswerB

The policy denies if encryption is not aws:kms.

Why this answer

The S3 bucket policy denies s3:PutObject unless the request uses SSE-KMS encryption (condition StringNotEquals 'aws:kms'). This forces all PutObject requests to use SSE-KMS. Option A is incorrect because the policy does not allow SSE-S3; only SSE-KMS is permitted.

Option C is incorrect because the policy does not require a specific KMS key; it only checks that encryption is SSE-KMS. Option D is incorrect because the policy explicitly denies requests without SSE-KMS, not allows all.

Full explanation →

1467

MCQhard

A network engineer is designing a multi-region architecture using AWS Transit Gateway and wants to minimize inter-region latency for data transfer between VPCs. The application requires high throughput and low latency. Which design should be used?

A.Establish VPC peering connections between all VPCs across regions

B.Use AWS Site-to-Site VPN between Transit Gateways in each region

C.Configure VPC endpoints to route traffic through AWS backbone

D.Use Transit Gateway inter-region peering between Transit Gateways

AnswerD

This provides low-latency, high-throughput connectivity.

Why this answer

Transit Gateway inter-region peering allows direct connectivity between Transit Gateways in different regions, using the AWS global backbone to minimize latency and maximize throughput. Option A (VPC peering) does not scale to multiple VPCs and regions. Option B (Site-to-Site VPN) introduces encryption overhead and potential latency.

Option C (VPC endpoints) are for accessing AWS services, not for inter-VPC traffic. Therefore, Option D is the correct design for minimizing inter-region latency and achieving high throughput.

Full explanation →

1468

MCQeasy

A company wants to encrypt all data in transit between its on-premises data center and AWS. They are using AWS Direct Connect for connectivity. Which additional configuration is required to ensure encryption?

A.Use MACsec to encrypt the Direct Connect connection

B.Configure TLS on all applications

C.No additional configuration is needed; Direct Connect encrypts traffic automatically

D.Set up an IPsec VPN over the Direct Connect connection

AnswerD

IPsec provides encryption for the entire traffic.

Why this answer

Direct Connect does not provide encryption by default. To encrypt data in transit over Direct Connect, you need to set up an IPsec VPN over the Direct Connect connection. Option A is incorrect because MACsec encrypts at Layer 2, but it is not available on all Direct Connect connections and is different from IPsec.

Option B is incorrect because TLS is for application-level encryption, which may not cover all traffic. Option C is incorrect because Direct Connect does not encrypt traffic automatically. Therefore, option D is correct.

Full explanation →

1469

MCQhard

A company is migrating a legacy application to AWS. The application requires that all traffic between the web and application tiers be encrypted, but the application does not support TLS. What should a network engineer do to meet this requirement without modifying the application?

A.Establish a VPN connection between the web and application instances.

B.Use a Network Load Balancer (NLB) with TLS termination and target groups with TCP, then enable encryption on the NLB.

C.Use an Application Load Balancer (ALB) with TLS termination between the tiers.

D.Use a Classic Load Balancer with TCP listeners.

AnswerA

Correct. A VPN connection between instances encrypts all traffic at the network layer, so the application does not need to support TLS. This meets the requirement without modifying the application.

Why this answer

Establishing a VPN connection between the web and application instances encrypts all traffic at the network layer, making encryption transparent to the application. This meets the requirement without modifying the application. Option B is incorrect because a Network Load Balancer with TLS termination only encrypts traffic between clients and the NLB; traffic from the NLB to targets is sent in cleartext, so targets must support TLS for end-to-end encryption.

Since the application does not support TLS, this does not satisfy the requirement. Option C is incorrect because an Application Load Balancer terminates TLS but forwards HTTP traffic to targets in cleartext. Option D is incorrect because a Classic Load Balancer with TCP listeners does not provide any encryption.

Full explanation →

1470

Drag & Dropmedium

Order the steps to set up a redundant Direct Connect connection with two virtual interfaces in different AWS regions:

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

First provision the connections, then create VIFs, configure BGP, tune routing, then test failover.

Full explanation →

1471

MCQhard

An IAM policy is attached to a user who needs to manage VPC peering connections. The policy allows creating and accepting peering connections, but the user reports they cannot add routes to the route table of their VPC (vpc-11111111) for the peered connection. What is the most likely cause?

A.The condition in the policy restricts the VPC, but the route table is not associated with that VPC.

B.The user does not have permission to create routes.

C.The user needs additional permissions for the peering connection.

D.The user needs to accept the peering connection first.

AnswerA

Condition limits to specific VPC ARN, but route table may have different ARN.

Why this answer

The IAM policy includes a condition that restricts the VPC (e.g., `ec2:Vpc` condition key set to `vpc-11111111`), but the route table the user is trying to modify is not associated with that VPC. Even though the user has permissions to create and accept peering connections, the condition on the route table modification action (like `ec2:CreateRoute`) limits the operation to route tables belonging to the specified VPC. Since the route table belongs to a different VPC or is not associated with `vpc-11111111`, the request fails.

Exam trap

AWS often tests the misconception that route table modifications are solely governed by the `ec2:CreateRoute` action, ignoring that IAM conditions like `ec2:Vpc` can restrict the operation based on the route table's associated VPC, leading candidates to incorrectly choose Option B.

How to eliminate wrong answers

Option B is wrong because the user does have permission to create routes (the policy allows managing VPC peering connections, which typically includes `ec2:CreateRoute` for the peered VPC), but the condition on the VPC is the actual blocker. Option C is wrong because the user already has the necessary permissions for the peering connection (create and accept), and the issue is not about additional peering permissions but about the route table's VPC association. Option D is wrong because accepting the peering connection is a separate step that the user can already perform (the policy allows it), and the route cannot be added until the peering connection is in the 'active' state, but the error reported is about adding routes, not about the peering state.

Full explanation →

1472

MCQhard

A company has a VPC with CIDR 10.0.0.0/16. They have a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). They have a Network Load Balancer (NLB) in the public subnet, and EC2 instances in the private subnet. The NLB has a target group pointing to the EC2 instances. The security group for the EC2 instances allows traffic from the NLB's private IP addresses on port 80. The network ACL for the private subnet allows inbound traffic on port 80 from the public subnet CIDR and outbound ephemeral ports to 0.0.0.0/0. However, clients connecting to the NLB experience intermittent timeouts. The network engineer checks the NLB logs and sees that connections are established but occasionally drop. The engineer also notices that the EC2 instances have a default route to a NAT Gateway in the public subnet. What is the most likely cause of the intermittent timeouts?

A.Cross-zone load balancing is disabled on the NLB.

B.The NLB health checks are failing, causing targets to be removed.

C.The EC2 instances have a default route to the NAT Gateway, causing asymmetric routing.

D.The security group for the NLB is blocking inbound traffic.

AnswerC

Return traffic goes to NAT instead of NLB, breaking the connection.

Why this answer

The NLB with client IP preservation sends traffic to targets with the client's source IP. The EC2 instances have a default route pointing to the NAT Gateway. When the instance responds to a client, the response is routed to the NAT Gateway (because the destination is the client's IP, which is outside the VPC).

The NAT Gateway then sends the response to the internet, but the client expects the response from the NLB's IP address. This asymmetric routing causes the NLB to not see the response, leading to intermittent timeouts. Options A, B, and D are incorrect: disabling cross-zone load balancing does not cause timeouts, health checks are independent, and NLB does not have security groups.

Full explanation →

1473

MCQhard

A company is designing a highly available network for a critical application that requires sub-second failover between two AWS regions. The application uses active-active traffic distribution. Which routing policy should they use in Amazon Route 53?

A.Latency routing with health checks

B.Failover routing

C.Geolocation routing

D.Weighted routing

AnswerA

Correct: Distributes traffic based on latency and health.

Why this answer

Latency routing with health checks is the correct choice because it directs traffic to the region that provides the lowest latency for each user, and when combined with health checks, Route 53 can automatically route traffic away from unhealthy endpoints. This enables sub-second failover between two active-active regions, as Route 53's DNS-based health checking and routing updates occur quickly (typically within a few seconds) without requiring manual intervention or a primary/secondary failover model.

Exam trap

The ANS-C01 exam often tests the misconception that Failover routing is the only way to achieve high availability, but the trap here is that the question specifies active-active traffic distribution, which requires a routing policy that supports multiple healthy endpoints simultaneously, not a primary/standby model.

How to eliminate wrong answers

Option B (Failover routing) is wrong because it is designed for active-passive configurations, where one region is primary and the other is standby; it does not support active-active traffic distribution and would not provide sub-second failover for an active-active design. Option C (Geolocation routing) is wrong because it routes traffic based on the geographic location of the user, not on real-time endpoint health or latency, and it cannot dynamically shift traffic between regions for sub-second failover. Option D (Weighted routing) is wrong because it distributes traffic based on fixed weights assigned to records, and while it can be combined with health checks, it does not inherently optimize for latency or provide the automatic, sub-second failover behavior required for an active-active architecture.

Full explanation →

1474

MCQhard

A security engineer is designing a network security architecture for a multi-account AWS environment using AWS Organizations. The company requires that all VPC flow logs be delivered to a central S3 bucket in the security account. The security engineer has created a bucket policy that grants the necessary permissions. However, flow logs from member accounts are failing to be delivered. What is the most likely cause?

A.The member accounts have not created an IAM role with permissions to write to the central bucket.

B.The bucket policy does not include a condition that restricts access to the flow log delivery service using aws:SourceArn or aws:SourceAccount.

C.The bucket policy does not grant write access to the member accounts' root user.

D.The central S3 bucket has not been configured with ACLs enabled.

AnswerB

This condition is essential to prevent the confused deputy problem.

Why this answer

The VPC Flow Logs delivery service uses a service-linked role to write to the destination S3 bucket. Without a condition in the bucket policy that restricts access using `aws:SourceArn` or `aws:SourceAccount`, the policy is vulnerable to the confused deputy problem, where a different AWS service or account could potentially write to the bucket. The missing condition causes the delivery to fail because the service cannot verify that the request originated from the expected source.

Exam trap

AWS often tests the confused deputy problem in cross-account service delivery scenarios, and the trap here is that candidates mistakenly focus on IAM roles or root user permissions instead of recognizing that the bucket policy must include a source condition to prevent unauthorized access.

How to eliminate wrong answers

Option A is wrong because VPC Flow Logs use a service-linked role (AWSServiceRoleForVPCFlowLogs) that is automatically created in each member account; the engineer does not need to manually create an IAM role for writing to the central bucket. Option C is wrong because granting write access to the member accounts' root user is unnecessary and overly permissive; the bucket policy should grant permissions to the VPC Flow Logs service principal (delivery.logs.amazonaws.com) with the appropriate source condition. Option D is wrong because S3 ACLs are not required for this use case; bucket policies alone can grant cross-account access, and disabling ACLs (the default in modern AWS) does not prevent flow log delivery.

Full explanation →

1475

Matchingmedium

Match each AWS service or feature to its primary function in network architecture.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Hub-and-spoke connectivity between VPCs and on-premises

Dedicated network connection from on-premises to AWS

Direct network connection between two VPCs

Private access to services across VPCs and accounts

Encrypted tunnel over the internet to AWS

Why these pairings

Correct matches: VPC is an isolated virtual network; Direct Connect is a dedicated physical connection; VPN is an encrypted internet-based connection; Route 53 is a DNS service. Common confusions include mixing Direct Connect with VPN and VPC with Direct Connect.

Full explanation →

1476

MCQeasy

A company is deploying a multi-tier application in a VPC. The web servers must be accessible from the internet, while the application servers must only be accessible from the web servers. Which architecture meets these requirements?

A.All servers in private subnets; use a load balancer in a public subnet.

B.Web servers in private subnets; application servers in public subnets with an Internet Gateway.

C.All servers in public subnets; use Security Groups to restrict access.

D.Web servers in public subnets with an Internet Gateway; application servers in private subnets with a route to the NAT Gateway.

AnswerD

This provides internet access to web servers while keeping app servers private.

Why this answer

It places web servers in public subnets with an Internet Gateway (IGW) for direct internet access, while application servers reside in private subnets that lack a direct route to the IGW. The private subnets have a route to a NAT Gateway, allowing the application servers to initiate outbound internet connections (e.g., for updates) without being reachable from the internet. Security Groups on the application servers can further restrict inbound traffic to only the web servers' security group, ensuring the application tier is isolated.

Exam trap

AWS often tests the misconception that Security Groups alone can fully isolate traffic in a public subnet, but the trap here is that instances in public subnets still have public IP addresses and are reachable from the internet unless explicitly blocked by a Network ACL or Security Group, which is less reliable than using private subnets with no IGW route.

How to eliminate wrong answers

Option A is wrong because placing all servers in private subnets and using a load balancer in a public subnet would make the web servers inaccessible from the internet unless the load balancer is configured as an internet-facing load balancer and the web servers are in private subnets with a route to the load balancer; however, the description 'all servers in private subnets' implies the web servers themselves are not directly internet-accessible, which contradicts the requirement that web servers must be accessible from the internet. Option B is wrong because placing application servers in public subnets with an Internet Gateway would expose them directly to the internet, violating the requirement that they must only be accessible from the web servers. Option C is wrong because placing all servers in public subnets with an Internet Gateway would expose both web and application servers to the internet, and while Security Groups can restrict traffic, the application servers would still have public IP addresses and be reachable from the internet if the Security Group rules are misconfigured or if a user accidentally allows broader access; the requirement demands that application servers must only be accessible from the web servers, which is best achieved by placing them in private subnets with no direct internet path.

Full explanation →

1477

MCQeasy

A company has a VPC with a public subnet and a private subnet. The private subnet contains Amazon RDS instances that should only be accessed by EC2 instances in the same VPC. The EC2 instances are in a security group named 'App-SG'. Which configuration will meet the requirement?

A.Configure a network ACL on the private subnet to allow inbound traffic from the VPC CIDR.

B.Configure a network ACL on the private subnet to allow inbound traffic from the public subnet CIDR.

C.Configure a security group on the RDS instances to allow inbound traffic from the 'App-SG' security group.

D.Configure a security group on the RDS instances to allow inbound traffic from the VPC CIDR.

AnswerC

Security group referencing another security group allows only instances with that security group.

Why this answer

Security groups are stateful and can reference other security groups as a source, allowing traffic from all instances associated with the source security group. By configuring the RDS security group to allow inbound traffic from 'App-SG', only EC2 instances in that group can access the RDS instances, meeting the requirement without exposing the database to the entire VPC CIDR.

Exam trap

The trap here is that candidates often confuse security groups with network ACLs, or assume that allowing the VPC CIDR is sufficient, not realizing that security group references provide more precise, instance-level access control than CIDR-based rules.

How to eliminate wrong answers

Option A is wrong because network ACLs are stateless and apply at the subnet level, not the instance level; allowing inbound traffic from the VPC CIDR would permit any resource in the VPC (including unauthorized instances) to access the RDS instances, and would also require explicit outbound rules for return traffic. Option B is wrong because allowing inbound traffic from the public subnet CIDR is overly permissive and does not restrict access to only the EC2 instances in 'App-SG'; it would also allow any instance in the public subnet, not just those in the security group. Option D is wrong because allowing inbound traffic from the VPC CIDR via a security group would permit any resource in the VPC (including unauthorized instances or services) to access the RDS instances, violating the requirement for access only by EC2 instances in 'App-SG'.

Full explanation →

1478

MCQmedium

Refer to the exhibit. A network engineer has configured VPC Flow Logs for a VPC and is verifying the logs. The flow logs are being delivered to CloudWatch Logs, but the engineer notices that the logs do not contain the 'srcaddr' and 'dstaddr' fields. What is the most likely cause?

A.The flow log is configured with TrafficType set to 'REJECT' only

B.The IAM role FlowLogRole does not have permission to write to CloudWatch Logs

C.The flow log is configured with a MaxAggregationInterval of 60 seconds, which causes fields to be omitted

D.The flow log is using the default log format, which does not include source and destination addresses

AnswerD

The default format does not include srcaddr and dstaddr; a custom format is required.

Why this answer

The default log format for VPC Flow Logs does not include source and destination addresses. To include those fields, you must specify a custom format with `${srcaddr}` and `${dstaddr}`. Since the logs are missing these fields, the flow log is likely using the default format rather than a custom one.

Full explanation →

1479

MCQmedium

A company is designing a multi-Region architecture with active-active failover for a web application. The application uses Application Load Balancers (ALBs) in two AWS Regions. Traffic must be routed to the closest healthy Region with automatic failover. Which AWS service should be used to route traffic?

A.Network Load Balancer with cross-zone load balancing

B.Amazon CloudFront with multiple origins

C.Amazon Route 53 with latency-based routing and health checks

D.AWS Global Accelerator

AnswerC

Route 53 latency routing directs traffic to the Region with the lowest latency, and health checks automatically fail over to the next best Region.

Why this answer

Amazon Route 53 with latency-based routing and health checks is the correct choice because it directs traffic to the AWS Region with the lowest latency for each user, and health checks automatically fail over to the next best healthy Region if an ALB becomes unhealthy. This satisfies the active-active failover requirement without introducing additional caching or anycast complexities.

Exam trap

The ANS-C01 exam often tests the distinction between DNS-based routing (Route 53) and anycast-based traffic steering (Global Accelerator), where candidates mistakenly choose Global Accelerator because it provides low-latency routing, but it does not natively support active-active failover between two independent ALBs in different Regions without additional custom logic.

How to eliminate wrong answers

Option A is wrong because a Network Load Balancer operates at Layer 4 and does not provide cross-Region routing or DNS-based latency steering; cross-zone load balancing only distributes traffic within a single Region. Option B is wrong because Amazon CloudFront is a content delivery network that caches content at edge locations; it does not natively route traffic to the closest healthy ALB based on latency for dynamic workloads without custom origin failover configurations, and it is not designed for active-active DNS failover. Option D is wrong because AWS Global Accelerator uses anycast IPs to direct traffic to the nearest edge location, but it then forwards traffic to a single regional endpoint or a weighted set; it does not provide latency-based DNS routing with automatic failover between two independent ALBs in different Regions in the same way Route 53 does.

Full explanation →

1480

Multi-Selecteasy

A company is designing a VPC for a three-tier application. The web tier must be accessible from the internet, the application tier must only be accessible from the web tier, and the database tier must only be accessible from the application tier. Which THREE design elements are required? (Choose THREE.)

Select 3 answers

A.A public subnet for the web tier with an internet gateway

B.A private subnet for the database tier with a route to the application subnet

C.A private subnet for the application tier with a route to the web subnet

D.A NAT gateway in the public subnet for outbound traffic from private subnets

E.A VPN connection to on-premises

AnswersA, B, C

Provides internet access to web servers.

Why this answer

The web tier requires direct internet accessibility, which is achieved by placing it in a public subnet associated with an internet gateway. The internet gateway provides a target for the subnet's route table to allow inbound traffic from the internet and outbound responses, enabling users to reach the web application.

Exam trap

The ANS-C01 exam often tests the misconception that a NAT gateway is required for private subnets in any multi-tier architecture, but here the private subnets only need internal routing between tiers, not outbound internet access.

Full explanation →

1481

MCQeasy

A company is designing a network security architecture for a multi-account AWS environment. They need to centrally inspect and filter traffic between VPCs using a third-party firewall appliance. Which AWS service should they use to route traffic through the inspection VPC?

A.VPC Peering

B.AWS Direct Connect

C.AWS Transit Gateway

D.VPC Endpoints

AnswerC

Supports hub-and-spoke architecture with inspection VPC.

Why this answer

AWS Transit Gateway allows centralized routing and can forward traffic to a central inspection VPC for firewall inspection. Option A is wrong because VPC Peering does not support transitive routing and is not centralized. Option B is wrong because AWS Direct Connect is for on-premises connectivity, not inter-VPC routing.

Option D is wrong because VPC Endpoints are for private access to AWS services, not for routing inter-VPC traffic.

Full explanation →

1482

MCQhard

A company is using an AWS Transit Gateway to connect multiple VPCs and on-premises networks via Direct Connect. The network team notices that traffic from an on-premises network (CIDR 172.16.0.0/12) to a VPC (CIDR 10.0.0.0/16) is being dropped. The transit gateway route table shows a static route for 10.0.0.0/16 pointing to the VPC attachment. The Direct Connect virtual interface (VIF) is associated with the transit gateway and the on-premises router is advertising 172.16.0.0/12 via BGP. What is the most likely cause of the traffic being dropped?

A.The VPC has a route that points to the transit gateway for the on-premises CIDR, causing asymmetric routing.

B.The Direct Connect VIF is not configured with BFD.

C.The transit gateway route table does not have a route for the on-premises CIDR (172.16.0.0/12) pointing to the Direct Connect attachment.

D.The VPC route table does not have a route for the on-premises CIDR pointing to the transit gateway.

AnswerC

The transit gateway needs a route for the on-premises CIDR to forward return traffic to the Direct Connect attachment.

Why this answer

The transit gateway route table must contain a route for the on-premises CIDR (172.16.0.0/12) pointing to the Direct Connect attachment for return traffic to be forwarded correctly. Without this route, the transit gateway has no path for traffic destined to the on-premises network, causing it to be dropped. The static route for 10.0.0.0/16 only handles traffic toward the VPC, not the return direction.

Exam trap

The trap here is that candidates often assume the transit gateway automatically learns routes from BGP advertisements over Direct Connect and installs them into the route table, but in reality, you must either propagate the attachment or add a static route for the on-premises CIDR.

How to eliminate wrong answers

Option A is wrong because asymmetric routing would not cause traffic to be dropped; it would still be delivered, though potentially with issues. Option B is wrong because BFD (Bidirectional Forwarding Detection) is used for fast failure detection, not for enabling traffic forwarding; its absence does not cause traffic to be dropped. Option D is wrong because the VPC route table is irrelevant for traffic originating from on-premises; the issue is the transit gateway's lack of a return route for the on-premises CIDR.

Full explanation →

1483

Multi-Selectmedium

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company does not want to assign public IP addresses to the instance. Which combination of resources is required? (Choose TWO.)

Select 2 answers

A.VPN connection to the on-premises data center

B.NAT Gateway in a public subnet

C.VPC endpoint for Amazon S3

D.Internet Gateway attached to the VPC

AnswersB, D

The NAT Gateway enables outbound internet traffic for instances in private subnets.

Why this answer

A NAT Gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway. An Internet Gateway is needed for the NAT Gateway to reach the internet, but the question asks for resources; the IGW is already implied.

A VPC endpoint is for AWS services, not internet. A VPN connection is for on-premises connectivity.

Full explanation →

1484

MCQeasy

A company is designing a hybrid network connecting an on-premises data center to AWS via AWS Direct Connect. The company requires high availability and wants to avoid a single point of failure. Which design meets these requirements?

A.Provision a single Direct Connect connection with multiple virtual interfaces (VIFs).

B.Provision one Direct Connect connection with two VLANs to separate production and non-production traffic.

C.Use a single Direct Connect connection and a VPN backup over the internet.

D.Provision two Direct Connect connections at two different Direct Connect locations.

AnswerD

Two connections at different locations provide physical diversity and high availability.

Why this answer

Provisioning two Direct Connect connections at two different Direct Connect locations eliminates any single point of failure. This design ensures that if one connection or location fails, traffic can automatically fail over to the other connection, meeting the high availability requirement. A single Direct Connect connection, regardless of the number of VIFs or VLANs, remains a single point of failure.

Exam trap

AWS often tests the misconception that multiple VIFs or VLANs on a single Direct Connect connection provide redundancy, but they do not eliminate the physical single point of failure of the connection itself.

How to eliminate wrong answers

Option A is wrong because a single Direct Connect connection with multiple virtual interfaces (VIFs) still relies on a single physical link and single Direct Connect location; if that connection fails, all VIFs go down, so it does not avoid a single point of failure. Option B is wrong because using one Direct Connect connection with two VLANs only separates traffic logically on the same physical link; it does not provide physical redundancy, so a failure of the single connection takes down both VLANs. Option C is wrong because while a VPN backup over the internet provides a failover path, the primary single Direct Connect connection is still a single point of failure; the design does not meet the requirement to avoid a single point of failure for the primary connection, and the VPN backup may have lower performance and higher latency.

Full explanation →

1485

Multi-Selecteasy

Which TWO of the following are valid components of an AWS Transit Gateway design for connecting multiple VPCs and on-premises networks?

Select 2 answers

A.VPC Endpoint Gateway

B.Transit Gateway endpoint attached to a subnet in a VPC

C.Direct Connect Gateway associated with a Transit Gateway

D.Transit Gateway route table

E.Transit Gateway peering attachment

AnswersD, E

Route tables control traffic between attachments.

Why this answer

A Transit Gateway route table is a fundamental component that controls how traffic is routed between attachments (VPCs, VPNs, Direct Connect) within the Transit Gateway. Each attachment is associated with exactly one route table, and route propagation enables dynamic learning of routes across the network.

Exam trap

AWS often tests the misconception that a Transit Gateway endpoint attaches to a subnet like a VPC endpoint, but in reality, Transit Gateway attachments are VPC-level constructs that require a subnet in each AZ for the attachment's elastic network interfaces.

Full explanation →

1486

Multi-Selecthard

A company uses AWS Direct Connect with a public VIF to access S3. The on-premises network uses BGP to advertise a specific prefix to AWS. The company wants to ensure that traffic to S3 from on-premises always uses the Direct Connect connection and not the internet. Which ONE configuration must be in place?

Select 1 answer

A.Set a higher MED value on routes learned from the internet to make them less preferred.

B.Set a higher local preference on the Direct Connect BGP session for the S3 prefixes.

C.Disable the internet gateway for the VPC.

D.Set the AS_PATH prepend on the Direct Connect BGP session.

E.Configure the on-premises router to advertise a more specific route for the S3 CIDR blocks over the Direct Connect BGP session.

AnswersB

Local preference influences outbound route selection; higher value is preferred.

Why this answer

To ensure on-premises traffic to S3 uses Direct Connect (public VIF) instead of the internet, the primary mechanism is to set a higher local preference on the Direct Connect BGP session for the S3 prefixes (B). Local preference is evaluated first in the BGP path selection process, making the Direct Connect path more attractive than internet paths. Option E is incorrect because the on-premises router does not advertise S3 CIDRs; AWS advertises them.

Other methods like MED or AS path prepend are not as effective for this scenario when comparing routes from different ASes.

Full explanation →

1487

MCQhard

A company has a VPC with multiple subnets across three Availability Zones. They are deploying an NFS file system using Amazon EFS. They need high availability and low latency from all subnets. Which EFS deployment option meets these requirements?

A.Use EFS One Zone storage class with a single mount target in the same Availability Zone as the application.

B.Use EFS Standard storage class with Multi-AZ and create a single mount target in one Availability Zone.

C.Use EFS Standard storage class with Multi-AZ and create mount targets in each Availability Zone.

D.Use EFS One Zone storage class and create mount targets in each Availability Zone.

AnswerC

Standard storage is replicated across AZs; mount targets in each AZ provide low latency.

Why this answer

The EFS Standard storage class provides Multi-AZ durability and availability, and creating mount targets in each Availability Zone ensures that EC2 instances in any subnet can connect to EFS with low latency by using a mount target in the same AZ. This architecture avoids cross-AZ data transfer charges and minimizes latency, meeting both high availability and low latency requirements.

Exam trap

The ANS-C01 exam often tests the misconception that creating mount targets in every AZ alone guarantees high availability, but the storage class must also be Multi-AZ (Standard) to replicate data across AZs; otherwise, a single-AZ failure can cause data loss.

How to eliminate wrong answers

Option A is wrong because EFS One Zone storage class stores data in a single Availability Zone, which does not provide high availability across multiple AZs, and a single mount target cannot serve instances in other AZs with low latency. Option B is wrong because although EFS Standard is Multi-AZ, creating only one mount target forces instances in other AZs to route traffic across AZs, incurring higher latency and cross-AZ data transfer costs. Option D is wrong because EFS One Zone storage class is not Multi-AZ, so even with mount targets in each AZ, the underlying data is not replicated across AZs, failing the high availability requirement.

Full explanation →

1488

MCQmedium

A company is deploying a web application across multiple Availability Zones in a VPC. The application needs to be highly available and scale based on traffic. The architecture includes an Application Load Balancer (ALB) in front of EC2 instances in an Auto Scaling group. The company wants to ensure that if an Availability Zone fails, the ALB can still route traffic to healthy instances in other zones. What should the network engineer implement to meet this requirement?

A.Configure a Network Load Balancer instead of an ALB, and enable cross-zone load balancing.

B.Use an ALB with a target group that contains instances from only one Availability Zone, and use Route 53 health checks.

C.Deploy one ALB in each Availability Zone and use Route 53 latency-based routing.

D.Enable cross-zone load balancing on the ALB.

AnswerD

Cross-zone load balancing allows the ALB to distribute traffic across instances in all enabled AZs, providing high availability.

Why this answer

Enabling cross-zone load balancing on an Application Load Balancer (ALB) allows it to distribute incoming traffic evenly across all registered targets in all enabled Availability Zones. If an entire Availability Zone fails, the ALB automatically routes traffic only to healthy instances in the remaining zones, ensuring high availability without requiring manual intervention or additional components.

Exam trap

The ANS-C01 exam often tests the misconception that cross-zone load balancing is only relevant for Network Load Balancers or that it must be explicitly enabled for ALBs, when in fact ALBs have it enabled by default and it is the key mechanism for multi-AZ failover.

How to eliminate wrong answers

Option A is wrong because a Network Load Balancer (NLB) does not inherently provide better zone failover than an ALB; cross-zone load balancing is disabled by default on NLB and must be explicitly enabled, but the requirement specifically asks for an ALB, and the ALB already supports cross-zone load balancing. Option B is wrong because using a target group with instances from only one Availability Zone defeats the purpose of multi-AZ high availability; if that single zone fails, no healthy instances remain, and Route 53 health checks cannot reroute traffic to other zones because the ALB itself is a single endpoint. Option C is wrong because deploying one ALB per Availability Zone and using Route 53 latency-based routing introduces unnecessary complexity and does not guarantee seamless failover; each ALB is an independent endpoint, and if a zone fails, its ALB becomes unreachable, requiring DNS propagation delays and client-side retries, which violates the requirement for immediate traffic rerouting.

Full explanation →

1489

MCQeasy

A company has several VPCs in the same AWS account and region. They want to centrally manage and monitor network traffic between these VPCs and also to on-premises networks. Which AWS service should they use?

A.AWS Direct Connect

B.VPC Peering

C.Transit Gateway

D.AWS VPN CloudHub

AnswerC

Transit Gateway provides a hub-and-spoke architecture for connecting multiple VPCs and on-premises networks.

Why this answer

AWS Transit Gateway (C) is the correct choice because it acts as a central hub to interconnect multiple VPCs and on-premises networks using a single gateway, simplifying network management and enabling centralized monitoring. It supports transitive routing between all attached networks, which is essential for the company's requirement to manage and monitor traffic across many VPCs and their on-premises environment.

Exam trap

The trap here is that candidates often confuse VPC Peering's ability to connect VPCs with the need for transitive routing, mistakenly thinking a mesh of peering connections is simpler than Transit Gateway, but they overlook the operational overhead and lack of centralized management.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect is a dedicated physical connection from on-premises to AWS, but it does not provide inter-VPC connectivity or centralized management of traffic between multiple VPCs; it only extends the on-premises network to AWS. Option B is wrong because VPC Peering creates a one-to-one, non-transitive connection between two VPCs, requiring a full mesh of peering connections for multiple VPCs, which becomes unmanageable and does not support centralized monitoring or on-premises integration without additional components. Option D is wrong because AWS VPN CloudHub is designed for connecting multiple remote sites (e.g., branch offices) to a single AWS VPN endpoint, not for interconnecting multiple VPCs within the same region or centrally managing VPC-to-VPC traffic.

Full explanation →

1490

MCQhard

A company uses AWS Direct Connect with a private VIF to connect to a VPC. They have an on-premises application that needs to resolve private hosted zone names in Amazon Route 53. The on-premises DNS server forwards queries for the private domain to the VPC's DNS resolver. However, resolution fails. What is the most likely cause?

A.The private hosted zone is not associated with the VPC.

B.The VPC's DHCP option set is not configured to use the Route 53 Resolver.

C.The security group for the VPC DNS resolver is blocking inbound UDP port 53 from the on-premises network.

D.A Route 53 Resolver outbound endpoint is not configured to forward queries from on-premises to the VPC.

AnswerA

Correct. If the private hosted zone is not associated with the VPC, the VPC's DNS resolver will not have the zone's records, causing resolution failure even when queries are forwarded from on-premises.

Why this answer

The most likely cause is that the private hosted zone is not associated with the VPC. For Route 53 private hosted zones, the zone must be explicitly associated with the VPC in which the DNS resolver operates. If the zone is not associated, the VPC's DNS resolver (Route 53 Resolver) will not respond to queries for that domain, even if queries are forwarded from on-premises.

The on-premises DNS server forwards queries to the VPC's DNS resolver, but without zone association, the resolver has no knowledge of the private hosted zone. Options B and C are incorrect because DHCP option sets and security groups do not directly affect the VPC DNS resolver's ability to resolve private hosted zones. Option D is incorrect because an outbound endpoint is used to forward queries from the VPC to on-premises, not to accept inbound queries; the correct component would be an inbound endpoint, but the primary issue here is zone association.

Exam trap

The trap is that candidates often overlook the necessity of associating a private hosted zone with the VPC, and instead focus on DNS forwarding configurations like inbound/outbound endpoints. While an inbound endpoint is needed for on-premises resolution, the fundamental requirement is that the zone is associated with the VPC.

How to eliminate wrong answers

Option A is wrong because if the private hosted zone were not associated with the VPC, the VPC's DNS resolver would not be able to resolve the private domain at all, but the question states that the on-premises DNS server forwards queries to the VPC's DNS resolver, implying the VPC itself can resolve the domain; the issue is with the forwarding path, not the zone association. Option B is wrong because the DHCP option set for the VPC controls how instances in the VPC resolve DNS (e.g., using the VPC's DNS resolver IP), but it does not affect how the on-premises DNS server forwards queries to the VPC; the on-premises server is not using the VPC's DHCP options. Option C is wrong because the VPC's DNS resolver (the Route 53 Resolver) is not a traditional EC2 instance with a security group; it is an AWS-managed service that operates at the VPC network layer, and security groups do not apply to it; inbound UDP port 53 from on-premises is controlled by network ACLs or the Direct Connect routing, not by a security group.

Full explanation →

1491

MCQhard

A company uses AWS Direct Connect with a private VIF to connect its on-premises network to a VPC. The on-premises router advertises a specific route for a subnet (192.168.1.0/24) to the VPC via BGP. However, instances in the VPC cannot reach the 192.168.1.0/24 subnet. The VPC route table shows the route as 'active' and 'propagated' from the Direct Connect virtual interface. What is the most likely cause?

A.The security group for the VPC instances is blocking inbound traffic from the on-premises network.

B.The VPC has overlapping CIDR with the on-premises network.

C.The on-premises router is not advertising the correct BGP community.

D.The VPC route table does not have a route to the 192.168.1.0/24 subnet pointing to the virtual private gateway.

AnswerD

Route propagation does not automatically add the route to the route table; it must be associated.

Why this answer

Even though the VPC route table shows the route as 'active' and 'propagated', this might be the main route table. If the instance's subnet is associated with a different route table that does not have a route to 192.168.1.0/24 pointing to the virtual private gateway, traffic will not be directed properly. The most likely cause is that the subnet's route table lacks this specific route.

Option A is incorrect because security groups do not affect outbound traffic initiated by instances, and the issue is routing, not security. Option B is incorrect because overlapping CIDR would cause the route to not appear as active or propagated, contradicting the scenario. Option C is incorrect because BGP communities are not used for route propagation in Direct Connect private VIFs.

Full explanation →

1492

Multi-Selectmedium

A company has multiple VPCs that need to communicate with each other and with an on-premises network via AWS Transit Gateway. Which THREE of the following are valid attachment types for a transit gateway?

Select 3 answers

A.Direct Connect Gateway

B.Internet Gateway

C.Site-to-Site VPN connection

D.VPC

E.Network Load Balancer

AnswersA, C, D

Direct Connect Gateway can be associated with a transit gateway.

Why this answer

AWS Transit Gateway supports attachments to Direct Connect Gateways, enabling integration of Direct Connect virtual interfaces with the transit gateway for hybrid connectivity. This allows traffic from on-premises networks connected via Direct Connect to be routed through the transit gateway to multiple VPCs and other attachments.

Exam trap

The ANS-C01 exam often tests the misconception that any AWS networking component can be attached to a Transit Gateway, but only VPCs, Site-to-Site VPN connections, and Direct Connect Gateways are valid attachment types.

Full explanation →

1493

MCQeasy

A company has a VPC with public and private subnets. An EC2 instance in the private subnet needs to access the internet. The instance has a route table with a default route to a NAT gateway. However, the instance cannot reach the internet. What is the most likely cause?

A.The NAT gateway is placed in a private subnet.

B.The instance does not have a public IP address assigned.

C.The security group attached to the instance does not allow outbound HTTPS traffic.

D.The network ACL on the private subnet blocks outbound HTTP traffic.

AnswerA

NAT gateway must be in a public subnet with an internet gateway.

Why this answer

The most likely cause is that the NAT gateway is placed in a private subnet (Option A). A NAT gateway must be deployed in a public subnet with an associated Internet Gateway to route traffic to the internet. If it is in a private subnet, it cannot access the internet, thus the instance in the private subnet cannot reach the internet.

Option B is incorrect because an instance in a private subnet does not need a public IP address to access the internet through a NAT gateway; it uses the NAT gateway's public IP. Option C is incorrect because security groups are stateful and allow outbound traffic by default; the security group would not block HTTPS outbound unless explicitly configured. Option D is incorrect because the default network ACL allows all outbound traffic; even if modified, the question says the route table points to the NAT gateway, so the issue is the NAT gateway's placement.

Full explanation →

1494

MCQmedium

A network engineer configured VPC Flow Logs for a subnet to capture all traffic. After reviewing the logs in CloudWatch Logs, they notice that some logs show 'NODATA' for the log-status field. What does 'NODATA' indicate?

A.No network traffic was observed for the given capture period.

B.The flow log record was skipped due to an internal error.

C.The log record was successfully delivered to CloudWatch.

D.The traffic was rejected by a network ACL or security group.

AnswerA

Correct meaning.

Why this answer

When VPC Flow Logs display 'NODATA' for the log-status field, it indicates that no network traffic was observed for the subnet during the aggregation interval (typically 10 minutes). This is a normal status meaning the capture window had zero packets flowing through the monitored interfaces, not an error or delivery issue.

Exam trap

AWS often tests the distinction between 'NODATA' (no traffic) and 'SKIPDATA' (internal error), leading candidates to incorrectly associate 'NODATA' with rejected traffic or delivery failures.

How to eliminate wrong answers

Option B is wrong because 'NODATA' is not caused by an internal error; internal errors are reported as 'SKIPDATA' in the log-status field. Option C is wrong because a successful delivery to CloudWatch is indicated by 'OK' in the log-status field, not 'NODATA'. Option D is wrong because traffic rejected by a network ACL or security group is still captured and logged with an 'ACCEPT' or 'REJECT' action in the flow log record, not as 'NODATA'.

Full explanation →

1495

MCQmedium

A company is migrating a legacy application to AWS. The application requires a fixed IP address for outbound traffic to a partner's firewall. The application will run on Amazon EC2 instances in a private subnet. Which design meets the requirement without exposing the instances to inbound internet traffic?

A.Deploy a NAT gateway with an Elastic IP and route outbound traffic through it

B.Attach an Internet Gateway to the VPC and assign public IPs to the instances

C.Place the instances behind an Application Load Balancer

D.Create a VPC Gateway Endpoint for the partner's service

AnswerA

A NAT gateway with an Elastic IP provides a single fixed IP for all outbound traffic from private instances, and no inbound traffic is allowed.

Why this answer

A NAT gateway with an Elastic IP provides a fixed public IP address for outbound traffic from instances in a private subnet while preventing any unsolicited inbound connections from the internet. The NAT gateway translates the private source IPs of the instances to its own Elastic IP, meeting the partner firewall's requirement for a fixed source IP without exposing the EC2 instances directly.

Exam trap

The trap here is that candidates often confuse a NAT gateway with an Internet Gateway, thinking both provide outbound connectivity, but an Internet Gateway alone does not offer a fixed source IP for private instances and would expose them to inbound traffic if public IPs are assigned.

How to eliminate wrong answers

Option B is wrong because attaching an Internet Gateway and assigning public IPs to the instances would expose them to inbound internet traffic, violating the requirement to keep instances private. Option C is wrong because an Application Load Balancer operates at Layer 7 and does not provide a fixed source IP for outbound traffic; it distributes inbound traffic to targets, not outbound. Option D is wrong because a VPC Gateway Endpoint is used for private connectivity to AWS services like S3 or DynamoDB, not for routing general outbound traffic to an external partner's firewall.

Full explanation →

1496

Drag & Dropmedium

Order the steps to troubleshoot an AWS Direct Connect virtual interface that is in the 'down' state:

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Start with the connection status, then verify virtual interface configuration, check on-premises BGP, test connectivity, and escalate if unresolved.

Full explanation →

1497

Multi-Selectmedium

A company has a VPC with a CIDR of 10.0.0.0/16. They need to create subnets for a three-tier application. Which THREE subnet CIDR blocks are valid within this VPC?

Select 3 answers

A.10.0.1.0/24

B.10.0.3.0/24

C.10.0.5.0/24

D.10.1.0.0/24

E.10.0.0.0/8

AnswersA, B, C

Within 10.0.0.0/16.

Why this answer

(10.0.1.0/24) is a valid subnet within the VPC CIDR 10.0.0.0/16 because its entire address range (10.0.1.0–10.0.1.255) falls within the VPC's address space. The /24 subnet mask is smaller than the VPC's /16, so it is a proper subset. AWS VPCs allow any RFC 1918 private IP range as long as the subnet CIDR is fully contained within the VPC CIDR.

Exam trap

The ANS-C01 exam often tests the misconception that any private IP range can be used as a subnet as long as it starts with 10.x.x.x, but the subnet must be a strict subset of the VPC CIDR, not just any overlapping range.

Full explanation →

1498

MCQmedium

A company has a VPC with a CIDR block of 10.0.0.0/16. They have two subnets: a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). They launch an Amazon RDS for MySQL DB instance in the private subnet. The DB instance needs to be accessed by an EC2 instance in the public subnet. The security group for the DB instance allows inbound traffic on port 3306 from the security group of the EC2 instance. However, the EC2 instance cannot connect to the DB instance. What is the most likely cause?

A.The private subnet does not have a route to the public subnet

B.The network ACL for the private subnet is blocking inbound traffic

C.The security group for the EC2 instance does not allow outbound traffic

D.The DB instance does not have a public IP address

AnswerB

Correct. The network ACL for the private subnet is stateless and must allow inbound traffic on port 3306 from the public subnet. If it has been modified to block this traffic, the connection will fail. By default, NACLs allow all traffic, but custom rules may block it.

Why this answer

The most likely cause is that the network ACL (NACL) for the private subnet is blocking inbound traffic on port 3306. In Amazon VPC, each subnet has a default NACL that allows all inbound and outbound traffic by default, but if the NACL has been modified to block inbound traffic on port 3306, the connection from the EC2 instance will be denied. Security groups are stateful and allow return traffic automatically, but NACLs are stateless and require explicit rules for both inbound and outbound traffic.

The private subnet's route table automatically includes a local route to the entire VPC CIDR (10.0.0.0/16), which cannot be deleted, so a missing route is not a possible cause. The DB instance does not need a public IP for VPC internal communication, and the EC2 security group likely allows all outbound traffic by default.

Exam trap

Candidates often assume that security group misconfigurations or missing public IPs are the cause, but they overlook the stateless nature of network ACLs. In a VPC, subnets automatically have a local route, so routing is not an issue. The real trap is failing to check the network ACL for the private subnet when inbound traffic is blocked.

How to eliminate wrong answers

Option B is wrong because network ACLs are stateless and, by default, allow all inbound and outbound traffic unless explicitly modified; the question does not indicate any custom NACL rules blocking traffic, so this is unlikely. Option C is wrong because the security group for the EC2 instance does not need to allow outbound traffic to the DB instance; security groups are stateful, so if the EC2 instance initiates the connection, the return traffic is automatically allowed regardless of outbound rules. Option D is wrong because the DB instance does not need a public IP address; it is in a private subnet and can be accessed from the public subnet via private IP routing, provided the route tables are correctly configured.

Full explanation →

1499

MCQeasy

A company wants to encrypt data at rest in an S3 bucket. Which AWS service can manage the encryption keys if the company wants to use server-side encryption with AWS KMS?

A.AWS Certificate Manager (ACM)

B.AWS CloudHSM

C.AWS Secrets Manager

D.AWS Key Management Service (KMS)

AnswerD

KMS creates and manages encryption keys used for server-side encryption in S3.

Why this answer

AWS Key Management Service (KMS) is the service that manages encryption keys for server-side encryption (SSE-KMS). Option D is correct. AWS Certificate Manager (ACM) manages SSL/TLS certificates.

AWS CloudHSM provides dedicated hardware security modules but is not required for SSE-KMS. AWS Secrets Manager manages secrets like database credentials.

Full explanation →

1500

MCQeasy

A company wants to allow its employees to securely access internal applications hosted in a VPC without traversing the internet. The company also wants to be able to enforce security policies at the user level. Which AWS service should the company use?

A.Bastion host in a public subnet

B.AWS Direct Connect

C.AWS Site-to-Site VPN

D.AWS Client VPN

AnswerD

Client VPN provides per-user secure access to VPC.

Why this answer

AWS Client VPN is a managed, cloud-based VPN service that allows employees to securely access internal applications hosted in a VPC from any location without traversing the internet. It uses OpenVPN-based client software and integrates with AWS Identity and Access Management (IAM) and Active Directory to enforce security policies at the user level, such as group-based access controls and multi-factor authentication.

Exam trap

The trap here is that candidates often confuse network-level connectivity services (Direct Connect, Site-to-Site VPN) with user-level remote access solutions, overlooking that only Client VPN provides per-user authentication and policy enforcement for individual employees.

How to eliminate wrong answers

Option A is wrong because a bastion host in a public subnet provides only SSH/RDP access to instances, not application-level access, and cannot enforce user-level security policies for internal applications. Option B is wrong because AWS Direct Connect establishes a dedicated private network connection from on-premises to AWS, but it does not inherently enforce user-level policies; it is a network transport layer, not a user-authentication or policy-enforcement service. Option C is wrong because AWS Site-to-Site VPN creates an encrypted tunnel between an on-premises network and a VPC, but it is a network-to-network connection that does not support per-user authentication or granular policy enforcement; it treats all traffic from the on-premises side as a single entity.

Full explanation →

Page 20 of 22

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

Practice ANS-C01 by domain

Target a specific domain to shore up weak areas.

Network Management and Operations Network Security, Compliance and Governance Network Design Network Implementation

See all domains with question counts →