Knowledge + Practice

AWS Certified Advanced Networking Specialty ANS-C01 (ANS-C01) — Questions 1501–1575

1621 questions total · 22pages · All types, answers revealed

Take a mock exam Exam hub

Page 21 of 22

1501

MCQeasy

A company is setting up a Site-to-Site VPN connection to AWS. The customer gateway device is behind a NAT device that performs address translation. Which tunnel option must be enabled to ensure the VPN tunnel establishes correctly?

A.Perfect Forward Secrecy (PFS)

B.NAT Traversal (NAT-T)

C.Dead Peer Detection (DPD)

D.IKEv2

AnswerB

Required to encapsulate IPsec in UDP to pass through NAT.

Why this answer

When a customer gateway device is behind a NAT device, the NAT device modifies the IP addresses and potentially the UDP ports in the IPsec packet headers. Standard IPsec (ESP) does not work through NAT because ESP is a Layer 4 protocol with no port numbers. NAT Traversal (NAT-T) solves this by encapsulating IPsec packets inside UDP (typically port 4500), allowing the NAT device to perform address translation without breaking the VPN tunnel.

Exam trap

The ANS-C01 exam often tests the misconception that IKEv2 alone solves NAT traversal, but in reality, NAT-T is a separate mechanism that must be enabled or negotiated regardless of the IKE version, and simply using IKEv2 does not automatically enable UDP encapsulation for ESP traffic.

How to eliminate wrong answers

Option A is wrong because Perfect Forward Secrecy (PFS) is a cryptographic property that ensures session keys are not compromised if long-term keys are exposed; it does not address NAT traversal issues. Option C is wrong because Dead Peer Detection (DPD) is a keepalive mechanism to detect if the remote peer is still reachable, but it does not solve the problem of IPsec packets being dropped or mangled by NAT. Option D is wrong because IKEv2 is a key exchange protocol version that supports NAT-T natively, but simply enabling IKEv2 without also enabling NAT-T (or using UDP encapsulation) will not fix the NAT traversal issue; NAT-T is a separate feature that must be explicitly enabled or negotiated.

Full explanation →

1502

MCQmedium

A company is designing a multi-region active-active application using Amazon Route 53 latency-based routing with health checks. The application is deployed in us-east-1 and eu-west-1. During a load test, users in South America experience high latency despite the Route 53 configuration. What is the most likely cause?

A.The health check for one region is failing, causing all traffic to be routed to the remaining healthy region.

B.The company should use geolocation routing instead of latency-based routing.

C.The latency records are not refreshed frequently enough, causing stale routing decisions.

D.The Route 53 health check is configured to use CloudWatch alarms, which introduced additional latency.

AnswerA

If a region fails health check, traffic is routed to healthy regions, increasing latency for users far from that region.

Why this answer

Latency-based routing directs traffic to the region with the lowest latency for the user. If a health check fails, Route 53 treats that region as unhealthy and stops routing traffic to it, even if it would otherwise provide lower latency. In this scenario, users in South America likely experience high latency because the eu-west-1 region (which might have lower latency for them) is marked unhealthy, forcing all traffic to us-east-1, which is farther away.

Exam trap

The ANS-C01 exam often tests the interaction between health checks and routing policies, where candidates assume latency-based routing always sends traffic to the lowest-latency region, forgetting that a failed health check overrides that decision and routes all traffic to the healthy region, even if it is geographically distant.

How to eliminate wrong answers

Option B is wrong because geolocation routing routes based on the user's geographic location, not on network latency; it would not necessarily improve latency for South American users and could even worsen it if the nearest region is unhealthy. Option C is wrong because latency records are recalculated in real time based on current network conditions; there is no refresh interval that causes stale routing decisions. Option D is wrong because CloudWatch alarms are not used directly in Route 53 health checks; health checks can be based on endpoint status, calculated health checks, or CloudWatch metrics, but the alarm itself does not introduce additional latency into the routing decision.

Full explanation →

1503

Multi-Selecteasy

A company needs to encrypt data in transit between an Application Load Balancer and EC2 instances. Which TWO actions should they take?

Select 2 answers

A.Create a TCP listener on the ALB.

B.Place Amazon CloudFront in front of the ALB.

C.Upload a certificate to AWS Certificate Manager (ACM).

D.Configure the ALB target group to use HTTPS protocol.

E.Use a self-signed certificate on the EC2 instances.

AnswersC, D

ACM provides SSL/TLS certificates that can be used by the ALB for HTTPS.

Why this answer

To encrypt traffic between the ALB and EC2 instances, you need to upload a certificate to AWS Certificate Manager (ACM) for the backend HTTPS listener (Option C) and configure the ALB target group to use HTTPS protocol (Option D). Option A (TCP listener) does not support encryption. Option B (CloudFront) is a CDN and not required for backend encryption.

Option E (self-signed certificate) is not recommended for production environments.

Full explanation →

1504

Multi-Selecthard

Which THREE services can be used to detect and protect against DDoS attacks? (Choose THREE.)

Select 3 answers

A.AWS Firewall Manager

B.AWS Config

C.AWS Shield Advanced

D.AWS WAF

E.VPC Flow Logs

AnswersA, C, D

AWS Firewall Manager centrally manages AWS WAF rules across accounts and resources, helping to protect against DDoS attacks by enabling consistent web ACLs.

Why this answer

Options A, C, and D are correct. AWS Shield Advanced provides DDoS protection, AWS WAF filters web traffic, and AWS Firewall Manager centrally manages rules. Option B is wrong because AWS Config tracks configuration changes, not DDoS detection.

Option E is wrong because VPC Flow Logs only log traffic.

Full explanation →

1505

MCQhard

A company is experiencing intermittent connectivity issues between its on-premises network and AWS via a Direct Connect connection. The link is up, but packet loss is observed. Which test should the network engineer perform first to isolate the issue?

A.Run a traceroute with MTR

B.Ping the virtual private gateway

C.Perform a DNS lookup

D.Run a speed test

AnswerA

MTR shows loss per hop, helping identify the problematic segment.

Why this answer

MTR (My TraceRoute) combines the functionality of traceroute and ping to provide per-hop latency and packet loss statistics. This allows the engineer to pinpoint whether the packet loss is occurring on the Direct Connect link itself, the customer gateway, or somewhere in the transit path, rather than just confirming end-to-end reachability.

Exam trap

The trap here is that candidates assume pinging the virtual private gateway (Option B) is sufficient to verify the link, but it only confirms reachability and cannot isolate the specific hop causing packet loss, which is the primary goal of troubleshooting intermittent issues.

How to eliminate wrong answers

Option B is wrong because pinging the virtual private gateway only tests end-to-end reachability and cannot isolate where in the path the packet loss is occurring; it provides no per-hop visibility. Option C is wrong because a DNS lookup tests name resolution, not network-layer connectivity or packet loss, and is irrelevant to a physical or logical link issue. Option D is wrong because a speed test measures throughput and bandwidth, not packet loss or path-specific latency, and is not designed to diagnose intermittent packet loss on a Direct Connect circuit.

Full explanation →

1506

MCQeasy

A company wants to block outgoing traffic from a specific EC2 instance to the internet, except for HTTPS traffic to a specific API endpoint. Which AWS service can enforce this at the instance level?

A.AWS WAF

B.Network ACL

C.Security group with outbound rules

D.AWS Network Firewall

AnswerD

Can filter outbound traffic by domain name.

Why this answer

AWS Network Firewall can be deployed in the VPC to filter outbound traffic based on domain names. Option A (AWS WAF) is wrong because it works at the application layer for inbound web traffic and does not block outbound traffic at the instance level. Option B (Network ACL) is wrong because NACLs are stateless and work at the subnet level.

Option C (Security group with outbound rules) is wrong because security groups do not support allowlisting based on domain names.

Full explanation →

1507

MCQhard

A company uses AWS CloudFormation to deploy a multi-tier application. The template includes a VPC, public and private subnets, security groups, and an Application Load Balancer. The network team wants to ensure that the ALB can only accept traffic from a specific set of IP addresses. They add a security group rule that allows inbound traffic on port 443 from the allowed IP CIDR. However, after deployment, the ALB is not responding to requests from the allowed IPs. The team checks the security group and confirms the rule exists. They also verify that the ALB is in the public subnet and has a public DNS name. What is the MOST likely cause?

A.The security group rule is blocking return traffic; security groups are stateful.

B.The ALB listener is not configured to forward traffic to the target group.

C.The public subnet does not have a route to an internet gateway.

D.The ALB is using an internal scheme instead of internet-facing.

AnswerC

For internet-facing ALBs, the subnets must have a default route to an internet gateway. Without it, internet traffic cannot reach the ALB.

Why this answer

The most likely cause is that the public subnet does not have a route to an internet gateway. For an internet-facing ALB to receive traffic from the internet, the subnets where the ALB is deployed must have a default route (0.0.0.0/0) pointing to an internet gateway. Without this route, even if the security group allows the traffic, the ALB cannot be reached because the subnet is not routable from the internet.

Option A is incorrect because security groups are stateful and automatically allow return traffic, so that would not block responses. Option B is incorrect because the listener configuration affects whether traffic is forwarded to targets, not whether the ALB itself accepts incoming connections from allowed IPs. Option D is incorrect because the ALB uses an internet-facing scheme; if it were internal, it would not have a public DNS name.

Full explanation →

1508

MCQhard

A company has a VPC with an AWS Site-to-Site VPN connection to their on-premises network. The VPN uses dynamic routing with BGP. The on-premises network is advertising a specific route to the VPC. However, instances in the VPC cannot reach the on-premises network. The VPN tunnels are up and BGP sessions are established. What should the engineer check?

A.The tunnel options include the correct encryption algorithms.

B.The on-premises router is advertising the route with the correct ASN.

C.Route propagation is enabled on the VPC route tables.

D.The VPN connection's static routes are configured for the on-premises CIDR.

AnswerC

Without route propagation, BGP routes are not added to route tables.

Why this answer

Even if BGP routes are received, they must be propagated to the route tables. If route propagation is not enabled, the routes are not added. Option A is incorrect; static routes are not necessary for dynamic routing.

Option B is incorrect because the VPN connection routes are already configured. Option D is incorrect because the tunnels are up, so the configuration is likely correct.

Full explanation →

1509

MCQmedium

A company has a VPC with an AWS Direct Connect private VIF connected to a virtual private gateway. The on-premises network uses BGP to advertise routes to AWS. The network team wants to ensure that only specific prefixes from on-premises are accepted. They configure the virtual private gateway with a BGP community. However, after configuration, they notice that all prefixes are still being accepted. What is the MOST likely reason?

A.The virtual private gateway needs to have the BGP community enabled.

B.The virtual private gateway does not filter routes based on BGP communities; you need to use a prefix list.

C.The BGP community is not being advertised by the on-premises router.

D.The BGP community must be configured on the customer gateway device.

AnswerB

BGP communities are tags, not filters.

Why this answer

BGP communities are tags that can be applied to routes, but the virtual private gateway (VPG) does not filter routes based on BGP communities. To filter which prefixes are accepted, you must use a prefix list or route table filtering. Therefore, simply configuring a BGP community on the VPG will not prevent all prefixes from being accepted; you need to explicitly filter using a prefix list.

Option B is correct. Option A is not needed because BGP communities are already supported. Option C is not the most likely reason because even if the community is advertised, the VPG won't filter based on it.

Option D is false because the community can be configured on either side, but filtering still requires a prefix list.

Full explanation →

1510

MCQhard

A network engineer analyzes a VPC Flow Log entry showing an ACCEPT for a TCP connection from 203.0.113.50 (internet) to 10.0.1.5 on port 443. The security group for the instance allows inbound HTTPS only from 10.0.0.0/16, and the NACL for the subnet has the rules shown. Why was the traffic accepted?

A.The NACL inbound rule #120 allows HTTPS from 10.0.0.0/16, but the source is 203.0.113.50, so it should be denied.

B.The NACL inbound rule #100 allows HTTP from anywhere, and the traffic is HTTP.

C.The security group allows inbound HTTPS from 10.0.0.0/16, but the flow log source is 203.0.113.50, so it should be denied. The ACCEPT must be an error.

D.The flow log entry represents outbound traffic from the instance (source 10.0.1.5:443 to destination 203.0.113.50:38000). The security group's default outbound rule allows all traffic, and the NACL outbound (not shown) also allows it, resulting in ACCEPT.

AnswerD

Correct interpretation of the flow log: source is the instance, destination is internet. Outbound is allowed by default.

Why this answer

The VPC Flow Log entry shows an ACCEPT for traffic from 203.0.113.50:38000 to 10.0.1.5:443. Because flow logs record connection state, this entry actually represents the return traffic of an outbound connection initiated by the instance (10.0.1.5) to the internet host on port 443. The security group's default outbound rule allows all traffic, and the NACL outbound rules (not shown) also permit it, so the return ACCEPT is valid.

Exam trap

AWS often tests the misconception that VPC Flow Log entries always represent the direction of traffic as seen by the network, when in fact they record the connection tuple as observed, which can be the reverse direction of the original request, leading candidates to incorrectly apply inbound security rules.

How to eliminate wrong answers

Option A is wrong because the NACL inbound rule #120 allows HTTPS from 10.0.0.0/16, but the source IP is 203.0.113.50, so it would deny the traffic if this were an inbound connection; however, the traffic is actually outbound, so inbound NACL rules are irrelevant. Option B is wrong because the traffic is HTTPS (port 443), not HTTP (port 80), and rule #100 allows HTTP from anywhere, which does not apply to port 443. Option C is wrong because the security group's inbound rule restricts HTTPS to 10.0.0.0/16, but this is return traffic for an outbound connection, so inbound security group rules are not evaluated; the ACCEPT is not an error.

Full explanation →

1511

MCQeasy

An application running on EC2 instances in a private subnet needs to send logs to Amazon CloudWatch Logs. Which step is essential to allow this communication without traversing the internet?

A.Create a VPC Interface Endpoint for CloudWatch Logs and attach it to the subnet.

B.Create a VPC Gateway Endpoint for CloudWatch Logs and update the route table.

C.Assign a public IP to the EC2 instance and route directly to the internet.

D.Attach a NAT Gateway to the private subnet and route traffic to the internet.

AnswerB

Provides private connectivity to CloudWatch Logs.

Why this answer

Amazon CloudWatch Logs supports both VPC Gateway Endpoints and VPC Interface Endpoints (PrivateLink). However, a Gateway Endpoint is more efficient as it does not require an Elastic Network Interface (ENI) and is accessed via route table entries, making it a simpler and more cost-effective solution for this scenario. Therefore, Option B is the appropriate choice.

Exam trap

The trap is that candidates may assume CloudWatch Logs only supports Interface Endpoints like many other AWS services, but in fact CloudWatch Logs supports Gateway Endpoints as well, which are often preferred for private connectivity without ENIs.

How to eliminate wrong answers

Option A is wrong because VPC Interface Endpoints are not supported for CloudWatch Logs; CloudWatch Logs only supports Gateway Endpoints, not Interface Endpoints. Option C is wrong because assigning a public IP to the EC2 instance would require the instance to be in a public subnet with an internet gateway, which violates the requirement of staying in a private subnet and not traversing the internet. Option D is wrong because a NAT Gateway provides internet access for private subnets, but the question explicitly states 'without traversing the internet,' making this solution non-compliant.

Full explanation →

1512

Multi-Selectmedium

A network engineer is analyzing VPC Flow Logs and notices that some rejected traffic is not logged. Which THREE conditions could cause this?

Select 3 answers

A.The traffic is blocked by a network ACL.

B.The traffic is rejected by the destination network.

C.The Flow Logs capture only accepted traffic due to the filter.

D.The Flow Logs are configured for a specific network interface only.

E.The traffic is blocked by a security group before reaching the network interface.

AnswersC, D, E

Flow Logs can filter by acceptance status.

Why this answer

Correct options are C, D, and E. Option C: If the Flow Logs are configured to capture only accepted traffic (filter: ACCEPT), then rejected traffic is not logged. Option D: Flow Logs are per network interface; if the traffic does not traverse the monitored interface, it won't be logged.

Option E: Security groups operate at the instance level; if a security group blocks traffic before it reaches the network interface, the flow log for that interface will not capture the rejected traffic. Options A and B are incorrect because network ACLs operate at the subnet level and their deny actions are logged by Flow Logs if the traffic reaches the subnet; destination network rejection is also logged as 'REJECT' in the flow log record.

Full explanation →

1513

MCQhard

A company has a Direct Connect connection with multiple Virtual Interfaces (VIFs) to an on-premises network. The VIFs are associated with a Direct Connect Gateway that is attached to multiple VPCs. The company is experiencing asymmetric routing and wants to ensure that traffic from on-premises to the VPCs always uses the same VIF. Which configuration should be implemented?

A.Use AS_PATH prepending on the VIFs to make one path more preferred

B.Enable Jumbo Frames on the Direct Connect connection

C.Set the Local Preference attribute on the AWS side

D.Configure BGP communities on the VIFs to influence route preference

AnswerD

BGP communities allow tagging routes to influence the on-premises router's preference.

Why this answer

BGP communities allow you to tag routes on the Direct Connect VIFs with specific community values (e.g., 7224:7100 for the primary VIF, 7224:7200 for the secondary VIF). AWS Direct Connect uses these community tags to influence route preference, ensuring that traffic from on-premises to the VPCs consistently uses the designated primary VIF. This mechanism provides granular control over path selection without modifying AS_PATH or local preference, directly addressing asymmetric routing.

Exam trap

The trap here is that candidates confuse AS_PATH prepending (which affects outbound traffic from AWS) with BGP communities (which can influence inbound traffic from on-premises), leading them to select Option A despite it solving the wrong direction of traffic flow.

How to eliminate wrong answers

Option A is wrong because AS_PATH prepending influences outbound route advertisement from AWS to on-premises, not inbound traffic direction; it makes a path less preferred for traffic leaving AWS, but the question requires controlling traffic from on-premises to VPCs. Option B is wrong because enabling Jumbo Frames increases the Maximum Transmission Unit (MTU) for better throughput but has no effect on routing decisions or path selection to resolve asymmetric routing. Option C is wrong because the Local Preference attribute is used within an AS to influence outbound traffic from that AS; AWS does not allow customers to set Local Preference on the AWS side of a Direct Connect VIF, and it would not control inbound traffic from on-premises.

Full explanation →

1514

MCQmedium

Refer to the exhibit. A company has an S3 bucket with the bucket policy shown. An EC2 instance in a VPC with CIDR 10.0.0.0/16 tries to retrieve an object from the bucket using the S3 console, but receives an 'Access Denied' error. The instance's security group allows all outbound traffic. What is the most likely cause?

A.The EC2 instance is accessing the S3 bucket through a NAT Gateway, so the source IP is the public IP of the NAT Gateway, which does not match the condition.

B.The bucket policy does not allow the s3:GetObject action.

C.The bucket policy does not specify a principal, so it defaults to deny.

D.The condition aws:SourceIp is too restrictive and blocks all traffic.

AnswerA

The IP condition requires the source IP to be within the VPC CIDR, but via NAT the source IP is the NAT's public IP.

Why this answer

The bucket policy uses the `aws:SourceIp` condition to restrict access to requests originating from the specific IP range 10.0.0.0/16. However, when the EC2 instance accesses S3 through a NAT Gateway, the source IP seen by S3 is the public IP of the NAT Gateway, not the private IP of the instance. Since the NAT Gateway's public IP does not fall within the 10.0.0.0/16 range, the condition fails and S3 returns an 'Access Denied' error.

Exam trap

The ANS-C01 exam often tests the misconception that the `aws:SourceIp` condition evaluates the private IP of the EC2 instance, when in reality it evaluates the source IP of the IP packet as seen by S3, which after NAT is the public IP of the NAT Gateway.

How to eliminate wrong answers

Option B is wrong because the bucket policy explicitly includes the `s3:GetObject` action in the `Action` element, so the action is allowed. Option C is wrong because the bucket policy does specify a principal — it uses `"Principal": "*"`, which grants access to all principals, so the policy is not defaulting to deny. Option D is wrong because the `aws:SourceIp` condition is not too restrictive in general; it correctly restricts to the 10.0.0.0/16 range, but the issue is that the source IP seen by S3 is the NAT Gateway's public IP, not a private IP in that range.

Full explanation →

1515

MCQhard

A financial services company must ensure that all traffic between its on-premises data center and VPC is encrypted in transit and does not traverse the public internet. The company has an AWS Direct Connect connection. Which solution meets these requirements?

A.Use a private virtual interface (VIF) over the Direct Connect connection and establish an IPsec VPN tunnel over the private VIF

B.Use a private virtual interface (VIF) and rely on Direct Connect encryption

C.Use a public virtual interface (VIF) over the Direct Connect connection and configure an IPsec VPN tunnel over it

D.Use a transit virtual interface (VIF) over the Direct Connect connection and attach it to a transit gateway

AnswerA

This provides encryption over a private connection, meeting both requirements.

Why this answer

A private virtual interface (VIF) provides private, non-internet-routed connectivity between the on-premises data center and the VPC over AWS Direct Connect. However, Direct Connect itself does not natively encrypt traffic; by establishing an IPsec VPN tunnel over the private VIF, you add end-to-end encryption (e.g., using AES-256) while keeping all traffic off the public internet, meeting both requirements.

Exam trap

The trap here is that candidates assume Direct Connect provides encryption by default, but it does not; the exam tests whether you know that a private VIF alone is unencrypted and that an IPsec VPN overlay is required to meet encryption mandates.

How to eliminate wrong answers

Option B is wrong because Direct Connect does not provide native encryption for data in transit; it relies on physical security of the fiber, but the traffic is not encrypted, so it fails the 'encrypted in transit' requirement. Option C is wrong because a public VIF connects to AWS public services (e.g., S3, DynamoDB) over the internet-routable path, which can traverse the public internet, violating the 'does not traverse the public internet' requirement. Option D is wrong because a transit VIF is used to connect a Direct Connect gateway to a transit gateway for multi-VPC routing, but it does not inherently provide encryption; it still requires an IPsec VPN or similar overlay to encrypt traffic.

Full explanation →

1516

Multi-Selecthard

A company is using AWS Organizations to manage multiple accounts. The security team wants to enforce that all S3 buckets across the organization are encrypted with SSE-S3 or SSE-KMS. Which THREE steps should they take to implement this policy?

Select 3 answers

A.Apply a bucket policy in each account that denies PutObject without encryption.

B.Attach the SCP to the root organizational unit (OU) to apply to all accounts.

C.Use a VPC endpoint policy to enforce encryption for all S3 access from the VPC.

D.Use AWS Config rules to check for unencrypted S3 buckets and trigger automatic remediation.

E.Create a service control policy (SCP) that denies s3:PutBucketPublicAccessBlock and s3:CreateBucket without encryption settings.

AnswersB, D, E

Attaching SCP to root OU ensures enforcement across all accounts.

Why this answer

Service control policies (SCPs) can be applied at the root organizational unit (OU) to deny actions that create or modify S3 buckets without encryption (SSE-S3 or SSE-KMS), as in options B and E. AWS Config rules can detect unencrypted buckets and trigger automated remediation, such as enabling default encryption, which addresses existing buckets (option D). Option A is incorrect because bucket policies are account-specific and cannot enforce organization-wide policies.

Option C is incorrect because VPC endpoint policies control network access, not encryption enforcement.

Full explanation →

1517

MCQmedium

A company is designing a network for a multi-tier application that includes a web tier, application tier, and database tier. The web tier must be accessible from the internet, while the application and database tiers should have no direct internet access. All tiers are in the same VPC. Which configuration meets these requirements?

A.Place all tiers in public subnets and use security group rules to restrict access to app and DB tiers

B.Place web tier in public subnets with Internet Gateway, app and DB tiers in private subnets with a NAT Gateway for outbound traffic

C.Place web tier in a public subnet and app and DB tiers in the same public subnet but with restrictive Network ACLs

D.Place all tiers in private subnets and attach an Internet Gateway to the private subnets for the web tier

AnswerB

This design provides internet access to web tier while isolating app and DB tiers.

Why this answer

It places the web tier in a public subnet with an Internet Gateway (IGW) for direct inbound internet traffic, while the application and database tiers reside in private subnets with no direct internet path. A NAT Gateway in a public subnet provides outbound-only internet access for the private tiers (e.g., for software updates) without allowing inbound connections, satisfying the requirement that only the web tier be internet-accessible.

Exam trap

The ANS-C01 exam often tests the misconception that security groups or NACLs alone can fully isolate tiers from the internet when placed in public subnets, ignoring that a public subnet’s route to an Internet Gateway inherently allows inbound traffic unless explicitly blocked by a firewall or stateful inspection.

How to eliminate wrong answers

Option A is wrong because placing all tiers in public subnets exposes the application and database tiers to the internet; security group rules alone cannot prevent direct inbound traffic from the internet if the subnets have a route to an Internet Gateway. Option C is wrong because placing all tiers in the same public subnet with restrictive Network ACLs still allows inbound internet traffic to the application and database tiers (since the subnet is public), and NACLs are stateless, requiring complex bidirectional rules that are error-prone and do not provide the same isolation as private subnets. Option D is wrong because attaching an Internet Gateway to private subnets makes them public; private subnets by definition have no direct route to an IGW, and doing so would expose all tiers to the internet, violating the requirement.

Full explanation →

1518

MCQhard

A company has a VPC with multiple subnets. The security team requires that all outbound traffic from the VPC to the internet goes through a centralized firewall. Which design should be used?

A.Route all internet traffic through a centralized inspection VPC using Transit Gateway.

B.Attach an Internet Gateway to each VPC.

C.Use AWS Site-to-Site VPN to a third-party firewall.

D.Use VPC Endpoints for all services.

AnswerA

Enforces centralized firewall.

Why this answer

It uses a Transit Gateway to route all outbound internet traffic from the VPC to a centralized inspection VPC, where a firewall (e.g., AWS Network Firewall or a third-party appliance) inspects and forwards traffic to an Internet Gateway. This design meets the security requirement by enforcing a single egress point, ensuring all traffic is inspected before reaching the internet.

Exam trap

The trap here is that candidates often assume an Internet Gateway is required for internet access and overlook the need for centralized inspection, leading them to choose Option B without considering the security constraint.

How to eliminate wrong answers

Option B is wrong because attaching an Internet Gateway to each VPC creates direct internet access, bypassing the centralized firewall and violating the security requirement. Option C is wrong because AWS Site-to-Site VPN connects to an on-premises firewall, not a centralized firewall within AWS, and does not inherently route all VPC outbound traffic through it without additional routing complexity. Option D is wrong because VPC Endpoints provide private connectivity to AWS services only, not general internet access, and thus cannot handle all outbound internet traffic.

Full explanation →

1519

MCQmedium

A company is designing a network for a three-tier web application. The web tier must be accessible from the internet, the application tier must only be accessible from the web tier, and the database tier must only be accessible from the application tier. Which VPC design meets these requirements with the highest security?

A.Create a single public subnet and use security groups to restrict traffic between instances.

B.Place all instances in public subnets but assign private IP addresses only.

C.Create public subnets for web tier and private subnets for app and database tiers. Use security groups to allow traffic from web to app and app to database.

D.Use network ACLs on subnets to restrict traffic instead of security groups.

AnswerC

Best practices for tiered architecture.

Why this answer

It uses separate public subnets for the web tier (with an Internet Gateway for inbound traffic) and private subnets for the application and database tiers, which have no direct route to the internet. Security groups act as stateful virtual firewalls at the instance level, allowing you to precisely control traffic flows: the web tier security group allows inbound HTTP/HTTPS from the internet, the application tier security group allows inbound traffic only from the web tier security group, and the database tier security group allows inbound traffic only from the application tier security group. This layered approach enforces least-privilege access and minimizes the attack surface.

Exam trap

The trap here is that candidates often assume network ACLs are more secure than security groups because they operate at the subnet level, but they overlook the fact that security groups provide stateful, instance-level control that is inherently more secure and easier to manage for isolating application tiers.

How to eliminate wrong answers

Option A is wrong because placing all instances in a single public subnet exposes the application and database tiers to the internet, even if security groups restrict traffic; the instances still have public IP addresses and are reachable from the internet, violating the requirement that only the web tier be internet-accessible. Option B is wrong because assigning private IP addresses only does not prevent instances in public subnets from being assigned public IPs via an Internet Gateway or NAT device; moreover, public subnets are defined by having a route to an Internet Gateway, so all instances would still be directly reachable from the internet, breaking the isolation requirements. Option D is wrong because network ACLs are stateless and operate at the subnet level, requiring explicit inbound and outbound rules for ephemeral ports, which complicates management and can inadvertently allow or block traffic; security groups are stateful and provide finer-grained, instance-level control, making them more secure and easier to manage for this use case.

Full explanation →

1520

MCQeasy

A company is using Amazon S3 to store sensitive data. The security team wants to ensure that all data is encrypted at rest. Which S3 bucket property should be enabled?

A.Versioning

B.MFA Delete

C.Server access logging

D.Default encryption

AnswerD

Default encryption enforces encryption on all objects stored in the bucket.

Why this answer

S3 bucket default encryption ensures that all objects uploaded to the bucket are encrypted at rest. Option A (Versioning) is for preserving object versions, not encryption. Option B (MFA Delete) adds multi-factor authentication for delete operations, not encryption.

Option C (Server access logging) logs access requests, not encryption. Therefore, enabling Default encryption is the correct property to enforce encryption at rest.

Full explanation →

1521

Multi-Selecteasy

Which TWO of the following are valid methods to connect a VPC to an on-premises network? (Choose TWO.)

Select 2 answers

A.AWS Site-to-Site VPN

B.AWS Direct Connect

C.VPC endpoints

D.AWS Transit Gateway

E.VPC peering

AnswersA, B

Creates a secure connection over the internet.

Why this answer

AWS Site-to-Site VPN creates an encrypted tunnel over the public internet between a VPC and an on-premises network using IPsec. It is a fully managed, quick-to-deploy method that supports both static routes and BGP dynamic routing via the virtual private gateway.

Exam trap

The trap here is that candidates confuse AWS Transit Gateway as a direct connection method to on-premises, when it is actually a central hub that requires a VPN or Direct Connect attachment to reach on-premises networks.

Full explanation →

1522

MCQhard

A company has a hybrid network architecture with an AWS Direct Connect connection between its on-premises data center and an Amazon VPC. The VPC has a single private subnet with Amazon EC2 instances running a critical application. The on-premises network uses BGP to advertise a route for the VPC's CIDR (10.0.0.0/16) to the on-premises routers. Recently, the company added a new application in a second VPC (VPC-B) with CIDR 10.1.0.0/16 and peered it with the original VPC (VPC-A). After the peering, users on-premises can still reach resources in VPC-A, but cannot reach resources in VPC-B. The VPC-A route table has a route for VPC-B's CIDR pointing to the peering connection. The VPC-B route table has a route for VPC-A's CIDR pointing to the peering connection. The on-premises routers have a static route for VPC-B's CIDR pointing to the Direct Connect virtual interface. What is the most likely cause of the issue?

A.The VPC peering connection is not properly configured.

B.The on-premises network is not advertising VPC-B's CIDR to the VPC via BGP, so VPC-B does not have a route back to on-premises.

C.The security group on VPC-B instances is blocking inbound traffic from on-premises IP ranges.

D.The virtual private gateway does not have route propagation enabled for VPC-B.

AnswerB

VPC-B needs a route to on-premises CIDR pointing to the virtual private gateway, but that route must be propagated via BGP or added manually.

Why this answer

The on-premises network is not advertising VPC-B's CIDR via BGP over Direct Connect. While the on-premises routers have a static route for VPC-B's CIDR pointing to the Direct Connect virtual interface, this only directs traffic from on-premises to VPC-B. For return traffic from VPC-B to on-premises, VPC-B needs a route to the on-premises network.

Normally, this route would be learned via BGP over Direct Connect if the on-premises network advertised the VPC-B CIDR to the VPC. Without that advertisement, VPC-B does not have a route back to on-premises, causing the connectivity failure. Option A is incorrect because the VPC peering connection is working: VPC-A and VPC-B can communicate, as the issue is only with on-premises reachability.

Option C is incorrect because security groups are stateful; if traffic from on-premises reached VPC-B, the return traffic would be automatically allowed. The issue is routing, not security. Option D is incorrect because route propagation for the virtual private gateway only affects VPC-A (if it is attached to the VGW), not VPC-B, which is connected via peering.

Full explanation →

1523

Multi-Selecthard

Which THREE of the following are considerations when designing a multi-account VPC architecture using AWS Transit Gateway? (Choose 3.)

Select 3 answers

A.Transit Gateway can be integrated with Direct Connect Gateway

B.Each VPC must have a unique route table

C.Transit Gateway supports cross-account VPC attachments

D.Route tables can be used to isolate VPCs from each other

E.VPCs with overlapping CIDR blocks can be attached

AnswersA, C, D

Direct Connect Gateway can connect to Transit Gateway.

Why this answer

AWS Transit Gateway acts as a central hub for interconnecting VPCs and on-premises networks. It can be integrated with Direct Connect Gateway, allowing a single Direct Connect connection to reach multiple VPCs attached to the Transit Gateway, simplifying hybrid network design and reducing operational overhead.

Exam trap

AWS often tests the misconception that each VPC must have its own route table in Transit Gateway, but in reality, multiple VPCs can share a single route table for simplified management, and overlapping CIDRs are explicitly unsupported.

Full explanation →

1524

MCQeasy

A security engineer needs to centrally manage and enforce rules for network traffic between VPCs in a large AWS environment. Which AWS service provides this capability?

A.VPC peering

B.Security groups

C.Network ACLs

D.AWS Network Firewall

AnswerD

AWS Network Firewall provides centralized firewall management across VPCs.

Why this answer

AWS Network Firewall provides centralized management of firewall rules across multiple VPCs, allowing security engineers to enforce consistent network traffic controls. Option A (VPC peering) is just a connectivity mechanism, not a filtering service. Option B (Security groups) operate at the ENI level and are not centrally managed across VPCs.

Option C (Network ACLs) are stateless and applied per subnet, not centrally. Therefore, D is correct.

Full explanation →

1525

MCQhard

A company is designing a multi-account AWS environment using AWS Organizations. They want to restrict the use of certain instance types across all accounts. Which approach should they use to enforce this policy?

A.Create an IAM policy that denies the ec2:RunInstances action for noncompliant instance types and attach it to each IAM user.

B.Create a service control policy (SCP) that denies the ec2:RunInstances action for noncompliant instance types and attach it to the root organizational unit.

C.Set up AWS Config rules to detect noncompliant instances and trigger an AWS Lambda function to terminate them.

D.Use AWS CloudTrail to monitor ec2:RunInstances events and send alerts.

AnswerB

SCPs can be applied to organizational units to restrict actions across accounts.

Why this answer

Service control policies (SCPs) in AWS Organizations can be used to restrict the use of specific instance types across all member accounts from a central location. Option B is correct. IAM policies are account-specific and cannot be applied across all accounts from a central location.

AWS Config can detect noncompliant instances but cannot prevent them from being launched. AWS CloudTrail is for auditing, not enforcement.

Full explanation →

1526

MCQhard

A company has multiple VPCs connected via a Transit Gateway. Each VPC has its own CIDR block. The company wants to isolate network traffic between specific VPCs. What is the most scalable way to achieve this?

A.Deploy AWS Network Firewall in each VPC.

B.Create separate Transit Gateway route tables and associate VPC attachments to the appropriate route tables.

C.Use Security Groups in each VPC to filter traffic.

D.Use VPC Peering connections and modify route tables.

AnswerB

Transit Gateway route tables provide scalable isolation.

Why this answer

Transit Gateway route tables allow you to isolate traffic between VPCs by controlling which VPC attachments can communicate with each other. By associating each VPC attachment with a specific route table and configuring route propagation appropriately, you can enforce isolation without additional appliances or complex routing. This approach scales seamlessly as you add more VPCs, because you simply create new route tables and associate attachments as needed.

Exam trap

The trap here is that candidates often assume Security Groups or Network Firewall are the only ways to isolate traffic, but the question specifically asks for the most scalable method, which is achieved by Transit Gateway route tables rather than per-VPC firewall appliances or instance-level security groups.

How to eliminate wrong answers

Option A is wrong because deploying AWS Network Firewall in each VPC introduces unnecessary cost, complexity, and a single point of failure per VPC, and it does not natively scale to many VPCs without manual configuration of routing and firewall policies. Option C is wrong because Security Groups are stateful firewalls that filter traffic at the instance level, not at the network edge, and they cannot isolate traffic between VPCs at the Transit Gateway level; they also require explicit rules for every instance pair, which does not scale. Option D is wrong because VPC Peering connections create a full mesh of point-to-point links, which does not scale beyond a few VPCs due to the quadratic increase in peering connections and the need to manually update route tables in every VPC.

Full explanation →

1527

MCQmedium

A company is designing a multi-region application with an Application Load Balancer (ALB) in us-east-1 and us-west-2. They want to route traffic to the nearest region using latency-based routing. Which AWS service should they use to achieve this?

A.AWS Global Accelerator

B.AWS Transit Gateway

C.Amazon CloudFront with multiple origins

D.Amazon Route 53 with latency routing policy

AnswerD

Amazon Route 53’s latency routing policy directs traffic to the region with the lowest network latency for each user, satisfying the requirement to route to the nearest region in a multi-region ALB deployment. This policy uses latency measurements between AWS regions and the client’s DNS resolver, not geographic distance, to select the optimal endpoint.

Why this answer

Route 53's latency routing policy directs traffic to the region with the lowest network latency for the end user, based on measurements between AWS regions and the client's DNS resolver. This directly meets the requirement to route traffic to the nearest region without adding any additional infrastructure or cost beyond DNS queries.

Exam trap

The trap here is that candidates often confuse AWS Global Accelerator's Anycast routing with DNS-based latency routing, but Global Accelerator optimizes network path performance for TCP/UDP traffic at the transport layer, not DNS-level latency-based routing for ALB endpoints.

How to eliminate wrong answers

Option A is wrong because AWS Global Accelerator uses Anycast IPs and the AWS global network to route traffic to the optimal endpoint, but it does not use latency-based DNS routing; it operates at the network layer (Layer 3/4) and is designed for TCP/UDP traffic, not for HTTP/HTTPS ALB routing based on latency. Option B is wrong because AWS Transit Gateway is a network transit hub used to interconnect VPCs and on-premises networks via a central router, not a DNS-based traffic routing service; it has no capability to route traffic based on latency or user location. Option C is wrong because CloudFront with multiple origins can route requests to different origins based on geographic or latency-based behaviors, but it is a CDN service that caches content at edge locations; for dynamic traffic that must reach the ALB directly without caching, CloudFront adds unnecessary latency and complexity, and its latency-based origin routing is not as granular or cost-effective as Route 53 latency routing for this specific use case.

Full explanation →

1528

MCQmedium

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access an S3 bucket. The company wants to ensure that traffic to S3 does not traverse the internet. Which solution should a network engineer implement?

A.Create a VPC interface endpoint for S3 and attach it to the private subnet.

B.Deploy an S3 VPN endpoint in the VPC.

C.Create a VPC gateway endpoint for S3 and add a route to the S3 prefix list via the endpoint.

D.Set up a NAT gateway in the public subnet and add a route to the S3 prefix list via the NAT gateway.

AnswerC

Gateway endpoints provide private connectivity to S3.

Why this answer

A VPC gateway endpoint for S3 allows instances in a private subnet to access S3 privately using AWS's internal network, without traversing the internet. By adding a route to the S3 prefix list via the gateway endpoint, traffic destined for S3 is directed through the endpoint, which uses AWS's private backbone. This solution is cost-effective and does not require a NAT gateway or internet gateway.

Exam trap

The ANS-C01 exam often tests the distinction between gateway endpoints and interface endpoints for AWS services, and the trap here is that candidates may incorrectly assume S3 supports interface endpoints (like it does for other services such as DynamoDB or API Gateway) or that a NAT gateway is required for private subnet outbound traffic, when a gateway endpoint is the correct and more efficient choice for S3.

How to eliminate wrong answers

Option A is wrong because a VPC interface endpoint for S3 is not supported; S3 only supports gateway endpoints (and interface endpoints for S3 on AWS Outposts, but not in standard VPCs). Option B is wrong because there is no such thing as an 'S3 VPN endpoint'; VPN endpoints are used for Site-to-Site VPN connections, not for direct S3 access. Option D is wrong because a NAT gateway would route traffic to S3 over the internet, which violates the requirement that traffic not traverse the internet, and it also incurs additional costs.

Full explanation →

1529

MCQeasy

A security engineer is configuring AWS CloudTrail to log all management events across all regions. The logs must be stored in an S3 bucket that is encrypted with an AWS KMS key. Which bucket policy element is required to allow CloudTrail to write logs?

A.kms:Encrypt

B.kms:GenerateDataKey

C.kms:CreateKey

D.kms:Decrypt

AnswerB

kms:GenerateDataKey is required for CloudTrail to encrypt the logs.

Why this answer

CloudTrail requires kms:GenerateDataKey and kms:Decrypt permissions in the KMS key policy to deliver logs to an encrypted S3 bucket. kms:GenerateDataKey generates a data key for encrypting the log files, while kms:Decrypt validates the key. For this question, kms:GenerateDataKey is the required element for writing logs, as it enables the encryption process.

Full explanation →

1530

MCQmedium

A company uses AWS Direct Connect with a private VIF to connect to a VPC. The network team notices that traffic from on-premises to an EC2 instance in the VPC is taking a suboptimal path through the internet instead of the Direct Connect. What is the most likely cause?

A.The on-premises router does not have a specific route for the VPC CIDR via the Direct Connect.

B.The VPC route table does not include a route to the Direct Connect gateway.

C.The Direct Connect virtual interface has BGP ASN prepending configured.

D.The VPC route table does not have a prefix list for the on-premises CIDR.

AnswerA

Without a specific route, traffic may default to internet.

Why this answer

If the on-premises network does not have a specific route pointing to the Direct Connect for the VPC CIDR, traffic may use the internet. Option B is wrong because prefix lists are not required. Option C is wrong because ASN prepending would affect outbound traffic, not inbound.

Option D is wrong because VPC route tables are not visible to on-premises.

Full explanation →

1531

MCQmedium

Refer to the exhibit. A network engineer is analyzing VPC Flow Logs for an EC2 instance with IP 10.0.1.5. Based on the logs, which statement is true?

A.The instance is not communicating with the internet

B.The instance's security group is blocking traffic

C.The instance is only communicating with another instance in the same subnet

D.The instance is communicating with both internal and internet hosts

AnswerD

Logs show internal (10.0.1.8) and internet (203.0.113.5) traffic.

Why this answer

The VPC Flow Logs show the EC2 instance (10.0.1.5) communicating with both an internal IP (10.0.2.10) on port 443 and an external IP (203.0.113.50) on port 80, with ACCEPT records for both flows. This indicates successful bidirectional traffic to both internal and internet hosts, confirming option D is correct.

Exam trap

AWS often tests the misconception that any traffic to a non-RFC 1918 IP automatically implies internet access, but the trap here is that candidates may overlook the ACCEPT status and assume security group blocking, or misinterpret internal IPs as being in the same subnet when they are not.

How to eliminate wrong answers

Option A is wrong because the logs show an ACCEPT record for traffic to 203.0.113.50:80, which is a public IP, proving the instance is communicating with the internet. Option B is wrong because all logged flows show ACCEPT status, meaning neither the security group nor network ACLs are blocking traffic; a blocked flow would show REJECT or SKIPDATA. Option C is wrong because the instance communicates with 10.0.2.10 (different subnet) and 203.0.113.50 (internet), not just another instance in the same subnet.

Full explanation →

1532

Multi-Selectmedium

A network engineer is troubleshooting a slow connection between an EC2 instance and an RDS database in the same VPC. The engineer wants to analyze network performance metrics. Which TWO metrics should the engineer examine? (Choose two.)

Select 2 answers

A.Database connections count

B.Disk queue depth

C.Round-trip time between the EC2 instance and RDS

D.RDS instance CPU utilization

E.Network packets dropped by the RDS instance's network interface

AnswersC, E

Direct measure of latency.

Why this answer

(Round-trip time) directly measures latency between the EC2 instance and RDS, which is key for diagnosing slow connections. Option E (Network packets dropped) indicates network congestion or performance issues at the network interface. Option A (Database connections count) is an application-level metric that does not directly measure network performance.

Option B (Disk queue depth) is storage-related. Option D (RDS CPU utilization) is a system metric that may affect database performance but does not directly indicate network latency or packet loss.

Full explanation →

1533

MCQhard

A company has a large AWS environment with hundreds of VPCs connected via Transit Gateway. They want to centrally manage network traffic flow and enforce security policies. Which service should they use to create a central network inspection architecture?

A.AWS WAF

B.Security groups

C.AWS Network Firewall

D.AWS Shield Advanced

AnswerC

Network Firewall is designed for centralized network inspection and can be integrated with Transit Gateway.

Why this answer

AWS Network Firewall provides managed firewall services that can be centrally deployed in a dedicated VPC and route traffic through it for inspection.

Full explanation →

1534

MCQmedium

A company uses AWS Organizations with multiple accounts. The security team wants to centrally enforce that no Amazon S3 buckets are publicly accessible across all accounts. Which solution meets this requirement with the least operational overhead?

A.Use AWS Trusted Advisor to check for public buckets and send alerts.

B.Apply a service control policy (SCP) in AWS Organizations that denies the s3:PutBucketPublicAccessBlock action or enforces a bucket policy condition.

C.Create an IAM role in each account with a policy to deny public bucket access, and require users to assume that role.

D.Configure security group rules to block public internet access to the S3 endpoints.

AnswerB

SCPs centrally enforce rules across all accounts.

Why this answer

A service control policy (SCP) can be applied at the root organizational unit to deny the s3:PutBucketPublicAccessBlock action and enforce that no S3 buckets are publicly accessible across all accounts. Option A is incorrect because Trusted Advisor provides recommendations, not enforcement. Option C is incorrect because IAM roles are per-account and cannot centrally enforce across all accounts without additional overhead.

Option D is incorrect because security groups apply to EC2 instances, not S3 buckets.

Full explanation →

1535

MCQmedium

A company has a VPC with public and private subnets. An application running in a private subnet needs to access an S3 bucket to read and write data. The security team wants to ensure that traffic to S3 does not traverse the internet. Which solution should the team implement?

A.Establish a VPN connection to AWS and route S3 traffic through the VPN.

B.Configure a NAT gateway in the public subnet and update the private subnet route table with a default route pointing to the NAT gateway.

C.Create a gateway VPC endpoint for S3 and add a route to the endpoint in the private subnet route table.

D.Attach an internet gateway to the VPC and add a route to the S3 prefix list in the private subnet route table.

AnswerC

Gateway endpoints provide private access to S3 without traversing the internet.

Why this answer

A gateway VPC endpoint for S3 allows instances in a private subnet to access S3 privately using AWS's internal network, without traversing the internet. By adding a route to the endpoint's prefix list in the private subnet route table, traffic destined for S3 is directed through the endpoint, which uses AWS PrivateLink to provide highly available, redundant connectivity.

Exam trap

AWS often tests the misconception that a NAT gateway is required for private subnet outbound traffic, but for AWS services like S3, a gateway VPC endpoint provides private connectivity without internet egress.

How to eliminate wrong answers

Option A is wrong because establishing a VPN connection would route traffic over an encrypted tunnel that still traverses the internet or a third-party network, and it does not provide direct private connectivity to S3 without internet egress. Option B is wrong because a NAT gateway in a public subnet enables outbound internet access, but traffic to S3 would still traverse the internet, violating the requirement to avoid internet transit. Option D is wrong because attaching an internet gateway and adding a route to the S3 prefix list would direct traffic to the internet gateway, forcing S3 traffic over the internet, which does not meet the security requirement.

Full explanation →

1536

MCQmedium

A company has a hybrid network with multiple VPCs connected via a Transit Gateway. They want to centralize outbound internet traffic through a single VPC with a NAT gateway. The security team requires that all traffic to the internet must be logged. Which solution is MOST operationally efficient?

A.Enable VPC Flow Logs on the NAT gateway's subnet and publish to Amazon S3

B.Enable VPC Flow Logs on the central VPC and publish to Amazon CloudWatch Logs

C.Deploy a third-party firewall appliance in the central VPC and enable logging

D.Enable AWS CloudTrail to log all network events

AnswerB

Captures all IP traffic and can be analyzed.

Why this answer

The most operationally efficient solution is to enable VPC Flow Logs on the central VPC and publish them to Amazon CloudWatch Logs. This captures all traffic passing through the VPC, including internet-bound traffic routed through the NAT gateway, and provides a centralized logging solution. Option A is incorrect because VPC Flow Logs on the NAT gateway's subnet only capture traffic for that subnet, not all internet-bound traffic from other VPCs routed through the Transit Gateway.

Option C is incorrect because deploying a third-party firewall adds unnecessary complexity and cost. Option D is incorrect because AWS CloudTrail logs API calls, not network traffic.

Full explanation →

1537

Multi-Selecthard

A company is using a transit gateway to connect multiple VPCs and on-premises networks via VPN. The network team notices that some VPCs can communicate with each other but not with the on-premises network. The transit gateway route tables are configured correctly. Which TWO configurations should the team check?

Select 2 answers

A.Verify that the transit gateway is in a 'available' state

B.Check the security group rules of the EC2 instances in the VPCs

C.Verify that the on-premises router is advertising the on-premises CIDR over BGP to the VPN

D.Check the VPC Flow Logs for dropped packets

E.Confirm that the VPN attachment is associated with the correct transit gateway route table

AnswersC, E

If routes are not advertised, the transit gateway won't have paths to on-premises.

Why this answer

Options C and E are correct. For VPCs to communicate with the on-premises network, the on-premises router must advertise its CIDR over BGP (C) so the transit gateway learns the route. Additionally, the VPN attachment must be associated with the correct transit gateway route table (E) to propagate the learned routes and enable connectivity.

Option A is incorrect because the transit gateway is available if inter-VPC traffic works. Option B is incorrect because security groups are instance-level and do not affect routing; if inter-VPC traffic works, security groups are not the issue. Option D is incorrect because VPC Flow Logs only log traffic, they do not affect routing or configuration.

Full explanation →

1538

MCQmedium

Refer to the exhibit. A network engineer examines the network ACL for a subnet. Which statement best describes the effect of this network ACL?

A.Both inbound and outbound TCP traffic are allowed

B.Inbound TCP traffic is allowed, but all outbound traffic is denied

C.All inbound traffic is allowed

D.All outbound traffic is allowed

AnswerB

Inbound TCP rule allows TCP; outbound default deny blocks all.

Why this answer

The inbound rule explicitly allows TCP traffic (protocol 6) from any source (0.0.0.0/0). However, the outbound rules consist only of a default deny rule, which blocks all outbound traffic. Therefore, inbound TCP traffic is allowed, but all outbound traffic is denied.

Option A is incorrect because outbound traffic is denied, not allowed. Option C is incorrect because only inbound TCP is allowed, not all inbound traffic. Option D is incorrect because outbound traffic is denied.

Full explanation →

1539

MCQhard

A company has a VPC with multiple subnets. They deploy a Network Firewall to inspect traffic. The firewall is configured with a stateful rule that allows outbound HTTP traffic to any destination. However, traffic from an EC2 instance in a private subnet to an external web server fails. The route table for the private subnet has a default route pointing to the firewall endpoint. What is the likely issue?

A.The stateful rule order is incorrect; a default deny rule is blocking traffic.

B.The EC2 instance security group does not allow outbound HTTP.

C.The firewall endpoint is in a different Availability Zone than the instance.

D.The subnet does not have a route to a NAT gateway.

AnswerC

Traffic must be sent to the firewall endpoint in the same AZ; otherwise routing may fail.

Why this answer

The firewall endpoint must be in the same Availability Zone as the subnet's route table target. If the endpoint is in a different AZ, traffic is not properly routed to it. The stateful rule allows HTTP, so A is incorrect.

Security groups do not affect outbound traffic unless explicitly blocked, and default outbound is allow, so B is incorrect. A NAT gateway is not needed when using a firewall, so D is incorrect.

Full explanation →

1540

MCQeasy

A network engineer is troubleshooting intermittent connectivity issues between two VPCs connected via a VPC peering connection. The engineer notices that the route tables in both VPCs have the correct routes. What should the engineer check next?

A.Check security group and network ACL rules

B.Verify that DNS resolution is enabled for the VPCs

C.Ensure that the VPN connection is active

D.Check the internet gateway configuration

AnswerA

Security groups and NACLs can block traffic even with correct routes.

Why this answer

Security group rules and NACLs can block traffic even if routes are correct. Option B is wrong because DNS resolution is not related to basic connectivity. Option C is wrong because internet gateway is not involved in VPC peering.

Option D is wrong because VPN connection is a different service.

Full explanation →

1541

MCQhard

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They have peered this VPC with another VPC using a VPC Peering connection. The peered VPC has a CIDR of 10.0.0.0/16 (overlapping). The company wants to allow communication between specific instances in both VPCs without changing the CIDRs. What should they do?

A.Configure a NAT gateway in each VPC

B.Use AWS PrivateLink to create a VPC endpoint service in one VPC and access it from the other VPC

C.Use security group references to allow traffic between the instances

D.Create a Transit Gateway and attach both VPCs

AnswerB

PrivateLink allows connectivity without IP routing, avoiding CIDR overlap issues.

Why this answer

With overlapping CIDRs (both VPCs use 10.0.0.0/16), VPC Peering cannot route traffic correctly due to identical IP ranges. AWS PrivateLink (VPC endpoint services) allows instances in one VPC (service consumer) to access a service hosted in the other VPC (service provider) via private IP addresses, creating a logical connection that bypasses the routing conflict. The service is fronted by a Network Load Balancer, and consumer instances access it through a VPC endpoint.

This works without modifying CIDRs. Option A is incorrect because NAT gateways are used for outbound internet access and do not resolve overlapping CIDR routing. Option C is incorrect because security group references allow traffic based on security group IDs but still rely on IP routing, which fails with overlapping CIDRs.

Option D is incorrect because a Transit Gateway does not resolve overlapping CIDRs; overlapping routes would cause routing conflicts unless additional measures like NAT are used, which the question precludes.

Full explanation →

1542

Multi-Selecthard

A company has a VPC with a CIDR of 10.0.0.0/16. It creates a subnet 10.0.1.0/24 in us-east-1a and launches an EC2 instance with a private IP 10.0.1.10. The instance needs to send traffic to an on-premises server at 192.168.1.50 over a Direct Connect private VIF. The VPC has a virtual private gateway attached and a route table associated with the subnet. Which TWO entries must exist in the route table for the traffic to succeed?

Select 2 answers

A.Destination: 0.0.0.0/0, Target: igw-xxxxxxxx

B.Destination: 0.0.0.0/0, Target: nat-xxxxxxxx

C.Destination: 10.0.0.0/16, Target: local

D.Destination: 192.168.1.0/24, Target: vgw-xxxxxxxx

E.Destination: 10.0.1.0/29, Target: local

AnswersC, D

Correct. The local route for the VPC CIDR is automatically added and allows the instance to communicate within the VPC. This is necessary as the instance sends traffic to the on-premises server, and the route table must have a local entry for the VPC.

Why this answer

For traffic from an EC2 instance in a VPC to an on-premises server over a Direct Connect private VIF, the route table must include two entries: a local route for the VPC CIDR (10.0.0.0/16) which is automatically added and enables communication within the VPC (Option C), and a specific route to the on-premises network (192.168.1.0/24) pointing to the virtual private gateway (vgw-xxxxxxxx) so that traffic destined for 192.168.1.50 is directed over the Direct Connect (Option D). No other entries are required; the local route already covers all subnets, and there is no need for a default route to the internet.

Exam trap

The trap is that candidates might think a default route to a NAT gateway or internet gateway is required for any outbound traffic, but the question specifically asks only about traffic to the on-premises server. The correct required routes are only the local route and the specific route to the on-premises network.

Full explanation →

1543

MCQmedium

A company uses AWS Shield Advanced to protect against DDoS attacks. They notice that some legitimate traffic is being throttled during a DDoS event. The security team wants to ensure that legitimate traffic from specific business partners is not affected. Which action should they take?

A.Disable the rate-based rule in AWS WAF during the DDoS event.

B.Increase the global rate limit in AWS Shield Advanced.

C.Add the partners' IP addresses to the AWS Shield Advanced whitelist.

D.Create a rate-based rule in AWS WAF with an IP set that includes the partners' IPs and set the rate limit high for that rule.

AnswerD

Correct. A rate-based rule with an IP set for the partners' IPs and a high rate limit ensures their traffic is not throttled while still protecting against DDoS.

Why this answer

AWS WAF allows you to create rate-based rules that can include an IP set with the partners' IPs and set a high rate limit for that specific rule, thereby excluding legitimate traffic from rate limiting while maintaining protection against DDoS. Option A is wrong because disabling rate-based rules removes protection against DDoS. Option B is wrong because increasing the global rate limit may still throttle legitimate traffic and is not a precise solution.

Option C is wrong because AWS Shield Advanced does not have a whitelist for individual IPs at the application layer; IP whitelisting is done via AWS WAF.

Exam trap

Candidates often confuse AWS Shield Advanced and AWS WAF capabilities. Shield Advanced provides global DDoS protection but does not have application-layer rate limiting; that is handled by WAF.

Full explanation →

1544

MCQhard

A company is running a multi-tier web application across two AWS Regions (us-east-1 and eu-west-1) for disaster recovery. The application uses an Application Load Balancer (ALB) in each Region. The company uses Amazon Route 53 with latency-based routing to direct traffic to the closest Region. Recently, during a regional failure in us-east-1, users experienced timeouts instead of being redirected to eu-west-1. The DNS TTL is set to 60 seconds. The Route 53 health checks for the us-east-1 ALB are configured to check the HTTP endpoint every 30 seconds with 3 consecutive failures required to mark it unhealthy. The eu-west-1 ALB is healthy. The company's network design includes a VPC in each Region with public and private subnets. The ALBs are internet-facing and have proper security groups. The Route 53 records are configured correctly. What is the MOST likely cause of the timeout?

A.The latency-based routing policy does not fail over to the other region when a health check fails.

B.The ALB in us-east-1 is not configured to be cross-zone load balancing, causing it to fail.

C.The health check interval and failure threshold cause a delay in detecting the failure, and DNS caching causes clients to still resolve to the unhealthy endpoint.

D.The Route 53 health check is not able to reach the ALB in us-east-1 from eu-west-1 due to network ACLs.

AnswerC

The health check takes up to 90 seconds to mark unhealthy, and DNS TTL of 60 seconds extends the impact.

Why this answer

The most likely cause is that the health check interval and failure threshold create a delay in detection, and DNS caching causes clients to still resolve to the unhealthy endpoint. Route 53 health checks check the endpoint every 30 seconds and require 3 consecutive failures to mark it unhealthy, resulting in up to 90 seconds (3 * 30s) before the health check fails. Additionally, DNS resolvers cache the resolved IP address for the TTL of 60 seconds.

Therefore, even after the health check marks the endpoint unhealthy, some clients may still have the cached IP and attempt to connect to the failed us-east-1 ALB, causing timeouts. Option A is incorrect because latency-based routing does fail over when health checks fail; the issue is the delay. Option B is incorrect because cross-zone load balancing is irrelevant to multi-region failover.

Option D is incorrect because Route 53 health checks are global and can reach any region.

Full explanation →

1545

MCQmedium

A company is designing a hybrid network architecture that connects an on-premises data center to AWS using AWS Direct Connect. The company wants to ensure high availability and avoid a single point of failure. The on-premises router connects to two separate AWS Direct Connect locations. Which configuration should be used to meet these requirements?

A.Create two private VIFs on the same Direct Connect connection and connect each to a different VPC.

B.Create a single private virtual interface (VIF) on one Direct Connect connection and connect it to a single VPC.

C.Create two Direct Connect connections, each with a private VIF, and connect them to a Direct Connect gateway that is associated with a Transit VPC.

D.Create a Direct Connect gateway and attach a single private VIF from one connection.

AnswerC

Provides redundancy with two separate connections and a Transit VPC.

Why this answer

It uses two separate Direct Connect connections, each with a private VIF, both attached to a Direct Connect gateway. This eliminates a single point of failure at the connection level and, when combined with a Transit VPC, provides redundant, highly available connectivity from the on-premises data center to multiple VPCs. The Direct Connect gateway aggregates the private VIFs and allows traffic to be forwarded to the Transit VPC, which then routes to the attached VPCs, ensuring no single component failure disrupts the hybrid network.

Exam trap

AWS often tests the misconception that multiple VIFs on a single connection or a single VIF attached to a Direct Connect gateway provide high availability, but the trap is that the physical connection itself remains a single point of failure unless two separate Direct Connect connections are used.

How to eliminate wrong answers

Option A is wrong because creating two private VIFs on the same Direct Connect connection does not eliminate the single point of failure; if that single physical connection fails, both VIFs go down. Option B is wrong because a single private VIF on one Direct Connect connection creates a single point of failure; if the connection or VIF fails, all connectivity to AWS is lost. Option D is wrong because attaching a single private VIF from one connection to a Direct Connect gateway still relies on a single Direct Connect connection, leaving the architecture vulnerable to a failure of that connection.

Full explanation →

1546

MCQhard

A company is migrating its on-premises data center to AWS. The network team needs to design a hybrid connectivity solution that provides high availability with a bandwidth of at least 10 Gbps and low latency for real-time data replication. The company has two redundant on-premises routers connected to two separate internet service providers (ISPs). Which combination of AWS services should the company use to meet these requirements?

A.Use AWS Direct Connect Gateway to aggregate multiple VPN connections to achieve higher bandwidth.

B.Provision a single AWS Direct Connect connection with a 10 Gbps port and connect both on-premises routers to it via a single interface.

C.Provision two AWS Direct Connect connections at two different Direct Connect locations, each with a 10 Gbps port, and connect each on-premises router to one of them.

D.Set up two AWS Site-to-Site VPN tunnels from each on-premises router to two different AWS VPN endpoints in the same region.

AnswerC

Provides high availability and meets bandwidth/latency requirements.

Why this answer

Provisioning two AWS Direct Connect connections at two different Direct Connect locations, each with a 10 Gbps port, and connecting each on-premises router to one of them provides both high availability (via geographic and path redundancy) and the required 10 Gbps bandwidth with low latency for real-time data replication. This design eliminates single points of failure and meets the bandwidth requirement without relying on VPNs, which cannot guarantee consistent low latency or 10 Gbps throughput.

Exam trap

The trap here is that candidates often assume a single Direct Connect connection with redundant routers on-premises is sufficient for high availability, but they overlook that the Direct Connect connection itself (including the physical fiber and the AWS Direct Connect location) is a single point of failure, requiring two separate connections at different locations to meet true high availability.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect Gateway does not aggregate VPN connections; it is a transit hub that interconnects Direct Connect connections and VPNs, but VPNs themselves are limited by internet-based encryption overhead and cannot reliably achieve 10 Gbps bandwidth or the low latency required for real-time replication. Option B is wrong because a single Direct Connect connection with a 10 Gbps port and a single interface creates a single point of failure; if the connection or location fails, the entire hybrid connectivity is lost, violating the high availability requirement. Option D is wrong because two AWS Site-to-Site VPN tunnels from each on-premises router to two different VPN endpoints still rely on the public internet, which introduces variable latency, jitter, and bandwidth limitations (typically up to 1.25 Gbps per tunnel with ECMP), failing to meet the 10 Gbps and low latency requirements.

Full explanation →

1547

MCQhard

A company is using AWS Client VPN to provide remote access to employees. Users report that they can connect to the VPN but cannot reach resources in the VPC. The Client VPN endpoint is associated with a subnet, and authorization rules are configured. What is the most likely cause?

A.The Client VPN endpoint's security group does not allow inbound traffic from the client IP pool.

B.The VPC's network ACLs are blocking traffic.

C.The authorization rules are not associated with the correct groups.

D.The subnet association is missing.

AnswerA

The security group acts as a firewall for the VPN endpoint; if it doesn't allow traffic from the client CIDR, traffic is blocked.

Why this answer

The most likely cause is that the Client VPN endpoint's security group does not allow inbound traffic from the client IP pool. Since users can connect to the VPN, the subnet association and authorization rules are correctly configured. However, the security group attached to the VPN endpoint acts as a virtual firewall for inbound and outbound traffic.

If it does not permit inbound traffic from the client IP range, resources in the VPC will not be reachable. The network ACLs are stateless and default to allowing outbound traffic, so they are less likely to be the issue.

Full explanation →

1548

MCQhard

A network engineer is designing a hybrid network with multiple AWS accounts. The company wants to simplify management by using a single AWS Direct Connect connection shared among accounts. Which service should be used to achieve this?

A.Transit Gateway with Direct Connect Gateway

B.VPC Peering

C.AWS PrivateLink

D.AWS VPN CloudHub

AnswerA

Transit Gateway with Direct Connect Gateway allows multi-account sharing of a single Direct Connect connection.

Why this answer

A Transit Gateway with a Direct Connect Gateway allows you to attach multiple VPCs from different AWS accounts to a single Direct Connect connection. The Direct Connect Gateway acts as a bridge between the on-premises network and the Transit Gateway, which then routes traffic to the appropriate VPCs across accounts. This setup simplifies management by centralizing the Direct Connect connection while supporting multi-account architectures.

Exam trap

The trap here is that candidates often confuse Direct Connect Gateway with a simple VIF or assume VPC Peering can provide transitive routing across multiple accounts, but only Transit Gateway with Direct Connect Gateway supports multi-account sharing of a single Direct Connect connection.

How to eliminate wrong answers

Option B is wrong because VPC Peering only connects two VPCs directly and does not support sharing a single Direct Connect connection across multiple accounts; it also lacks transitive routing. Option C is wrong because AWS PrivateLink is used to expose services privately within a VPC or across accounts via interface endpoints, not to share a Direct Connect connection. Option D is wrong because AWS VPN CloudHub is a hub-and-spoke VPN model that uses multiple VPN connections, not a single Direct Connect connection, and does not integrate with Direct Connect Gateway.

Full explanation →

1549

Multi-Selecthard

A company wants to secure network traffic between on-premises data centers and AWS using AWS Site-to-Site VPN. Which TWO components are required to establish a VPN connection?

Select 2 answers

A.Transit Gateway

B.Customer Gateway (CGW)

C.VPN Connection

D.Direct Connect connection

E.Virtual Private Gateway (VGW)

AnswersB, E

CGW represents the on-premises device.

Why this answer

AWS Site-to-Site VPN requires a Virtual Private Gateway (VGW) on the AWS side and a Customer Gateway (CGW) representing the on-premises VPN device. Option A (Transit Gateway) is not required; it's optional for complex routing. Option C (VPN Connection) is not a component; it's the logical connection object that ties VGW and CGW together.

Option D (Direct Connect connection) is a different service.

Full explanation →

1550

MCQhard

A company has a multi-account AWS environment using AWS Organizations. Each account contains a VPC with a private subnet and a public subnet. The company uses a centralized inspection VPC in the network account with third-party firewall appliances. All internet-bound traffic from the VPCs must be routed through the inspection VPC via an AWS Transit Gateway. The network team has configured the transit gateway with separate route tables: one for the inspection VPC and one for the spoke VPCs. The spoke VPCs have a default route (0.0.0.0/0) pointing to the transit gateway. The inspection VPC has a default route pointing to an egress VPC that has an internet gateway. However, traffic from a spoke VPC is not reaching the internet. The network engineer has verified that the firewall appliances are running and that the security groups and NACLs allow traffic. What is the most likely cause of the issue?

A.The inspection VPC route table does not have a route to the transit gateway for the spoke VPC CIDRs.

B.The inspection VPC route table does not have a route to the spoke VPC CIDRs via the transit gateway.

C.The inspection VPC route table has a blackhole route for the spoke VPC CIDRs.

D.The transit gateway route table for the spoke VPCs does not have a route to the egress VPC.

AnswerA

Correct: Without a route to the transit gateway, the firewall cannot send traffic back to the spoke VPCs.

Why this answer

For traffic from a spoke VPC to reach the internet via the inspection VPC, the inspection VPC must be able to route return traffic back to the spoke VPC. The inspection VPC's route table requires routes for each spoke VPC's CIDR blocks with the Transit Gateway as the target. Without these routes, the firewall cannot forward return traffic, causing the initial connection to time out and internet access to fail.

Option B is similar but misstates the requirement. Options C and D describe different issues that do not align with the described symptoms.

Full explanation →

1551

MCQmedium

A network engineer is designing a security group for a web application that must allow inbound HTTPS traffic from the internet and outbound traffic to an RDS MySQL database. The web servers are in a public subnet and the RDS database is in a private subnet. What is the most secure way to configure the security groups?

A.Web SG: inbound HTTPS from 0.0.0.0/0; outbound MySQL to DB SG. DB SG: inbound MySQL from Web SG.

B.Web SG: inbound HTTPS from 0.0.0.0/0; outbound 0.0.0.0/0. DB SG: inbound MySQL from Web SG.

C.Web SG: inbound HTTPS from 0.0.0.0/0; outbound MySQL to DB SG. DB SG: inbound MySQL from 0.0.0.0/0.

D.Web SG: inbound HTTPS from 0.0.0.0/0; outbound 0.0.0.0/0. DB SG: inbound MySQL from 0.0.0.0/0.

AnswerA

Least privilege: web outbound only to DB, DB inbound only from web.

Why this answer

The most secure configuration. The web server security group allows inbound HTTPS from the internet (0.0.0.0/0) and outbound MySQL traffic specifically to the database security group. The database security group allows inbound MySQL only from the web server security group.

This ensures that only the web servers can communicate with the database, minimizing exposure. Option B is less secure because the web server security group allows outbound traffic to 0.0.0.0/0, which is overly permissive. Option C is incorrect because the database security group allows inbound MySQL from 0.0.0.0/0, exposing the database to the internet.

Option D combines both overly permissive outbound and inbound rules, making it the least secure.

Full explanation →

1552

MCQmedium

A company is designing a network for a critical application that requires high availability across two AWS Regions (us-east-1 and us-west-2). The application uses an Application Load Balancer (ALB) in each region, with Auto Scaling groups behind them. The database is an Amazon Aurora Global Database with a primary cluster in us-east-1 and a secondary cluster in us-west-2. The company wants to use Amazon Route 53 to route traffic to the closest healthy ALB. They also need to ensure that if the primary database fails over to the secondary region, the application can still write to the database with minimal latency. Additionally, the application must be able to read from the local database in each region for read-intensive workloads. The network team has designed the following: Route 53 with latency-based routing and health checks for the ALBs. The application instances in each region are configured to connect to the local Aurora cluster endpoint. For writes, they use the global writer endpoint. What is the MOST significant design flaw?

A.The Auto Scaling groups are not configured with lifecycle hooks to drain connections during scale-in

B.The Route 53 health checks only monitor the ALB endpoint, not the overall application health including database connectivity

C.The application instances in us-west-2 experience high latency for write operations due to cross-region traffic to the primary database

D.The Aurora Global Database does not support cross-region replication for read replicas

AnswerB

If the database fails in a region, the ALB might still be healthy, causing traffic to be sent to a region that cannot serve requests.

Why this answer

The design flaw is that Route 53 health checks only monitor the ALB endpoint, not the overall application health including database connectivity. If the database in a region fails (e.g., due to a failure in the primary or secondary cluster), the ALB might still be healthy, and Route 53 would continue to route traffic to that region. However, the application instances would not be able to serve requests properly because they rely on the local database.

A robust health check should include checking the application's ability to connect to the database and perform basic operations. This ensures that traffic is only routed to regions where the full application stack is healthy. Other options are less significant: A (lifecycle hooks) is a minor optimization, C (write latency) is inherent to the architecture and might be acceptable for critical writes, and D is false because Aurora Global Database does support cross-region replication.

Full explanation →

1553

MCQhard

A security engineer is designing a network architecture for a multi-account AWS environment using AWS Organizations. The company requires that all inter-VPC traffic be inspected by a centralized firewall appliance. Which solution provides the most scalable and maintainable inspection architecture?

A.Use a Transit Gateway with a centralized inspection VPC that uses AWS Network Firewall

B.Create VPC peering connections between all VPCs and route traffic through a security VPC with a firewall

C.Use Network ACLs in each VPC to filter traffic between subnets

D.Use a Transit Gateway and attach all VPCs to a centralized inspection VPC that hosts a third-party firewall

AnswerA

This provides scalable, centralized traffic inspection with managed firewall service.

Why this answer

Using a Transit Gateway with a centralized inspection VPC that uses AWS Network Firewall provides a scalable and maintainable architecture. Transit Gateway allows all VPCs to connect through a central hub, and AWS Network Firewall provides managed, scalable deep packet inspection. Option B is incorrect because VPC peering does not scale well and requires complex routing.

Option C is incorrect because Network ACLs are stateless and cannot perform deep packet inspection. Option D is incorrect because third-party firewall appliances in a single VPC can become a bottleneck and are less scalable than the managed AWS Network Firewall solution.

Full explanation →

1554

MCQmedium

A company is deploying a VPC with public and private subnets across two Availability Zones. They need to ensure that instances in the private subnets can access the internet for software updates without being directly reachable from the internet. Which AWS service should they use?

A.Virtual Private Gateway

B.VPC Peering Connection

C.Internet Gateway

D.NAT Gateway

AnswerD

A NAT Gateway allows outbound internet traffic from private subnets while blocking inbound traffic.

Why this answer

A NAT Gateway enables instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet. It translates the private IP addresses of the instances to the NAT Gateway's Elastic IP address using source network address translation (SNAT). This satisfies the requirement of internet access without direct reachability.

Exam trap

The ANS-C01 exam often tests the misconception that an Internet Gateway can be used for private subnets by simply not assigning public IPs, but the trap here is that an Internet Gateway requires instances to have public IP addresses or Elastic IPs for outbound traffic, which still makes them potentially reachable from the internet if routes are misconfigured.

How to eliminate wrong answers

Option A is wrong because a Virtual Private Gateway is used to connect a VPC to an on-premises network via VPN or AWS Direct Connect, not to provide internet access to private instances. Option B is wrong because VPC Peering Connection allows routing between two VPCs using private IP addresses but does not provide internet access. Option C is wrong because an Internet Gateway enables both inbound and outbound internet access for instances with public IP addresses; attaching it to private subnets would make instances directly reachable from the internet, violating the requirement.

Full explanation →

1555

MCQeasy

A company has multiple VPCs that need to communicate with each other using private IP addresses. The VPCs are in the same AWS account and Region. Which AWS service provides the simplest and most scalable solution?

A.VPC peering connections

B.AWS Site-to-Site VPN

C.ClassicLink

D.AWS Transit Gateway

AnswerA

Simple, direct, scalable for multiple VPCs.

Why this answer

VPC peering connections allow direct, private IP connectivity between VPCs using the AWS global network, with no single point of failure or bandwidth bottleneck. It is the simplest solution because it requires no additional hardware or software, and it scales horizontally by adding more peering connections as needed, though it does not support transitive routing.

Exam trap

The trap here is that candidates may choose AWS Transit Gateway (Option D) because it is a powerful hub-and-spoke solution, but the question asks for the 'simplest and most scalable' solution for multiple VPCs in the same account and Region, and VPC peering is simpler for small numbers of VPCs, while Transit Gateway adds unnecessary complexity and cost for this specific scenario.

How to eliminate wrong answers

Option B is wrong because AWS Site-to-Site VPN is designed for connecting on-premises networks to AWS, not for inter-VPC communication, and it introduces complexity with VPN tunnels and potential bandwidth limitations. Option C is wrong because ClassicLink is a legacy feature that only connects EC2-Classic instances to a single VPC, not multiple VPCs, and it is not scalable or supported for modern VPC-only architectures. Option D is wrong because AWS Transit Gateway, while scalable and supporting transitive routing, is more complex and costly than VPC peering for a simple scenario with a small number of VPCs in the same account and Region; it is overkill when direct peering suffices.

Full explanation →

1556

MCQeasy

A company is deploying a VPC with public and private subnets in two Availability Zones. They need to ensure that instances in private subnets can access the internet for software updates while remaining unreachable from the internet. Which solution meets these requirements?

A.Attach an internet gateway to the private subnets and configure route tables.

B.Deploy a NAT Gateway in a public subnet and add a route to the NAT Gateway in the private subnet route tables.

C.Use a transit gateway to connect the VPC to the internet.

D.Establish a VPN connection to an on-premises network and route traffic through it.

AnswerB

NAT Gateway enables outbound internet connectivity while preventing inbound traffic from the internet.

Why this answer

A NAT Gateway deployed in a public subnet provides outbound-only internet access for instances in private subnets. The private subnet route table directs 0.0.0.0/0 traffic to the NAT Gateway, which translates the private IPs to the NAT Gateway's Elastic IP, allowing internet access while preventing any unsolicited inbound connections from the internet.

Exam trap

AWS often tests the misconception that an internet gateway can be directly associated with private subnets, but the trap here is that an internet gateway enables bidirectional traffic, so attaching it to private subnets would expose instances to inbound internet connections, violating the requirement for unreachability from the internet.

How to eliminate wrong answers

Option A is wrong because an internet gateway (IGW) must be attached to the VPC, not to subnets, and adding a route to an IGW in private subnet route tables would make those subnets effectively public, allowing inbound traffic from the internet, which violates the requirement that instances remain unreachable from the internet. Option C is wrong because a transit gateway is used for inter-VPC or hybrid connectivity, not for providing direct internet access to VPC resources; it does not replace the need for a NAT device or internet gateway for internet-bound traffic. Option D is wrong because a VPN connection to an on-premises network routes traffic through a corporate network, which may not provide direct internet access for software updates and introduces unnecessary latency and complexity; it does not satisfy the requirement for instances to access the internet directly.

Full explanation →

1557

Multi-Selectmedium

A company is designing a VPC architecture with a public subnet and a private subnet. They want to allow instances in the private subnet to download software updates from the internet. Which TWO options satisfy this requirement? (Choose TWO.)

Select 2 answers

A.Configure a forward proxy in the private subnet and configure the instances to use it.

B.Create a VPC Gateway Endpoint for Amazon S3 and route traffic to it.

C.Set up a NAT Gateway in a public subnet and add a default route in the private subnet route table pointing to the NAT Gateway.

D.Launch a NAT instance in a public subnet and add a default route in the private subnet route table pointing to the NAT instance.

E.Attach an Internet Gateway to the private subnet and add a default route to it.

AnswersC, D

NAT Gateway provides outbound internet access.

Why this answer

A NAT Gateway in a public subnet provides outbound-only internet access to instances in a private subnet. By adding a default route (0.0.0.0/0) in the private subnet route table pointing to the NAT Gateway, traffic from private instances is source-NATed to the NAT Gateway's Elastic IP, allowing downloads while preventing inbound connections from the internet.

Exam trap

AWS often tests the misconception that a NAT Gateway or NAT instance can be placed in a private subnet, but both must reside in a public subnet with an Internet Gateway to translate private IPs to a public IP for outbound internet access.

Full explanation →

1558

MCQmedium

Refer to the exhibit. After deploying this CloudFormation stack, the VPC is attached to the transit gateway. However, routes are not being propagated to the transit gateway route table. What is the most likely cause?

A.The VPC attachment is not in the 'available' state.

B.The transit gateway route table propagation is not configured.

C.VPN ECMP support is enabled, preventing propagation.

D.DNS support is disabled on the transit gateway.

AnswerB

DefaultRouteTablePropagation enables automatic propagation, but the attachment does not explicitly propagate.

Why this answer

The exhibit shows a transit gateway route table attached to the VPC, but no propagation is configured. Without explicit propagation, the VPC attachment's CIDR blocks are not automatically added to the transit gateway route table. The CloudFormation resource AWS::EC2::TransitGatewayRouteTablePropagation must be declared to enable route propagation from the VPC attachment into the transit gateway route table.

Exam trap

The ANS-C01 exam often tests the distinction between transit gateway attachment and route propagation, trapping candidates who assume that simply attaching a VPC to a transit gateway automatically populates the route table with the VPC's CIDR.

How to eliminate wrong answers

Option A is wrong because if the VPC attachment were not in the 'available' state, the attachment would fail entirely or be in a 'pending' or 'failed' state, which would prevent any route propagation, but the question states the VPC is attached to the transit gateway, implying the attachment is available. Option C is wrong because VPN ECMP support is a feature for VPN attachments that allows equal-cost multipath routing across multiple VPN tunnels; it does not affect route propagation from a VPC attachment to the transit gateway route table. Option D is wrong because DNS support is a VPC-level setting (enableDnsSupport) that controls DNS resolution within the VPC and has no impact on transit gateway route propagation.

Full explanation →

1559

Multi-Selecthard

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to an on-premises network with CIDR 172.16.0.0/12. They are using an AWS Transit Gateway with a VPN attachment to the on-premises network. The transit gateway route table has a static route for 172.16.0.0/12 pointing to the VPN attachment. Which THREE of the following are necessary for traffic to flow from the VPC to on-premises?

Select 3 answers

A.The VPC route tables include a route for 172.16.0.0/12 pointing to the transit gateway

B.The VPC is attached to the transit gateway

C.The transit gateway route table includes a route for 172.16.0.0/12 pointing to the VPN attachment

D.The on-premises router is advertising the 172.16.0.0/12 route over BGP

E.The VPN tunnel is configured with dynamic BGP routing

AnswersA, B, C

VPC instances need a route to send traffic to the transit gateway.

Why this answer

Necessary because the VPC route tables must have a route for 172.16.0.0/12 pointing to the transit gateway to forward traffic to on-premises. Option B is necessary because the VPC must be attached to the transit gateway to allow communication. Option C is necessary because the transit gateway route table must include a static route for 172.16.0.0/12 pointing to the VPN attachment.

Option D is not necessary because the on-premises router does not need to advertise the route over BGP; the static route in the transit gateway suffices. Option E is not necessary because the VPN tunnel can use static routing instead of dynamic BGP.

Full explanation →

1560

MCQeasy

A network engineer is designing a highly available VPN connection between an on-premises network and AWS. The on-premises network has two internet connections from different ISPs. Which AWS VPN configuration should be used to provide the highest availability?

A.Create a single VPN tunnel from one customer gateway to the virtual private gateway.

B.Create two customer gateways, each with a VPN tunnel to the virtual private gateway.

C.Create one customer gateway with two VPN tunnels, each using different internet connections.

D.Use AWS Direct Connect instead of VPN for higher availability.

AnswerB

Two tunnels from different devices and ISPs provide high availability.

Why this answer

Using two customer gateways with two VPN tunnels each provides redundancy at both the device and ISP level. Option A is wrong because a single VPN tunnel is not redundant. Option C is wrong because a single customer gateway with two tunnels only provides ISP redundancy.

Option D is wrong because Direct Connect is not a VPN.

Full explanation →

1561

MCQhard

A company is designing a network security architecture for a multi-account AWS environment using AWS Organizations. They need to centrally manage and enforce VPC security group rules across all accounts. Which service should they use?

A.AWS CloudFormation StackSets

B.AWS Config

C.AWS Firewall Manager

D.AWS Service Catalog

AnswerC

Firewall Manager provides centralized management and enforcement of security groups and firewall rules across accounts.

Why this answer

AWS Firewall Manager allows centralized management of security groups and AWS WAF rules across accounts in AWS Organizations. Option A is wrong because AWS CloudFormation StackSets deploy resources but do not centrally enforce security group rules. Option B is wrong because AWS Config is for compliance and configuration tracking, not enforcement.

Option D is wrong because AWS Service Catalog is for provisioning approved resources, not managing security groups.

Full explanation →

1562

Multi-Selecthard

A company wants to monitor and log all changes to security group rules in their AWS account for compliance purposes. Which TWO services can be used together to achieve this?

Select 2 answers

A.AWS Trusted Advisor

B.VPC Flow Logs

C.Amazon EventBridge

D.AWS Config

E.AWS CloudTrail

AnswersC, E

EventBridge can match CloudTrail events and trigger actions for compliance monitoring.

Why this answer

(Amazon EventBridge) can capture AWS CloudTrail events and trigger notifications. Option E (AWS CloudTrail) logs API calls, including changes to security group rules. Together, they provide monitoring and logging of security group changes.

Option A is wrong because AWS Trusted Advisor provides best-practice checks, not change logging. Option B is wrong because VPC Flow Logs capture traffic, not configuration changes. Option D is wrong because AWS Config records resource state but does not log API calls.

Full explanation →

1563

Multi-Selectmedium

Which THREE AWS services can be used to improve the availability of a web application across multiple AWS Regions? (Choose 3.)

Select 3 answers

A.VPC peering

B.AWS Global Accelerator

C.AWS Direct Connect

D.Amazon CloudFront

E.Amazon Route 53

AnswersB, D, E

Traffic management with health checks.

Why this answer

AWS Global Accelerator improves availability across multiple AWS Regions by using the AWS global network to route user traffic to the optimal regional endpoint based on health, latency, and geography. It provides static anycast IP addresses and automatically reroutes traffic to healthy endpoints during a regional failure, thereby enhancing fault tolerance and performance for global web applications.

Exam trap

AWS often tests the misconception that VPC peering or Direct Connect can provide multi-Region high availability, but these services are designed for private connectivity and do not include any global traffic routing, health monitoring, or automatic failover capabilities.

Full explanation →

1564

Multi-Selectmedium

A network team is planning a migration of a legacy application to AWS. The application requires a static IP address for the on-premises firewall whitelist. Which THREE AWS services can provide a static IP address for outbound traffic from a VPC?

Select 3 answers

A.AWS Direct Connect with a public virtual interface.

B.VPC endpoint (gateway endpoint) for S3.

C.Application Load Balancer without a static IP.

D.Amazon NAT Gateway with an Elastic IP address.

E.Network Load Balancer with an Elastic IP address per subnet.

AnswersA, D, E

Traffic over a public VIF comes from a static public IP (the Direct Connect public IP).

Why this answer

Options A, D, and E are correct. A Direct Connect public virtual interface uses a static public IP address for outbound traffic. A NAT Gateway with an Elastic IP provides a static IP for outbound traffic from private subnets.

A Network Load Balancer with Elastic IPs per subnet provides static IPs for inbound and outbound traffic. Option B (VPC endpoint for S3) does not provide a static IP; it uses a prefix list. Option C (Application Load Balancer) does not have a static IP by default; it uses dynamic IPs.

Full explanation →

1565

MCQmedium

A network engineer is monitoring a Direct Connect connection. The exhibit shows CloudWatch metric data for the ConnectionState metric. The engineer sees that the average value is 0.0 for most of the day. What does this indicate?

A.The connection was fluctuating between up and down.

B.The connection was down for most of the day.

C.The metric data is incomplete.

D.The connection was up and stable.

AnswerB

0 means down.

Why this answer

The ConnectionState metric indicates the state of the Direct Connect connection, where 0 means down and 1 means up. An average value of 0.0 for most of the day indicates the connection was down. Therefore, option B is correct.

Option A is incorrect because the metric shows a consistent value of 0, not fluctuating. Option C is incorrect because the data is complete and clearly shows the connection was down. Option D is incorrect because a value of 0 means the connection was not up and stable.

Full explanation →

1566

MCQhard

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The network team wants to ensure that traffic between the on-premises network and AWS is encrypted. Which solution meets this requirement?

A.Establish an IPSec VPN tunnel over the Direct Connect connection using a public VIF or transit VIF.

B.Establish a VPC peering connection between the on-premises network and the VPC.

C.Use a private virtual interface (VIF) over Direct Connect.

D.Use an IPSec VPN connection over the internet.

AnswerA

This encrypts traffic while using Direct Connect's low latency.

Why this answer

Direct Connect does not provide encryption by default. To encrypt traffic between on-premises and AWS over a Direct Connect connection, you can establish an IPSec VPN tunnel over a public VIF or transit VIF. This encrypts the traffic while still using the Direct Connect link.

Option A is correct. Option B (VPC peering) is not applicable to on-premises networks. Option C (private VIF) does not provide encryption.

Option D (IPSec VPN over the internet) does not use Direct Connect and does not meet the requirement to use Direct Connect.

Full explanation →

1567

MCQhard

A company has deployed an application in a VPC with public and private subnets. The application uses an Amazon RDS for MySQL database in a private subnet. To meet security requirements, the database must not be accessible from the internet. The application team needs to connect to the database for maintenance using SSH over a bastion host. Which architecture is the most secure?

A.Bastion host in a public subnet with the same security group as the database, allowing SSH from the corporate IP range and MySQL from the bastion

B.Bastion host in a public subnet with a security group allowing SSH from 0.0.0.0/0, and database security group allowing MySQL from the bastion host's security group

C.Connect to the database directly using a Site-to-Site VPN without a bastion host

D.Bastion host in a public subnet with a security group allowing SSH from the corporate IP range, and database security group allowing MySQL from the bastion host's security group

AnswerD

This is secure and follows best practices.

Why this answer

The most secure architecture because it restricts SSH access to the bastion host from only the corporate IP range, and the database security group allows MySQL (port 3306) traffic solely from the bastion host's security group. This ensures the database is never directly exposed to the internet and only accepts connections from the bastion, which itself is locked down to authorized corporate IPs. The use of security group referencing (instead of IP-based rules) provides dynamic, scalable access control that automatically applies to any instances with the bastion's security group.

Exam trap

The trap here is that candidates often confuse security group referencing with IP-based rules, or they mistakenly think that allowing SSH from 0.0.0.0/0 is acceptable because the bastion host is the only entry point, ignoring the increased attack surface and the principle of least privilege.

How to eliminate wrong answers

Option A is wrong because placing the bastion host in the same security group as the database would allow the database to inherit the bastion's SSH rule, potentially exposing the database to SSH traffic from the corporate IP range, which violates the requirement that the database not be accessible from the internet. Option B is wrong because allowing SSH from 0.0.0.0/0 exposes the bastion host to brute-force attacks from any internet source, significantly reducing security. Option C is wrong because connecting directly to the database via Site-to-Site VPN without a bastion host still exposes the database to the corporate network, and if the VPN is compromised, the database is directly accessible; a bastion host provides an additional layer of authentication and audit logging.

Full explanation →

1568

MCQmedium

A company has a VPC with public and private subnets in multiple Availability Zones. They want to deploy a NAT gateway for outbound internet access for instances in private subnets. Which of the following is the most highly available architecture?

A.Deploy one NAT gateway in each Availability Zone with a route table per AZ that points to the NAT gateway in the same AZ.

B.Deploy one NAT gateway in the first Availability Zone and route all private subnet traffic to that NAT gateway.

C.Use a single NAT instance in a public subnet with an auto scaling group and health checks.

D.Deploy two NAT gateways in the first Availability Zone and use a single route table pointing to one of them.

AnswerA

This provides per-AZ redundancy and avoids cross-AZ dependency.

Why this answer

For high availability, you should deploy a NAT gateway in each Availability Zone and route traffic from private subnets in each AZ to the NAT gateway in the same AZ. This avoids cross-AZ data transfer costs and ensures that an AZ failure does not affect other AZs. Option A is correct.

Options B and C do not provide equal HA. Option D is incorrect because deploying both NAT gateways in the same Availability Zone creates a single point of failure—if that AZ goes down, both gateways fail, so it is not highly available.

Full explanation →

1569

MCQmedium

A company is deploying a hybrid network architecture with an AWS Direct Connect connection. They require high availability with redundant connections to two different AWS Direct Connect locations. Which configuration meets the high availability requirement?

A.Two Direct Connect connections at two different AWS Direct Connect locations

B.One Direct Connect connection and one AWS Site-to-Site VPN as backup

C.Two virtual interfaces (VIFs) on the same Direct Connect connection

D.Two Direct Connect connections at the same AWS Direct Connect location

AnswerA

Provides physical redundancy and high availability.

Why this answer

Deploying two Direct Connect connections at two different AWS Direct Connect locations provides physical and logical redundancy. This ensures that if one location experiences an outage, the other location can continue to handle traffic, meeting the high availability requirement. AWS recommends this architecture for production workloads requiring resilient hybrid connectivity.

Exam trap

The trap here is that candidates often confuse multiple virtual interfaces (VIFs) or multiple connections at the same location as sufficient redundancy, but AWS explicitly requires connections at two different Direct Connect locations to achieve true high availability against facility-level failures.

How to eliminate wrong answers

Option B is wrong because a Site-to-Site VPN over the internet is not a fully redundant alternative to a second Direct Connect connection; it introduces higher latency, lower bandwidth, and dependency on internet availability, which does not meet the same high availability SLA as dual Direct Connect connections. Option C is wrong because two virtual interfaces on the same Direct Connect connection share the same physical infrastructure; a single fiber cut or device failure at that location will bring down both VIFs, providing no redundancy. Option D is wrong because two Direct Connect connections at the same AWS Direct Connect location still share the same facility and potential single points of failure (e.g., power, cooling, or carrier issues), so they do not achieve the required high availability across independent failure domains.

Full explanation →

1570

MCQmedium

A company has a VPC with a CIDR of 172.16.0.0/16. They have a subnet 172.16.1.0/24 for web servers and another subnet 172.16.2.0/24 for database servers. The web servers need to access the database servers on port 3306. Which configuration is required?

A.Configure network ACLs to allow inbound on port 3306 from web subnet.

B.Web SG: inbound from 0.0.0.0/0 on port 3306. DB SG: outbound to web SG on port 3306.

C.Web SG: outbound to DB SG on port 3306. DB SG: inbound from web SG on port 3306.

D.Web SG: outbound to DB SG on all ports. DB SG: inbound from web SG on all ports.

AnswerC

Allows only MySQL traffic from web to DB.

Why this answer

Security groups are stateful and control traffic at the instance level. The web server security group needs an outbound rule allowing traffic to the database security group on port 3306, and the database security group needs an inbound rule allowing traffic from the web security group on port 3306. This ensures that only the web servers can initiate connections to the database servers on the required port.

Exam trap

The trap here is that candidates often confuse the stateless nature of network ACLs with the stateful behavior of security groups, or they incorrectly assume that inbound rules on the source security group are needed instead of outbound rules on the source and inbound rules on the destination.

How to eliminate wrong answers

Option A is wrong because network ACLs are stateless and apply at the subnet level, not the instance level, and they require both inbound and outbound rules to allow traffic; additionally, the question asks for a configuration that works with security groups, not network ACLs. Option B is wrong because it incorrectly sets the web security group to allow inbound traffic on port 3306 from 0.0.0.0/0, which would allow any source to connect to the web servers on the database port, and the outbound rule on the database security group is unnecessary because security groups are stateful and return traffic is automatically allowed. Option D is wrong because it allows all ports instead of restricting to port 3306, violating the principle of least privilege and unnecessarily exposing the database servers to all traffic from the web servers.

Full explanation →

1571

Multi-Selecteasy

A company is setting up a site-to-site VPN connection between an on-premises network and AWS. Which TWO components are required for the VPN connection?

Select 2 answers

A.Customer gateway

B.Transit gateway

C.Virtual private gateway

D.VPN connection

E.Direct Connect connection

AnswersA, C

Represents the on-premises router.

Why this answer

A customer gateway is required as the on-premises side endpoint for the site-to-site VPN, representing the physical or software VPN device on the customer network. A virtual private gateway is required as the AWS-side VPN concentrator that terminates the VPN tunnels and routes traffic from the VPC to the on-premises network. Together, they form the two mandatory endpoints for establishing IPsec VPN tunnels over the internet.

Exam trap

The ANS-C01 exam often tests the misconception that the VPN connection resource itself is a required component, but it is actually the logical configuration object that links the two endpoints, not a physical or virtual endpoint required for the VPN to function.

Full explanation →

1572

MCQeasy

A company wants to connect its on-premises data center to AWS using a dedicated, high-bandwidth, low-latency connection. The data center is collocated with an AWS Direct Connect location. Which AWS service should be used to establish this connection?

A.VPC peering

B.AWS Transit Gateway

C.AWS Direct Connect

D.AWS Site-to-Site VPN

AnswerC

Direct Connect provides a dedicated, private connection with high bandwidth and low latency.

Why this answer

AWS Direct Connect is the correct service because it provides a dedicated, private, high-bandwidth, low-latency connection from an on-premises data center to AWS. Since the data center is collocated with an AWS Direct Connect location, the company can establish a physical cross-connect directly to the AWS Direct Connect router, bypassing the public internet entirely.

Exam trap

The ANS-C01 exam often tests the distinction between the physical connectivity service (Direct Connect) and the logical aggregation service (Transit Gateway), leading candidates to mistakenly choose Transit Gateway when the question explicitly asks for the service that establishes the dedicated connection.

How to eliminate wrong answers

Option A is wrong because VPC peering connects two VPCs within AWS, not an on-premises data center to AWS. Option B is wrong because AWS Transit Gateway is a network transit hub that connects VPCs and on-premises networks, but it does not provide the physical dedicated connection itself; it requires an underlying connection like Direct Connect or VPN. Option D is wrong because AWS Site-to-Site VPN uses the public internet and IPSec tunnels, which cannot guarantee the dedicated high-bandwidth and low-latency requirements specified in the question.

Full explanation →

1573

Multi-Selectmedium

A company is designing a multi-region active-active application. They need to ensure that traffic is routed to the closest healthy region and that failover happens automatically. Which TWO services should be used together to achieve this?

Select 2 answers

A.AWS Transit Gateway with inter-region peering

B.Amazon CloudFront with multiple origins

C.AWS Global Accelerator with endpoint groups

D.Amazon Route 53 with latency-based routing

E.AWS Direct Connect with multiple locations

AnswersC, D

Provides anycast IPs and health checks.

Why this answer

AWS Global Accelerator (C) uses Anycast IPs to direct traffic to the closest healthy endpoint group, automatically rerouting traffic if a region becomes unhealthy. This provides fast regional failover and low-latency routing without DNS caching delays, making it ideal for active-active multi-region applications.

Exam trap

The trap here is that candidates often think Route 53 latency-based routing (D) alone is sufficient for automatic failover, but it relies on DNS caching and TTLs, which can delay failover by minutes, whereas Global Accelerator provides sub-second failover and is the recommended service for active-active multi-region traffic steering.

Full explanation →

1574

MCQmedium

A company is using AWS CloudFormation to deploy a stack that includes an S3 bucket with a bucket policy that restricts access to a specific VPC endpoint. The stack fails to create, and the error indicates that the bucket policy contains an invalid principal. Which condition key should be used to restrict access to a VPC endpoint in the bucket policy?

A.The condition key aws:SourceVpce

B.The VPC ID

C.The ARN of the VPC endpoint

D.The VPC endpoint service

AnswerA

Correct. `aws:SourceVpce` is a condition key, not a principal, but it is the standard way to restrict access to a specific VPC endpoint in an S3 bucket policy. The question's phrasing is technically imprecise; the correct method uses this condition key in the Condition element.

Why this answer

To restrict access to a specific VPC endpoint in an S3 bucket policy, you must use the `aws:SourceVpce` condition key in the `Condition` element, not a principal. VPC endpoints cannot be specified as principals in policies. Option A correctly identifies the condition key.

Option B (VPC ID) is incorrect because you need the VPC endpoint ID, not the VPC ID. Option C (ARN of the VPC endpoint) is incorrect because ARNs are not used in condition keys for this purpose. Option D (VPC endpoint service) is incorrect because the endpoint service is not used in this condition.

Exam trap

A common mistake is attempting to use a VPC endpoint ARN or ID as a principal in the policy. However, VPC endpoints are not valid principals. The correct method uses the `aws:SourceVpce` condition key.

Full explanation →

1575

MCQhard

A company is designing a network architecture for a critical application that requires sub-millisecond latency between EC2 instances in the same placement group. The instances will be launched in a single Availability Zone in us-east-1. Which combination of features should be used to achieve the lowest latency?

A.Launch instances in a cluster placement group with Enhanced Networking (ENA) enabled.

B.Launch instances in a spread placement group with SR-IOV enabled.

C.Launch instances in a spread placement group with Enhanced Networking (ENA) enabled.

D.Launch instances in a cluster placement group with Elastic Fabric Adapter (EFA) enabled.

AnswerD

Cluster placement group minimizes network distance, and EFA provides OS-bypass for low latency.

Why this answer

Elastic Fabric Adapter (EFA) provides OS-bypass capabilities that enable HPC and machine learning workloads to achieve sub-millisecond latency by bypassing the operating system kernel for inter-instance communication. Combined with a cluster placement group, which ensures instances are in close physical proximity within a single Availability Zone, this configuration delivers the lowest possible latency for tightly coupled applications.

Exam trap

The trap here is that candidates often assume Enhanced Networking (ENA) is the best option for low latency because it is widely used for high-throughput workloads, but they overlook that EFA's OS-bypass is specifically designed for sub-millisecond latency in tightly coupled HPC applications.

How to eliminate wrong answers

Option A is wrong because while Enhanced Networking (ENA) improves throughput and reduces latency compared to legacy networking, it still requires the OS kernel to process network packets, which introduces higher latency than the OS-bypass mechanism of EFA. Option B is wrong because spread placement groups are designed to maximize availability by placing instances on distinct hardware, which increases physical distance and latency, and SR-IOV is a generic term for direct I/O virtualization, not a specific AWS feature like ENA or EFA. Option C is wrong because spread placement groups are unsuitable for low-latency clustering due to hardware separation, and ENA alone cannot achieve sub-millisecond latency as it does not provide OS-bypass.

Full explanation →

Page 21 of 22

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

Practice ANS-C01 by domain

Target a specific domain to shore up weak areas.

Network Management and Operations Network Security, Compliance and Governance Network Design Network Implementation

See all domains with question counts →