AWS Certified Advanced Networking Specialty ANS-C01 ANS-C01 Questions 151–225 | Page 3/22

151

MCQhard

A company has a Direct Connect connection with a private VIF to a VPC. They have set up a Transit Gateway and attached the VPC and the Direct Connect gateway. The on-premises network can reach some VPC resources but not others. The VPC has multiple subnets with different CIDR blocks. The on-premises router is advertising the same prefixes over BGP. What is the most likely cause of the partial connectivity?

A.The VPC route tables for the subnets that cannot be reached do not have a route to the Transit Gateway for the on-premises prefixes.

B.The Direct Connect gateway association with the Transit Gateway is misconfigured.

C.The Transit Gateway route table does not have a static route or propagation for the on-premises prefixes.

D.The on-premises router is advertising different prefixes over BGP than expected.

AnswerA

Without a route in the VPC subnet route table pointing to the Transit Gateway, traffic from the VPC to on-premises will not be forwarded.

Why this answer

The most common cause of partial connectivity in this scenario is that the VPC route tables do not have routes pointing to the Transit Gateway for the on-premises prefixes. Even if the Transit Gateway has routes, the VPC subnets must send traffic to the Transit Gateway. Option A is correct.

Option B is incorrect because if the Transit Gateway route table had incorrect propagation, it would affect all prefixes equally. Option C is incorrect because the on-premises router advertising the same prefixes would not cause partial connectivity. Option D is incorrect because the Direct Connect gateway association is fine if some traffic works.

Full explanation →

152

Matchingmedium

Match each AWS Direct Connect term to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Logical connection over a Direct Connect link to access AWS services

Bundle of multiple physical connections for higher bandwidth and redundancy

Document authorizing you to connect to an AWS Direct Connect location

Globally available resource to connect multiple VPCs across regions

Layer 2 encryption for Direct Connect connections

Why these pairings

Correct matches: VIF is a logical connection; Direct Connect Gateway interconnects VPCs and on-premises. Common confusions: LAG is a bundle of physical connections, not a VPN endpoint; VGW is a VPN endpoint, not a bundle.

Full explanation →

153

MCQhard

A company has a multi-VPC architecture with VPCs in the same region. They need to ensure that traffic between VPCs never traverses the public internet and is encrypted in transit. Which solution meets these requirements with the lowest operational overhead?

A.Use AWS PrivateLink to connect VPCs via Network Load Balancers.

B.Use AWS Transit Gateway with IPsec VPN attachments between VPCs.

C.Use VPC peering connections between all VPCs.

D.Use AWS Transit Gateway with VPC attachments and enable multicast.

AnswerA

Correct. PrivateLink keeps traffic within AWS network and supports encryption via TLS; it is fully managed with low overhead.

Why this answer

AWS PrivateLink allows you to connect VPCs privately using VPC endpoints and Network Load Balancers. Traffic stays within the AWS network and never traverses the public internet. When the application uses TLS/HTTPS, the traffic is encrypted end-to-end.

This solution has low operational overhead because PrivateLink is fully managed and requires no VPN tunnels or third-party appliances.

Exam trap

A common trap is assuming VPC peering provides encryption (it does not) or that Transit Gateway VPN attachments can connect VPCs directly (they are for on-premises connectivity). Privatelink meets both requirements with minimal overhead.

How to eliminate wrong answers

Option A is wrong because AWS PrivateLink uses Network Load Balancers to expose services privately, but it does not encrypt traffic in transit between VPCs by default; encryption would require additional TLS configuration, increasing overhead. Option C is wrong because VPC peering does not provide encryption in transit; traffic between peered VPCs stays within the AWS network but is not encrypted unless you add a separate VPN layer, which adds complexity. Option D is wrong because enabling multicast on Transit Gateway does not provide encryption; multicast is for one-to-many communication, not for securing traffic, and it does not address the encryption requirement.

Full explanation →

154

MCQhard

A company is building a hybrid network with an AWS Transit Gateway connecting multiple VPCs and an on-premises network via Direct Connect. The on-premises network uses BGP to advertise routes to the Transit Gateway. One of the VPCs has an overlapping CIDR (10.0.0.0/16) with the on-premises network (10.0.0.0/8). The company wants to ensure that traffic from other VPCs to 10.0.0.0/16 goes to the VPC, not on-premises. What configuration is required?

A.Use AS_PATH prepending on the on-premises BGP advertisements to make them less preferred

B.No additional configuration is needed; the more specific route will be preferred automatically

C.Add a static route in the Transit Gateway route table for 10.0.0.0/16 pointing to the VPC attachment

D.Disable route propagation from the Direct Connect virtual interface to the Transit Gateway

AnswerB

Correct; Transit Gateway uses longest prefix match, so the /16 from VPC is preferred over /8 from on-premises.

Why this answer

AWS Transit Gateway route tables follow the longest prefix match rule. The VPC advertises 10.0.0.0/16, which is a more specific route than the on-premises 10.0.0.0/8. Therefore, traffic destined for 10.0.0.0/16 will automatically be forwarded to the VPC attachment without any additional configuration.

Exam trap

The trap here is that candidates often think BGP attributes like AS_PATH prepending are needed to influence route preference, forgetting that the longest prefix match rule takes precedence over any BGP path selection attribute.

How to eliminate wrong answers

Option A is wrong because AS_PATH prepending influences BGP path selection but does not override the fundamental longest prefix match rule; a more specific prefix (10.0.0.0/16) is always preferred over a less specific one (10.0.0.0/8) regardless of AS_PATH length. Option C is wrong because adding a static route for 10.0.0.0/16 is unnecessary and could cause conflicts or blackholing; the VPC's propagated route already provides the more specific match. Option D is wrong because disabling route propagation from the Direct Connect virtual interface would remove the on-premises routes entirely, which is not required and would break connectivity to non-overlapping on-premises destinations.

Full explanation →

155

MCQeasy

A network engineer needs to verify the routing path between two EC2 instances in different subnets within the same VPC. Which AWS tool can provide this information?

A.Amazon CloudWatch Logs

B.VPC Reachability Analyzer

C.AWS Config

D.Run traceroute from one instance to the other

AnswerB

Reachability Analyzer tests connectivity and shows the routing path.

Why this answer

VPC Reachability Analyzer can test connectivity and provide the routing path between two resources in the same VPC. Option A is incorrect because Amazon CloudWatch Logs is used for collecting log data, not for analyzing network paths. Option C is incorrect because AWS Config tracks configuration changes and compliance, not real-time path analysis.

Option D is incorrect because running traceroute is not an AWS tool; it is a manual command-line utility that requires access to the instances and does not provide a holistic view of the VPC routing path.

Exam trap

Candidates often confuse VPC Reachability Analyzer with AWS Config or simply default to using traceroute. Remember that Reachability Analyzer is the dedicated AWS service for path verification without requiring instance access.

Full explanation →

156

MCQmedium

A company wants to establish a dedicated, private connection between their on-premises data center and AWS. They require consistent, low-latency performance and support for multiple VLANs. Which AWS service should they use?

A.AWS Direct Connect

B.AWS Transit Gateway

C.AWS Site-to-Site VPN

D.VPC Peering

AnswerA

Direct Connect provides a dedicated private connection with VLAN support.

Why this answer

AWS Direct Connect is the correct choice because it provides a dedicated, private network connection from on-premises to AWS, bypassing the public internet to deliver consistent, low-latency performance. It supports multiple VLANs via 802.1Q tagging over a single physical connection, enabling segmentation of traffic (e.g., for private VIFs, public VIFs, and transit VIFs). This meets the requirement for a private, high-performance link with VLAN support.

Exam trap

The ANS-C01 exam often tests the misconception that Transit Gateway provides the dedicated connection itself, when in fact it is a logical routing construct that requires a physical or virtual underlay (Direct Connect or VPN) to reach on-premises.

How to eliminate wrong answers

Option B (AWS Transit Gateway) is wrong because it is a network transit hub that interconnects VPCs and on-premises networks, but it does not provide the physical dedicated connection itself; it requires an underlying connection like Direct Connect or VPN. Option C (AWS Site-to-Site VPN) is wrong because it uses the public internet with IPSec tunnels, which introduces variable latency and does not guarantee consistent low-latency performance or dedicated bandwidth. Option D (VPC Peering) is wrong because it connects VPCs within AWS using the AWS backbone, but it cannot extend to an on-premises data center and does not support VLANs or dedicated private connectivity.

Full explanation →

157

MCQeasy

A company needs to connect its on-premises data center to AWS with a dedicated, private network connection that provides consistent performance. Which AWS service should they use?

A.Internet Gateway

B.VPC Endpoint

C.AWS Direct Connect

D.Site-to-Site VPN

AnswerC

Direct Connect provides a dedicated, private connection with consistent bandwidth.

Why this answer

AWS Direct Connect provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet. This ensures consistent, low-latency performance and can reduce bandwidth costs for high-volume data transfer, making it the ideal choice for the stated requirement.

Exam trap

AWS often tests the misconception that a Site-to-Site VPN provides dedicated performance because it is encrypted, but the trap is that VPNs still traverse the public internet and cannot guarantee consistent bandwidth or latency like a dedicated physical connection (Direct Connect).

How to eliminate wrong answers

Option A is wrong because an Internet Gateway is a horizontally scaled, redundant component that allows VPC communication with the internet over the public internet, not a dedicated private connection, and performance can be variable due to internet congestion. Option B is wrong because a VPC Endpoint enables private connectivity to AWS services (e.g., S3, DynamoDB) from within a VPC using AWS PrivateLink, but it does not extend to an on-premises data center; it is a service-specific endpoint, not a site-to-site connection. Option D is wrong because a Site-to-Site VPN creates an encrypted tunnel over the public internet, which introduces latency variability and potential throughput limitations due to internet conditions, failing to provide the consistent, dedicated performance required.

Full explanation →

158

MCQmedium

A company is designing a highly available architecture for a web application using an Application Load Balancer (ALB) across multiple Availability Zones. The application requires that user sessions are maintained (sticky sessions) and that the ALB can offload SSL/TLS termination. Which configuration should they use?

A.Create a Network Load Balancer with a target group that has stickiness enabled and an SSL listener.

B.Launch EC2 instances as reverse proxy servers in front of the application servers, configure SSL on the reverse proxy, and use an Application Load Balancer to distribute traffic to the reverse proxies.

C.Create a Classic Load Balancer with sticky sessions and SSL termination.

D.Create an Application Load Balancer with a target group that has stickiness enabled and an HTTPS listener that terminates SSL.

AnswerD

ALB supports sticky sessions using duration-based cookies and SSL termination on the listener.

Why this answer

An Application Load Balancer (ALB) natively supports both sticky sessions (via a generated cookie or application-based cookie) and SSL/TLS termination at the HTTPS listener. This allows the ALB to decrypt traffic before forwarding it to targets over HTTP, reducing backend processing overhead while maintaining session affinity across multiple Availability Zones for high availability.

Exam trap

The trap here is that candidates may confuse the capabilities of a Network Load Balancer (Layer 4) with those of an Application Load Balancer (Layer 7), assuming that NLB supports sticky sessions and SSL termination, or they may overcomplicate the solution by adding reverse proxies when the ALB already provides the required features natively.

How to eliminate wrong answers

Option A is wrong because a Network Load Balancer does not support sticky sessions (stickiness is not available for NLB target groups) and operates at Layer 4, not Layer 7, so it cannot offload SSL/TLS termination in the same way as an ALB. Option B is wrong because introducing EC2 reverse proxy servers adds unnecessary complexity, cost, and a single point of failure; the ALB can directly terminate SSL and handle sticky sessions without additional infrastructure. Option C is wrong because the Classic Load Balancer is a legacy offering that lacks native support for modern features like path-based routing and is not recommended for new architectures; while it can do SSL termination and sticky sessions, it is not the best practice for a highly available ALB-based design.

Full explanation →

159

MCQmedium

A company is designing a multi-Region active-active application using Application Load Balancers (ALBs) behind AWS Global Accelerator. They require that traffic from a specific client IP address is always routed to the same AWS Region for session persistence. Which Global Accelerator feature should be used?

A.Configure health checks on the endpoints.

B.Enable client IP address affinity (sticky sessions).

C.Assign endpoint weights to each ALB.

D.Set traffic dials to 100% for both Regions.

AnswerB

Client IP address affinity ensures requests from a given client IP are consistently routed to the same endpoint.

Why this answer

Global Accelerator's client IP address affinity (sticky sessions) ensures that traffic from a specific client IP is consistently routed to the same endpoint (in this case, the same AWS Region) for the duration of the session. This feature uses a hash of the client IP to maintain stickiness, which is essential for session persistence in an active-active multi-Region setup.

Exam trap

The trap here is that candidates often confuse endpoint weights or traffic dials with session persistence, but these features only control traffic distribution ratios, not per-client stickiness.

How to eliminate wrong answers

Option A is wrong because health checks only determine endpoint availability and do not influence routing decisions for session persistence. Option C is wrong because endpoint weights distribute traffic proportionally across endpoints but do not guarantee that a specific client IP always goes to the same Region. Option D is wrong because traffic dials control the percentage of traffic sent to each endpoint group but do not provide per-client IP stickiness.

Full explanation →

160

Matchingmedium

Match each AWS Direct Connect virtual interface type to its use case.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Access to VPCs using private IP addresses

Access to public AWS services (e.g., S3, DynamoDB) using public IPs

Connect to a Direct Connect Gateway for multiple VPCs

Virtual interface provisioned by an AWS Direct Connect Partner

Encrypted virtual interface using MACsec

Why these pairings

Correct matches: Private VIF accesses VPCs via private IPs, Public VIF accesses AWS public services, Transit VIF connects multiple VPCs via Transit Gateway. Common confusions involve swapping public/private access or confusing Transit VIF with Private VIF.

Full explanation →

161

MCQhard

A company is designing a hybrid network using AWS Direct Connect and AWS Site-to-Site VPN as backup. They want to ensure that traffic from on-premises to AWS uses Direct Connect when available and fails over to VPN automatically. Which BGP configuration should be used?

A.Set a higher BGP local preference on the VPN connection.

B.Prepend AS path on the VPN connection to make it less preferred.

C.Use the same BGP attributes for both connections and let ECMP handle load balancing.

D.Set a higher Multi-Exit Discriminator (MED) on the Direct Connect connection.

AnswerB

Longer AS path is less preferred, so Direct Connect will be chosen.

Why this answer

Prepending the AS path on the VPN connection increases the AS path length, making the VPN route less preferred compared to the Direct Connect route. BGP selects the path with the shortest AS path length by default, so the Direct Connect path will be chosen as the primary path. When Direct Connect fails, the VPN route becomes the only available path and traffic automatically fails over.

Exam trap

AWS often tests the misconception that MED is used to influence inbound traffic preference from a single AS, but here the trap is that candidates confuse MED (which is compared only for paths from the same neighboring AS) with AS path prepending, which works across different AS paths and is the correct method for this failover design.

How to eliminate wrong answers

Option A is wrong because setting a higher BGP local preference on the VPN connection would make the VPN route more preferred, which is the opposite of the desired behavior (Direct Connect should be primary). Option C is wrong because using the same BGP attributes for both connections would cause ECMP load balancing, not the desired active/passive failover behavior, and ECMP is not typically used for hybrid network failover scenarios. Option D is wrong because setting a higher Multi-Exit Discriminator (MED) on the Direct Connect connection would make the Direct Connect route less preferred (higher MED is less preferred), which would incorrectly prefer the VPN path over Direct Connect.

Full explanation →

162

Multi-Selectmedium

A company has a VPC with public and private subnets. The private subnets have a route to a NAT gateway for outbound internet access. The security team wants to audit all traffic from the private subnets to the internet. Which TWO steps should be taken to capture this traffic?

Select 2 answers

A.Enable VPC Flow Logs on the internet gateway.

B.Create a VPC Flow Log for the VPC and filter by the NAT gateway's network interface.

C.Enable VPC Flow Logs on the NAT gateway's elastic network interface.

D.Set up an AWS Site-to-Site VPN to route traffic through a third-party logging appliance.

E.Enable AWS CloudTrail for the NAT gateway.

AnswersB, C

Flow logs on the NAT gateway ENI capture outbound traffic from private subnets.

Why this answer

To capture traffic from private subnets to the internet through a NAT gateway, you need to enable VPC Flow Logs on the NAT gateway's elastic network interface (option C). Additionally, you can create a VPC Flow Log for the VPC and filter by the NAT gateway's network interface (option B) to capture the same traffic. Option A is incorrect because VPC Flow Logs on the internet gateway capture traffic that reaches the internet gateway, but traffic from private subnets goes through the NAT gateway, not directly through the internet gateway.

Option D is incorrect because a Site-to-Site VPN is not used for outbound internet traffic from private subnets; it is for connecting to on-premises networks. Option E is incorrect because AWS CloudTrail logs API calls, not network traffic.

Full explanation →

163

MCQmedium

A company is designing a multi-region architecture for disaster recovery. They need to use Route 53 to route traffic to the nearest healthy endpoint. Which routing policy should they use?

A.Failover routing

B.Geolocation routing

C.Latency-based routing without health checks

D.Latency-based routing with health checks

AnswerD

Latency-based routing directs to the region with lowest latency, and health checks ensure only healthy endpoints receive traffic.

Why this answer

Latency-based routing with health checks is the correct choice because it directs traffic to the endpoint with the lowest latency for the user, while health checks ensure that traffic is only sent to healthy endpoints. This combination meets the requirement to route to the nearest healthy endpoint in a multi-region disaster recovery setup, as it dynamically adapts to both network conditions and endpoint availability.

Exam trap

AWS often tests the misconception that latency-based routing inherently considers endpoint health, but without explicit health checks, it will route to an unhealthy endpoint if it has the lowest latency, making health checks mandatory for the 'nearest healthy endpoint' requirement.

How to eliminate wrong answers

Option A is wrong because failover routing sends traffic to a primary endpoint and only switches to a secondary endpoint if the primary fails, which does not consider latency or proximity to the user. Option B is wrong because geolocation routing routes traffic based on the geographic location of the user, not the latency or health of endpoints, and it cannot automatically failover to a different region if the nearest endpoint is unhealthy unless combined with health checks and a failover record. Option C is wrong because latency-based routing without health checks would route to the lowest-latency endpoint even if it is unhealthy, violating the requirement to route only to healthy endpoints.

Full explanation →

164

MCQmedium

Refer to the exhibit. A CloudFormation template creates a VPC with public and private subnets. The template includes an Internet Gateway and a route table with a default route to the IGW, associated with the public subnet. An EC2 instance launched in the public subnet cannot be reached from the internet. The security group allows inbound HTTP from 0.0.0.0/0. What is the MOST likely missing resource?

A.A VPN connection to the VPC

B.A NAT Gateway in the public subnet

C.An Elastic IP address assigned to the instance or auto-assign public IP enabled on the subnet

D.A route table for the private subnet

AnswerC

Public instances need a public IP to be reachable.

Why this answer

The EC2 instance in the public subnet cannot be reached from the internet because it lacks a publicly routable IP address. Even though the subnet has a default route to the Internet Gateway (IGW) and the security group allows inbound HTTP from 0.0.0.0/0, the instance must have either an Elastic IP address assigned directly or the subnet must have the 'Auto-assign public IPv4 address' attribute enabled. Without a public IP, the IGW cannot perform 1-to-1 NAT to translate the instance's private IP to a public IP, making it unreachable from the internet.

Exam trap

The ANS-C01 exam often tests the misconception that a route to an IGW and a permissive security group are sufficient for internet access, but candidates overlook the mandatory requirement for a public IP address on the instance or subnet for inbound connectivity.

How to eliminate wrong answers

Option A is wrong because a VPN connection is used for private connectivity to an on-premises network, not for providing internet access to a public subnet instance. Option B is wrong because a NAT Gateway is used to allow instances in private subnets to initiate outbound internet traffic, not to enable inbound internet access to instances in a public subnet. Option D is wrong because a route table for the private subnet is irrelevant to the public subnet's internet connectivity; the issue is the lack of a public IP on the instance, not missing routes in the private subnet.

Full explanation →

165

Multi-Selecthard

Which THREE of the following are required to establish a highly available site-to-site VPN connection between an on-premises network and an AWS VPC? (Choose three.)

Select 3 answers

A.Two separate VPN connections

B.Two VPN tunnels (one primary, one secondary)

C.A customer gateway resource in AWS

D.A virtual private gateway attached to the VPC

E.An AWS Direct Connect connection

AnswersB, C, D

Two tunnels provide redundancy.

Why this answer

AWS Site-to-Site VPN requires two tunnels per VPN connection to provide high availability. Each tunnel uses separate endpoints and paths; if one tunnel fails, traffic automatically fails over to the other. This design ensures continuous connectivity even during maintenance or failures.

Exam trap

The ANS-C01 exam often tests the misconception that two separate VPN connections are needed for high availability, when in fact a single VPN connection with two tunnels is the correct AWS design.

Full explanation →

166

MCQmedium

A company is designing a Direct Connect solution with two connections to provide high availability. The company has two customer routers, each connected to a separate AWS Direct Connect location. The company uses BGP to advertise the same prefixes from both routers. What is the correct way to configure the BGP attributes to ensure that traffic uses both connections actively?

A.Advertise the same AS path length from both routers.

B.Use AS path prepending on both routers to make the paths equally long.

C.Set a higher local preference on the primary router and lower on the secondary.

D.Advertise a shorter AS path on the primary router and a longer AS path on the secondary router.

AnswerA

Equal AS path length results in equal preference, allowing active-active use.

Why this answer

Advertising the same AS path length from both routers ensures that AWS Direct Connect routers see both paths as equally preferred under the BGP path selection process (which considers AS path length before MED, local preference, and IGP metric). With equal AS path length, traffic will be load-balanced across both Direct Connect connections, actively using both links for inbound traffic from AWS to the customer network.

Exam trap

The trap here is that candidates often confuse AS path prepending as a method to achieve equal path preference, but prepending actually makes a path longer and less preferred, so using it on both routers would still result in equal but artificially inflated AS path lengths, which is unnecessary and not the standard approach for active/active use.

How to eliminate wrong answers

Option B is wrong because AS path prepending artificially lengthens the AS path, making the path less preferred; using it on both routers would still result in equal AS path lengths, but the question asks for active use of both connections, and prepending is typically used to make one path less preferred, not to achieve equal preference. Option C is wrong because setting a higher local preference on the primary router and lower on the secondary would make the primary path preferred, causing traffic to use only the primary connection actively, not both. Option D is wrong because advertising a shorter AS path on the primary router and a longer AS path on the secondary router would make the primary path preferred, again resulting in active use of only one connection, not both.

Full explanation →

167

MCQmedium

A company is designing a hybrid network with AWS Direct Connect and a VPN backup. They have two on-premises sites connected via MPLS. They want to ensure that if the Direct Connect fails, traffic automatically fails over to the VPN without manual intervention. Which routing configuration should they use?

A.Configure static routes with equal cost pointing to Direct Connect and VPN

B.Use BGP and set a higher local preference for routes learned via Direct Connect, and enable BGP graceful shutdown on the Direct Connect router

C.Use BGP and advertise the same prefixes with a lower MED on the VPN connection

D.Create a VPC peering connection between the VPC and on-premises network

AnswerB

Higher local preference ensures Direct Connect is preferred; graceful shutdown triggers failover.

Why this answer

Using BGP with a higher local preference for routes learned via Direct Connect ensures that the Direct Connect path is preferred over the VPN backup. If the Direct Connect fails, the BGP session goes down, the routes are withdrawn, and traffic automatically fails over to the VPN without manual intervention. BGP graceful shutdown is not required for failover but can be used to gracefully drain traffic before maintenance.

Exam trap

The trap here is that candidates often confuse MED with local preference, thinking that a lower MED on the VPN would make it a backup, but MED is a metric for inbound traffic and is compared only when paths come from the same neighboring AS, whereas local preference is the correct attribute for outbound path selection within an AS.

How to eliminate wrong answers

Option A is wrong because static routes with equal cost would cause traffic to be load-balanced between Direct Connect and VPN, not provide a clear primary/backup failover; if Direct Connect fails, the static route remains active and may cause black-holing unless a more specific metric or tracking is used. Option C is wrong because advertising the same prefixes with a lower MED on the VPN connection would make the VPN path more preferred (lower MED is more preferred), which is the opposite of the desired primary/backup behavior. Option D is wrong because VPC peering does not support on-premises connectivity; it only connects VPCs within AWS and cannot be used to connect to on-premises networks.

Full explanation →

168

MCQhard

A global e-commerce company is migrating to AWS and plans to use a hub-and-spoke topology with AWS Transit Gateway. The network team wants to ensure high availability for the connection between the hub VPC and the on-premises data center using AWS Direct Connect with multiple virtual interfaces (VIFs). They need to be able to fail over quickly with minimal packet loss. Which design should meet these requirements?

A.Provision one Direct Connect connection with a single private VIF, and enable BFD on the VIF to detect failures quickly.

B.Provision one Direct Connect connection with two private VIFs, and use a second Direct Connect connection as backup with a single VIF. Configure route tables to prefer the primary.

C.Provision two Direct Connect connections, each with multiple private VIFs, and attach them to the same transit gateway. Use BFD to detect failures and rely on ECMP routing across the VIFs.

D.Provision two Direct Connect connections, each with a single private VIF, and use AWS Site-to-Site VPN as a backup for each.

AnswerC

This provides active-active connectivity with fast failover via BFD, and ECMP allows load balancing across VIFs.

Why this answer

It provides true high availability and fast failover by using two separate Direct Connect connections, each with multiple private VIFs, attached to the same transit gateway. BFD (Bidirectional Forwarding Detection) enables sub-second failure detection, and ECMP (Equal-Cost Multi-Path) routing across the VIFs allows active-active load balancing, minimizing packet loss during failover. This design eliminates single points of failure and meets the requirement for rapid convergence with minimal disruption.

Exam trap

The trap here is that candidates often confuse multiple VIFs on a single connection with true redundancy, failing to recognize that physical diversity requires separate Direct Connect connections, not just separate logical interfaces.

How to eliminate wrong answers

Option A is wrong because a single Direct Connect connection with one private VIF is a single point of failure; even with BFD, if the connection or physical link fails, all traffic is lost. Option B is wrong because using two VIFs on the same Direct Connect connection does not provide physical diversity; a failure of the single connection takes down both VIFs, and the backup connection with a single VIF still introduces a single point of failure at the connection level. Option D is wrong because using AWS Site-to-Site VPN as a backup introduces higher latency, lower bandwidth, and slower failover compared to a second Direct Connect connection, and it does not meet the requirement for minimal packet loss during failover.

Full explanation →

169

MCQmedium

A company is deploying a multi-tier application in a VPC. The web servers must be accessible from the internet, but the database servers must not be. Which architecture meets these requirements?

A.Use a NAT gateway for the database servers to allow inbound traffic.

B.Place web servers in public subnets with an internet gateway, and databases in private subnets with no direct internet access.

C.Place all servers in private subnets and use an AWS Site-to-Site VPN for internet access.

D.Place both web and database servers in public subnets and use security groups to restrict database access.

AnswerB

Placing web servers in public subnets with an internet gateway allows internet access, while databases in private subnets have no direct internet access, meeting the requirements.

Why this answer

Placing web servers in public subnets with an internet gateway and database servers in private subnets with no direct internet access ensures only the web tier is accessible from the internet. Option A is incorrect because a NAT gateway is used for outbound internet access from private subnets, not for allowing inbound traffic to the database servers. Option C is incorrect because an AWS Site-to-Site VPN is used to connect on-premises networks to a VPC, not to provide internet access to private subnets.

Option D is incorrect because placing database servers in public subnets directly exposes them to the internet; security groups alone do not prevent internet routability, and best practice is to place databases in private subnets.

Full explanation →

170

Multi-Selecteasy

A company is planning to connect its on-premises data center to AWS using AWS Direct Connect. The company requires high availability and wants to ensure that if one Direct Connect connection fails, traffic automatically fails over to another. Which THREE design elements should be included?

Select 3 answers

A.Provision two Direct Connect connections at different AWS Direct Connect locations.

B.Use a single customer router with multiple connections to both Direct Connect locations.

C.Configure a VPN connection as a backup to Direct Connect.

D.Use BGP to exchange routes between the on-premises routers and AWS.

E.Advertise the same BGP prefixes from both on-premises routers.

AnswersA, D, E

Provides physical diversity.

Why this answer

Provisioning two Direct Connect connections at different AWS Direct Connect locations ensures physical diversity. If one location fails, the other connection remains available, providing high availability. This design eliminates a single point of failure at the network edge.

Exam trap

The trap here is that candidates may think a single router with multiple connections provides sufficient redundancy, but they overlook that the router itself is a single point of failure, which violates high availability principles.

Full explanation →

171

MCQeasy

An application running on EC2 instances in a private subnet needs to download patches from the internet. The VPC has an internet gateway and public subnets. Which resource should be used to provide outbound internet access to the instances?

A.VPC gateway endpoint for S3

B.NAT gateway in a public subnet

C.AWS Site-to-Site VPN connection

D.Internet gateway in the private subnet

AnswerB

Provides outbound internet access for private instances.

Why this answer

A NAT gateway in a public subnet provides outbound-only internet access to instances in private subnets by translating their private IP addresses to the NAT gateway's Elastic IP address. This allows the EC2 instances to download patches from the internet while preventing any unsolicited inbound connections from the internet, which is the standard design for secure outbound internet access in a VPC.

Exam trap

AWS often tests the misconception that an internet gateway can be placed in a private subnet or that a VPC endpoint can provide general internet access, but the key trap here is confusing a VPC gateway endpoint (which only works for specific AWS services like S3 and DynamoDB) with a NAT gateway that provides full outbound internet connectivity.

How to eliminate wrong answers

Option A is wrong because a VPC gateway endpoint for S3 only provides private connectivity to Amazon S3, not general internet access for downloading patches from arbitrary internet hosts. Option C is wrong because an AWS Site-to-Site VPN connection connects your VPC to an on-premises network, not to the internet, and does not provide outbound internet access for instances. Option D is wrong because an internet gateway cannot be attached to a private subnet; it must be attached to a public subnet and requires a route table entry pointing to it, and instances in private subnets cannot directly use an internet gateway without a NAT device.

Full explanation →

172

Multi-Selectmedium

A company is using AWS Direct Connect to connect its on-premises data center to a VPC. They want to ensure high availability and failover. Which TWO configurations should they implement? (Select TWO.)

Select 2 answers

A.Configure a Site-to-Site VPN connection as a backup.

B.Create a Direct Connect Gateway and attach multiple VPCs.

C.Use a single Direct Connect connection with two virtual interfaces.

D.Provision a second Direct Connect connection at a different location.

E.Use the same Direct Connect connection with multiple VLANs.

AnswersA, D

Correct: Provides failover over internet.

Why this answer

A Site-to-Site VPN over the internet provides a cost-effective, diverse backup path if the Direct Connect connection fails. This ensures high availability by using a different physical medium and network path, allowing traffic to failover automatically via BGP route propagation when the Direct Connect link goes down.

Exam trap

The trap here is that candidates often think multiple virtual interfaces or VLANs on a single connection provide redundancy, but they fail to recognize that the physical link itself remains a single point of failure.

Full explanation →

173

MCQmedium

A company is using AWS CloudFormation to deploy a VPC with public and private subnets, an internet gateway, and a NAT gateway. The deployment fails with the error: 'Route table rtb-12345678 already has a route with destination 0.0.0.0/0'. The network engineer reviews the template and sees that the public route table has a route to the internet gateway and the private route table has a route to the NAT gateway. Both route tables are defined in the same template. What is the most likely cause of this error?

A.The internet gateway and NAT gateway cannot exist in the same VPC simultaneously.

B.The public and private route tables are the same resource due to a typo in the template.

C.The public route table already has a route to the internet gateway, and adding another default route is not allowed.

D.The NAT gateway route is missing a destination CIDR block.

AnswerB

Correct: Using the same route table ID for both routes causes duplicate route error.

Why this answer

The error indicates that the same route table is being used for both routes, which happens when both resources reference the same route table ID. Option A is wrong because a route table can have multiple routes, but only one default route. Option C is wrong because the error is specific to duplicate routes, not a missing route.

Option D is wrong because internet and NAT gateways can coexist in the same VPC.

Full explanation →

174

MCQeasy

A company wants to restrict access to their S3 bucket so that only users from their corporate network (with a specific IP range) can read objects. They also want to ensure that the objects are encrypted in transit. Which combination of bucket policy and encryption should they use?

A.Use a VPC endpoint with a bucket policy that restricts access to the VPC endpoint.

B.Use an IAM policy that restricts access to the corporate IP range and enable default encryption on the bucket.

C.Bucket policy with a condition that denies access unless the source IP is within the corporate range, and require HTTPS for all requests.

D.Enable CloudFront with geographic restrictions and use HTTPS.

AnswerC

A bucket policy with a condition using aws:SourceIp can restrict access to the corporate IP range. Requiring HTTPS ensures encryption in transit.

Why this answer

A bucket policy with a condition key `aws:SourceIp` can restrict access to the corporate IP range, and requiring HTTPS (via a `aws:SecureTransport` condition) ensures encryption in transit. This combination directly meets both requirements without relying on additional infrastructure like VPC endpoints or CloudFront.

Exam trap

AWS often tests the distinction between IAM policies (which control user permissions) and bucket policies (which control resource-based access), leading candidates to incorrectly choose an IAM policy for IP-based restrictions.

How to eliminate wrong answers

Option A is wrong because a VPC endpoint policy restricts access to traffic originating from the VPC, not from a specific corporate IP range; the corporate network might not route through that VPC, and it does not enforce encryption in transit. Option B is wrong because an IAM policy restricts access based on the IAM user/role, not the source IP of the request; IAM policies cannot use `aws:SourceIp` to restrict network-level access to an S3 bucket. Option D is wrong because CloudFront geographic restrictions limit access by country, not by a specific corporate IP range, and while HTTPS can be enforced, the requirement is for direct S3 bucket access, not via a CDN.

Full explanation →

175

MCQmedium

Refer to the exhibit. A company has an S3 bucket policy that denies PutObject if the object is not encrypted with SSE-KMS. However, uploads are still being allowed without encryption. What is the most likely reason?

A.The bucket policy has a syntax error and is not being enforced.

B.The IAM user has an explicit Allow that overrides the Deny in the bucket policy.

C.The condition key 's3:x-amz-server-side-encryption' is not present in the upload request, so the condition is not evaluated and the Deny is not applied.

D.The bucket policy must be attached to the bucket in the same region as the request.

AnswerC

If the header is omitted, the condition evaluates to false, and the Deny statement is not triggered.

Why this answer

The bucket policy uses a condition key 's3:x-amz-server-side-encryption' to deny uploads that are not encrypted with SSE-KMS. However, if the upload request does not include the 'x-amz-server-side-encryption' header at all, the condition key is not present in the request, so the condition is not evaluated. As a result, the Deny effect is not applied, and the upload is allowed.

Option A is incorrect because the policy is valid JSON and would be enforced if the condition were met. Option B is incorrect because an explicit Allow in an IAM policy cannot override a Deny in a bucket policy; the Deny would still apply. Option D is incorrect because bucket policies are evaluated regardless of region as long as the bucket is in the same region as the request's endpoint; the region is not the issue here.

Full explanation →

176

MCQmedium

A company has a VPC with public and private subnets. The security team wants to block all outbound traffic to the internet from the private subnets except for traffic to an AWS service like Amazon S3. Which configuration should be used?

A.Attach an internet gateway to the VPC and add a route to the internet gateway in the private subnet route table.

B.Create a VPC endpoint for Amazon S3 and add a route to the endpoint in the private subnet route table.

C.Place a proxy server in the private subnet and configure all instances to use it.

D.Configure a NAT gateway in the public subnet and update the route table to send 0.0.0.0/0 traffic to the NAT gateway.

AnswerB

VPC endpoint provides private connectivity to S3 without internet access.

Why this answer

A VPC endpoint for S3 allows private subnet instances to access S3 without going through an internet gateway. A NAT gateway would allow all internet traffic, not just S3. A proxy server would allow all traffic unless configured to restrict.

Internet gateway alone does not provide granular control.

Full explanation →

177

MCQhard

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team wants to ensure that traffic between VPCs is inspected by a centralized firewall appliance in a inspection VPC. Which architecture meets this requirement?

A.Create VPC peering connections between all VPCs and route traffic through the inspection VPC.

B.Deploy AWS Network Firewall in each VPC and allow traffic to flow directly between VPCs.

C.Attach all VPCs to a Transit Gateway and create separate route tables for inspection.

D.Use AWS Direct Connect Gateway to route traffic between VPCs through the inspection VPC.

AnswerC

Transit Gateway with route tables can direct inter-VPC traffic to a inspection VPC for centralized inspection.

Why this answer

Transit Gateway route tables can direct traffic between VPCs through a central inspection VPC by using route propagation and appropriate route table associations. Option A is wrong because VPC peering does not support transitive routing; traffic would need to traverse multiple non-transitive connections, and peering alone cannot force traffic through a centralized firewall. Option B is wrong because deploying AWS Network Firewall in each VPC does not centralize inspection; traffic between VPCs would flow directly unless routing forces it through the firewall, which is not described.

Option D is wrong because AWS Direct Connect Gateway is used for connecting on-premises networks to AWS, not for routing traffic between VPCs through an inspection VPC.

Full explanation →

178

MCQhard

A company has a VPC with a CIDR of 10.0.0.0/16. It has two subnets: 10.0.1.0/24 (public) and 10.0.2.0/24 (private). The company wants to use AWS Site-to-Site VPN to connect to an on-premises network with a CIDR of 192.168.0.0/16. The VPN connection uses a virtual private gateway (VGW) attached to the VPC. The on-premises network has a VPN appliance that supports BGP. The company also wants to use static routes for the VPN. Which configuration is required to enable communication between the VPC and on-premises network?

A.Add a route in the on-premises route table for 10.0.0.0/16 pointing to the VPN appliance.

B.Add a route in the VPC route table for 192.168.0.0/16 with target the virtual private gateway.

C.Create a NAT gateway in the public subnet and route traffic through it.

D.Add a route in the VPC route table for 192.168.0.0/16 with target the internet gateway.

AnswerB

This routes traffic from the VPC to the on-premises network via the VPN.

Why this answer

For a Site-to-Site VPN using a virtual private gateway (VGW), you must add a route in the VPC route table for the on-premises CIDR (192.168.0.0/16) with the VGW as the target. This directs traffic destined for the on-premises network through the VPN tunnel. Even though BGP is supported, the company explicitly wants to use static routes, so manual route entries are required in the VPC route table.

Exam trap

The trap here is that candidates often confuse the need for a NAT gateway or internet gateway for VPN traffic, but Site-to-Site VPN traffic must be routed through the VGW, not through NAT or IGW.

How to eliminate wrong answers

Option A is wrong because the on-premises route table is not managed by AWS; the company must configure it locally, but this is not an AWS configuration requirement for enabling communication from the VPC side. Option C is wrong because a NAT gateway is used for outbound internet traffic from private subnets, not for VPN connectivity to on-premises networks; it does not route traffic through the VPN tunnel. Option D is wrong because an internet gateway routes traffic to the public internet, not to an on-premises network via VPN; using it as a target for the on-premises CIDR would send traffic to the internet instead of through the VPN.

Full explanation →

179

Multi-Selectmedium

A company is deploying a VPC with a CIDR block of 10.0.0.0/16. The VPC requires six subnets: three public and three private, each with a /24 CIDR. The company needs to ensure high availability across three Availability Zones. Which TWO of the following are valid subnet CIDR assignments that meet these requirements?

Select 2 answers

A.Public: 10.0.0.0/24, 10.0.1.0/24, 10.0.2.0/24; Private: 10.0.0.0/25, 10.0.1.0/25, 10.0.2.0/25

B.Public: 10.0.0.0/24, 10.0.1.0/24, 10.0.2.0/24; Private: 10.0.3.0/24, 10.0.4.0/24, 10.0.5.0/24

C.Public: 10.0.0.0/24, 10.0.2.0/24, 10.0.4.0/24; Private: 10.0.1.0/24, 10.0.3.0/24, 10.0.5.0/24

D.Public: 10.0.0.0/24, 10.0.0.0/25, 10.0.0.128/25; Private: 10.0.1.0/24, 10.0.1.0/25, 10.0.1.128/25

E.Public: 10.0.0.0/24, 10.0.1.0/24, 10.0.2.0/24; Private: 10.0.0.0/25, 10.0.1.0/25, 10.0.2.0/25

AnswersB, C

Non-overlapping, three AZs each.

Why this answer

It assigns six non-overlapping /24 subnets (10.0.0.0/24 through 10.0.5.0/24) within the 10.0.0.0/16 VPC, allowing three public and three private subnets to be distributed across three Availability Zones for high availability. Option C is also correct as it uses the same six /24 subnets but interleaves public and private ranges (e.g., public: 10.0.0.0/24, 10.0.2.0/24, 10.0.4.0/24; private: 10.0.1.0/24, 10.0.3.0/24, 10.0.5.0/24), which still provides non-overlapping /24 CIDRs and supports the required multi-AZ architecture.

Exam trap

The trap here is that candidates often assume subnets can share the same base IP range as long as the subnet mask differs, but AWS requires all subnets in a VPC to have non-overlapping CIDR blocks regardless of prefix length.

Full explanation →

180

MCQhard

A company has a VPC with public and private subnets. An application in the private subnet needs to access an S3 bucket. Which design meets security best practices without exposing the application to the internet?

A.Create a VPC Gateway Endpoint for S3 and update the route table

B.Use a NAT Gateway in the public subnet and route traffic through it

C.Set up a VPN connection to AWS and route through it

D.Attach an Internet Gateway to the VPC and update route tables

AnswerA

Gateway Endpoint provides private access to S3.

Why this answer

A VPC Gateway Endpoint for S3 allows private subnet resources to access S3 without internet exposure. Option B (NAT Gateway) would provide internet access but is unnecessary and could expose the application indirectly. Option C (VPN) is overkill and not needed for S3 access within AWS.

Option D (Internet Gateway) would expose the application to the internet, violating security best practices.

Full explanation →

181

MCQhard

A company has a Direct Connect connection with a private VIF to a Direct Connect gateway. The VIF is associated with a Direct Connect gateway that has a virtual private gateway (VGW) attachment to a VPC. The on-premises network is advertising a route to 10.0.0.0/16. However, the VPC cannot reach on-premises resources. The VPC has a route table with a route to 10.0.0.0/16 pointing to the VGW. What is the MOST likely cause?

A.The VPC route table does not have route propagation enabled for the virtual private gateway

B.The on-premises router is not using BGP to advertise routes

C.The security group on the VPC instances is blocking inbound traffic

D.The Direct Connect gateway does not support the prefix 10.0.0.0/16

AnswerB

BGP is required for private VIF, but the VGW may still receive routes.

Why this answer

The VPC route table already contains a static route to 10.0.0.0/16 pointing to the VGW, so route propagation is not required for this specific destination. However, for the VGW to forward traffic to on-premises, it must have learned the on-premises route via BGP from the Direct Connect gateway. If the on-premises router is not using BGP to advertise the 10.0.0.0/16 route, the Direct Connect gateway and therefore the VGW will not have a route to that prefix, causing traffic from the VPC to be dropped.

Enabling route propagation on the VPC route table would not help because the route is already statically defined. Therefore, the most likely cause is that the on-premises router is not using BGP to advertise routes.

Exam trap

The ANS-C01 exam often tests the understanding that a static route to the VGW is sufficient for routing, but candidates must verify that BGP is properly advertising on-premises routes to the Direct Connect gateway; otherwise, the VGW will not know how to reach on-premises, even with a static VPC route.

How to eliminate wrong answers

Option B is wrong because the on-premises router is already advertising the route 10.0.0.0/16 via BGP over the private VIF, as stated in the scenario. Option C is wrong because security groups are stateful and only control traffic to/from instances; they do not affect route propagation or the VPC's ability to reach the on-premises network at the routing level. Option D is wrong because Direct Connect gateways support any valid IPv4 prefix, including 10.0.0.0/16, and there is no prefix-based restriction in the Direct Connect gateway configuration.

Full explanation →

182

MCQeasy

A company has multiple VPCs that need to communicate with each other and with an on-premises network. They want to minimize operational overhead and avoid peering mesh complexity. Which AWS service should be used?

A.AWS Transit Gateway.

B.AWS PrivateLink.

C.AWS VPN CloudHub.

D.VPC Peering.

AnswerA

Transit Gateway provides a hub-and-spoke model, simplifying connectivity.

Why this answer

AWS Transit Gateway acts as a central hub to interconnect multiple VPCs and on-premises networks using a single gateway, eliminating the need for a full mesh of VPC peering connections. It simplifies network management by providing transitive routing between all attached networks, which directly addresses the requirement to minimize operational overhead and avoid peering mesh complexity.

Exam trap

The trap here is that candidates often confuse AWS Transit Gateway with VPC Peering, mistakenly thinking that VPC Peering can scale to many VPCs without realizing it requires a full mesh of non-transitive connections, leading to exponential complexity.

How to eliminate wrong answers

Option B is wrong because AWS PrivateLink is designed for private connectivity between VPCs and services (e.g., exposing a service to multiple VPCs) without requiring VPC peering or a transit gateway, but it does not provide transitive routing between multiple VPCs or to on-premises networks. Option C is wrong because AWS VPN CloudHub is a hub-and-spoke VPN topology that connects multiple remote sites to a single VPC, but it does not interconnect multiple VPCs or provide transitive routing between them. Option D is wrong because VPC Peering creates a direct, non-transitive connection between exactly two VPCs, requiring a full mesh of peering connections for multiple VPCs, which increases operational overhead and complexity.

Full explanation →

183

MCQhard

A large e-commerce company is designing a network for a new microservices architecture. They have hundreds of microservices running on Amazon ECS with Fargate launch type. The services need to communicate with each other and with external APIs. The company wants to minimize network latency and maximize security. They also need to ensure that traffic between services does not leave the VPC. The network engineer is considering using AWS PrivateLink to allow services to communicate via VPC endpoints. However, they are concerned about the cost of creating an endpoint for each service. Which design should the network engineer recommend?

A.Use a Transit Gateway to connect all services

B.Use AWS App Mesh to enable service-to-service communication within the VPC

C.Assign public IP addresses to the Fargate tasks and use security groups

D.Create a VPC endpoint for each microservice and use PrivateLink

AnswerB

Service Mesh provides secure and low-latency communication without VPC endpoints.

Why this answer

AWS App Mesh provides a service mesh that enables secure, low-latency communication between microservices within the same VPC using Envoy sidecar proxies. It handles service discovery, traffic routing, and encryption (mTLS) without requiring VPC endpoints or public IPs, keeping all traffic within the VPC and minimizing cost. This directly addresses the requirement for hundreds of services to communicate privately and efficiently.

Exam trap

The trap here is that candidates confuse PrivateLink (designed for external service access) with internal service mesh solutions, assuming VPC endpoints are the only way to keep traffic private, while overlooking App Mesh as a cost-effective, VPC-contained alternative for microservice communication.

How to eliminate wrong answers

Option A is wrong because Transit Gateway is designed for connecting multiple VPCs or on-premises networks, not for service-to-service communication within a single VPC, and it adds unnecessary complexity and cost without providing the granular traffic control needed for microservices. Option C is wrong because assigning public IP addresses to Fargate tasks would expose services to the internet, violating the security requirement to keep traffic within the VPC and increasing latency due to NAT traversal. Option D is wrong because creating a VPC endpoint for each microservice would be prohibitively expensive at scale (each endpoint incurs hourly charges and data processing fees), and PrivateLink is intended for accessing specific AWS services or third-party SaaS, not for internal service mesh communication.

Full explanation →

184

Multi-Selecteasy

A network engineer needs to monitor network performance between two EC2 instances in different Availability Zones. Which THREE metrics from Amazon CloudWatch should the engineer use?

Select 3 answers

A.NetworkPacketsIn

B.VolumeQueueLength

C.NetworkPacketsDropped

D.NetworkOut

E.NetworkIn

AnswersA, D, E

Measures number of incoming packets.

Why this answer

Options A, D, and E are correct. NetworkPacketsIn, NetworkOut, and NetworkIn are standard EC2 CloudWatch metrics that measure network traffic volume and packet counts, useful for monitoring network performance between instances. Option B (VolumeQueueLength) is an EBS metric, not network.

Option C (NetworkPacketsDropped) is not a standard CloudWatch metric for EC2.

Full explanation →

185

MCQhard

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They have a VPC with a CIDR of 10.0.0.0/16 and an on-premises network with CIDR 10.0.0.0/8. The Transit Gateway route table has a static route for 10.0.0.0/8 pointing to the VPN attachment. However, traffic from on-premises to the VPC is not working. What is the most likely cause?

A.The VPN attachment is in the wrong TGW route table.

B.The VPC route table does not have a route pointing to the Transit Gateway for on-premises traffic.

C.The VPC CIDR overlaps with the on-premises CIDR.

D.The Transit Gateway route table does not have a route for the VPC CIDR.

AnswerB

Return traffic needs a route to TGW.

Why this answer

For traffic from on-premises to reach the VPC, the VPC's route table must have a route pointing to the Transit Gateway (TGW) attachment as the target for the on-premises CIDR (10.0.0.0/8). Without this route, the VPC subnet will not forward return traffic to the TGW, causing a one-way communication failure. The TGW route table already has a static route for 10.0.0.0/8 pointing to the VPN attachment, so the issue is on the VPC side, not the TGW.

Exam trap

The trap here is that candidates often focus on the TGW route table configuration and overlook the requirement for a return route in the VPC route table, assuming that the TGW handles all routing decisions unilaterally.

How to eliminate wrong answers

Option A is wrong because the VPN attachment being in the wrong TGW route table would affect all traffic through that attachment, but the TGW route table already has a static route for 10.0.0.0/8 pointing to the VPN attachment, indicating the attachment is correctly associated. Option C is wrong because while the VPC CIDR (10.0.0.0/16) does overlap with the on-premises CIDR (10.0.0.0/8), overlapping CIDRs do not inherently break traffic; AWS TGW supports overlapping CIDRs with proper route table isolation and propagation, and the issue is specifically about missing return routing. Option D is wrong because the TGW route table does have a route for the VPC CIDR — it is propagated automatically when the VPC is attached, or can be added statically; the problem is the absence of a return route in the VPC route table, not in the TGW route table.

Full explanation →

186

Multi-Selecthard

A company is designing a network security architecture for a multi-account environment using AWS Transit Gateway. The company requires that all traffic between VPCs must be inspected by a centralized security appliance in a shared services VPC. The security appliance must receive traffic for both directions (ingress and egress). Which THREE components are required to achieve this? (Choose THREE.)

Select 3 answers

A.A shared services VPC containing the security appliances.

B.VPC attachments to the Transit Gateway for each VPC.

C.VPC peering connections between each spoke VPC and the shared services VPC.

D.Transit Gateway route tables that route traffic between VPCs through the security appliances.

E.NAT gateways in each spoke VPC for outbound traffic.

AnswersA, B, D

Centralized inspection point.

Why this answer

The shared services VPC hosts the centralized security appliances (e.g., firewalls, intrusion detection systems) that must inspect all inter-VPC traffic. This VPC acts as a hub for traffic inspection, ensuring that both ingress and egress traffic flows through the appliances before reaching its destination.

Exam trap

AWS often tests the misconception that VPC peering can be used for transitive routing in a hub-and-spoke model, but the trap here is that VPC peering does not support transitive routing, so it cannot replace Transit Gateway attachments for centralized inspection.

Full explanation →

187

Multi-Selecthard

A company is designing a multi-region network with Direct Connect. They have two Direct Connect connections in each region. They want to achieve the HIGHEST availability and lowest latency for cross-region traffic. Which THREE design elements should they include?

Select 3 answers

A.Configure BGP ASN prepending to influence path selection

B.Use different Direct Connect providers in each region

C.Use different Direct Connect locations within each region

D.Use multiple virtual interfaces per Direct Connect connection

E.Use the same BGP ASN for all Direct Connect connections

AnswersA, B, C

Helps control traffic flow.

Why this answer

Options A, B, and C are correct. Using different Direct Connect providers in each region avoids a single point of failure and enhances availability. Using different Direct Connect locations within each region provides physical diversity, further increasing resilience.

ASN prepending allows you to influence BGP path selection, enabling you to choose lower-latency paths for cross-region traffic. Option D is incorrect because multiple virtual interfaces per connection are not necessary for the highest availability; they would still share the same underlying physical connection. Option E is incorrect because using the same BGP ASN for all connections can cause routing issues and does not improve availability or latency.

Full explanation →

188

MCQhard

A company has a VPC with a CIDR block of 10.0.0.0/16. They have two subnets: Subnet A (10.0.1.0/24) and Subnet B (10.0.2.0/24). They launch an EC2 instance in Subnet A and assign it a primary private IP address of 10.0.1.50. They then attach a second elastic network interface (ENI) to the instance with a primary private IP of 10.0.2.100. The instance needs to send traffic from the second ENI. However, when the instance sends traffic from the second ENI, it fails. What is the MOST likely cause?

A.The two ENIs are in different subnets, which is not allowed.

B.The instance's operating system routing table does not have a route for the second ENI's subnet.

C.The security group for the second ENI does not allow outbound traffic.

D.The subnet route table does not have a route for the second ENI's IP address.

AnswerB

The OS routing table must have a route to send traffic from the second ENI through its own subnet.

Why this answer

When an EC2 instance has multiple ENIs, the operating system's routing table must have explicit routes for each ENI's subnet to ensure traffic leaves via the correct interface. By default, the OS only adds a route for the primary ENI's subnet, so traffic from the second ENI (10.0.2.100) fails because the OS tries to send it out the primary ENI, which is in a different subnet. This is a common cause of asymmetric routing or connectivity failure.

Exam trap

The trap here is that candidates often assume the issue is with AWS networking components (security groups or route tables) rather than the instance's operating system routing, which is a common oversight in multi-ENI configurations.

How to eliminate wrong answers

Option A is wrong because attaching ENIs from different subnets to the same instance is allowed and a common practice for multi-homed architectures. Option C is wrong because security groups are stateful and allow outbound traffic by default; outbound rules are not the cause of failure unless explicitly blocked. Option D is wrong because the subnet route table already has a local route for the VPC CIDR (10.0.0.0/16), which covers the second ENI's IP address; the issue is at the OS level, not the subnet route table.

Full explanation →

189

MCQmedium

A company is designing a hybrid network connecting on-premises data centers to AWS via AWS Direct Connect. The company requires high availability with multiple connections. Which design ensures that a failure of a single Direct Connect location does not impact connectivity?

A.Provision a single Direct Connect connection with a large bandwidth.

B.Provision two Direct Connect connections at two different Direct Connect locations.

C.Provision two Direct Connect connections at the same AWS Direct Connect location.

D.Provision one Direct Connect connection and one AWS Site-to-Site VPN as backup.

AnswerB

Connections at different locations provide redundancy against a location failure.

Why this answer

Deploying two Direct Connect connections at two different Direct Connect locations ensures that a single location failure (e.g., power outage, fiber cut, or facility issue) does not affect connectivity. This design provides geographic redundancy, meeting the high availability requirement by eliminating a single point of failure at the Direct Connect location level.

Exam trap

The trap here is that candidates often confuse 'multiple connections' with 'location diversity,' assuming two connections at the same location provide sufficient redundancy, but AWS explicitly requires connections at different Direct Connect locations to protect against a location-level failure.

How to eliminate wrong answers

Option A is wrong because a single Direct Connect connection, regardless of bandwidth, creates a single point of failure; if the connection or its location fails, all connectivity is lost. Option C is wrong because two connections at the same Direct Connect location share the same facility risk; a location-wide outage (e.g., power or fiber cut) would impact both connections simultaneously, failing the high availability requirement. Option D is wrong because while a Site-to-Site VPN can serve as a backup, it introduces a different failure domain (internet-based) and typically offers lower and less consistent performance; the question specifically requires that a failure of a single Direct Connect location does not impact connectivity, and a VPN backup does not provide redundant Direct Connect location diversity.

Full explanation →

190

MCQmedium

A company uses AWS Direct Connect to connect its on-premises network to a VPC. They have a private VIF attached to a virtual private gateway. They want to use AWS Site-to-Site VPN as a backup connection. Which configuration ensures automatic failover?

A.Attach the VPN connection to a separate virtual private gateway and use a transit gateway to combine them.

B.Use static routes on the Direct Connect private VIF and BGP on the VPN connection.

C.Use BGP on both the Direct Connect private VIF and the VPN connection, and advertise the same prefixes with a longer AS path for the VPN.

D.Create a second Direct Connect connection and use equal-cost multipath (ECMP) between the two.

AnswerC

This provides automatic failover via BGP.

Why this answer

Using BGP on both the Direct Connect private VIF and the VPN connection allows you to manipulate route selection via AS path prepending. By advertising the same prefixes with a longer AS path on the VPN, the Direct Connect path is preferred, and if it fails, BGP withdraws the routes, causing traffic to automatically fail over to the VPN.

Exam trap

AWS often tests the misconception that static routes can provide automatic failover, but static routes lack dynamic withdrawal, so BGP must be used on both connections with AS path prepending to ensure automatic and predictable failover.

How to eliminate wrong answers

Option A is wrong because attaching the VPN to a separate virtual private gateway and using a transit gateway does not provide automatic failover; it introduces additional complexity and does not inherently prioritize one path over the other without BGP path manipulation. Option B is wrong because using static routes on the Direct Connect private VIF and BGP on the VPN prevents automatic failover; static routes do not dynamically withdraw when the Direct Connect link fails, so traffic may blackhole or require manual intervention. Option D is wrong because creating a second Direct Connect connection and using ECMP provides load balancing, not failover, and does not address the requirement for a VPN backup; it also does not ensure automatic failover to a different type of connection.

Full explanation →

191

MCQhard

A global company is designing a multi-region architecture with an Active-Passive setup. They want to use Amazon Route 53 to route traffic to the active region and fail over to the passive region during an outage. They need to ensure that the failover is automatic based on health checks. Which routing policy should they use?

A.Weighted routing policy

B.Latency routing policy

C.Geolocation routing policy

D.Failover routing policy

AnswerD

Designed for active-passive failover using health checks.

Why this answer

The Failover routing policy in Amazon Route 53 is specifically designed for active-passive configurations. It allows you to designate one record as primary (active) and another as secondary (passive), and Route 53 automatically routes traffic to the secondary record only when the health check associated with the primary record fails. This meets the requirement for automatic failover based on health checks without manual intervention.

Exam trap

The trap here is that candidates often confuse the Failover routing policy with the Weighted or Latency policies, mistakenly thinking those can also provide automatic failover, but only the Failover policy is designed for active-passive setups with health check-driven automatic failover.

How to eliminate wrong answers

Option A is wrong because the Weighted routing policy distributes traffic across multiple resources based on assigned weights, not for active-passive failover; it does not automatically fail over based on health checks. Option B is wrong because the Latency routing policy routes traffic to the region with the lowest latency for the end user, not to provide failover between an active and passive region. Option C is wrong because the Geolocation routing policy routes traffic based on the geographic location of the user, not for failover; it can be combined with failover but alone does not provide automatic failover based on health checks.

Full explanation →

192

MCQmedium

A company has a VPC with a CIDR block of 10.0.0.0/16. The company needs to add a secondary CIDR block for additional subnets. Which CIDR block can be used?

A.10.1.0.0/16

B.172.16.0.0/16

C.192.168.0.0/16

D.10.0.0.0/16

AnswerA, B, C

This is correct because it is a non-overlapping subnet within the same /8 range as the primary VPC CIDR (10.0.0.0/16).

Why this answer

Options A (10.1.0.0/16), B (172.16.0.0/16), and C (192.168.0.0/16) are all valid secondary CIDR blocks for a VPC with a primary CIDR of 10.0.0.0/16. They are all RFC 1918 private IP ranges that do not overlap with the primary CIDR. AWS allows adding any non-overlapping private CIDR block as a secondary, regardless of whether it belongs to the same /8 range.

Option D (10.0.0.0/16) is invalid because it overlaps exactly with the primary CIDR. Note: This question has multiple correct answers; you must select all that apply.

Exam trap

The trap is that candidates may think any non-overlapping RFC 1918 range is allowed, but in this question, only a CIDR within the same /8 is valid.

How to eliminate wrong answers

Option B (172.16.0.0/16) is wrong because although it is a valid RFC 1918 private range, it is not contiguous with the existing 10.0.0.0/16 CIDR; however, the primary reason it is incorrect is that the question does not specify any restriction on using a different RFC 1918 range, but in practice AWS does allow secondary CIDRs from any RFC 1918 range, so this option is actually technically valid—but the trap is that the question expects a /16 that is within the same /8 as the primary to avoid routing complexity, and 172.16.0.0/16 is not within 10.0.0.0/8. Option C (192.168.0.0/16) is wrong for the same reason: it is a valid RFC 1918 range but not within the 10.0.0.0/8 space, and the question implies the secondary CIDR should be from the same major network (10.0.0.0/8) to simplify routing and avoid potential peering conflicts. Option D (10.0.0.0/16) is wrong because it is identical to the existing primary CIDR block; AWS does not allow adding a secondary CIDR that overlaps or is identical to the primary CIDR.

Full explanation →

193

Multi-Selecteasy

A company is designing a network for a three-tier web application on AWS. The web tier must be accessible from the internet, and the application and database tiers must be in private subnets. The company wants to use a single AWS Region and ensure high availability. Which TWO configurations should be implemented? (Choose two.)

Select 2 answers

A.Place an internet-facing Application Load Balancer (ALB) in public subnets across two Availability Zones.

B.Configure the web tier EC2 instances in an Auto Scaling group across two Availability Zones.

C.Use a stateful network ACL for the web tier subnets to simplify security rules.

D.Deploy a NAT Gateway in a single Availability Zone for outbound traffic from private subnets.

E.Create the VPC with a single Availability Zone to simplify management.

AnswersA, B

Provides high availability and internet access for the web tier.

Why this answer

An internet-facing Application Load Balancer (ALB) in public subnets across two Availability Zones (AZs) provides both internet access to the web tier and high availability. The ALB distributes incoming HTTP/HTTPS traffic to web instances in private subnets, and deploying across two AZs ensures fault tolerance if one AZ fails.

Exam trap

The trap here is that candidates often confuse stateless network ACLs with stateful security groups, leading them to incorrectly select option C, or they assume a single NAT Gateway is sufficient for high availability, overlooking the need for redundancy in each AZ.

Full explanation →

194

MCQmedium

A company uses AWS PrivateLink to access a SaaS application hosted in another AWS account. The SaaS provider has created a VPC endpoint service in their account. The consumer has created a VPC endpoint in their VPC. The consumer's VPC has a route table with a local route and a route to a NAT gateway. The VPC endpoint is associated with a security group that allows inbound HTTPS from the consumer's VPC CIDR. The consumer's EC2 instances can resolve the DNS name of the endpoint but cannot connect to the SaaS service. What is the most likely cause?

A.The consumer's route table routes traffic to the endpoint via the NAT gateway

B.The VPC endpoint service is not available in the consumer's Availability Zone

C.The VPC endpoint security group does not allow inbound HTTPS from the consumer's EC2 instances

D.The consumer's route table does not have a route to the VPC endpoint

AnswerD

Correct. The consumer's route table must contain a route that points traffic destined to the endpoint's service (or the endpoint's CIDR) to the VPC endpoint's ENI. Without this route, traffic may be dropped or misrouted, preventing connectivity despite successful DNS resolution.

Why this answer

For PrivateLink, the consumer's VPC endpoint is accessed via private IP addresses from the endpoint's elastic network interfaces (ENIs) in the consumer's VPC. The consumer's VPC route table must have a route to the endpoint's ENI to direct traffic correctly. The stem states that the security group allows inbound HTTPS from the consumer's VPC CIDR, so option C is not the cause.

DNS resolution works because the endpoint's DNS name resolves to the private IPs of the ENIs, but without a matching route in the route table, traffic may be dropped or misrouted. Option D is the most likely cause.

Exam trap

A common mistake is to assume that if DNS resolution works, routing is fine. However, DNS resolves to private IPs, but the route table must have a route directing traffic to the VPC endpoint's ENI. Without that route, traffic may go to the NAT gateway (if present) or be dropped.

Full explanation →

195

MCQmedium

A company has a VPC with a CIDR block of 10.0.0.0/16. They have three subnets: Subnet A (10.0.1.0/24) in us-east-1a, Subnet B (10.0.2.0/24) in us-east-1b, and Subnet C (10.0.3.0/24) in us-east-1c. The company has deployed a set of EC2 instances in Subnet A that need to access an Amazon S3 bucket. The company wants to ensure that traffic to S3 does not traverse the internet and remains within the AWS network. The VPC has a VPC endpoint for S3 (gateway type) created and associated with the route table for Subnet A. However, the instances are unable to access the S3 bucket. What is the MOST likely cause?

A.The VPC does not have an internet gateway attached.

B.The route table for Subnet A does not have a route for the S3 prefix list pointing to the VPC endpoint.

C.The S3 bucket policy does not allow access from the VPC endpoint.

D.The VPC endpoint is not associated with a security group that allows outbound traffic to S3.

AnswerB

Without this route, traffic from Subnet A to S3 does not use the endpoint.

Why this answer

A gateway VPC endpoint for S3 is only accessible from the subnet whose route table has a route to the endpoint. The route table for Subnet A must have a route for the S3 prefix list pointing to the VPC endpoint. If that route is missing, traffic will not use the endpoint.

Option A is incorrect because a VPC endpoint does not require an internet gateway. Option C is incorrect because a gateway endpoint does not use security groups; it uses endpoint policies. Option D is incorrect because the endpoint policy does not need to be explicitly attached to the bucket; the bucket policy must grant access to the VPC endpoint.

Full explanation →

196

Multi-Selectmedium

A company has a VPC with a CIDR block of 10.0.0.0/16 and needs to establish connectivity to an on-premises network via AWS Site-to-Site VPN. The on-premises network uses a CIDR block of 192.168.0.0/16. The VPN connection will be redundant using two tunnels. Which THREE actions are required to enable this connectivity?

Select 3 answers

A.Create a Customer Gateway (CGW) in the same AWS region.

B.Create a Direct Connect virtual interface.

C.Create a Virtual Private Gateway (VGW) and attach it to the VPC.

D.Configure a NAT Gateway in the VPC.

E.Add a route in the VPC route tables pointing to the VGW for the on-premises CIDR.

AnswersA, C, E

Correct. The CGW must be created to represent the on-premises device.

Why this answer

To establish an AWS Site-to-Site VPN, three actions are required: creating a Customer Gateway (CGW), creating a Virtual Private Gateway (VGW) and attaching it to the VPC, and adding a route in the VPC route tables pointing to the VGW for the on-premises CIDR. The correct answers are A, C, and E.

Exam trap

Candidates often omit the route addition and think only the CGW and VGW are needed, but full connectivity also requires a route in the VPC route table pointing to the VGW for the on-premises CIDR.

Full explanation →

197

MCQhard

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network team reports intermittent connectivity loss to resources in the VPC, but the Direct Connect tunnel status shows as UP. Which configuration is MOST likely causing the issue?

A.The BGP keepalive interval is set to 60 seconds

B.Jumbo frames are enabled on the Direct Connect interface but not on on-premises routers

C.A separate private VIF is required for each VPC in the account

D.Traffic is being routed asymmetrically through the Direct Connect and a VPN backup

AnswerD

Asymmetric routing can cause connectivity issues if stateful firewalls or security groups block return traffic.

Why this answer

Asymmetric routing occurs when traffic from on-premises to the VPC uses Direct Connect, but return traffic from the VPC takes the VPN backup path. This can cause stateful firewalls (e.g., AWS Network Firewall, security groups, or on-premises firewalls) to drop packets because they expect traffic to arrive on the same interface. The Direct Connect tunnel status remains UP because the BGP session is still established, but connectivity is intermittent due to dropped return packets.

Exam trap

The ANS-C01 exam often tests the misconception that a Direct Connect tunnel status of UP guarantees end-to-end connectivity, ignoring the impact of asymmetric routing on stateful firewalls.

How to eliminate wrong answers

Option A is wrong because a BGP keepalive interval of 60 seconds is the default for Direct Connect private VIFs and does not cause intermittent connectivity loss; it would take three missed keepalives (180 seconds) to tear down the session. Option B is wrong because jumbo frames on Direct Connect are supported only for data plane traffic and do not affect BGP keepalive or tunnel status; mismatched MTU would cause packet drops for large frames, not intermittent connectivity. Option C is wrong because a single private VIF can be associated with multiple VPCs using a Direct Connect Gateway, so a separate VIF per VPC is not required.

Full explanation →

198

MCQmedium

A company uses AWS Global Accelerator to improve performance for a global application. The application is deployed in two AWS regions behind Network Load Balancers. Users in Asia report high latency even though the accelerator should route them to the nearest endpoint. What is the most likely reason?

A.The endpoint in the closer region is marked unhealthy

B.Traffic Dial is set to 100% for the distant region

C.The accelerator is configured with on-premises endpoints

D.Client affinity is set to source IP

AnswerA

Global Accelerator routes traffic away from unhealthy endpoints.

Why this answer

If the endpoint in the closer region is marked unhealthy, Global Accelerator will automatically route traffic to the next nearest healthy endpoint, which may be in a distant region, causing high latency. Option B is incorrect because if Traffic Dial were set to 100% for the distant region, traffic would be intentionally routed there, so users would not expect routing to the nearest endpoint. Option C is incorrect because on-premises endpoints are not typical for Global Accelerator, and even if used, they would not cause high latency specifically for Asian users if the closer region has healthy endpoints.

Option D is incorrect because client affinity affects stickiness, not overall latency; it would not cause all Asian users to experience high latency.

Full explanation →

199

MCQeasy

A company wants to provide its employees with secure access to internal applications running on AWS without using a VPN. Which AWS service can be used?

A.AWS Site-to-Site VPN

B.AWS Transit Gateway

C.AWS Client VPN

D.AWS Direct Connect

AnswerC

Client VPN provides secure access for individual users.

Why this answer

AWS Client VPN is a managed, cloud-based VPN solution that allows employees to securely access AWS resources and internal applications from their devices using OpenVPN or IKEv2 protocols, without requiring a traditional site-to-site VPN or dedicated hardware. It provides per-user authentication via Active Directory, SAML, or mutual authentication, making it ideal for remote user access to internal applications without a VPN appliance on-premises.

Exam trap

The trap here is that candidates often confuse AWS Client VPN (a managed remote access VPN for individual users) with AWS Site-to-Site VPN (a site-to-site tunnel between networks), leading them to select Option A because they see 'VPN' in the question but miss the requirement for employee remote access without a VPN appliance.

How to eliminate wrong answers

Option A is wrong because AWS Site-to-Site VPN creates an encrypted tunnel between an on-premises network and AWS VPC, requiring a customer gateway device and static routing or BGP, which does not address individual employee remote access without a VPN. Option B is wrong because AWS Transit Gateway is a network transit hub that interconnects VPCs and on-premises networks, but it does not provide client-based VPN connectivity for individual users; it is a routing construct, not a remote access service. Option D is wrong because AWS Direct Connect provides a dedicated private network connection from on-premises to AWS, but it requires physical cabling, colocation, and a VPN overlay for encryption, and it does not offer per-user remote access without a VPN.

Full explanation →

200

MCQhard

A company has a VPC with multiple subnets. They have an Amazon RDS for MySQL database in a private subnet. The application team needs to access the database for maintenance from a bastion host in a public subnet. The security group for the database allows inbound traffic from the security group of the bastion host on port 3306. However, the application team cannot connect. What is the most likely cause?

A.The network ACL on the private subnet is blocking inbound traffic on port 3306.

B.The database does not have a route to the internet.

C.The security group rule for the database is incorrectly configured.

D.The bastion host does not have a route to the database subnet.

AnswerA

Network ACLs are stateless and can block traffic even if security groups allow it.

Why this answer

The most likely cause is that the network ACL (NACL) on the private subnet is blocking inbound traffic on port 3306. Even though the security group on the RDS instance allows traffic from the bastion host's security group, NACLs are stateless and must explicitly allow both inbound and outbound traffic. By default, custom NACLs deny all inbound traffic, so unless an inbound rule for port 3306 (MySQL) is added, the connection will be dropped at the subnet boundary.

Exam trap

AWS often tests the distinction between stateful security groups and stateless network ACLs, trapping candidates who assume that a security group rule alone is sufficient for connectivity.

How to eliminate wrong answers

Option B is wrong because the database does not need a route to the internet; it only needs a route back to the bastion host within the VPC, which is provided by the VPC's main route table or subnet route table. Option C is wrong because the security group rule is explicitly described as correctly allowing inbound traffic from the bastion host's security group on port 3306, so it is not the cause. Option D is wrong because the bastion host does not need a route to the database subnet; it only needs a route to the VPC's CIDR, which is typically a local route already present in the route table.

Full explanation →

201

MCQmedium

A company is migrating its on-premises data center to AWS. The migration requires connectivity between the on-premises network and a VPC. The company needs a connection that supports multiple VLANs for separate environments (development, test, production) and provides consistent performance. The company also wants to avoid using the public internet. Which AWS service should be used?

A.AWS Transit Gateway

B.AWS Direct Connect

C.AWS Site-to-Site VPN

D.AWS Client VPN

AnswerB

Direct Connect provides a private connection supporting multiple VLANs for environment isolation.

Why this answer

AWS Direct Connect is the correct choice because it provides a dedicated, private network connection from on-premises to AWS, bypassing the public internet for consistent performance. It supports multiple VLANs (802.1Q) via Virtual LANs (VLANs) on a single Direct Connect circuit, allowing separate logical networks for development, test, and production environments. This meets the requirements for private connectivity, multi-VLAN support, and predictable performance.

Exam trap

The trap here is that candidates often confuse AWS Transit Gateway as a connectivity service, but it is a central hub that requires an underlying connection (like Direct Connect or VPN) to reach on-premises, not a direct replacement for the physical link itself.

How to eliminate wrong answers

Option A is wrong because AWS Transit Gateway is a network transit hub that interconnects VPCs and on-premises networks, but it does not provide the physical connectivity itself; it requires an underlying connection like Direct Connect or VPN to attach to on-premises, so it cannot fulfill the requirement for a direct private connection. Option C is wrong because AWS Site-to-Site VPN uses the public internet, which violates the requirement to avoid using the public internet, and its performance is variable due to internet congestion and latency. Option D is wrong because AWS Client VPN is a remote access VPN solution for individual clients (e.g., laptops) connecting to AWS, not for site-to-site connectivity between an on-premises data center and a VPC, and it also traverses the public internet.

Full explanation →

202

MCQmedium

A company uses an AWS Network Firewall to inspect traffic between VPCs and the internet. They want to allow outbound HTTPS traffic only to specific domains. Which rule configuration should be used?

A.Create a stateless rule group with a 'forward' action for the allowed IP addresses.

B.Create a stateful rule group with a 'pass' action for the allowed domains using domain list rule group.

C.Create a stateful rule group with a 'drop' action for all traffic and then 'pass' for the allowed domains using Suricata compatible rules.

D.Create an IP set rule group with the allowed domain IP addresses.

AnswerB

Domain list rule group allows matching by domain name in stateful rules.

Why this answer

Domain list rule group in AWS Network Firewall can match FQDNs. Stateful rule groups inspect traffic states. Suricata compatible rules allow custom domain matching.

IP set would match by IP, not domain.

Full explanation →

203

MCQhard

An organization has a requirement that all cross-account access to Amazon S3 buckets must be logged and monitored. The security team has enabled AWS CloudTrail and S3 server access logs. However, they notice that some cross-account access attempts are not being logged. Which additional step should be taken to ensure all cross-account access is logged?

A.Create a CloudWatch Logs subscription filter to capture all S3 access logs.

B.Enable default encryption on all S3 buckets.

C.Enable CloudTrail data events for S3 buckets to capture object-level API operations.

D.Enable S3 Object Lock on all buckets to prevent deletion of logs.

AnswerC

CloudTrail data events log object-level operations such as GetObject, PutObject, which are used in cross-account access.

Why this answer

CloudTrail logs management events by default, but not data events. S3 server access logs capture object-level operations but require proper configuration. Option A is wrong because CloudWatch Logs is for log storage, not for enabling logging.

Option B is wrong because enabling default encryption does not affect logging. Option D is wrong because S3 Object Lock is for compliance, not logging.

Full explanation →

204

Multi-Selectmedium

A company is designing a network security architecture for a multi-tier application. They need to ensure that the web tier can only communicate with the app tier on port 443, and the app tier can only communicate with the database tier on port 3306. Which TWO actions should they take? (Choose TWO.)

Select 2 answers

A.Create a security group for the web tier that allows outbound traffic to the app tier security group on port 443.

B.Create a security group for the app tier that allows inbound traffic from the web tier security group on port 443.

C.Deploy an AWS Network Firewall to inspect inter-tier traffic.

D.Use network ACLs to statelessly filter traffic on the subnets.

E.Configure a VPC endpoint policy to deny all traffic between tiers.

AnswersA, B

Security group outbound rule allows traffic to app tier.

Why this answer

Options A and B are correct because security groups are stateful and allow you to reference other security groups as sources or destinations, enabling granular control of traffic between tiers. Option A allows the web tier to send outbound traffic to the app tier on port 443, and Option B allows the app tier to receive that traffic from the web tier. Options C, D, and E are incorrect: AWS Network Firewall is unnecessary for this simple requirement; network ACLs are stateless and would require complex rules; a VPC endpoint policy only applies to VPC endpoints, not inter-tier traffic.

Full explanation →

205

MCQeasy

A company has a VPC with a CIDR of 10.0.0.0/16. They need to create a subnet for a new application that requires at least 2000 usable IP addresses. Which subnet size should they choose?

A./24 (256 IPs)

B./22 (1024 IPs)

C./19 (8192 IPs)

D./20 (4096 IPs)

AnswerD

4091 usable, sufficient.

Why this answer

A /20 subnet provides 4096 total IP addresses, with 4091 usable (AWS reserves 5). This meets the requirement of at least 2000 usable IP addresses. Option A (/24) provides 251 usable.

Option B (/22) provides 1023 usable. Option C (/19) provides 8191 usable, which is more than needed, but /20 is the smallest sufficient subnet.

Full explanation →

206

MCQmedium

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. They have also set up a Site-to-Site VPN as a backup. The VPC has a virtual private gateway (VGW) attached. The on-premises network uses BGP over the Direct Connect and static routes for the VPN. The network engineer notices that traffic from the VPC to on-premises is not using the Direct Connect when it is available; instead, it goes over the VPN. The VPC route table has a route for the on-premises CIDR (10.0.0.0/8) to the VGW. The VPN connection is configured with static routes. What is the MOST likely cause of this behavior?

A.The VPN static route has higher precedence than the BGP route from Direct Connect

B.The VPC route table does not have a route for the on-premises CIDR

C.The VGW is not attached to the VPC

D.The Direct Connect virtual interface is not associated with the VGW

AnswerA

Correct; static routes (from VPN) are preferred over BGP propagated routes in AWS route tables.

Why this answer

When a VPC route table has a route for the on-premises CIDR (10.0.0.0/8) pointing to the VGW, AWS uses the longest prefix match to select the route. If both the Direct Connect BGP route and the VPN static route have the same prefix length, static routes are preferred over propagated BGP routes. Therefore, the VPN static route takes precedence, causing traffic to flow over the VPN even when Direct Connect is available.

To fix this, the VPN should use BGP instead of static routes, or the static route should be removed so that the BGP route from Direct Connect is used.

Full explanation →

207

Multi-Selecthard

A company is designing a network security architecture for a multi-account environment using AWS Organizations. The security team needs to ensure that all internet-bound traffic from VPCs in the organization goes through a centralized egress VPC where it is inspected by a firewall. Which TWO steps are required to enforce this?

Select 2 answers

A.Create a central egress VPC with an Internet Gateway and a NAT Gateway or firewall.

B.Use AWS WAF to block internet access from all VPCs except the central egress VPC.

C.Set up an AWS Direct Connect connection to route internet traffic through the central VPC.

D.Configure VPC endpoints for all AWS services to force traffic through the central VPC.

E.Apply an SCP that denies the ec2:CreateInternetGateway action in all accounts except the central network account.

AnswersA, E

Central egress VPC hosts the internet gateway.

Why this answer

Options A and E are correct. Option A: A central egress VPC with an Internet Gateway and NAT Gateway or firewall is required to route and inspect all internet-bound traffic. Option E: An SCP denying ec2:CreateInternetGateway in all accounts except the central network account prevents other accounts from creating their own Internet Gateways, thereby forcing traffic through the central VPC.

Option B is incorrect because AWS WAF is a web application firewall that filters HTTP/S traffic, not a method to block all internet access at the network level. Option C is incorrect because AWS Direct Connect is for private on-premises connectivity, not for routing internet traffic. Option D is incorrect because VPC endpoints provide private access to AWS services without traversing the internet; they do not enforce internet egress routing.

Full explanation →

208

Multi-Selecteasy

Which TWO AWS services can be used to monitor and log network traffic in a VPC for security analysis? (Choose two.)

Select 2 answers

A.VPC Flow Logs

B.AWS Config

C.AWS CloudTrail

D.Amazon Inspector

E.Amazon GuardDuty

AnswersA, C

Captures metadata about IP traffic.

Why this answer

Options A and C are correct. VPC Flow Logs capture IP traffic information for network interfaces in a VPC, enabling security analysis of traffic patterns. AWS CloudTrail logs API calls to the AWS Management Console and SDKs, providing visibility into user activity and resource changes.

Option B (AWS Config) is incorrect because it evaluates resource configurations for compliance, not network traffic logging. Option D (Amazon Inspector) is a vulnerability assessment service that scans for software vulnerabilities and unintended network exposure. Option E (Amazon GuardDuty) is a threat detection service that analyzes data sources like DNS logs and VPC Flow Logs, but it is not itself a logging service for network traffic.

Full explanation →

209

MCQmedium

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to access an S3 bucket in the same Region. Which solution provides the most secure and cost-effective connectivity?

A.Create a NAT gateway in a public subnet and add a route in the private subnet's route table pointing to the NAT gateway.

B.Create an interface endpoint for S3 in the private subnet.

C.Attach an internet gateway to the VPC and add a route to the internet gateway in the private subnet's route table.

D.Create a gateway endpoint for S3 in the VPC and add a route in the private subnet's route table pointing to the endpoint.

AnswerD

A gateway endpoint provides private, cost-effective access to S3 without internet connectivity.

Why this answer

A gateway endpoint for S3 uses Amazon's private network to connect the VPC to S3 without traversing the internet, providing the most secure and cost-effective solution. It avoids NAT gateway hourly charges and data processing fees, and it does not require public IPs or internet access for the private subnet EC2 instance.

Exam trap

The ANS-C01 exam often tests the misconception that a NAT gateway is required for private subnet internet access, but for S3 in the same Region, a gateway endpoint is both more secure and cost-effective, and candidates may overlook the free, private connectivity option.

How to eliminate wrong answers

Option A is wrong because a NAT gateway incurs hourly charges and data processing costs, and it routes traffic over the internet, which is less secure and more expensive than a gateway endpoint. Option B is wrong because an interface endpoint for S3 is more expensive than a gateway endpoint (charges per hour and per GB processed) and is unnecessary when a gateway endpoint can serve the same purpose at lower cost. Option C is wrong because attaching an internet gateway and routing private subnet traffic through it would expose the EC2 instance to the internet, violating security best practices and still requiring a NAT device for outbound-only access, which adds cost and complexity.

Full explanation →

210

MCQhard

A company has a Direct Connect connection with a private VIF to a VPC. The VPC has a virtual private gateway (VGW) attached. The on-premises network advertises a prefix 10.0.0.0/8 over BGP. The VPC has subnets with CIDR 10.0.1.0/24 and 10.0.2.0/24. The company wants to ensure that traffic to on-premises uses Direct Connect. However, traffic to an S3 bucket uses the internet. What route configuration is required?

A.Change the VPC CIDR to avoid overlap with on-premises.

B.Add specific routes for S3 public IP prefixes pointing to the internet gateway.

C.Add a static route for 0.0.0.0/0 pointing to the internet gateway.

D.Add a static route in the VPC route table for 0.0.0.0/0 pointing to the VGW.

AnswerB

More specific routes override the general route to VGW, directing S3 traffic to IGW.

Why this answer

S3 public IP prefixes are not within the on-premises advertised prefix 10.0.0.0/8. Without explicit routes for S3, traffic to S3 would use the default route (if any) or be dropped. By adding specific routes for S3 public IP prefixes pointing to the internet gateway, S3 traffic is forced over the internet while all other traffic (including to on-premises) uses the Direct Connect private VIF via the propagated 10.0.0.0/8 route.

Exam trap

The trap is assuming that a default route (0.0.0.0/0) to the internet gateway is sufficient, but that would also send all non-matching traffic (e.g., to the internet) via IGW, which might be undesirable. The correct approach is to add specific routes for S3 public IP prefixes to the IGW, leaving the propagated 10.0.0.0/8 route for on-premises traffic.

How to eliminate wrong answers

Option A is wrong because changing the VPC CIDR to avoid overlap with on-premises does not address the requirement to route S3 traffic over the internet; it only prevents routing conflicts but does not provide a mechanism to direct S3 traffic to the internet gateway. Option C is wrong because adding a 0.0.0.0/0 route pointing to the internet gateway would send all traffic not matching a more specific route (including traffic to on-premises) to the internet, which violates the requirement that on-premises traffic uses Direct Connect. Option D is wrong because adding a 0.0.0.0/0 route pointing to the VGW would send all internet-bound traffic (including S3 traffic) through Direct Connect, which is not desired and would not allow S3 traffic to use the internet.

Full explanation →

211

MCQhard

A company is migrating its on-premises data center to AWS and wants to use AWS Direct Connect for private connectivity. The network team plans to advertise the company's public IP prefixes to AWS via BGP. Which AWS resource must be configured to allow advertisement of these prefixes?

A.A VPN CloudHub topology

B.A public virtual interface on the Direct Connect connection

C.A private virtual interface on the Direct Connect connection

D.A transit virtual interface on the Direct Connect connection

AnswerB

Public VIF is used to advertise public IP prefixes.

Why this answer

A public virtual interface (VIF) on AWS Direct Connect allows BGP peering where you can advertise your public IP prefixes to AWS, enabling private connectivity to public AWS services. Private and transit VIFs do not support customer-originated public prefix advertisements.

Exam trap

The trap here is that candidates often confuse private VIFs (used for VPC connectivity) with public VIFs (used for public IP reachability), assuming that any BGP session on Direct Connect can advertise public prefixes, but only the public VIF is designed for that purpose.

How to eliminate wrong answers

Option A is wrong because a VPN CloudHub topology is used for connecting multiple VPN sites together over AWS VPN, not for advertising public IP prefixes over Direct Connect. Option C is wrong because a private virtual interface is used for connecting to a VPC via private IP addresses and does not support the advertisement of public IP prefixes. Option D is wrong because a transit virtual interface is used for connecting a Direct Connect gateway to a transit gateway, enabling connectivity to multiple VPCs, but it does not handle public prefix advertisements; that is the role of a public VIF.

Full explanation →

212

MCQeasy

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The network engineer is troubleshooting connectivity issues and notices that the BGP session between the on-premises router and the AWS Direct Connect virtual interface is down. The engineer has verified the physical connectivity and the VLAN configuration. What should the engineer check next?

A.Ensure the virtual interface type is set to 'public'.

B.Verify that the on-premises router is advertising a CIDR block smaller than /24.

C.Confirm that the BGP ASN configured on the on-premises router matches the one provided by AWS.

D.Check the VPC CIDR range in the route table.

AnswerC

Correct: BGP ASN mismatch prevents session establishment.

Why this answer

Correct answer is C. BGP session establishment requires matching BGP ASN on both sides; if they don't match, the session fails. Option A is incorrect because the virtual interface type (private or public) does not prevent BGP from coming up; it affects routing scope.

Option B is incorrect because the route size advertised does not affect the BGP session itself; AWS accepts routes of any size within limits. Option D is incorrect because the VPC CIDR is used for routing, but not for BGP session establishment; the session can be up even if no routes are propagated.

Full explanation →

213

MCQhard

A company has a VPC with a CIDR block of 172.16.0.0/20. They need to create subnets for three tiers: web, application, and database. The web tier must be public and support at least 1000 hosts. The application and database tiers must be private. Which subnet design meets the requirements?

A.Web: 172.16.0.0/22, App: 172.16.4.0/24, DB: 172.16.5.0/24

B.Web: 172.16.0.0/23, App: 172.16.2.0/23, DB: 172.16.4.0/23

C.Web: 172.16.0.0/20, App: 172.16.0.0/20, DB: 172.16.0.0/20

D.Web: 172.16.0.0/24, App: 172.16.1.0/24, DB: 172.16.2.0/24

AnswerA

/22 provides 1022 hosts, meeting 1000 requirement.

Why this answer

The web tier subnet 172.16.0.0/22 provides 2^(32-22) - 5 = 1024 - 5 = 1019 usable host addresses (AWS reserves 5 IPs per subnet), which meets the requirement of at least 1000 hosts. The application and database subnets use /24 masks, each offering 251 usable hosts, and are private. All subnets fall within the VPC CIDR 172.16.0.0/20 without overlap.

Exam trap

The trap here is that candidates often forget to subtract the 5 reserved AWS IPs from the total subnet size, leading them to incorrectly believe a /23 (512 IPs) can support 1000 hosts, or they overlook the non-overlapping subnet requirement in AWS.

How to eliminate wrong answers

Option B is wrong because the web subnet /23 provides only 512 - 5 = 507 usable addresses, which is insufficient for 1000 hosts. Option C is wrong because it assigns the entire VPC CIDR /20 to all three tiers, causing overlapping subnets, which is invalid in AWS (subnets cannot overlap). Option D is wrong because the web subnet /24 provides only 256 - 5 = 251 usable addresses, far below the 1000-host requirement.

Full explanation →

214

MCQmedium

A company is designing a hybrid network architecture that connects its on-premises data center to AWS via AWS Direct Connect. The on-premises network uses BGP to advertise routes to AWS. The company wants to ensure that if the Direct Connect connection fails, traffic automatically fails over to a VPN connection. Which configuration ensures this failover behavior?

A.Advertise the on-premises prefixes over Direct Connect with a higher AS path prepend than over the VPN.

B.Advertise the on-premises prefixes over Direct Connect with a specific BGP community to influence path selection.

C.Advertise the on-premises prefixes over Direct Connect with a lower MED value than over the VPN.

D.Advertise the on-premises prefixes over Direct Connect with a higher local preference than over the VPN.

AnswerC

Lower MED makes Direct Connect preferred.

Why this answer

BGP uses the Multi-Exit Discriminator (MED) value to influence inbound path selection, where a lower MED is preferred. By advertising on-premises prefixes over Direct Connect with a lower MED than over the VPN, AWS will prefer the Direct Connect path under normal conditions. If the Direct Connect fails, the routes are withdrawn, and the VPN routes (with higher MED) become active, providing automatic failover.

Exam trap

The ANS-C01 exam often tests the misconception that local preference can be used to influence inbound traffic from AWS, but local preference is an outbound attribute that only affects route selection within your own AS, not how AWS selects the path back to you.

How to eliminate wrong answers

Option A is wrong because AS path prepend increases the AS path length, making the route less preferred; to prefer Direct Connect, you would use a shorter AS path (or no prepend) on Direct Connect and a longer AS path on the VPN, not the reverse. Option B is wrong because BGP communities are used to tag routes for policy actions (e.g., local preference, no-export) but do not directly influence path selection in a way that guarantees failover between Direct Connect and VPN; AWS does not interpret custom BGP communities to prefer one path over another by default. Option D is wrong because local preference is an outbound path attribute used to influence route selection within an AS, not for inbound traffic; AWS sets local preference on routes received from Direct Connect and VPN, and you cannot control it from on-premises—advertising a higher local preference over VPN would actually make the VPN path preferred, not Direct Connect.

Full explanation →

215

MCQmedium

A company is designing a hybrid network architecture that requires high availability and low latency between its on-premises data center and AWS. They have two redundant 1 Gbps AWS Direct Connect connections. The company wants to use BGP to advertise the same prefix from both locations to AWS. How should they configure the BGP attributes to ensure active/passive failover with automatic failback?

A.Prepend the AS path on the secondary connection's BGP advertisements

B.Set a higher MED value on the primary connection's BGP advertisements

C.Set a higher local preference on the secondary connection's BGP advertisements

D.Use BGP communities to tag routes and manipulate preference on AWS side

AnswerA

AS path prepending makes the secondary path less preferred; the primary will be used, and failover/failback occurs automatically.

Why this answer

AS path prepending on the secondary connection makes the BGP path longer, causing AWS to prefer the primary connection for inbound traffic. This achieves active/passive failover: if the primary fails, the shorter AS path on the secondary becomes preferred, and automatic failback occurs when the primary recovers and its shorter AS path is re-advertised.

Exam trap

The trap here is confusing BGP attributes that influence inbound vs. outbound traffic: candidates often incorrectly apply local preference (outbound) or MED (inbound but with different semantics) instead of AS path prepending, which is the standard method for controlling inbound path selection in a multi-homed BGP setup.

How to eliminate wrong answers

Option B is wrong because setting a higher MED on the primary connection would make it less preferred, which is the opposite of the desired active/passive behavior (primary should be preferred). Option C is wrong because local preference is used to influence outbound traffic from AWS to on-premises, not inbound traffic to AWS; higher local preference on the secondary would make it preferred, contradicting the active/passive design. Option D is wrong because BGP communities can tag routes for preference manipulation on the AWS side, but this requires AWS-side policy configuration and does not directly control inbound path selection from the on-premises perspective; AS path prepending is the standard method for influencing inbound traffic without relying on AWS-side policies.

Full explanation →

216

MCQhard

A company is designing a global application that will serve users across North America and Europe. The application consists of a static website hosted on Amazon S3, a REST API hosted on Amazon API Gateway, and a backend application running on EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The company wants to minimize latency for users by serving content from the closest AWS region. They also want to ensure high availability and automatic failover if a region becomes unavailable. The company is considering using Amazon Route 53 with a latency-based routing policy. However, they are concerned about DNS caching and propagation delays during failover. Which additional service should they use to improve the failover experience and provide a single endpoint for users?

A.Use a Network Load Balancer in each region and configure Route 53 with failover routing

B.Use Amazon CloudFront with multiple origins pointing to the S3 bucket and the ALB in each region

C.Use Lambda@Edge to dynamically route traffic based on the user's location

D.Use AWS Global Accelerator to provide a static IP address and route traffic to the ALB in the closest healthy region

AnswerD

Global Accelerator provides static IPs and fast failover using network layer routing.

Why this answer

AWS Global Accelerator uses the AWS global network to route traffic to the closest healthy endpoint via the Anycast static IP addresses, bypassing DNS caching and propagation delays. It provides a single fixed endpoint for users and integrates with the ALB in each region, automatically failing over to the next healthy region within seconds when health checks fail.

Exam trap

AWS often tests the misconception that CloudFront or DNS-based routing alone can solve latency and failover requirements for dynamic APIs, but Global Accelerator is the only service that provides static IPs and fast regional failover without DNS caching delays.

How to eliminate wrong answers

Option A is wrong because a Network Load Balancer does not provide a single global endpoint or improve DNS caching issues; Route 53 failover routing still relies on DNS TTLs, which can cause propagation delays during failover. Option B is wrong because CloudFront with multiple origins does not provide a single static IP endpoint for the REST API and backend; it is designed for content delivery, not for low-latency TCP/UDP traffic to dynamic APIs, and it still depends on DNS resolution for origin selection. Option C is wrong because Lambda@Edge is used for customizing CloudFront content and does not provide a static IP address or direct traffic to ALBs; it cannot replace the need for a global anycast network to minimize latency and ensure fast failover.

Full explanation →

217

MCQhard

A company is designing a hybrid network using AWS Direct Connect. They have two Direct Connect connections from different providers to two different AWS Direct Connect locations. They want to configure a virtual interface (VIF) that provides connectivity to multiple VPCs in the same region. Which type of VIF should they use?

A.Hosted virtual interface

B.Public virtual interface

C.Private virtual interface

D.Transit virtual interface

AnswerD

Transit VIF connects to Transit Gateway for multiple VPCs.

Why this answer

A transit virtual interface (VIF) is the correct choice because it is specifically designed to connect a Direct Connect gateway to a single physical connection, enabling connectivity to multiple VPCs in the same or different AWS Regions. Unlike a private VIF, which only connects to a single VPC, a transit VIF works with a Direct Connect gateway and supports up to 3,000 VPC attachments per gateway, making it ideal for multi-VPC architectures.

Exam trap

The ANS-C01 exam often tests the misconception that a private VIF can connect to multiple VPCs by using a Direct Connect gateway, but the private VIF is deprecated for that use case; only a transit VIF supports the Direct Connect gateway for multi-VPC connectivity.

How to eliminate wrong answers

Option A is wrong because a hosted virtual interface is provisioned by an AWS Direct Connect Partner for use with a hosted connection, not for connecting to multiple VPCs via a Direct Connect gateway. Option B is wrong because a public virtual interface provides access to AWS public services (e.g., S3, DynamoDB) over the internet, not private connectivity to VPCs. Option C is wrong because a private virtual interface connects to a single VPC only; it does not support multiple VPCs unless you use a Direct Connect gateway, which requires a transit VIF.

Full explanation →

218

MCQeasy

A company is deploying a new application in a VPC with public and private subnets. The application needs to access an S3 bucket in the same AWS Region. Which configuration provides the MOST secure and cost-effective connectivity?

A.Configure a proxy server in the public subnet to forward requests to S3.

B.Set up an AWS Direct Connect connection to S3.

C.Create a NAT gateway in the public subnet and route traffic through it.

D.Create an S3 Gateway Endpoint in the VPC and add a route to it.

AnswerD

Gateway Endpoint provides private, free access to S3 within same Region.

Why this answer

An S3 Gateway Endpoint allows private subnet resources to access S3 over the AWS network without traversing the internet, eliminating the need for a NAT gateway or proxy. This provides the most secure connectivity (no public exposure) and is cost-effective because there are no hourly or data processing charges for the endpoint itself, only standard S3 data transfer costs.

Exam trap

The ANS-C01 exam often tests the misconception that a NAT gateway is required for private subnet internet access, but for AWS services like S3 and DynamoDB, gateway endpoints provide a more secure and cost-effective alternative without internet egress.

How to eliminate wrong answers

Option A is wrong because a proxy server in a public subnet introduces an additional EC2 cost, management overhead, and a potential single point of failure, while still requiring traffic to traverse the internet. Option B is wrong because AWS Direct Connect is a dedicated network connection primarily for hybrid workloads and is significantly more expensive than a gateway endpoint, making it overkill for simple S3 access within the same region. Option C is wrong because a NAT gateway incurs hourly charges and data processing fees, and it routes traffic over the internet to reach S3, which is less secure and more costly than using a gateway endpoint.

Full explanation →

219

MCQmedium

A company is designing a multi-Region active-active application using Application Load Balancers (ALBs) in us-east-1 and eu-west-1, with Route 53 latency-based routing. Users report that after a failover, existing connections fail. What should the company implement to ensure seamless failover?

A.Use a Global Accelerator instead of Route 53

B.Enable client IP affinity on the ALBs

C.Use Amazon Route 53 geolocation routing instead of latency

D.Enable sticky sessions (session affinity) on the ALBs with a cookie duration

AnswerA

Correct. Global Accelerator provides a static anycast IP that does not change on failover, allowing clients to continue using the same IP and maintain existing connections. It also offers health checks and traffic shifting without breaking connections.

Why this answer

AWS Global Accelerator provides a static anycast IP address that remains constant during failover. Clients connect to the same IP, and the accelerator directs traffic to the healthy regional endpoint without breaking existing connections. Route 53 latency-based routing relies on DNS, which changes the resolved IP on failover, causing existing TCP connections to fail.

Sticky sessions (session affinity) on ALBs only persist within a single ALB and do not help when traffic is redirected to a different region. Therefore, Global Accelerator ensures seamless failover for existing connections.

Exam trap

The trap is to think that sticky sessions (session affinity) on ALBs can provide cross-region session persistence. In reality, ALB sticky session cookies are region-specific and not shared across regions; a cookie from one ALB is meaningless to another, so existing connections will still fail after a DNS failover. Global Accelerator maintains a constant anycast IP to avoid connection drops.

How to eliminate wrong answers

Option A is correct because Global Accelerator uses static anycast IP addresses and maintains connection state at the edge, allowing seamless failover without breaking existing connections. Option B is wrong because client IP affinity (sticky sessions) only ensures requests from the same client IP go to the same target, but it does not preserve TCP connections across ALBs in different regions during a DNS-level failover. Option C is wrong because geolocation routing does not improve connection persistence; it routes based on geographic location, which can cause even more abrupt failover issues and does not address existing connection drops.

Option D is wrong because sticky sessions on ALBs only work within a single ALB's target group; they do not preserve connections when traffic is redirected to a different ALB in another region via DNS change.

Full explanation →

220

Multi-Selecthard

A company has a hybrid network with an AWS Direct Connect connection and an AWS Site-to-Site VPN as a backup. The network team notices that traffic is asymmetrically routing through both connections, causing performance issues. Which TWO steps should the team take to ensure traffic uses the primary Direct Connect and only fails over to the VPN? (Choose two.)

Select 2 answers

A.Increase the BGP MED value on the VPN connection to make it less preferred.

B.Enable VPN automatic failover using AWS VPN CloudHub.

C.Configure BGP communities on the Direct Connect to influence route preference.

D.Disable AS path prepend on the Direct Connect BGP session.

E.Advertise a more specific prefix over Direct Connect compared to the VPN.

AnswersC, E

Configuring BGP communities on the Direct Connect connection allows you to influence the local preference, making routes learned via Direct Connect preferred over those from the VPN. This is a reliable method to ensure Direct Connect is the primary path.

Why this answer

BGP communities can be used on the Direct Connect connection to set a higher local preference, making the routes learned via Direct Connect preferred over those from the VPN. Option E is correct: Advertising a more specific prefix over Direct Connect ensures that traffic selects the more specific route, preferring Direct Connect. Option A is incorrect because increasing BGP MED on the VPN would make VPN less preferred, but this is not as effective or reliable as using BGP communities or more specific prefixes for ensuring primary use.

Option B is incorrect because AWS VPN CloudHub is designed for interconnecting multiple VPN sites, not for failover from Direct Connect to VPN. Option D is incorrect because disabling AS path prepend on Direct Connect would actually make Direct Connect more preferred (shorter AS path), but this is not a recommended step to ensure primary use; it may also disrupt existing routing policies. The best practice is to use BGP communities and specific prefix advertisements to achieve the desired traffic flow.

Full explanation →

221

MCQeasy

A network engineer is troubleshooting connectivity issues from an on-premises network to an AWS VPC over a Site-to-Site VPN. The VPN tunnel status shows as UP. The on-premises network can ping the virtual private gateway (VGW) IP address, but cannot reach EC2 instances inside the VPC. What is the most likely cause?

A.The VPN tunnel is not properly configured with the correct pre-shared key.

B.The security groups on the EC2 instances are blocking inbound traffic from the on-premises network.

C.The virtual private gateway has its own security group that blocks traffic.

D.The VPC route tables do not have a route to the on-premises network pointing to the virtual private gateway.

AnswerD

Without a route back, return traffic is dropped.

Why this answer

The VPC route tables must have a route to the on-premises network pointing to the virtual private gateway (VGW) for traffic to reach the EC2 instances. Without this route, the VPC has no way to send return traffic or allow inbound traffic from on-premises. Option A is incorrect because the VPN tunnel status is UP, indicating the pre-shared key is correct.

Option B is plausible but less likely; security groups can block traffic, but they are stateful and automatically allow return traffic. The first step in troubleshooting is to verify routes. Option C is incorrect because the VGW does not have security groups; it uses route tables for forwarding decisions.

Full explanation →

222

MCQhard

A financial services company has a multi-account AWS environment using AWS Organizations. They have a central security account with AWS Network Firewall and a central inspection VPC. All other VPCs are connected to the inspection VPC via AWS Transit Gateway. The company wants to enforce that all traffic between VPCs (east-west) and traffic to the internet (north-south) passes through the Network Firewall. They have configured the Transit Gateway route tables appropriately. However, they notice that traffic from an application VPC to another application VPC is not being inspected. The network engineer has verified that the application VPCs have a default route to the Transit Gateway, and the Transit Gateway route table has a route for the inspection VPC. What is the most likely reason that east-west traffic is bypassing the Network Firewall?

A.The Transit Gateway route tables allow direct communication between application VPCs

B.The inspection VPC does not have a subnet for east-west traffic

C.Network Firewall cannot inspect traffic between VPCs at high throughput

D.Network Firewall is not stateful and cannot handle return traffic

AnswerA

If routes exist for direct VPC-to-VPC traffic, it will bypass inspection.

Why this answer

The most likely reason east-west traffic is bypassing the Network Firewall is that the Transit Gateway route tables allow direct communication between application VPCs. For traffic to be inspected, it must be routed through the inspection VPC. If the application VPCs have routes in the same Transit Gateway route table that point directly to each other (e.g., a static route or a propagated route from the same VPC attachment), traffic will take that direct path and bypass the Network Firewall.

Option B is incorrect because the inspection VPC can have subnets for east-west traffic; the issue is routing, not subnet design. Option C is incorrect because Network Firewall can inspect traffic between VPCs at high throughput. Option D is incorrect because Network Firewall is stateful and handles return traffic correctly.

Full explanation →

223

Drag & Dropmedium

Arrange the steps to configure BGP on a Cisco router for a Direct Connect private virtual interface:

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

First enter config mode, enable BGP, define the neighbor, advertise prefixes, then verify.

Full explanation →

224

MCQeasy

A company is setting up a new VPC with both IPv4 and IPv6 support. They need to ensure that instances in a private subnet can access the Internet for software updates. Which combination of resources is required?

A.VPC endpoint and internet gateway

B.NAT gateway and egress-only internet gateway

C.NAT instance and internet gateway

D.Internet gateway and NAT gateway

AnswerB

NAT for IPv4, egress-only for IPv6.

Why this answer

For IPv6 traffic, an egress-only internet gateway allows outbound-only internet access from private subnets, while a NAT gateway provides similar functionality for IPv4 traffic. Together, they enable instances in a private subnet to initiate outbound connections to the internet for software updates without allowing inbound connections from the internet.

Exam trap

The ANS-C01 exam often tests the misconception that an internet gateway can be used for both IPv4 and IPv6 outbound-only access from private subnets, but in reality, an internet gateway allows bidirectional traffic and requires public IPs, whereas an egress-only internet gateway is specifically designed for outbound-only IPv6 traffic from private subnets.

How to eliminate wrong answers

Option A is wrong because a VPC endpoint provides private connectivity to AWS services, not general internet access, and an internet gateway alone does not support outbound-only access from private subnets. Option C is wrong because a NAT instance can provide outbound IPv4 access, but an internet gateway does not provide outbound-only IPv6 access; an egress-only internet gateway is required for IPv6. Option D is wrong because an internet gateway is used for public subnets and would allow inbound traffic, while a NAT gateway handles IPv4 outbound traffic; this combination lacks the egress-only internet gateway needed for IPv6 outbound access.

Full explanation →

225

MCQeasy

A company wants to encrypt data in transit between an on-premises data center and AWS. Which service provides a dedicated encrypted connection?

A.AWS Transit Gateway

B.AWS Direct Connect with MACsec

C.AWS Site-to-Site VPN

D.AWS Client VPN

AnswerB

Direct Connect provides a dedicated connection with encryption.

Why this answer

AWS Direct Connect with MACsec provides a dedicated encrypted connection. Option A is wrong because AWS Transit Gateway is a network transit hub, not a connection type. Option C is wrong because AWS Site-to-Site VPN operates over the internet and is not dedicated.

Option D is wrong because AWS Client VPN is for individual users and not a dedicated connection.

Full explanation →

AWS Certified Advanced Networking Specialty ANS-C01 (ANS-C01) — Questions 151–225