Knowledge + Practice

AWS Certified Advanced Networking Specialty ANS-C01 (ANS-C01) — Questions 1576–1621

1621 questions total · 22pages · All types, answers revealed

Take a mock exam Exam hub

Page 22 of 22

1576

MCQmedium

A company has a VPC with an Application Load Balancer (ALB) that distributes traffic to EC2 instances in private subnets. The ALB needs to be accessible from the internet. The security team requires that all traffic to the ALB be inspected by AWS WAF. Which configuration meets these requirements?

A.Associate AWS WAF with the ALB and make the ALB internet-facing

B.Use a Network Load Balancer with AWS WAF attached

C.Place the ALB behind a Security Group that inspects traffic

D.Use Amazon CloudFront in front of the ALB with AWS WAF

AnswerA

ALB supports AWS WAF integration for web traffic inspection.

Why this answer

AWS WAF can be directly associated with an Application Load Balancer (ALB) to inspect HTTP/HTTPS traffic before it reaches the ALB. Making the ALB internet-facing allows it to receive traffic directly from the internet while WAF provides the required traffic inspection. This combination meets both the accessibility and security requirements without additional components.

Exam trap

The trap here is that candidates may think CloudFront is always required for WAF integration, but AWS WAF can be directly associated with an internet-facing ALB without needing CloudFront.

How to eliminate wrong answers

Option B is wrong because AWS WAF cannot be directly attached to a Network Load Balancer (NLB); WAF only supports ALBs, API Gateway, CloudFront, and AppSync. Option C is wrong because a Security Group acts as a stateful firewall filtering traffic based on IP addresses and ports, but it does not perform application-layer inspection like WAF (e.g., SQL injection or XSS detection). Option D is wrong because while CloudFront with WAF can inspect traffic, it introduces an additional CDN layer that is not required by the question; the ALB itself can be directly associated with WAF without CloudFront.

Full explanation →

1577

MCQhard

A network engineer is setting up a cross-account Route 53 Resolver rule association. The engineer creates the above resource-based policy on a resolver rule in account 111111111111. The engineer then tries to associate the rule from account 222222222222 but receives an access denied error. What is the MOST likely reason for the failure?

A.The policy does not allow the 'route53resolver:AssociateResolverRule' action.

B.The policy does not include the 'route53resolver:DisassociateResolverRule' action.

C.The policy's Principal is set to account 111111111111 instead of account 222222222222.

D.The resolver rule is not shared with account 222222222222.

AnswerC

The principal should be the account that will use the rule.

Why this answer

The resource-based policy on the Route 53 Resolver rule must specify the consuming account (222222222222) as the Principal to authorize cross-account association. Since the policy incorrectly sets the Principal to the owning account (111111111111), the request from account 222222222222 lacks the required permissions, resulting in an access denied error.

Exam trap

AWS often tests the distinction between the resource-based policy's Principal field and the Action field, tricking candidates into thinking a missing action is the cause when the real issue is an incorrect principal account ID.

How to eliminate wrong answers

Option A is wrong because the policy does include the 'route53resolver:AssociateResolverRule' action (as shown in the policy snippet), so the failure is not due to a missing action. Option B is wrong because the 'DisassociateResolverRule' action is irrelevant for associating a rule; the error occurs during association, not disassociation. Option D is wrong because the policy itself is the mechanism for sharing; if the policy were correctly configured, the rule would be shared, but the error stems from an incorrect Principal, not from a lack of sharing.

Full explanation →

1578

MCQeasy

A startup is launching a new web application on AWS and needs to design a highly available and secure network architecture. The application will run on EC2 instances in an Auto Scaling group across two Availability Zones in a single region. The application must be accessible from the internet over HTTPS. The company expects variable traffic and wants to reduce costs where possible. They also need to protect against common web exploits like SQL injection and cross-site scripting. Which combination of AWS services should be used for the network design?

A.Use an Application Load Balancer (ALB) in private subnets. Enable AWS WAF on the ALB. Place EC2 instances in public subnets with a VPC endpoint for outbound traffic.

B.Use an Application Load Balancer (ALB) in public subnets. Enable AWS WAF on the ALB. Place EC2 instances in private subnets with a NAT gateway for outbound traffic.

C.Use an Application Load Balancer (ALB) in public subnets. Use a VPC endpoint for outbound traffic. Place EC2 instances in public subnets with Elastic IPs.

D.Use a Network Load Balancer (NLB) in public subnets. Enable AWS Shield Advanced for DDoS protection. Place EC2 instances in private subnets with a NAT gateway for outbound traffic.

AnswerB

ALB provides HTTP/HTTPS termination, integrates with WAF for web exploit protection, and supports private subnet instances.

Why this answer

An Application Load Balancer (ALB) in public subnets can terminate HTTPS and distribute traffic to EC2 instances in private subnets, which enhances security by removing direct internet access from the instances. Enabling AWS WAF on the ALB protects against common web exploits like SQL injection and cross-site scripting. A NAT gateway in public subnets provides outbound internet access for instances in private subnets, which is cost-effective for variable traffic as it scales automatically and incurs charges only when used.

Exam trap

The trap here is that candidates often confuse the placement of load balancers and instances, mistakenly thinking that placing the ALB in private subnets is acceptable or that a VPC endpoint can replace a NAT gateway for general outbound internet access.

How to eliminate wrong answers

Option A is wrong because placing the ALB in private subnets would prevent it from receiving internet traffic directly, as private subnets lack a route to an internet gateway; also, placing EC2 instances in public subnets with a VPC endpoint for outbound traffic is incorrect because VPC endpoints are used for private connectivity to AWS services, not for general internet outbound traffic. Option C is wrong because placing EC2 instances in public subnets with Elastic IPs exposes them directly to the internet, bypassing the security and load-balancing benefits of the ALB, and using a VPC endpoint for outbound traffic does not provide general internet access. Option D is wrong because a Network Load Balancer (NLB) operates at Layer 4 and cannot inspect application-layer traffic, so it cannot be integrated with AWS WAF for web exploit protection; AWS Shield Advanced is overkill for basic DDoS protection and adds unnecessary cost for a startup with variable traffic.

Full explanation →

1579

MCQhard

A network engineer configured a custom network ACL for a VPC. An EC2 instance in a subnet associated with this ACL cannot receive ping (ICMP) from the internet. The security group allows ICMP. Which rule is causing the issue?

A.The default NACL rules are missing.

B.Outbound rule 220 blocks all outbound traffic.

C.Inbound rule 130 allows ICMP, but it is overridden by rule 120.

D.Inbound rule 100 only allows HTTPS.

AnswerC

Rule 120 (deny all) is evaluated before rule 130 (allow ICMP), so ICMP is denied.

Why this answer

NACL rules are evaluated in ascending order by rule number. Rule 120 (deny all) has a lower number than rule 130 (allow ICMP), so it is evaluated first. Thus, ICMP traffic from the internet is denied by rule 120 before rule 130 can allow it.

Option A is incorrect because the default NACL rules are not missing; the issue is the order. Option B is incorrect because outbound rules are not the problem for inbound ICMP. Option D is incorrect because inbound rule 100 allows HTTPS but does not affect ICMP.

Full explanation →

1580

Multi-Selectmedium

A company is designing a multi-region active-active application using Amazon Route 53 and Application Load Balancers (ALBs). The application must be highly available and route traffic to the closest healthy endpoint. Which TWO configurations should the company use? (Choose two.)

Select 2 answers

A.Configure Route 53 with failover routing

B.Configure Route 53 with latency-based routing

C.Associate health checks with each Route 53 record

D.Configure Route 53 with weighted routing

E.Configure Route 53 with geoproximity routing

AnswersB, C

Latency-based routing sends traffic to the region with the lowest latency, supporting active-active and health checks.

Why this answer

Latency-based routing (Option B) directs traffic to the AWS region that provides the lowest latency for each user, which aligns with the requirement to route to the closest healthy endpoint. Health checks (Option C) must be associated with each Route 53 record to mark endpoints as healthy or unhealthy, ensuring traffic is only sent to available ALBs. Together, these configurations enable an active-active multi-region design with automatic failover to the next-lowest-latency healthy region.

Exam trap

The trap here is that candidates often confuse latency-based routing with geoproximity routing, assuming geoproximity uses IP geolocation for closest endpoint routing, but latency-based routing is the correct service for dynamic proximity based on actual network performance, not static geographic boundaries.

Full explanation →

1581

Multi-Selectmedium

A network engineer is troubleshooting an issue where an EC2 instance in a VPC cannot reach an S3 bucket via a gateway endpoint. The instance is in a private subnet with a route table that has a route for the S3 prefix list pointing to the gateway endpoint. Which TWO actions should the engineer take to diagnose the problem?

Select 2 answers

A.Verify that the route table for the subnet includes a route for the S3 prefix list (com.amazonaws.region.s3) with target type gateway endpoint.

B.Ensure the VPC has an interface endpoint for S3.

C.Review VPC Flow Logs for the subnet to see if traffic is being dropped.

D.Confirm that the EC2 instance has a public IP address.

E.Check the security group associated with the EC2 instance to ensure it allows outbound HTTPS (443) traffic.

AnswersA, E

Without this route, traffic goes to NAT/IGW.

Why this answer

The correct diagnostic steps are A (verify the route table has the S3 prefix list route to the gateway endpoint) and E (check the security group allows outbound HTTPS). The route table must include the prefix list route for the gateway endpoint to work, and the security group must permit HTTPS (443) outbound because S3 API calls use HTTPS. Option B is incorrect because gateway endpoints are used for S3, not interface endpoints (which are for other services).

Option C is incorrect; although VPC Flow Logs can help analyze traffic after initial checks, they are not the first diagnostic step. Option D is incorrect because the instance does not need a public IP; gateway endpoints route traffic within the AWS network without leaving the VPC directly.

Full explanation →

1582

Multi-Selectmedium

A company is designing a VPN connection between an on-premises network and AWS. The network engineer wants to ensure high availability and fast failover. Which TWO actions should the engineer take? (Select TWO.)

Select 2 answers

A.Use the same customer gateway IP address for both tunnels

B.Use static routes instead of BGP to simplify configuration

C.Create two separate VPN connections to the same VPC

D.Enable BGP and configure BFD (Bidirectional Forwarding Detection) on the VPN tunnels

E.Configure two VPN tunnels to two different AWS endpoint IP addresses

AnswersD, E

Enabling BGP with BFD provides dynamic route exchange and fast failure detection (<1 second), enabling quick failover and high availability.

Why this answer

To ensure high availability and fast failover for a VPN connection between on-premises and AWS, the correct actions are D and E. Option D: Enable BGP and configure BFD (Bidirectional Forwarding Detection) on the VPN tunnels. BGP provides dynamic route exchange and automatic failover, while BFD offers fast failure detection (<1 second).

Option E: Configure two VPN tunnels to two different AWS endpoint IP addresses. This provides redundancy at the AWS side, so if one endpoint fails, the other tunnel remains active. Option A is incorrect because using the same customer gateway IP for both tunnels creates a single point of failure; if that IP becomes unreachable, both tunnels go down.

Option B is incorrect because static routes cannot dynamically adapt to failures, and BGP is needed for automatic failover. Option C is incorrect because creating two separate VPN connections to the same VPC is unnecessary and more complex; a single VPN connection with two tunnels to different endpoints achieves the same redundancy with simpler management.

Full explanation →

1583

MCQeasy

A company wants to block inbound SSH traffic to all EC2 instances in a VPC while allowing all other traffic. Which security group rule should be configured?

A.Add an inbound rule to deny TCP port 22

B.Remove any inbound rule that allows TCP port 22

C.Add an inbound deny rule for TCP port 22 to the network ACL

D.Add an outbound rule to deny TCP port 22

AnswerB

Correct. Removing the inbound allow rule for TCP port 22 implicitly blocks SSH traffic because security groups have an implicit deny for any traffic not explicitly allowed.

Why this answer

Security groups are stateful and act as a virtual firewall. By default, all inbound traffic is denied unless explicitly allowed. Therefore, to block SSH traffic, you simply remove any inbound rule that permits TCP port 22.

This is option B. Option A is incorrect because security groups do not support 'deny' rules; they only support allow rules. Option C is incorrect because the question specifically asks about security group configuration, not network ACLs.

Option D is incorrect because outbound rules do not affect inbound traffic, and security groups are stateful, so blocking outbound SSH would not block incoming SSH connections.

Full explanation →

1584

MCQhard

A company has a multi-VPC architecture connected via AWS Transit Gateway. They have VPCs in different AWS accounts. The network team wants to centralize internet traffic through a single egress VPC that has a NAT Gateway and an Internet Gateway. All other VPCs should route outbound internet traffic through the Transit Gateway to the egress VPC. They have configured route tables accordingly, but instances in non-egress VPCs cannot reach the internet. What is the most likely missing configuration?

A.The Transit Gateway route table does not have a route to the non-egress VPC attachments for the return traffic.

B.The security group for the NAT Gateway in the egress VPC is blocking inbound traffic from other VPCs.

C.The egress VPC's route table does not have a route to the Transit Gateway for the return traffic from the internet.

D.The non-egress VPCs are using VPC endpoints instead of the Transit Gateway for internet access.

AnswerA

For return traffic from the egress VPC to reach the non-egress VPCs, the TGW route table must have routes to those attachments.

Why this answer

For traffic from non-egress VPCs to reach the internet, the Transit Gateway must have a route table that includes a route to the non-egress VPC attachments for the return traffic. Without this route, return traffic from the internet (via the egress VPC's NAT Gateway) cannot be forwarded back to the originating VPC through the Transit Gateway. The other options are incorrect: B is false because security groups are stateful, so inbound rules do not affect return traffic; C is false because the egress VPC needs a route to the Transit Gateway for outbound traffic, not return traffic; D is false because VPC endpoints are not used for general internet access.

Full explanation →

1585

MCQmedium

A company wants to audit all changes to security groups in their AWS account. They need to be notified whenever a security group rule is added, modified, or removed. They also want to see who made the change. Which solution should they implement?

A.Use AWS Trusted Advisor to check for security group changes and send email alerts.

B.Use AWS Config to monitor security group changes and trigger a Lambda function to send notifications.

C.Enable AWS CloudTrail and create a CloudWatch Events rule that triggers on EC2 SecurityGroup events, sending notifications via SNS.

D.Enable VPC Flow Logs and analyze logs for changes to security group rules.

AnswerC

CloudTrail logs API calls to create, modify, and delete security group rules. CloudWatch Events can filter on these events and send to SNS for notification.

Why this answer

AWS CloudTrail captures all API calls, including EC2 SecurityGroup-related actions (AuthorizeSecurityGroupIngress, RevokeSecurityGroupIngress, etc.), recording the identity of the caller. A CloudWatch Events rule can filter for these specific events and trigger an SNS notification, providing both the change details and the IAM user or role that made the change. This meets the audit and notification requirements precisely.

Exam trap

The trap here is that candidates confuse AWS Config's configuration tracking (which detects drift but not per-event user identity) with CloudTrail's API-level audit trail, or they mistakenly think VPC Flow Logs can capture security group changes when they only capture traffic metadata.

How to eliminate wrong answers

Option A is wrong because AWS Trusted Advisor provides best-practice checks and alerts for security group configurations (e.g., overly permissive rules), but it does not log or notify on every individual rule change event, nor does it identify who made the change. Option B is wrong because AWS Config evaluates resource configurations and can detect drift, but it does not natively trigger real-time notifications on every security group rule change; it evaluates on a schedule or on configuration changes, and while it can invoke a Lambda function, it is not the direct, event-driven approach for per-change notifications and does not inherently capture the identity of the user making the change. Option D is wrong because VPC Flow Logs capture network traffic metadata (source/destination IP, ports, protocol) and do not log API-level changes to security group rules; they are used for traffic analysis, not for auditing configuration changes.

Full explanation →

1586

MCQeasy

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to add additional IP address space for new subnets. The existing subnets use 10.0.0.0/17 and 10.0.128.0/17. Which CIDR block should be added as a secondary CIDR to the VPC to provide the most additional contiguous address space?

A.10.1.0.0/16

B.10.0.0.0/0

C.10.0.0.0/8

D.10.0.0.0/16

AnswerA

This is a non-overlapping /16 block contiguous to the existing /16, providing additional address space.

Why this answer

(10.1.0.0/16) is correct because the VPC already uses the entire 10.0.0.0/16 range (split into 10.0.0.0/17 and 10.0.128.0/17). To add contiguous address space, you must use a different /16 block that is adjacent in the private IPv4 address space, such as 10.1.0.0/16. AWS VPCs support secondary CIDRs that must not overlap with existing CIDRs, and 10.1.0.0/16 provides a non-overlapping, contiguous block.

Exam trap

The trap here is that candidates mistakenly think they can reuse part of the same /16 block (like 10.0.0.0/16 again) or use a larger block like /8, but AWS requires secondary CIDRs to be non-overlapping and within the /16 maximum for a single VPC.

How to eliminate wrong answers

Option B (10.0.0.0/0) is wrong because it is not a valid CIDR block for a VPC; a /0 prefix length is too large and would overlap with all IP addresses, which is not allowed by AWS. Option C (10.0.0.0/8) is wrong because it overlaps with the existing 10.0.0.0/16 CIDR and is too large (a /8 block exceeds the maximum VPC size of /16 for a secondary CIDR in most cases). Option D (10.0.0.0/16) is wrong because it is identical to the primary CIDR and would cause an overlap, which AWS does not permit.

Full explanation →

1587

MCQeasy

A company is using AWS CloudTrail to log API calls. They want to ensure that log files are encrypted at rest and that only authorized users can access them. Which combination of actions should they take?

A.Use SSE-KMS with a customer managed key and allow CloudTrail to use the key.

B.Disable public access to the S3 bucket and enable versioning.

C.Enable default encryption (SSE-S3) on the S3 bucket and attach a bucket policy that restricts access to authorized IAM principals.

D.Enable SSE-C on the S3 bucket and provide the encryption key in each API call.

AnswerC

SSE-S3 encrypts logs at rest, and bucket policy controls access.

Why this answer

Enabling default encryption (SSE-S3) on the S3 bucket ensures logs are encrypted at rest. Attaching a bucket policy that restricts access to authorized IAM principals ensures only authorized users can access them. This combination fully satisfies both requirements.

Option A (SSE-KMS with a customer managed key) encrypts the logs at rest, but it does not include the access controls needed to ensure only authorized users can access the logs—additional measures would be required. Option B (disable public access and enable versioning) does not encrypt the logs. Option D (SSE-C) is impractical for CloudTrail logs because it requires you to supply encryption keys with every API call and does not inherently restrict access.

Therefore, option C is the correct combination.

Full explanation →

1588

MCQhard

A company is expanding its on-premises data center to AWS using a hybrid cloud architecture. They have established an AWS Direct Connect connection with a private virtual interface to a VPC. The on-premises network uses BGP to exchange routes with the VPC. The network engineer notices that the on-premises network can reach some EC2 instances in the VPC but not others. All EC2 instances are in the same subnet (10.0.1.0/24) and have private IP addresses. The Direct Connect virtual interface is configured with the VPC CIDR (10.0.0.0/16) advertised to on-premises. The on-premises firewall logs show that traffic to the unreachable instances is being dropped. What is the most likely cause?

A.The subnet route table does not have a route to the on-premises network.

B.The BGP session is not advertising the on-premises routes to the VPC.

C.The network ACL on the subnet is blocking inbound traffic from on-premises.

D.The security group attached to the unreachable instances is not allowing inbound traffic from the on-premises network.

AnswerD

Correct: Security groups can be different per instance, causing inconsistent reachability.

Why this answer

Security groups are stateful and control inbound traffic; if the security group does not allow inbound traffic from on-premises, it will be dropped. Option A is wrong because the subnet route table has a route to the virtual private gateway, which is correct. Option B is wrong because the VPC CIDR is advertised.

Option C is wrong because network ACLs are stateless and need both inbound and outbound rules; but if they were misconfigured, all instances would be affected.

Full explanation →

1589

MCQeasy

A company is designing a VPC for a three-tier web application. The web servers must be accessible from the internet, while the application and database servers must be isolated. Which subnet design should the company use?

A.A single subnet for all tiers with network ACLs to isolate traffic

B.Public subnet for web servers, private subnets for application and database servers

C.Private subnets for all tiers

D.Public subnets for all tiers

AnswerB

Provides internet access to web servers while isolating backend tiers.

Why this answer

It uses a public subnet with an Internet Gateway (IGW) for the web servers to receive inbound traffic from the internet, while placing the application and database servers in private subnets with no direct internet route. This design enforces the principle of least privilege by isolating sensitive tiers, using NAT Gateway or VPC endpoints for outbound traffic if needed, and relying on security groups and network ACLs for fine-grained access control.

Exam trap

The trap here is that candidates often confuse network ACLs with security groups, thinking ACLs alone can isolate traffic within a single subnet, but ACLs cannot prevent instances in the same subnet from communicating with each other unless explicit deny rules are added, and they cannot replace the architectural separation of public and private subnets required for internet-facing vs. internal tiers.

How to eliminate wrong answers

Option A is wrong because a single subnet for all tiers, even with network ACLs, cannot provide true isolation—network ACLs are stateless and apply to the entire subnet, so any instance in that subnet can potentially be reached from the internet if the route table includes an IGW, violating the requirement to isolate application and database servers. Option C is wrong because private subnets for all tiers would prevent the web servers from being directly accessible from the internet, as private subnets have no route to an IGW, breaking the requirement for internet-facing web servers. Option D is wrong because public subnets for all tiers would expose the application and database servers directly to the internet, creating a severe security risk and violating the isolation requirement.

Full explanation →

1590

MCQeasy

A company is deploying a web application in a VPC with an Application Load Balancer (ALB) in front of EC2 instances. The ALB must only accept traffic from the internet and forward it to the instances. Which subnet configuration is correct for the ALB and EC2 instances?

A.ALB in private subnets, EC2 in private subnets with a NAT gateway.

B.ALB in public subnets, EC2 in private subnets.

C.ALB in public subnets, EC2 in public subnets.

D.ALB in private subnets, EC2 in public subnets.

AnswerB

Standard architecture for internet-facing ALB.

Why this answer

An Application Load Balancer (ALB) must be deployed in public subnets to accept traffic directly from the internet, as it requires an internet gateway (IGW) route to receive inbound connections. The EC2 instances should reside in private subnets to enhance security, as they only need to respond to the ALB via the VPC's internal routing, not directly from the internet. This configuration ensures the ALB handles internet-facing traffic while the instances remain isolated from direct external access.

Exam trap

The trap here is that candidates often assume both the ALB and EC2 instances must be in the same subnet type (both public or both private), failing to recognize that the ALB acts as a reverse proxy that can bridge internet-facing public subnets with backend private subnets.

How to eliminate wrong answers

Option A is wrong because placing the ALB in private subnets prevents it from receiving internet traffic, as private subnets lack a direct route to an internet gateway, and a NAT gateway is used for outbound-only traffic, not inbound. Option C is wrong because placing EC2 instances in public subnets exposes them directly to the internet, bypassing the ALB's security benefits and violating the requirement that the ALB must forward traffic to instances. Option D is wrong because the ALB in private subnets cannot accept internet traffic, and placing EC2 instances in public subnets unnecessarily exposes them to the internet, defeating the purpose of using an ALB for controlled traffic flow.

Full explanation →

1591

MCQmedium

A company is deploying a fleet of EC2 instances in private subnets. The instances need to download patches from the internet. The company wants to minimize cost and avoid managing NAT instances. The VPC has an internet gateway (IGW) attached. What should the company do?

A.Attach the IGW to the private subnet route table.

B.Deploy a NAT Gateway in a public subnet and update the private subnet route tables.

C.Create a VPC endpoint for internet access.

D.Launch a NAT instance and configure routing.

AnswerB

Managed, cost-effective, provides internet access to private instances.

Why this answer

A NAT Gateway, deployed in a public subnet with an Elastic IP, allows instances in private subnets to initiate outbound traffic to the internet (e.g., for patch downloads) while preventing inbound connections from the internet. This solution is fully managed by AWS, eliminating the need to manage a NAT instance, and it is cost-effective compared to maintaining a dedicated instance. The private subnet route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway ID.

Exam trap

The trap here is that candidates often confuse an Internet Gateway with a NAT Gateway, assuming that simply attaching an IGW to a private subnet route table will provide internet access, but an IGW alone cannot perform SNAT for private IP addresses.

How to eliminate wrong answers

Option A is wrong because attaching an IGW directly to a private subnet route table would not work; an IGW requires a public IP address on the instance to function, and private subnets do not have a route to the IGW for outbound-only traffic. Option C is wrong because a VPC endpoint (e.g., Gateway or Interface endpoint) provides private connectivity to specific AWS services (like S3 or DynamoDB) via the AWS network, not general internet access for downloading arbitrary patches from the internet. Option D is wrong because while a NAT instance could work, it requires manual management, patching, and high-availability configuration, contradicting the requirement to 'avoid managing NAT instances' and minimize cost.

Full explanation →

1592

MCQhard

A company has a centralized inspection VPC architecture where all traffic from spoke VPCs is routed through a Transit Gateway to a centralized VPC that hosts firewall appliances (NGFW). The company needs to inspect traffic between two instances in the same spoke VPC. What is the simplest way to achieve this?

A.Deploy a Gateway Load Balancer (GWLB) in the spoke VPC and route traffic to it.

B.Use AWS Transit Gateway with VPC attachments and configure route tables to force traffic between the two instances through the inspection VPC.

C.Enable VPC peering and use route propagation to send traffic to the inspection VPC.

D.Create a VPC peering connection between the two instances' VPCs.

AnswerB

Transit Gateway can be configured with route tables that send inter-VPC traffic to the inspection VPC for firewall inspection.

Why this answer

AWS Transit Gateway can route traffic between instances in the same spoke VPC by using VPC attachments and route tables to force the traffic through the centralized inspection VPC. This is achieved by configuring the spoke VPC's route table to send inter-instance traffic to the Transit Gateway, which then forwards it to the inspection VPC for firewall inspection before returning it to the destination instance. This approach avoids the need for additional appliances or complex routing within the spoke VPC itself.

Exam trap

AWS often tests the misconception that VPC peering can be used for transitive routing or that a Gateway Load Balancer alone can redirect traffic within the same VPC, but the key trap here is that candidates overlook the Transit Gateway's ability to hairpin traffic from the same spoke VPC through a central inspection VPC using proper route table configurations.

How to eliminate wrong answers

Option A is wrong because a Gateway Load Balancer (GWLB) is used for scaling and distributing traffic to third-party appliances, but it does not inherently route traffic between instances in the same VPC through a centralized inspection VPC; it would require additional routing configurations and does not leverage the existing Transit Gateway architecture. Option C is wrong because VPC peering does not support transitive routing; even with route propagation, traffic between two instances in the same spoke VPC cannot be forced through a separate inspection VPC via VPC peering, as peering connections are point-to-point and do not allow intermediate hops. Option D is wrong because creating a VPC peering connection between the two instances' VPCs is irrelevant when both instances are in the same spoke VPC, and it does not provide a path to the centralized inspection VPC.

Full explanation →

1593

MCQhard

Refer to the exhibit. A company has two VPCs (vpc-aaaaaaaa and vpc-bbbbbbbb) that are peered. The CIDR blocks are both 10.0.0.0/16. The peering connection status is 'active'. Which of the following is true about this configuration?

A.The VPCs cannot communicate because of overlapping CIDR blocks

B.The VPC peering connection will not become active due to overlapping CIDRs

C.The VPCs can communicate using the peering connection without any issues

D.DNS resolution between the VPCs will be automatically enabled

AnswerA

Overlapping CIDRs prevent proper routing.

Why this answer

VPC peering does not support overlapping CIDR blocks. Even though the peering connection status is active, routes cannot be added to the route tables because the CIDR blocks are identical (both 10.0.0.0/16), preventing communication. Option B is incorrect because the peering connection can become active despite overlapping CIDRs; the issue arises at the routing layer.

Option C is incorrect because the overlapping CIDRs prevent any communication between the VPCs. Option D is incorrect because DNS resolution is not automatically enabled; it requires additional configuration.

Full explanation →

1594

MCQhard

A company has deployed a multi-account AWS environment using AWS Organizations. Each account has one or more VPCs that need to communicate with each other and with an on-premises data center via a central transit VPC. The company uses AWS Transit Gateway with a centralized network account that hosts the Transit Gateway. VPCs from other accounts are attached to the Transit Gateway via Resource Access Manager (RAM) shares. The network team notices that after attaching a new VPC from a member account, resources in that VPC cannot communicate with resources in other attached VPCs. The Transit Gateway route tables have appropriate routes, and the VPC route tables point to the Transit Gateway. What is the MOST likely cause of the issue?

A.The Transit Gateway attachment in the member account is in the 'pending acceptance' state and not yet accepted by the Transit Gateway owner.

B.The Transit Gateway route table does not have the routes from the new VPC propagated.

C.The new VPC's CIDR overlaps with an existing attachment's CIDR.

D.The member account's VPC does not have a route to the Transit Gateway in its route tables.

AnswerA

The owner must accept the attachment for it to be active.

Why this answer

When a Transit Gateway attachment is shared via AWS Resource Access Manager (RAM), the attachment must be accepted by the Transit Gateway owner in the central network account. Until acceptance, the attachment remains in a 'pending acceptance' state, and traffic cannot flow through it. Since the problem states that route tables are correctly configured and VPC routes point to the Transit Gateway, the most likely cause is that the new VPC's attachment has not yet been accepted, which corresponds to option A.

Full explanation →

1595

MCQmedium

A company is deploying a new application on AWS and needs a highly available architecture across two Availability Zones (AZs) in a single region. The application consists of an Application Load Balancer (ALB) in front of a fleet of EC2 instances running in an Auto Scaling group, and an Amazon RDS for MySQL database with Multi-AZ deployment. The company requires that the application remain available even if an entire AZ fails. The network team has designed the VPC with two public subnets and two private subnets, each in a different AZ. The ALB is internet-facing and placed in the public subnets. The EC2 instances are in the private subnets. The RDS instance is also in the private subnets. The route tables are configured with a default route via an Internet Gateway for public subnets and via a NAT Gateway for private subnets. What change is MOST likely needed to ensure the architecture can survive an AZ failure?

A.Add a second Internet Gateway in the other AZ

B.Use a Network Load Balancer instead of an Application Load Balancer

C.Create a NAT Gateway in each Availability Zone

D.Configure the Auto Scaling group to launch instances in both AZs

AnswerC

A NAT Gateway per AZ ensures outbound connectivity survives an AZ failure.

Why this answer

To survive an AZ failure, each AZ must have its own NAT Gateway to provide outbound internet access for instances in that AZ. If only one NAT Gateway is used and its AZ fails, instances in the other AZ lose internet connectivity. The architecture already has the ALB in public subnets across both AZs and RDS Multi-AZ, so the missing component is a NAT Gateway per AZ.

Option A is incorrect because you cannot have an Internet Gateway per AZ; it is a regional resource. Option B is incorrect because an NLB is not needed; the ALB already provides load balancing. Option D is incorrect because the Auto Scaling group should already be configured to launch instances in both AZs; that's a prerequisite, not the most likely missing change.

Full explanation →

1596

Multi-Selecthard

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. It needs to connect to two other VPCs: VPC B (10.1.0.0/16) and VPC C (10.2.0.0/16). The company wants to use AWS Transit Gateway. Which THREE configurations are required to enable full mesh connectivity between all three VPCs?

Select 3 answers

A.Create separate Transit Gateway route tables for each VPC to isolate traffic.

B.Create a VPN attachment to each VPC for encrypted communication.

C.Associate each VPC attachment with the Transit Gateway route table.

D.Create a Transit Gateway and attach each VPC to it.

E.Create a Transit Gateway route table and add static routes for each VPC CIDR pointing to the respective attachment.

AnswersC, D, E

Association allows the VPC to use the route table.

Why this answer

Associating each VPC attachment with the Transit Gateway route table is necessary for the Transit Gateway to know which attachments can communicate. Without this association, the Transit Gateway would not forward traffic between the VPCs, even if routes are present in the route table.

Exam trap

The trap here is that candidates often think separate route tables are needed for isolation (Option A) or that VPN attachments are required for security (Option B), but full mesh connectivity simply requires a single Transit Gateway route table with routes pointing to each VPC attachment and all attachments associated with that route table.

Full explanation →

1597

MCQmedium

A company is designing a hybrid network architecture that requires high availability and low latency between its on-premises data center and AWS. The company currently has two Direct Connect connections from different providers terminating at two different AWS Direct Connect locations. Which solution provides the most resilient and high-performance connectivity?

A.Use a single Direct Connect connection with multiple VLANs.

B.Use two Direct Connect connections from different providers at different locations with a VPN backup.

C.Use Site-to-Site VPN over the internet as the primary connection.

D.Use two Direct Connect connections from the same provider at the same location.

AnswerB

Provides diverse paths and high availability.

Why this answer

Using two Direct Connect connections from different providers at different locations ensures physical and provider diversity, eliminating single points of failure. Adding a VPN backup provides an additional failover path over the internet, which is essential for maintaining connectivity if both Direct Connect links fail. This design meets the requirements for high availability and low latency by leveraging active/active or active/passive traffic engineering with BGP routing and AS path prepending.

Exam trap

AWS often tests the misconception that multiple connections from the same provider or location are sufficient for high availability, but the trap here is that true resilience requires both provider and location diversity to protect against provider-specific outages and location-level disasters.

How to eliminate wrong answers

Option A is wrong because a single Direct Connect connection with multiple VLANs does not provide any physical or provider diversity; a single failure (e.g., fiber cut or provider outage) would take down all VLANs, violating high availability. Option C is wrong because a Site-to-Site VPN over the internet typically introduces higher latency and jitter compared to Direct Connect, and it lacks the consistent performance and SLA guarantees of dedicated connections, making it unsuitable as a primary low-latency solution. Option D is wrong because using two Direct Connect connections from the same provider at the same location creates a single point of failure at the provider level and the location level; a provider outage or location-wide event (e.g., power failure) would impact both connections, failing the resilience requirement.

Full explanation →

1598

Multi-Selecthard

A company has a VPC with multiple subnets. The network engineer wants to monitor network traffic between two specific EC2 instances in different subnets. Which THREE methods can be used to capture and analyze this traffic?

Select 3 answers

A.Enable VPC Flow Logs for the subnets containing the instances.

B.Configure Traffic Mirroring on one of the instances' ENI.

C.Use AWS CloudTrail to log network traffic.

D.Create a VPC peering connection between the two subnets' VPCs.

E.Set up AWS Network Firewall and route traffic through it.

AnswersA, B, E

Flow logs will show metadata of all traffic, including between the instances.

Why this answer

VPC Flow Logs capture metadata, Traffic Mirroring captures full packets, and AWS Network Firewall can inspect traffic. VPC Peering is for connectivity, not monitoring.

Full explanation →

1599

Multi-Selectmedium

A company wants to connect multiple VPCs in different AWS Regions using AWS Transit Gateway. The company requires full mesh connectivity with centralized inspection of inter-Region traffic. Which TWO actions should the company take? (Choose TWO.)

Select 2 answers

A.Create Transit Gateway peering attachments between the Transit Gateways in each Region.

B.Create VPN attachments between each Transit Gateway and the inspection VPC.

C.Use VPC peering connections between VPCs in different Regions.

D.Route traffic through a central inspection VPC in one Region using Transit Gateway route tables.

E.Disable cross-Region peering on the Transit Gateway.

AnswersA, D

Peering attachments enable inter-Region connectivity.

Why this answer

AWS Transit Gateway supports inter-Region peering attachments, which allow you to connect Transit Gateways in different Regions and route traffic between them using the AWS global network. Option D is correct because you can centralize traffic inspection by routing inter-Region traffic through a dedicated inspection VPC attached to one Transit Gateway, using separate route tables to force traffic through that VPC before forwarding it to the destination Region.

Exam trap

The trap here is that candidates often confuse Transit Gateway peering with VPC peering, assuming VPC peering can provide transitive routing across multiple VPCs, or they mistakenly think VPN attachments are required for centralized inspection instead of using route tables and attachments.

Full explanation →

1600

MCQmedium

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download updates from the internet. The company wants to minimize costs and avoid exposing the instance to inbound internet traffic. Which solution should the engineer choose?

A.Deploy a NAT instance in the private subnet and route traffic through it.

B.Deploy a NAT Gateway in the public subnet and add a route in the private subnet route table pointing to the NAT Gateway.

C.Configure a forward proxy on the EC2 instance itself.

D.Attach an internet gateway to the VPC and add a route to the internet gateway in the private subnet's route table.

AnswerB

NAT Gateway provides outbound internet access, cost-effective and managed.

Why this answer

A NAT Gateway in the public subnet allows instances in the private subnet to initiate outbound connections to the internet (e.g., for updates) while remaining unreachable from inbound internet traffic. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway, which then uses the Internet Gateway for outbound traffic. This is the most cost-effective and fully managed solution compared to a NAT instance, as it avoids per-instance management and scales automatically.

Exam trap

The ANS-C01 exam often tests the misconception that a NAT instance can be placed in a private subnet, but in reality, it must reside in a public subnet with a route to an Internet Gateway to perform its function.

How to eliminate wrong answers

Option A is wrong because a NAT instance must be deployed in a public subnet (not a private subnet) to have a route to the Internet Gateway; placing it in a private subnet would prevent it from reaching the internet. Option C is wrong because configuring a forward proxy on the EC2 instance itself does not solve the routing problem—the instance still needs a path to the internet, and a proxy alone does not provide NAT or a default gateway. Option D is wrong because adding a route to the Internet Gateway in the private subnet's route table would directly expose the private instance to inbound internet traffic (since the Internet Gateway allows bidirectional traffic), violating the requirement to avoid inbound exposure.

Full explanation →

1601

MCQhard

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to an on-premises network using AWS Site-to-Site VPN. The on-premises network uses 10.0.0.0/8. The company wants to ensure that traffic to on-premises from VPC does not overlap with VPC's own CIDR. Which action should be taken?

A.Change the VPC CIDR to a non-overlapping range such as 172.16.0.0/16.

B.Create a more specific route in the VPC route table for the on-premises network that is within the 10.0.0.0/8 range but not overlapping with the VPC's subnets.

C.Use a NAT gateway to translate the VPC's IP addresses to a different IP range when communicating with on-premises.

D.Use AWS Transit Gateway with a network overlay to encapsulate traffic.

AnswerB

More specific routes take precedence, so traffic to specific on-premises prefixes will go via VPN even if the VPC CIDR is a superset.

Why this answer

Creating a more specific route (e.g., 10.0.0.0/8 with a longer prefix than the VPC's /16) in the VPC route table allows traffic destined for the on-premises network to be directed through the VPN, while the VPC's own /16 CIDR remains local. AWS uses the most specific route that matches the destination IP, so a route with a longer prefix (e.g., /8) will not override the local /16 route for VPC-internal traffic, preventing overlap.

Exam trap

The trap here is that candidates assume overlapping CIDRs are impossible to route and immediately choose to change the VPC CIDR (Option A), but AWS allows overlapping ranges as long as more specific routes are used to direct traffic correctly.

How to eliminate wrong answers

Option A is wrong because changing the VPC CIDR to 172.16.0.0/16 is unnecessary and disruptive; the problem can be solved with routing without re-architecting the VPC. Option C is wrong because a NAT gateway translates source IPs for outbound traffic to the internet, not for Site-to-Site VPN traffic to on-premises; it cannot resolve overlapping CIDR issues in this context. Option D is wrong because AWS Transit Gateway with a network overlay (e.g., GRE or IPsec) adds complexity and cost but does not inherently solve the overlapping CIDR problem; the core issue is route table priority, which is handled by more specific routes.

Full explanation →

1602

Multi-Selectmedium

Which TWO actions improve the security of an AWS account's root user? (Choose two.)

Select 2 answers

A.Create an IAM user with administrative privileges and use it for daily tasks.

B.Enable multi-factor authentication (MFA) on the root user.

C.Share the root user password with the security team.

D.Set a strong password for the root user.

E.Generate an Access Key for the root user and use it for programmatic access.

AnswersA, B

This follows the principle of least privilege and reduces root user usage.

Why this answer

Options A and B are correct. Enabling MFA on the root user is a critical security best practice that adds an extra layer of protection. Creating an IAM user with administrative privileges and using it for daily tasks reduces the need to use the root user, which should be reserved for only a few account and service management tasks.

Option D is incorrect because while a strong password is important, it is not sufficient on its own; MFA provides additional security. Option C is incorrect because sharing the root password violates security best practices. Option E is incorrect because generating an Access Key for the root user is not recommended and increases risk.

Full explanation →

1603

MCQeasy

A company is designing a network for a three-tier web application. The web tier must be accessible from the internet, the application tier must only be accessible from the web tier, and the database tier must only be accessible from the application tier. All tiers must be in private subnets except the web tier. Which combination of AWS services and routing should be used to meet these requirements?

A.Use a NAT gateway in the public subnet for web tier, and route all traffic through it.

B.Use a VPN connection to the internet gateway and route traffic through a virtual private gateway.

C.Use an internet gateway, public subnet for web tier, private subnets for app and database, and network ACLs to filter traffic between tiers.

D.Use an internet gateway attached to the VPC, public subnet for web tier, private subnets for app and database tiers, and security groups to restrict traffic between tiers.

AnswerD

This standard architecture meets all requirements.

Why this answer

It uses an internet gateway attached to the VPC to provide internet access to the web tier in a public subnet, while the application and database tiers are placed in private subnets. Security groups are stateful and can restrict traffic between tiers by allowing inbound traffic only from the specific security group of the preceding tier (e.g., app tier SG allows traffic only from web tier SG), which meets the requirement without exposing private tiers to the internet. Network ACLs are stateless and less suitable for this granular, stateful filtering between tiers.

Exam trap

The ANS-C01 exam often tests the distinction between stateful security groups and stateless network ACLs, and the trap here is that candidates mistakenly choose network ACLs (Option C) because they think ACLs are the only way to filter traffic between subnets, overlooking that security groups can be applied to instances in private subnets and referenced by other security groups for cross-tier filtering.

How to eliminate wrong answers

Option A is wrong because a NAT gateway is used to allow outbound internet access from private subnets, not to provide inbound internet access to a web tier; it does not make the web tier accessible from the internet. Option B is wrong because a VPN connection and virtual private gateway are used for site-to-site VPN connectivity to an on-premises network, not for direct internet access; this would not allow the web tier to be publicly accessible from the internet. Option C is wrong because network ACLs are stateless and require explicit rules for both inbound and outbound traffic, making them more complex and error-prone for controlling traffic between tiers; security groups are the recommended stateful mechanism for such fine-grained, tier-to-tier access control.

Full explanation →

1604

Multi-Selecteasy

A network engineer is setting up a VPC peering connection between two VPCs in the same AWS account and Region. Which TWO steps are required to enable communication between instances in the peered VPCs? (Choose two.)

Select 2 answers

A.Attach an internet gateway to each VPC

B.Establish a VPN connection between the VPCs

C.Add routes in each VPC's route table pointing to the CIDR of the other VPC

D.Configure a NAT gateway in each VPC

E.Update security group rules to allow traffic from the peered VPC CIDR

AnswersC, E

Routes are needed for traffic to traverse the peering connection.

Why this answer

VPC peering requires adding routes in both VPC route tables to direct traffic to the peered VPC's CIDR. Option E is correct because security group rules must be updated to allow inbound traffic from the peered VPC's CIDR. Option A is incorrect because VPC peering does not require an internet gateway.

Option B is incorrect because VPC peering does not use a VPN connection. Option D is incorrect because a NAT gateway is not required for VPC peering.

Full explanation →

1605

Multi-Selecteasy

Which TWO AWS services can be used to provide inbound internet connectivity to resources in a VPC? (Select TWO.)

Select 2 answers

A.VPC Endpoint

B.Internet Gateway

C.Elastic Load Balancer (internet-facing)

D.Amazon CloudFront

E.NAT Gateway

AnswersB, C

Direct inbound access.

Why this answer

An Internet Gateway (IGW) is a horizontally scaled, redundant VPC component that provides a target in VPC route tables for internet-routable traffic and performs network address translation (NAT) for instances with public IPs. It enables inbound internet connectivity by allowing traffic from the internet to reach resources in the VPC, provided the resources have public IPs and the route table directs 0.0.0.0/0 traffic to the IGW.

Exam trap

The trap here is that candidates often confuse NAT Gateway with providing inbound internet access, but NAT Gateway is strictly one-way (outbound only) and cannot initiate or forward unsolicited inbound connections from the internet.

Full explanation →

1606

Multi-Selecthard

Which THREE of the following are required to configure a site-to-site VPN connection between an on-premises network and an Amazon VPC? (Select THREE.)

Select 3 answers

A.A customer gateway resource representing the on-premises VPN device.

B.A public virtual interface.

C.A virtual private gateway or transit gateway attached to the VPC.

D.An AWS Direct Connect connection.

E.Two VPN tunnels for high availability.

AnswersA, C, E

Defines the on-premises endpoint.

Why this answer

A customer gateway resource is required because it represents the on-premises VPN device in AWS, providing the necessary configuration information such as the device's public IP address and BGP ASN (if dynamic routing is used) to establish the site-to-site VPN connection. Without this resource, AWS has no reference to the remote endpoint for the IPsec tunnels.

Exam trap

The trap here is that candidates often confuse the requirements for a site-to-site VPN with those for AWS Direct Connect, mistakenly selecting a public virtual interface or Direct Connect connection as necessary components when they are actually part of a separate hybrid connectivity solution.

Full explanation →

1607

MCQeasy

A company wants to connect its on-premises data center to a VPC using AWS Site-to-Site VPN. Which of the following is required to establish the VPN connection?

A.Direct Connect gateway associated with the VPC

B.Internet gateway attached to the VPC

C.Virtual private gateway attached to the VPC and a customer gateway representing the on-premises router

D.VPC endpoint for the VPN service

AnswerC

A virtual private gateway is the AWS-side VPN endpoint, and a customer gateway represents the on-premises device.

Why this answer

To establish a Site-to-Site VPN, you need a virtual private gateway (VGW) or transit gateway on the AWS side, and a customer gateway (CGW) representing the on-premises router. Option C is correct. Option A is incorrect because a Direct Connect gateway is used for Direct Connect connections, not VPN.

Option B is incorrect because an internet gateway is used for public internet traffic, not VPN. Option D is incorrect because a VPC endpoint is for private access to AWS services, not for establishing a VPN connection.

Full explanation →

1608

MCQmedium

A company has set up a site-to-site VPN connection between its on-premises network and AWS. The tunnel status shows 'UP' on both sides, but traffic from on-premises cannot reach EC2 instances in the VPC. What is the most likely cause?

A.The pre-shared keys are mismatched.

B.The VPC route tables do not have a route pointing to the virtual private gateway for the on-premises CIDR.

C.The VPN tunnel has been idle for too long and needs to be re-initiated.

D.The security group associated with the EC2 instances does not allow inbound traffic from the VPN gateway.

AnswerB

Without a route to the virtual private gateway, traffic from the VPC to on-premises will not be forwarded.

Why this answer

The most likely cause is that the VPC route tables lack a route pointing to the virtual private gateway (VGW) for the on-premises CIDR. Even though the VPN tunnel is UP (indicating Phase 1 and Phase 2 IPsec SAs are established), traffic from on-premises cannot reach EC2 instances if the VPC does not know how to forward return traffic back through the VGW. Without this route, the VPC drops inbound packets or sends them to the internet gateway instead of the VPN tunnel.

Exam trap

The trap here is that candidates see 'tunnel status UP' and assume routing is automatically configured, but AWS requires explicit route table entries for the VPC to forward traffic to the VGW, and the exam tests this separation of control plane (tunnel) and data plane (routing).

How to eliminate wrong answers

Option A is wrong because mismatched pre-shared keys would prevent the IPsec tunnel from establishing, resulting in a DOWN status on both sides, not UP. Option C is wrong because VPN tunnels using IPsec with dead peer detection (DPD) do not require re-initiation due to idleness; the tunnel remains UP as long as DPD keepalives are exchanged, and traffic can flow immediately. Option D is wrong because security groups are stateful and automatically allow return traffic for established connections; if the tunnel is UP and routes are correct, inbound traffic from the VPN gateway would be permitted by default, and a security group rule is not needed for the initial inbound packet from on-premises.

Full explanation →

1609

Multi-Selectmedium

A company is using AWS Transit Gateway to interconnect multiple VPCs and on-premises networks. The network team wants to log and monitor all traffic flows across the Transit Gateway for security analysis. Which TWO actions should the team take? (Choose TWO.)

Select 2 answers

A.Use AWS Config rules to evaluate the Transit Gateway route tables.

B.Send the flow logs to Amazon CloudWatch Logs for monitoring and alerting.

C.Enable VPC Flow Logs on each Transit Gateway attachment.

D.Enable VPC Flow Logs on the Transit Gateway itself.

E.Configure VPC Traffic Mirroring on the Transit Gateway.

AnswersB, C

CloudWatch Logs can aggregate and analyze flow logs for security monitoring.

Why this answer

VPC Flow Logs can be published to Amazon CloudWatch Logs, enabling real-time monitoring, alerting, and integration with AWS Lambda or third-party tools for security analysis. This allows the network team to capture IP traffic information for all flows across Transit Gateway attachments when flow logs are enabled on those attachments. Option C is correct because VPC Flow Logs must be enabled at the Transit Gateway attachment level (not on the Transit Gateway itself) to capture traffic traversing the Transit Gateway, as the Transit Gateway is a network transit hub and does not generate its own flow logs.

Exam trap

The trap here is that candidates mistakenly think VPC Flow Logs can be enabled directly on the Transit Gateway itself (Option D), but AWS only supports flow logs on Transit Gateway attachments, not the Transit Gateway as a resource.

Full explanation →

1610

MCQhard

A company is using AWS Client VPN for remote access. They want to ensure that only clients with a valid client certificate can connect, and that traffic is routed through a centralized inspection VPC. The VPN endpoint is configured with mutual authentication using server and client certificates. The route table in the VPN VPC has a default route pointing to an AWS Network Firewall endpoint in the inspection VPC. Users report that they can connect to the VPN but cannot access any internal resources. The network engineer checks the Client VPN endpoint configuration and confirms that the authorization rules allow access to the internal CIDR (10.0.0.0/8). What is the most likely cause?

A.The route table in the VPN VPC has a default route (0.0.0.0/0) pointing to the Network Firewall, but the Network Firewall's route table needs a route back to the VPN VPC for the client CIDR, which is missing.

B.The client certificate is not associated with the same CA as the server certificate, causing TLS handshake failure.

C.The subnet route table in the VPN VPC does not have a route for the client CIDR (assigned by the VPN) pointing to the VPN endpoint's network interface.

D.The AWS Network Firewall in the inspection VPC is blocking traffic from the VPN client CIDR because it does not have a rule allowing it.

AnswerA

For traffic to flow, the inspection VPC must have a route back to the VPN VPC for the client CIDR. If the Network Firewall's route table (or the inspection VPC's route table) does not have a route for the client CIDR pointing to the VPN VPC's attachment (e.g., Transit Gateway), return traffic is dropped.

Full explanation →

1611

MCQmedium

A company has a VPC with multiple subnets across two Availability Zones. They are designing a highly available web application using an Application Load Balancer (ALB) and EC2 instances in an Auto Scaling group. Which of the following is the most resilient and cost-effective design for the network layer?

A.Deploy a Network Load Balancer (NLB) in each AZ and associate them with a single ALB.

B.Deploy an ALB in one AZ and EC2 instances in the same AZ.

C.Deploy a single ALB with subnets in two AZs and enable cross-zone load balancing.

D.Deploy an ALB in each AZ and use Route 53 weighted routing.

AnswerC

Cross-zone balancing ensures traffic is distributed across instances in all AZs.

Why this answer

Deploying a single Application Load Balancer (ALB) with subnets in two Availability Zones (AZs) and enabling cross-zone load balancing provides high availability and fault tolerance at the network layer. The ALB automatically distributes incoming traffic across healthy targets in all enabled AZs, eliminating the need for multiple load balancers and reducing costs while maintaining resilience. This design leverages the ALB's native ability to handle AZ failures by routing traffic only to healthy AZs, making it both resilient and cost-effective.

Exam trap

The trap here is that candidates often assume deploying a load balancer in each AZ (Option D) is necessary for high availability, but they overlook that a single ALB with subnets in multiple AZs and cross-zone load balancing already provides full AZ-level redundancy at lower cost and complexity.

How to eliminate wrong answers

Option A is wrong because deploying a Network Load Balancer (NLB) in each AZ and associating them with a single ALB introduces unnecessary complexity and cost; the ALB already supports multi-AZ deployments natively, and the NLB at Layer 4 does not provide application-layer features like path-based routing or host-based routing that the ALB offers, making this design redundant and more expensive. Option B is wrong because deploying an ALB and EC2 instances in a single AZ creates a single point of failure; if that AZ goes down, the entire application becomes unavailable, violating the high availability requirement. Option D is wrong because deploying an ALB in each AZ and using Route 53 weighted routing is overly complex and costly; Route 53 weighted routing does not provide automatic health-based failover between ALBs, and each ALB incurs separate hourly and data processing charges, making this design less resilient and more expensive than a single ALB with cross-zone load balancing.

Full explanation →

1612

Multi-Selecthard

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. They want to ensure that traffic between VPCs is inspected by a third-party firewall appliance deployed in a centralized inspection VPC. Which THREE steps are required? (Choose three.)

Select 3 answers

A.Configure the firewall appliance to perform stateful inspection and route traffic back to the Transit Gateway.

B.Set up VPC peering between the inspection VPC and each spoke VPC.

C.Create Transit Gateway route tables that propagate routes from the inspection VPC and associate them with the other VPC attachments.

D.Establish an AWS Direct Connect connection between the inspection VPC and the on-premises network.

E.Attach the inspection VPC to the Transit Gateway.

AnswersA, C, E

Correct: Firewall must inspect and forward traffic.

Why this answer

The firewall appliance must be configured for stateful inspection and to route traffic back to the Transit Gateway. Option C is correct because separate Transit Gateway route tables must be created to propagate routes from the inspection VPC and associate them with the spoke VPC attachments, ensuring traffic is directed to the inspection VPC. Option E is correct because the inspection VPC must be attached to the Transit Gateway to receive and forward traffic.

Option B is incorrect because Transit Gateway replaces VPC peering; peering is not used. Option D is incorrect because Direct Connect is not required; the existing VPN connection handles on-premises connectivity.

Full explanation →

1613

MCQhard

A company is using AWS CloudFormation to deploy a VPC with public and private subnets across multiple Availability Zones. The template includes a NAT gateway in each public subnet. The company wants to ensure that the private subnet route tables automatically update when the NAT gateway ID changes. Which feature should be used?

A.Use the 'DependsOn' attribute to ensure the route is created after the NAT gateway.

B.Use the 'AWS::EC2::Route' resource with a 'GatewayId' property that references the NAT gateway using 'Ref'.

C.Use the 'Fn::GetAtt' intrinsic function to retrieve the NAT gateway ID and pass it to the route.

D.Use an AWS Lambda custom resource to update the route table when the NAT gateway changes.

AnswerC

Fn::GetAtt can retrieve the physical ID of the NAT gateway, and if the NAT gateway is replaced, CloudFormation updates the route automatically.

Why this answer

The `Fn::GetAtt` intrinsic function can retrieve the NAT gateway ID (e.g., `Fn::GetAtt: [NatGateway, NatGatewayId]`) and pass it as the `GatewayId` property of an `AWS::EC2::Route` resource. This ensures that when the NAT gateway is replaced (e.g., due to an update or failure), the route automatically updates to reference the new NAT gateway ID, maintaining connectivity for private subnets without manual intervention.

Exam trap

The trap here is that candidates confuse `Ref` (which returns the logical resource name or a default attribute like the AZ) with `Fn::GetAtt` (which returns a specific physical attribute like the NAT gateway ID), leading them to choose Option B incorrectly.

How to eliminate wrong answers

Option A is wrong because the `DependsOn` attribute only controls the order of resource creation, not the dynamic resolution of the NAT gateway ID; it does not cause the route to update when the NAT gateway ID changes. Option B is wrong because the `AWS::EC2::Route` resource does not have a `GatewayId` property; it uses `NatGatewayId` for NAT gateway routes, and using `Ref` on a NAT gateway returns its logical name, not the physical ID, so the route would not automatically update on replacement. Option D is wrong because using an AWS Lambda custom resource is unnecessarily complex and introduces custom code and potential failure points; CloudFormation's built-in `Fn::GetAtt` already provides the required dynamic reference without additional resources.

Full explanation →

1614

Multi-Selecthard

Which THREE components are required to establish a site-to-site VPN connection between an on-premises network and AWS? (Choose 3)

Select 3 answers

A.A VPN tunnel between the customer gateway and the virtual private gateway

B.A VPC endpoint for the VPN service

C.An AWS Direct Connect dedicated line

D.A virtual private gateway (VGW) or transit gateway

E.A customer gateway device

AnswersA, D, E

The encrypted connection.

Why this answer

Options A, D, E are correct. A site-to-site VPN requires a VPN tunnel between the on-premises customer gateway and the AWS virtual private gateway (or transit gateway). The customer gateway device (hardware or software) is deployed on-premises to terminate the VPN tunnel.

Option B is incorrect because VPC endpoints are used for private access to AWS services, not for VPN connections. Option C is incorrect because AWS Direct Connect is a dedicated physical connection, not a requirement for a VPN connection.

Full explanation →

1615

MCQmedium

A company has a VPC with multiple subnets across three Availability Zones. The company wants to deploy a Network Load Balancer (NLB) to distribute TCP traffic to a fleet of EC2 instances. The NLB must preserve the source IP address of the client. Which configuration is required?

A.Enable Proxy Protocol v2 on the NLB target group.

B.Enable cross-zone load balancing on the NLB.

C.Attach a security group to the NLB that allows inbound traffic from the client IP range.

D.Create the NLB with a TCP listener and register the EC2 instances as targets in a target group.

AnswerD

NLB preserves source IP for TCP traffic when targets are instances.

Why this answer

Network Load Balancers (NLBs) preserve the source IP address of clients by default when using a TCP listener. No additional configuration is required to enable this behavior; the NLB forwards packets with the original source IP intact. Therefore, simply creating the NLB with a TCP listener and registering EC2 instances as targets is sufficient.

Exam trap

The ANS-C01 exam often tests the misconception that Proxy Protocol v2 must be enabled for source IP preservation on an NLB, when in fact NLBs preserve the source IP by default and Proxy Protocol is only needed for ALBs or when additional metadata is required.

How to eliminate wrong answers

Option A is wrong because Proxy Protocol v2 is an optional header that adds client connection information (including source IP) to the TCP stream, but it is not required for source IP preservation in an NLB; NLBs preserve the source IP natively without Proxy Protocol. Option B is wrong because cross-zone load balancing distributes traffic across targets in multiple Availability Zones but does not affect source IP preservation. Option C is wrong because NLBs do not use security groups; security groups are applied at the instance level, not to the NLB itself, and NLBs are not stateful firewall devices that inspect inbound traffic based on security groups.

Full explanation →

1616

Multi-Selecthard

A company has a VPC with public and private subnets. They want to implement a bastion host to allow secure SSH access to instances in private subnets. Which TWO components are required for this design?

Select 2 answers

A.A bastion host deployed in a public subnet

B.A NAT gateway in the public subnet

C.An Internet Gateway attached to the VPC

D.Security group rules allowing SSH from the bastion to private instances

E.A Site-to-Site VPN connection to the VPC

AnswersA, D

Bastion must be publicly accessible.

Why this answer

A bastion host must be deployed in a public subnet because it needs direct internet access via an Internet Gateway (IGW) to allow administrators to initiate SSH connections from the internet. The bastion then acts as a jump box, forwarding SSH traffic to private instances. Security group rules on the private instances must explicitly allow inbound SSH (TCP port 22) from the bastion host's private IP or security group, ensuring that only the bastion can reach them, not the internet directly.

Exam trap

AWS often tests the misconception that a NAT gateway is required for inbound SSH access to private instances, when in fact it only provides outbound internet access and cannot initiate inbound connections from the internet.

Full explanation →

1617

MCQeasy

A network engineer needs to analyze network traffic between EC2 instances in the same VPC to troubleshoot a performance issue. Which AWS feature should they use?

A.AWS Config.

B.AWS CloudTrail.

C.AWS X-Ray.

D.VPC Flow Logs.

AnswerD

Flow logs capture IP traffic metadata.

Why this answer

VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet/byte counts) for network interfaces in a VPC, making them the correct tool for analyzing network traffic between EC2 instances to troubleshoot performance issues. Unlike other options, Flow Logs operate at the network layer (Layer 3/4) and can be published to CloudWatch Logs or S3 for detailed traffic analysis.

Exam trap

The trap here is that candidates confuse VPC Flow Logs (network-level traffic metadata) with CloudTrail (API-level logging) or X-Ray (application tracing), failing to recognize that only Flow Logs provide the raw IP flow data needed for network performance analysis.

How to eliminate wrong answers

Option A is wrong because AWS Config is a resource inventory and compliance auditing service that tracks configuration changes, not network traffic flows. Option B is wrong because AWS CloudTrail records API calls and management events (control plane), not data plane network traffic between instances. Option C is wrong because AWS X-Ray is a distributed tracing service for application-level request analysis (Layer 7), not for raw network packet metadata analysis.

Full explanation →

1618

MCQmedium

A company has a VPC with a NAT Gateway in a public subnet. The network team notices that instances in private subnets cannot access the internet. Reviewing the route tables, the private subnet route table has a default route (0.0.0.0/0) pointing to the NAT Gateway. What is the most likely cause of the issue?

A.The network ACL in the private subnet blocks outbound traffic.

B.The NAT Gateway's subnet route table does not have a default route pointing to an Internet Gateway.

C.The NAT Gateway does not have an Elastic IP address attached.

D.The security group attached to the NAT Gateway blocks outbound traffic.

AnswerB

Without a route to IGW, NAT Gateway cannot forward traffic to the internet.

Why this answer

The NAT Gateway must have a route to an Internet Gateway. If the NAT Gateway's subnet route table does not have a default route pointing to an IGW, it cannot route traffic to the internet. Security groups, NACLs, or EIP are less likely to be the issue.

Full explanation →

1619

MCQhard

A company is implementing a multicast application in AWS. The application requires that multicast traffic be forwarded between Amazon EC2 instances in different VPCs. The company has set up a multicast domain using AWS Transit Gateway Connect with multicast support. The multicast group is using the IP address 239.0.1.10. The network engineer has confirmed that the EC2 instances are registered as multicast members and that the Transit Gateway multicast domain is configured correctly. However, receivers in VPC B are not receiving multicast traffic from senders in VPC A. What is the MOST likely cause of this issue?

A.The multicast group is not associated with the correct subnet in VPC A.

B.The multicast traffic has a TTL value of 1, which prevents it from leaving the source subnet.

C.The security group for the sender EC2 instances does not allow outbound UDP traffic to the multicast group address.

D.The receiver instances are not sending IGMP join messages to the multicast group.

AnswerC

Security groups control outbound traffic; if outbound rule missing, traffic is dropped.

Why this answer

The issue is that the sender EC2 instances' security group must allow outbound UDP traffic to the multicast group address 239.0.1.10. Even though the Transit Gateway multicast domain is correctly configured, security groups act as a virtual firewall at the instance level and can block multicast traffic if the appropriate outbound rule is not present. Option C is correct because without this rule, the traffic is blocked at the source.

Option A is incorrect because multicast groups are not tied to specific subnets; they are associated with the transit gateway. Option B is incorrect because TTL is not a limiting factor in this scenario; AWS Transit Gateway multicast handles traffic within the domain regardless of TTL. Option D is incorrect because IGMP join messages are not required; multicast group members are statically registered in the Transit Gateway multicast domain.

Full explanation →

1620

Multi-Selectmedium

A network engineer is configuring a Site-to-Site VPN connection between an on-premises network and AWS. The engineer wants to ensure high availability by using two tunnels. Which two components must be configured to achieve this? (Choose TWO.)

Select 1 answer

A.A single customer gateway with two IP addresses

B.An AWS Transit Gateway

C.Two customer gateways, each with a unique public IP address

D.Two VPN connections

E.A virtual private gateway with two BGP sessions

AnswersE

Two BGP sessions for two tunnels.

Why this answer

For high availability with two tunnels in an AWS Site-to-Site VPN, a single VPN connection provides two tunnels by default, terminating on two different AWS endpoints. This requires only one customer gateway with a single public IP address. The virtual private gateway must be configured with two BGP sessions (one per tunnel) to support dynamic routing and automatic failover.

Option C is incorrect because two customer gateways are unnecessary; one customer gateway with one IP suffices. Option D is incorrect because two VPN connections are not required—a single VPN connection already provides two tunnels. Option A is incorrect because a customer gateway cannot have two IP addresses.

Option B is incorrect because an AWS Transit Gateway is optional and not required for a basic HA VPN setup.

Full explanation →

1621

Multi-Selecteasy

Which TWO of the following are true about AWS VPC security groups? (Choose two.)

Select 2 answers

A.Rules are evaluated in order, and the first matching rule is applied.

B.They have an implicit deny all rule at the end.

C.They are stateful, meaning return traffic is automatically allowed regardless of outbound rules.

D.They support both allow and deny rules.

E.They can be associated with subnets.

AnswersB, C

If no rule matches, traffic is denied.

Why this answer

Security groups in AWS VPC are stateful, meaning that if you allow inbound traffic, the corresponding outbound return traffic is automatically permitted, regardless of outbound rules. They also have an implicit deny all rule at the end, so any traffic not explicitly allowed by a rule is denied. This makes options B and C correct.

Exam trap

The ANS-C01 exam often tests the misconception that security groups are stateless like network ACLs, or that they support deny rules, or that they are associated with subnets, leading candidates to confuse security groups with network ACLs.

Full explanation →

Page 22 of 22

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

Practice ANS-C01 by domain

Target a specific domain to shore up weak areas.

Network Management and Operations Network Security, Compliance and Governance Network Design Network Implementation

See all domains with question counts →