Knowledge + Practice

AWS Certified Advanced Networking Specialty ANS-C01 (ANS-C01) — Questions 226–300

1621 questions total · 22pages · All types, answers revealed

Take a mock exam Exam hub

Page 4 of 22

226

MCQmedium

A company is using AWS Direct Connect with a private VIF to connect to a VPC. They want to ensure high availability by having a second Direct Connect connection. Which configuration provides the most resilient setup?

A.Two Direct Connect connections from the same provider to the same Direct Connect location with separate VIFs.

B.Two Direct Connect connections from different providers to different Direct Connect locations.

C.One Direct Connect connection and one Site-to-Site VPN as backup.

D.One Direct Connect connection with two private VIFs.

AnswerB

Diverse paths provide maximum resilience.

Why this answer

Using two Direct Connect connections from different providers to different AWS Direct Connect locations eliminates single points of failure. A single provider outage or location failure will not disrupt connectivity. Option A is incorrect because two connections from the same provider to the same location share the same physical infrastructure, so a single failure can affect both.

Option C is incorrect because a Site-to-Site VPN backup typically offers lower bandwidth and higher latency compared to Direct Connect, and it relies on the public internet, which is less reliable than a dedicated connection. Option D is incorrect because two private VIFs on a single Direct Connect connection still share the same physical link; a link failure impacts both VIFs.

Full explanation →

227

MCQmedium

A company has a VPC with a CIDR of 10.0.0.0/16. They want to create a subnet that can host at least 2000 EC2 instances. Which subnet size should they choose?

A./21

B./22

C./24

D./20

AnswerA

Provides 2048 IPs, enough for 2000 instances.

Why this answer

A /21 subnet provides 2,048 usable IP addresses (2^(32-21) - 5 = 2,048 - 5 = 2,043 for AWS, but the key is that 2,048 total addresses minus the 5 reserved by AWS yields 2,043, which exceeds the requirement of 2,000 EC2 instances). AWS reserves 5 IP addresses per subnet (network, VPC router, DNS, future use, broadcast), so the usable count is total addresses minus 5. A /21 is the smallest subnet that meets the 2,000-instance requirement.

Exam trap

AWS often tests the misconception that you only need to consider total IP addresses (e.g., /22 gives 1,024, which seems close to 2,000) without accounting for AWS's 5 reserved addresses, or that a larger subnet like /20 is automatically better, ignoring the principle of choosing the smallest subnet that meets the requirement.

How to eliminate wrong answers

Option B (/22) is wrong because it provides only 1,024 total IP addresses, yielding 1,019 usable after AWS reserves 5, which is insufficient for 2,000 instances. Option C (/24) is wrong because it provides only 256 total IP addresses, yielding 251 usable, far below the requirement. Option D (/20) is wrong because although it provides 4,096 total IP addresses (4,091 usable) and would technically work, it is larger than necessary; the question asks which subnet size they should choose, implying the most efficient size that meets the requirement, and /21 is the smallest that satisfies it.

Full explanation →

228

MCQmedium

A network engineer is monitoring network performance between an EC2 instance and an on-premises server using AWS VPN. The engineer notices intermittent packet loss. Which AWS service can provide detailed network metrics and path visualization to troubleshoot?

A.Amazon CloudWatch

B.VPC Flow Logs

C.AWS Transit Gateway Network Manager

D.AWS X-Ray

AnswerC

Network Manager provides topology and monitoring for VPN and Direct Connect.

Why this answer

AWS X-Ray is for application tracing, not network path. VPC Flow Logs provide packet metadata but not path visualization. Amazon CloudWatch can monitor VPN tunnels but not path.

AWS Transit Gateway Network Manager provides network topology and path visualization.

Full explanation →

229

MCQeasy

A security team needs to audit all network traffic entering and leaving a VPC. Which AWS service should be used to capture IP traffic information?

A.VPC Flow Logs

B.AWS Config

C.Amazon CloudWatch Logs

D.AWS CloudTrail

AnswerA

VPC Flow Logs capture IP traffic information.

Why this answer

VPC Flow Logs capture IP traffic information for network interfaces in a VPC, allowing auditing of all network traffic. Option B is wrong because AWS Config records resource configuration changes, not network traffic. Option C is wrong because Amazon CloudWatch Logs can store and monitor logs but does not capture network traffic.

Option D is wrong because AWS CloudTrail records API calls, not network traffic.

Full explanation →

230

Multi-Selectmedium

A network engineer is troubleshooting a VPN connectivity issue. The VPN tunnel is up, but traffic is not passing. Which TWO AWS services should the engineer use to diagnose the problem?

Select 2 answers

A.AWS Config

B.VPC Flow Logs

C.AWS CloudTrail

D.AWS Direct Connect

E.Amazon CloudWatch

AnswersB, E

Flow Logs can show traffic flow to the VPN endpoint.

Why this answer

The correct answers are B and E. VPC Flow Logs capture IP traffic information for network interfaces, which can show if traffic is reaching the VPN endpoint. Amazon CloudWatch provides VPN tunnel metrics (e.g., tunnel state, data in/out) and logs, helping to diagnose connectivity issues.

Option A (AWS Config) is incorrect because it tracks resource configuration changes, not network traffic. Option C (AWS CloudTrail) is incorrect because it logs API calls, not data plane traffic. Option D (AWS Direct Connect) is incorrect because it is a dedicated connection service, not a diagnostic tool for VPN.

Full explanation →

231

MCQmedium

A company is deploying an AWS Network Firewall in a centralized inspection VPC to inspect traffic between VPCs connected to an AWS Transit Gateway. The architecture uses Transit Gateway route tables to send inter-VPC traffic through the inspection VPC. The Network Firewall is configured with stateful and stateless rule groups. After deployment, the security team notices that traffic from VPC A to VPC B is being dropped. Other traffic flows correctly. What is the MOST likely cause of this issue?

A.The route table for VPC A's subnets does not have a route to the inspection VPC.

B.The stateless rule group is set to forward traffic, but the stateful rule group is not configured to allow the traffic.

C.The stateful rule group is configured to drop all traffic that is not explicitly allowed.

D.The security group attached to the Transit Gateway is blocking the traffic.

AnswerB

Correct. AWS Network Firewall processes stateless rules first. If the stateless rule group is set to forward traffic, the stateful rule group must explicitly allow it. If the stateful rule group has no matching allow rule, the traffic is dropped, which explains why only traffic from VPC A to VPC B is affected.

Why this answer

In AWS Network Firewall, stateless rule groups evaluate traffic first. If the stateless rule group is set to 'forward' (i.e., pass traffic to the stateful engine), the stateful rule group must then explicitly allow the traffic. If the stateful rule group is not configured to allow the traffic (e.g., it has no matching allow rule or has a default drop), the traffic will be dropped.

This explains why only traffic from VPC A to VPC B is dropped while other flows work, as the issue is specific to the stateful rule group's handling of that particular flow.

Exam trap

The trap here is that candidates often assume stateless rules are the sole cause of dropped traffic, overlooking that stateful rule groups have their own default actions (typically drop) that can silently block forwarded traffic, especially when the stateless rule group is set to 'forward' but the stateful rules are incomplete.

How to eliminate wrong answers

Option A is wrong because if VPC A's subnets lacked a route to the inspection VPC, no traffic from VPC A would reach the Transit Gateway or the inspection VPC, causing all traffic from VPC A to fail, not just traffic to VPC B. Option C is wrong because a stateful rule group configured to drop all traffic not explicitly allowed is a valid design; however, the question states that other traffic flows correctly, implying that the stateful rule group does allow some traffic, so the issue is not a blanket drop but rather a missing allow rule for the specific VPC A-to-VPC B flow. Option D is wrong because Transit Gateway does not have security groups; security groups are attached to ENIs (e.g., in VPCs) or to resources like EC2 instances, not to Transit Gateway attachments, so this option describes a non-existent configuration.

Full explanation →

232

Multi-Selectmedium

A company is designing a multi-VPC architecture using AWS Transit Gateway. They need to ensure that traffic between VPCs is encrypted and that only specific VPCs can communicate with each other. Which two services should they use together? (Choose TWO.)

Select 2 answers

A.AWS PrivateLink

B.AWS Direct Connect

C.AWS Transit Gateway

D.AWS VPN CloudHub

E.AWS Network Firewall

AnswersC, E

AWS Transit Gateway provides transitive routing between VPCs, forming the connectivity backbone.

Why this answer

AWS Transit Gateway provides transitive routing between VPCs, enabling scalable connectivity. AWS Network Firewall provides centralized stateful inspection and filtering of traffic between VPCs, allowing you to enforce policies that require traffic to be encrypted (e.g., by blocking non-encrypted flows). While Network Firewall itself does not perform encryption, it can inspect and drop unencrypted traffic to meet encryption requirements.

Full explanation →

233

MCQmedium

A company uses AWS Shield Advanced and AWS WAF to protect its web application. The security team notices that some legitimate traffic is being blocked. They want to allow traffic from a specific set of IP addresses used by their partners. How can they ensure that partner traffic is not blocked by WAF rules?

A.Add the partner IPs to a Network ACL allow rule in the VPC.

B.Remove the blocking WAF rules and rely on Shield Advanced only.

C.Add the partner IPs to an AWS Shield Advanced IP whitelist.

D.Create a WAF IP set and add a rule to allow traffic from that IP set, with a higher priority than blocking rules.

AnswerD

This ensures partner traffic is allowed before it reaches blocking rules.

Why this answer

AWS WAF allows you to create an IP set containing the partner IP addresses and then add a rule with a higher priority than the blocking rules to allow traffic from that IP set. This ensures that partner traffic is explicitly allowed even if other rules would block it. Option A is incorrect because Network ACLs operate at the subnet level and are not evaluated by AWS WAF for application-layer traffic; they also do not have a whitelist feature within WAF.

Option B is incorrect because removing blocking rules would leave the application vulnerable; Shield Advanced provides DDoS protection but does not replace WAF rule logic. Option C is incorrect because AWS Shield Advanced does not have an IP whitelist feature; it focuses on mitigating DDoS attacks, not on application-layer allowlisting.

Full explanation →

234

MCQeasy

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download software patches from the internet. Which AWS service should be used to provide outbound internet access without allowing inbound traffic?

A.Site-to-Site VPN connection

B.VPC endpoint

C.NAT gateway

D.Internet gateway

AnswerC

A NAT gateway, deployed in the public subnet with an Elastic IP, enables EC2 instances in the private subnet to initiate outbound connections to the internet for patch downloads while its stateful translation drops all unsolicited inbound traffic, satisfying the requirement for outbound-only internet access.

Why this answer

A NAT gateway enables EC2 instances in a private subnet to initiate outbound IPv4 traffic to the internet (e.g., to download patches) while preventing any unsolicited inbound traffic from the internet. It resides in a public subnet with an Elastic IP and performs source network address translation (SNAT), replacing the private source IP with the gateway's public IP. This satisfies the requirement of outbound-only internet access without exposing the private instances to inbound connections.

Exam trap

The trap here is that candidates often confuse a NAT gateway with an internet gateway, thinking an internet gateway can be configured to block inbound traffic, but an internet gateway is a stateful device that inherently allows bidirectional traffic once attached to a subnet, whereas a NAT gateway explicitly prevents unsolicited inbound connections.

How to eliminate wrong answers

Option A is wrong because a Site-to-Site VPN connection establishes encrypted tunnels between the VPC and an on-premises network, not direct internet access; it does not provide a path to the public internet for patch downloads. Option B is wrong because a VPC endpoint (Gateway or Interface) provides private connectivity to AWS services (e.g., S3, DynamoDB) over the AWS network, not to the general internet; it cannot reach arbitrary internet hosts for software patches. Option D is wrong because an internet gateway allows bidirectional traffic; attaching it to a private subnet would expose the EC2 instance to inbound connections from the internet, violating the requirement to block inbound traffic.

Full explanation →

235

MCQhard

A company is using AWS Client VPN for remote access. Users can authenticate and establish a VPN connection, but they cannot access resources in the VPC. The Client VPN endpoint is associated with a subnet in the VPC. The security group for the Client VPN endpoint allows all traffic. What is the most likely cause?

A.There is no authorization rule to allow access to the VPC CIDR.

B.The Client VPN endpoint is not associated with the correct subnet.

C.The route table for the subnet does not have a route to the Client VPN endpoint.

D.The Client VPN endpoint's server certificate is expired.

AnswerA

Authorization rules define which networks VPN clients can access; without it, traffic is blocked.

Why this answer

AWS Client VPN requires an authorization rule to specify which networks clients can access. Without an authorization rule allowing access to the VPC CIDR, traffic from clients is dropped even if the security group allows all traffic. The endpoint is associated with a subnet, so option B is incorrect.

The subnet's route table automatically has a route for the VPC CIDR locally, so option C is incorrect. Since users can authenticate and establish a connection, the server certificate is valid, making option D incorrect.

Full explanation →

236

MCQhard

A company is expanding its on-premises network to AWS using Direct Connect and VPN backup. They have two Direct Connect connections from different providers to two different Direct Connect locations in the same region. They have configured a private virtual interface (VIF) on each connection to a virtual private gateway (VGW) attached to a VPC. They have also configured a VPN connection as a backup. The company uses BGP to advertise the on-premises prefixes to AWS. They want to ensure that traffic is load-balanced across both Direct Connect connections under normal conditions and that the VPN is used only if both Direct Connect connections fail. They also want to minimize the cost of data transfer. Which BGP configuration should they use?

A.Configure a single BGP session over both Direct Connect connections using the same virtual interface

B.Advertise the same prefixes over both Direct Connect connections with equal local preference, and prepend AS path on the VPN routes to make them less preferred

C.Set a higher MED on one of the Direct Connect connections to make it the primary, and use the VPN as secondary

D.Advertise different on-premises prefixes over each Direct Connect connection and use the VPN for all traffic

AnswerB

Equal local preference allows load balancing; AS path prepending makes VPN less preferred.

Why this answer

By advertising the same prefixes over both Direct Connect connections with equal local preference, traffic is load-balanced across both connections under normal conditions. AS path prepending on VPN routes makes the VPN less preferred than Direct Connect, so the VPN is used only when both Direct Connect connections fail. This configuration also minimizes cost by preferring Direct Connect over VPN.

Option A is incorrect because a single BGP session over one Direct Connect connection creates a single point of failure. Option C is incorrect because setting a higher MED on one Direct Connect connection makes it less preferred, resulting in active/passive rather than load-balanced traffic. Option D is incorrect because advertising different prefixes over each connection does not load-balance traffic; it routes different destinations through each connection.

Full explanation →

237

MCQmedium

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The network team notices intermittent packet loss and latency spikes during peak hours. Which action should the team take to diagnose the issue?

A.Increase the bandwidth of the Direct Connect connection

B.Enable Bidirectional Forwarding Detection (BFD) on the virtual interfaces

C.Apply a tag to the Direct Connect connection for monitoring

D.Change the private ASN on the customer router

AnswerB

Enabling Bidirectional Forwarding Detection (BFD) on the virtual interfaces allows rapid detection of connectivity failures, which can help isolate whether the issue is on the AWS side or the customer side.

Why this answer

Enabling Bidirectional Forwarding Detection (BFD) on the virtual interfaces allows rapid detection of connectivity failures, which can help isolate whether the issue is on the AWS side or the customer side. Option A is wrong because increasing bandwidth may not resolve intermittent issues caused by routing problems. Option C is wrong because tagging does not impact network performance.

Option D is wrong because changing the private ASN does not affect performance.

Full explanation →

238

MCQmedium

A company has a Direct Connect connection with a public virtual interface (VIF) to access AWS public services. They want to ensure that all traffic to Amazon S3 from on-premises uses the Direct Connect connection instead of the internet. Which configuration is required?

A.Establish a VPN connection over the Direct Connect private VIF and route S3 traffic through the VPN.

B.Use the public virtual interface and configure a route filter to only accept routes for the S3 service.

C.Create a private virtual interface and attach it to the VPC.

D.Create a Direct Connect gateway and associate the public VIF with it.

AnswerB

A public VIF provides access to AWS public services, and route filters can restrict which prefixes are advertised.

Why this answer

A public virtual interface (VIF) provides direct connectivity to AWS public services, including Amazon S3, over the Direct Connect link. By default, the public VIF advertises a default route or specific AWS public prefixes; you must configure a route filter to accept only the S3 service prefixes (e.g., from the S3 service-specific prefix list) to ensure all S3 traffic uses the Direct Connect connection instead of the internet. This prevents any other public traffic from using the link and enforces the desired routing behavior.

Exam trap

The trap here is that candidates often confuse public VIFs with private VIFs, assuming a private VIF is needed for any AWS service access, or they think a VPN or Direct Connect gateway is required to secure or direct S3 traffic, when in fact a public VIF with proper route filtering is the correct and simplest solution.

How to eliminate wrong answers

Option A is wrong because establishing a VPN over a private VIF would route traffic through a VPN tunnel, adding unnecessary overhead and complexity; it does not leverage the public VIF's native access to AWS public services, and S3 traffic would still need to traverse the VPN, not the Direct Connect public path. Option C is wrong because a private virtual interface connects to a VPC for private IP communication, not to AWS public services like S3; attaching it to a VPC would not provide access to S3 endpoints. Option D is wrong because a Direct Connect gateway is used to associate private virtual interfaces with multiple VPCs or transit gateways, not to control routing for a public VIF; associating a public VIF with a Direct Connect gateway is not a supported configuration.

Full explanation →

239

MCQmedium

A company wants to audit all changes made to security groups and network ACLs in its AWS account. Which AWS service should be used to capture these API calls?

A.AWS CloudTrail

B.Amazon GuardDuty

C.VPC Flow Logs

D.AWS Config

AnswerA

CloudTrail logs API calls for auditing.

Why this answer

AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including those that modify security groups and network ACLs. By enabling CloudTrail, you can capture CreateSecurityGroup, AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress, CreateNetworkAclEntry, and similar API calls, providing an audit trail of who made the change, when, and from which IP address.

Exam trap

The trap here is that candidates often confuse AWS Config (which tracks configuration state) with CloudTrail (which tracks API actions), but the question explicitly asks for capturing the API calls themselves, not the resulting configuration changes.

How to eliminate wrong answers

Option B (Amazon GuardDuty) is wrong because it is a threat detection service that monitors for malicious activity using anomaly detection and threat intelligence, not a service that captures API call logs for auditing changes. Option C (VPC Flow Logs) is wrong because it captures IP traffic metadata (source/destination IP, ports, protocol) at the network interface level, not API calls that modify security group or network ACL configurations. Option D (AWS Config) is wrong because it evaluates resource configurations against desired policies and tracks configuration changes over time, but it does not directly capture the API calls that initiated those changes; it records the resulting state, not the action itself.

Full explanation →

240

MCQeasy

A company is designing a disaster recovery solution that requires replicating data from an on-premises database to an Amazon RDS instance in a different AWS region. The data transfer must be encrypted in transit and should not traverse the public internet. Which approach meets these requirements?

A.Use an AWS Direct Connect connection with public VIF

B.Establish an AWS Site-to-Site VPN over an AWS Direct Connect connection

C.Establish an AWS Site-to-Site VPN over the internet

D.Use VPC Peering between the on-premises network and the RDS VPC

AnswerB

Correct; this provides encryption and uses a private connection.

Why this answer

An AWS Site-to-Site VPN over an AWS Direct Connect connection provides encrypted IPsec tunnels for data in transit while keeping traffic entirely within the private network, avoiding the public internet. The Direct Connect private VIF establishes a dedicated private link to AWS, and the VPN overlay adds encryption, meeting both requirements for an on-premises to RDS cross-region replication scenario.

Exam trap

The trap here is that candidates often assume a Direct Connect public VIF (Option A) provides encryption because it is a private circuit, but it does not encrypt the payload; only a VPN overlay or dedicated encrypted transport (e.g., MACsec) satisfies the encryption requirement.

How to eliminate wrong answers

Option A is wrong because a public VIF on Direct Connect provides access to public AWS services (e.g., S3, DynamoDB) but does not inherently encrypt traffic; data would traverse the Direct Connect link without IPsec encryption, failing the encryption-in-transit requirement. Option C is wrong because an AWS Site-to-Site VPN over the internet uses the public internet as the transport medium, which violates the requirement that data should not traverse the public internet. Option D is wrong because VPC Peering is used to connect VPCs within AWS and cannot extend to an on-premises network; it does not support on-premises connectivity and does not provide encryption by default.

Full explanation →

241

Multi-Selectmedium

A company wants to connect its on-premises network to AWS using AWS Direct Connect. The company has two data centers, each with a redundant connection to an AWS Direct Connect location. The company wants to ensure high availability and failover capability. Which THREE steps should be taken?

Select 3 answers

A.Configure a VPN connection as a backup in case Direct Connect fails.

B.Order at least two Direct Connect connections from different providers or locations.

C.Configure BGP sessions over each Direct Connect connection.

D.Use a Direct Connect gateway to connect to multiple VPCs.

E.Provision multiple virtual interfaces on a single Direct Connect connection.

AnswersB, C, D

Multiple connections ensure redundancy if one fails.

Why this answer

Ordering at least two Direct Connect connections from different providers or locations ensures physical diversity, eliminating single points of failure. This aligns with AWS best practices for high availability, as a single connection or provider can fail due to outages or maintenance. Redundant connections from separate providers or locations provide independent failure domains.

Exam trap

The trap here is that candidates often assume multiple virtual interfaces on a single connection provide redundancy, but they fail to recognize that the underlying physical link is a single point of failure, so true high availability requires physically diverse connections.

Full explanation →

242

MCQhard

A network engineer troubleshoots a VPN connection that shows 'available' state but traffic is not passing. The on-premises firewall logs show that the tunnel is established, but no traffic. The engineer checks the VPN configuration. Based on the exhibit, what is the MOST likely cause of the problem?

A.The VPN connection is not in 'available' state.

B.The VPN is configured for BGP (StaticRoutesOnly: false), but only a static route is added.

C.The outside IP addresses are not routable over the internet.

D.The inside IP addresses for the tunnels are missing.

AnswerB

With StaticRoutesOnly: false, BGP is required for route propagation; static routes are ignored.

Why this answer

The VPN connection has `StaticRoutesOnly` set to `false`, which indicates that dynamic routing (BGP) is expected for route propagation. However, the route shown is a static route, so the VPN will not use it, as BGP is required. Without a proper BGP session or a static route with `StaticRoutesOnly` set to `true`, traffic cannot pass through the VPN.

Option A is incorrect because the VPN state is indeed 'available'. Option C is incorrect because the outside IP addresses are routable over the internet. Option D is incorrect because the inside IP addresses (tunnel interfaces) are present in the configuration.

Full explanation →

243

Multi-Selecthard

A company has a Direct Connect connection with a private VIF to a VPC. They want to add a second Direct Connect connection for redundancy. Both connections will terminate at the same Direct Connect gateway. Which TWO steps are required to enable BGP multipath (ECMP) across the two connections?

Select 2 answers

A.Ensure the same customer-side ASN is used on both virtual interfaces.

B.Use a different autonomous system number (ASN) on each virtual interface.

C.Advertise different BGP prefixes on each virtual interface.

D.Advertise the same BGP prefixes (routes) on both virtual interfaces.

E.Attach each virtual interface to a different VPC.

AnswersA, D

Same ASN is required for ECMP.

Why this answer

To enable BGP multipath (ECMP) across two Direct Connect connections terminating on the same Direct Connect gateway, you must use the same customer-side ASN on both virtual interfaces. This allows the Direct Connect gateway to treat both paths as equal-cost routes. Additionally, you must advertise the same BGP prefixes on both virtual interfaces so that the gateway sees identical routes from both paths and can load-balance traffic across them.

Exam trap

AWS often tests the misconception that using different ASNs or different prefixes is required for redundancy, but the key to ECMP is identical ASN and identical prefixes to enable equal-cost multipath routing.

Full explanation →

244

MCQhard

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16 and needs to connect to an on-premises network via AWS Direct Connect. The on-premises network uses 10.0.0.0/16. Which solution allows connectivity without IP overlap?

A.Establish a VPC peering connection between the VPC and on-premises network.

B.Use AWS Direct Connect with a private VIF and static routes to route traffic.

C.Create a new VPC with a non-overlapping CIDR, connect both VPCs via Transit Gateway, and use NAT on the Transit Gateway attachment to the on-premises network.

D.Deploy a NAT instance in the VPC to translate on-premises IPs.

AnswerC

Transit Gateway with NAT attachment allows IP translation to resolve overlap.

Why this answer

When both the VPC and on-premises network use the same 10.0.0.0/16 CIDR, direct connectivity is impossible due to overlapping IP ranges. By creating a new VPC with a non-overlapping CIDR, connecting both VPCs via Transit Gateway, and applying NAT on the Transit Gateway attachment to the on-premises network, traffic from the original VPC can be source-NATed to the new VPC's range before being forwarded to on-premises, resolving the overlap. This allows the on-premises network to receive traffic with unique IPs, avoiding routing conflicts.

Exam trap

The ANS-C01 exam often tests the misconception that Direct Connect alone can handle overlapping IPs by using static routes or BGP communities, but without NAT or address translation, overlapping CIDRs cause asymmetric routing and unreachability.

How to eliminate wrong answers

Option A is wrong because VPC peering is used for connecting two VPCs within AWS, not for connecting a VPC to an on-premises network, and it cannot resolve IP overlap. Option B is wrong because Direct Connect with a private VIF and static routes does not address the IP overlap; if both sides use 10.0.0.0/16, routes will conflict and traffic will be unreachable. Option D is wrong because a NAT instance in the VPC translates on-premises IPs (destination NAT), but the fundamental issue is that the VPC and on-premises networks share the same CIDR, so return traffic from on-premises cannot be routed back correctly without also translating the VPC's source IPs, which a single NAT instance cannot fully resolve in a scalable manner.

Full explanation →

245

MCQhard

A company runs a critical application on EC2 instances in a VPC with a single private subnet (10.0.1.0/24) in us-east-1a. The instances need to download security updates from the internet. The company currently uses a NAT Gateway in a public subnet (10.0.0.0/24) in us-east-1a. Recently, an Availability Zone failure caused us-east-1a to become unavailable, and the application could not reach the internet. The company wants to redesign the network to be highly available across multiple AZs for internet access. The application must continue to use private IP addresses for outbound traffic. The company has a limited budget and wants to minimize costs while meeting high availability. Which solution should the company implement?

A.Deploy one NAT Gateway in a new public subnet in us-east-1b and update the private subnet route table to use it.

B.Remove the NAT Gateway and attach an internet gateway to the VPC. Add a route in the private subnet route table pointing 0.0.0.0/0 to the internet gateway.

C.Deploy a NAT Gateway in each of two AZs (us-east-1a and us-east-1b) in public subnets. Create private subnets in both AZs with separate route tables pointing to the local NAT Gateway.

D.Replace the NAT Gateway with a NAT instance in a public subnet in us-east-1a and configure a secondary ENI in us-east-1b for failover.

AnswerC

Multi-AZ NAT Gateways provide high availability with automatic failover.

Why this answer

It ensures high availability for outbound internet traffic by deploying a NAT Gateway in each of two Availability Zones (us-east-1a and us-east-1b) with separate private subnets and route tables. This design eliminates the single point of failure; if one AZ fails, the other NAT Gateway continues to route traffic. The application retains private IP addresses for outbound traffic, and the cost is minimized by using only two NAT Gateways (one per AZ) rather than a more expensive multi-AZ architecture like a transit gateway or VPN.

Exam trap

The trap here is that candidates often think a single NAT Gateway in a different AZ (Option A) provides high availability, but they miss that a NAT Gateway is AZ-scoped and cannot fail over to another AZ automatically, so a single NAT Gateway remains a single point of failure.

How to eliminate wrong answers

Option A is wrong because deploying a single NAT Gateway in us-east-1b still creates a single point of failure; if us-east-1b fails, internet access is lost. Option B is wrong because attaching an internet gateway directly to a private subnet would assign public IP addresses to the instances, violating the requirement to use private IP addresses for outbound traffic; internet gateways only work with public subnets and public IPs. Option D is wrong because using a NAT instance with a secondary ENI in another AZ for failover is more complex, less reliable (manual or scripted failover), and typically more expensive than managed NAT Gateways; NAT instances also require ongoing patching and management, contradicting the limited budget and high availability goals.

Full explanation →

246

MCQhard

The EC2 instance has a private IP 10.0.1.5. The first two hops are 10.0.1.1 (the subnet's default gateway) and 10.0.0.1. Based on the traceroute, what is the most likely configuration of the VPC?

A.The subnet is a public subnet with a route to an Internet Gateway

B.The subnet is a private subnet with no route to an Internet Gateway, and the default route points to a NAT instance or is missing

C.The subnet is a private subnet with a route to a NAT Gateway

D.The subnet is connected to a VPN

AnswerB

Traffic stops at VPC router, indicating no internet path.

Why this answer

The traceroute shows the first hop as 10.0.1.1 (the subnet's default gateway) and the second hop as 10.0.0.1 (the VPC router's IP for the main route table). The absence of a third hop to a public IP or NAT device indicates that the instance's traffic is not being forwarded beyond the VPC router. This is consistent with a private subnet that has no route to an Internet Gateway and either has no default route or a default route pointing to a NAT instance that is not responding or is missing, causing the traceroute to stop at the VPC router.

Exam trap

The trap here is that candidates often assume a private subnet must have a NAT Gateway or NAT instance for outbound traffic, but the traceroute's lack of a third hop indicates that either no NAT device exists or the default route is missing entirely, not that a NAT device is present but unresponsive.

How to eliminate wrong answers

Option A is wrong because if the subnet were public with a route to an Internet Gateway, the traceroute would show a third hop to the Internet Gateway's public IP or beyond, not stop at 10.0.0.1. Option C is wrong because a private subnet with a route to a NAT Gateway would show a third hop to the NAT Gateway's private IP (e.g., 10.0.0.100) before reaching the Internet, not stop at the VPC router. Option D is wrong because a VPN connection would route traffic through a Virtual Private Gateway, which would appear as a hop with a private IP in the VPC's CIDR range (e.g., 10.0.0.2) and then to the on-premises network, not stop at 10.0.0.1.

Full explanation →

247

MCQmedium

A company is designing a multi-region active-active application using Application Load Balancers (ALBs) behind AWS Global Accelerator. The application uses Aurora MySQL global database. Which design should be used to minimize cross-region latency for writes?

A.Use Route 53 latency-based routing with a single ALB in the primary region.

B.Use Amazon CloudFront with origins in both regions and cache invalidation for writes.

C.Use Global Accelerator with a single ALB endpoint in one region and failover to the second region.

D.Deploy an ALB in each region with a Global Accelerator endpoint group containing both ALBs.

AnswerD

Global Accelerator with two endpoints provides active-active, anycast routing to the nearest region.

Why this answer

Deploying an ALB in each region and adding both to a Global Accelerator endpoint group enables active-active traffic distribution with optimal path routing via the AWS global network. Global Accelerator uses Anycast IPs to direct user traffic to the nearest healthy endpoint, minimizing latency. For writes to an Aurora MySQL global database, the primary region handles all write operations, but Global Accelerator ensures that write requests are routed to the primary region's ALB with the lowest possible latency from the client's location, while read traffic can be served locally from the secondary region's ALB.

Exam trap

The trap here is that candidates often assume Global Accelerator only supports active-passive failover, but it actually supports active-active configurations with multiple endpoints in an endpoint group, which is essential for minimizing cross-region latency in a multi-region setup.

How to eliminate wrong answers

Option A is wrong because Route 53 latency-based routing does not provide static Anycast IPs and can introduce DNS caching delays, making it unsuitable for minimizing cross-region write latency in an active-active design. Option B is wrong because CloudFront is a content delivery network optimized for static and dynamic content caching, not for handling database write operations; cache invalidation does not reduce write latency to an Aurora global database. Option C is wrong because using a single ALB endpoint with failover to a second region creates an active-passive architecture, not active-active, and fails to minimize latency for writes as traffic is not distributed to the nearest region.

Full explanation →

248

MCQhard

A company has a Direct Connect connection with a private VIF to a VPC. They want to extend this connectivity to multiple VPCs in the same region without creating additional VIFs. Which solution should they implement?

A.Provision additional private VIFs for each VPC

B.Use VPC peering between the VPCs

C.Use a Transit VPC with VPN connections

D.Use a Direct Connect Gateway and attach the VPCs

AnswerD

Direct Connect Gateway enables a single VIF to connect to multiple VPCs.

Why this answer

A Direct Connect Gateway (DX Gateway) is a managed service that allows you to associate a single private virtual interface (VIF) with up to 10 VPCs in the same AWS Region (or across Regions with inter-region peering). This enables the company to extend their existing Direct Connect connection to multiple VPCs without provisioning additional VIFs, simplifying management and reducing costs.

Exam trap

The trap here is that candidates often confuse VPC peering with a Direct Connect Gateway, thinking that peering can extend the Direct Connect connection, but VPC peering does not propagate routes from the on-premises network to the peered VPCs without additional transitive routing configurations.

How to eliminate wrong answers

Option A is wrong because provisioning additional private VIFs for each VPC would increase complexity and cost, and the requirement explicitly states 'without creating additional VIFs.' Option B is wrong because VPC peering only provides connectivity between two VPCs and does not extend the Direct Connect connection to those VPCs; the on-premises network would still need a separate path to each VPC. Option C is wrong because a Transit VPC with VPN connections introduces unnecessary overhead and latency, and it does not leverage the existing Direct Connect private VIF directly; it would require additional VPN termination and routing complexity.

Full explanation →

249

MCQmedium

A company is designing a multi-region architecture with an Application Load Balancer (ALB) in each region. They want to route users to the nearest healthy ALB using latency-based routing. Which AWS service should be used?

A.Amazon Route 53 latency-based routing

B.Amazon CloudWatch

C.VPC Traffic Mirroring

D.AWS Global Accelerator

AnswerA

Latency-based routing routes users to the region with the lowest latency.

Why this answer

Amazon Route 53 latency-based routing directs user traffic to the AWS region with the lowest network latency for the end user, based on latency measurements between the user and each region's resources. This matches the requirement to route users to the nearest healthy ALB, as Route 53 can evaluate health checks on the ALBs and only route to healthy endpoints.

Exam trap

AWS often tests the distinction between DNS-based latency routing (Route 53) and anycast-based traffic acceleration (Global Accelerator), where candidates mistakenly choose Global Accelerator because it also improves performance, but it does not perform per-request latency-based DNS routing to the nearest healthy ALB.

How to eliminate wrong answers

Option B (Amazon CloudWatch) is wrong because CloudWatch is a monitoring and observability service for collecting metrics, logs, and alarms; it does not perform DNS routing or traffic steering. Option C (VPC Traffic Mirroring) is wrong because it copies network traffic from an elastic network interface for analysis (e.g., security inspection) and has no capability to route users based on latency or health. Option D (AWS Global Accelerator) is wrong because while it uses the AWS global network and anycast IPs to improve performance, it does not use latency-based DNS routing; it relies on static anycast IPs and endpoint weights, not per-request latency measurements to the nearest healthy ALB.

Full explanation →

250

MCQeasy

A developer wants to allow an EC2 instance in a VPC to access an Amazon S3 bucket without traversing the public internet. Which AWS service should be used?

A.AWS PrivateLink with an interface VPC endpoint.

B.VPC Gateway Endpoint for S3.

C.NAT gateway in the public subnet.

D.AWS Direct Connect with a public VIF.

AnswerB

Gateway endpoints provide private access to S3 and DynamoDB.

Why this answer

A VPC Gateway Endpoint for S3 allows EC2 instances to access S3 buckets privately using AWS’s internal network, without traversing the public internet. Gateway endpoints are specifically designed for services like S3 and DynamoDB, using route table entries to direct traffic to the service via the AWS backbone, with no data transfer costs for traffic within the same region.

Exam trap

The trap here is that candidates often confuse interface VPC endpoints (PrivateLink) with gateway endpoints, assuming all AWS services require interface endpoints, but S3 and DynamoDB use gateway endpoints which are simpler and do not incur hourly costs.

How to eliminate wrong answers

Option A is wrong because AWS PrivateLink with an interface VPC endpoint is used for services that require private IP connectivity via ENIs, but S3 does not support interface endpoints in all regions and gateway endpoints are the native, cost-effective solution for S3 access. Option C is wrong because a NAT gateway in the public subnet allows outbound internet access but still routes traffic over the public internet to reach S3, failing the requirement to avoid traversing the public internet. Option D is wrong because AWS Direct Connect with a public VIF provides a dedicated connection to AWS public services, but traffic to S3 still traverses the public internet (though over the Direct Connect link), and it does not provide private, internet-free access; a private VIF would be needed for private connectivity, but that does not directly enable S3 access without additional components.

Full explanation →

251

MCQhard

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team notices that some VPCs cannot communicate with each other even though they are attached to the same transit gateway. What is the most likely cause?

A.The security groups on the instances are not allowing inbound traffic from the other VPCs.

B.The transit gateway route tables are missing routes to the other VPCs.

C.The VPC attachments are not in the 'available' state.

D.The VPCs' network ACLs are blocking traffic.

AnswerB

Proper routing configuration is essential for inter-VPC communication.

Why this answer

Transit Gateway uses route tables to control inter-VPC traffic. If the route tables do not have routes to the other VPCs, or if the VPCs are in different route tables that are not associated or propagated correctly, communication fails. The most common issue is that the transit gateway route tables are not properly configured with routes to the other VPC attachments.

Full explanation →

252

MCQmedium

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises data centers. They want to centralize internet traffic through a single VPC that has an internet gateway. Which Transit Gateway feature should they enable?

A.Transit Gateway route tables

B.VPN attachments

C.Multicast support

D.IPsec acceleration

AnswerA

Route tables allow you to centralize internet traffic through a specific VPC.

Why this answer

To centralize internet traffic through a single VPC with an internet gateway, you need to control the routing of traffic from other VPCs and on-premises networks. Transit Gateway route tables allow you to isolate or share routes between attachments, enabling you to create a default route (0.0.0.0/0) pointing to the centralized VPC's attachment. This ensures all outbound internet traffic from other VPCs is forwarded to the egress VPC, which then uses its internet gateway.

Exam trap

The trap here is that candidates often confuse Transit Gateway route tables with VPC route tables, thinking that simply attaching an internet gateway to a VPC will automatically route traffic from other VPCs through it, without realizing that explicit route table entries in the Transit Gateway are required to direct traffic to the egress VPC.

How to eliminate wrong answers

Option B is wrong because VPN attachments are used to connect on-premises networks over IPsec tunnels, not to centralize internet traffic through a specific VPC. Option C is wrong because multicast support enables group communication using UDP multicast traffic, which is unrelated to routing internet-bound traffic to a single egress point. Option D is wrong because IPsec acceleration is a feature to offload IPsec encryption processing, not a routing or forwarding mechanism for internet traffic centralization.

Full explanation →

253

MCQmedium

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access an S3 bucket. The company wants to avoid using a NAT gateway and ensure that traffic does not traverse the internet. Which solution should be used?

A.Attach an internet gateway to the VPC and assign a public IP to the instance

B.Create a VPC endpoint for S3 (Gateway type) and update the route table

C.Set up a VPN connection to the S3 bucket

D.Deploy a NAT gateway in the public subnet and route traffic through it

AnswerB

This provides private connectivity to S3 without internet.

Why this answer

The correct solution is to create a VPC endpoint for S3 (Gateway type) and update the route table. This allows the EC2 instance in the private subnet to access S3 privately without traversing the internet or using a NAT gateway. Option A is incorrect because attaching an internet gateway and assigning a public IP would expose the instance to the internet.

Option C is incorrect because a VPN connection is not necessary for S3 access and would involve additional complexity. Option D is incorrect because a NAT gateway would route traffic through the internet, which the company wants to avoid.

Full explanation →

254

MCQmedium

A company is implementing a hybrid network using AWS Direct Connect and VPN backup. They have multiple VPCs in a single AWS Region. Which design minimizes the number of Direct Connect virtual interfaces while providing connectivity to all VPCs?

A.Create one private VIF attached to a Direct Connect gateway and associate the gateway with all VPCs.

B.Set up a transit VPC with EC2-based routers.

C.Create a separate private VIF for each VPC.

D.Use a single public VIF and route through the internet.

AnswerA

Direct Connect gateway enables multi-VPC connectivity over one VIF.

Why this answer

A Direct Connect gateway allows a single private virtual interface (VIF) to connect to multiple VPCs in the same AWS Region. By attaching the Direct Connect gateway to all target VPCs, you eliminate the need for separate private VIFs per VPC, minimizing operational overhead and cost while maintaining private connectivity.

Exam trap

The trap here is that candidates often confuse Direct Connect gateway with transit VPC or assume that each VPC requires its own private VIF, overlooking the gateway's ability to consolidate connectivity across multiple VPCs in a single Region.

How to eliminate wrong answers

Option B is wrong because a transit VPC with EC2-based routers introduces unnecessary complexity, single points of failure, and higher latency compared to a managed Direct Connect gateway, and it still requires at least one private VIF. Option C is wrong because creating a separate private VIF for each VPC violates the goal of minimizing the number of VIFs and increases cost and management overhead. Option D is wrong because a public VIF provides access only to public AWS services (e.g., S3, DynamoDB) and cannot route traffic to private VPC CIDRs; it also forces traffic over the internet, defeating the purpose of private hybrid connectivity.

Full explanation →

255

Multi-Selecthard

A company is designing a multi-region architecture using AWS Direct Connect. Which TWO of the following are valid configurations for connecting to multiple regions? (Select TWO.)

Select 2 answers

A.Use a single Direct Connect connection to connect to all regions

B.Set up separate Direct Connect connections in each region

C.Use a Transit Gateway to connect to multiple regions

D.Use a single private VIF associated with multiple regions

E.Create a Direct Connect Gateway and associate VPCs from different regions

AnswersB, E

You can have multiple connections in different regions.

Why this answer

Each AWS Direct Connect connection is physically provisioned at a specific Direct Connect location and terminates in a single AWS region. To connect to multiple regions, you must establish separate Direct Connect connections in each target region. Option E is correct because a Direct Connect Gateway allows you to associate Virtual Private Clouds (VPCs) from different regions to a single private virtual interface (VIF), enabling inter-region connectivity over the Direct Connect connection.

Exam trap

The trap here is that candidates often confuse the regional scope of a Transit Gateway with the global scope of a Direct Connect Gateway, mistakenly thinking a Transit Gateway can directly provide multi-region connectivity over Direct Connect without additional components.

Full explanation →

256

Multi-Selectmedium

A company needs to log all network traffic between EC2 instances in a VPC for security analysis. They want to capture metadata about traffic, including source and destination IP, ports, protocol, and packet counts. Which THREE AWS services or features can be used to achieve this? (Choose three.)

Select 3 answers

A.AWS CloudTrail

B.VPC Flow Logs

C.Traffic Mirroring

D.AWS Network Firewall flow logs

E.Security Group rules logging

AnswersB, C, D

VPC Flow Logs capture IP traffic metadata at the network interface level.

Why this answer

Options B, C, and D are correct because VPC Flow Logs capture metadata about network traffic (source/destination IP, ports, protocol, packet counts), Traffic Mirroring captures packets for deep inspection, and AWS Network Firewall provides flow logs for traffic passing through the firewall. Option A is wrong because CloudTrail logs API calls, not network traffic. Option E is wrong because Security Group rules logging does not exist; Security Groups do not log traffic.

Full explanation →

257

MCQeasy

A company is designing a multi-Region application using Amazon Route 53 latency-based routing. The application must be highly available and failover automatically if an AWS Region becomes unavailable. What should the company do to meet these requirements?

A.Configure latency-based routing with health checks and enable DNS failover.

B.Configure active-passive failover with latency-based routing and associate health checks with each record.

C.Configure geolocation routing policies and associate health checks.

D.Configure weighted routing policies with equal weights for all regions.

AnswerB

Correct: Active-passive failover with health checks and latency routing provides automatic regional failover.

Why this answer

It combines latency-based routing with health checks and active-passive failover, which allows Route 53 to route traffic to the region with the lowest latency under normal conditions and automatically fail over to the passive region if the active region's health check fails. This meets the high availability and automatic failover requirements by leveraging Route 53's DNS failover mechanism, which updates DNS responses based on health check status.

Exam trap

The trap here is that candidates often assume that simply enabling health checks with latency-based routing (Option A) is sufficient for automatic failover, but without explicitly configuring an active-passive failover policy, Route 53 does not have a defined secondary target to fail over to when all endpoints in a latency-based set become unhealthy.

How to eliminate wrong answers

Option A is wrong because while it mentions latency-based routing with health checks and DNS failover, it does not specify active-passive failover, which is necessary to ensure a clear failover target when a region becomes unavailable; without an active-passive setup, latency-based routing alone may still send traffic to unhealthy endpoints if all regions are considered active. Option C is wrong because geolocation routing policies route traffic based on the geographic location of the user, not latency or availability, and do not provide automatic failover between regions based on health checks. Option D is wrong because weighted routing policies distribute traffic based on weights and do not inherently support failover; without health checks and active-passive configuration, traffic would continue to be sent to an unavailable region.

Full explanation →

258

MCQmedium

A company wants to allow a specific IAM user to manage network ACLs for a specific VPC only. Which IAM policy action should be used?

A.ec2:AuthorizeSecurityGroupIngress

B.ec2:ModifyNetworkAclAttribute

C.ec2:CreateNetworkAcl

D.ec2:DescribeNetworkAcls

AnswerB

ec2:ModifyNetworkAclAttribute allows modification of network ACL attributes, which is a management action.

Why this answer

Managing network ACLs requires multiple IAM actions, including creating, deleting, and modifying rules and attributes. None of the listed actions alone sufficiently allows full management. ec2:ModifyNetworkAclAttribute only modifies attributes like tags, ec2:CreateNetworkAcl only creates new ACLs, ec2:DescribeNetworkAcls is read-only, and ec2:AuthorizeSecurityGroupIngress is for security groups. To allow a user to manage network ACLs, a combination of actions such as ec2:CreateNetworkAcl, ec2:DeleteNetworkAcl, ec2:ReplaceNetworkAclEntry, etc. is needed.

Full explanation →

259

MCQeasy

A network engineer needs to monitor the number of bytes dropped by a VPC flow log for a specific network interface. Which Amazon CloudWatch metric should be used?

A.NetworkPacketsDropped

B.VPCFlowLogsDroppedPackets

C.ENIDroppedPackets

D.FlowLogsBytesDropped

AnswerD

Correct. This is the option that corresponds to the 'BytesDropped' metric under the AWS/FlowLogs namespace, which tracks bytes dropped by flow logs.

Why this answer

The correct CloudWatch metric for monitoring dropped bytes from VPC Flow Logs is 'BytesDropped' under the AWS/FlowLogs namespace. While option D uses the name 'FlowLogsBytesDropped', this is a common but non-standard variation. The intended correct answer is D as it is the only option that references dropped data from VPC Flow Logs.

Full explanation →

260

MCQmedium

A company has deployed a web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application must be accessible over the internet, but the security team requires that all traffic be inspected by a third-party firewall appliance. What is the MOST scalable architecture?

A.Configure a Network Load Balancer with target groups pointing to firewall appliances.

B.Use an EC2 instance as a transparent proxy and set it as the next-hop in the route table.

C.Use a Gateway Load Balancer with firewall appliances in each Availability Zone.

D.Deploy a single firewall appliance in one Availability Zone and route all traffic through it.

AnswerC

GWLB provides scalable, HA traffic inspection.

Why this answer

Gateway Load Load Balancer (GWLB) is designed to scale third-party virtual appliances (e.g., firewalls) horizontally across multiple Availability Zones. It uses the GENEVE protocol to encapsulate traffic, enabling transparent inspection while preserving the original packet headers. This architecture meets the security requirement for traffic inspection and provides high availability and elasticity, unlike a single appliance or a proxy-based solution.

Exam trap

The trap here is that candidates often confuse Gateway Load Balancer with Network Load Balancer, thinking an NLB can transparently insert firewalls, but only GWLB supports transparent inline traffic inspection using GENEVE encapsulation without requiring the firewall to be the destination.

How to eliminate wrong answers

Option A is wrong because a Network Load Balancer (NLB) with target groups pointing to firewall appliances would require the firewall to be the final destination or to perform NAT, breaking the transparent inspection model; GWLB is the correct service for transparent insertion of inline appliances. Option B is wrong because using an EC2 instance as a transparent proxy and setting it as the next-hop in the route table creates a single point of failure, lacks native health checking and auto-scaling, and does not scale horizontally across AZs. Option D is wrong because deploying a single firewall appliance in one Availability Zone creates a single point of failure and a scalability bottleneck; it violates the principle of high availability and cannot handle traffic for all AZs if that AZ fails.

Full explanation →

261

MCQhard

A global e-commerce company operates a production environment on AWS with a VPC (10.0.0.0/16) containing public and private subnets in three Availability Zones. The application runs on EC2 instances in private subnets behind an Application Load Balancer (ALB) in public subnets. The company uses AWS Transit Gateway to connect multiple VPCs and on-premises data centers via Site-to-Site VPN. Recently, the operations team noticed intermittent connectivity issues: users in the Asia-Pacific region experience slow page load times and occasional timeouts, while users in other regions have no issues. The network team suspects packet loss or high latency on the VPN connection to the on-premises data center in Singapore, which hosts a critical database. The AWS Direct Connect connection is not yet available. The team ran a traceroute from an EC2 instance in the production VPC to the database server (IP 203.0.113.50) and observed high latency and packet loss on the fifth hop (a transit gateway attachment). The VPN tunnel status shows 'UP' on both ends. CloudWatch metrics for the VPN tunnel show no errors but high 'TunnelData' bytes. What should the network engineer do FIRST to resolve the issue?

A.Enable jumbo frames on the transit gateway and the EC2 instances in the private subnets.

B.Increase the VPN tunnel bandwidth by creating a second VPN tunnel and enabling ECMP.

C.Modify the BGP attributes on the transit gateway to prefer the Direct Connect path once it becomes available.

D.Rebuild the VPN connection using a different customer gateway device with stronger encryption.

AnswerA

Enable jumbo frames on the transit gateway and EC2 instances to allow larger MTU, reducing fragmentation and packet loss. This is the first step to address MTU-related issues.

Why this answer

Enabling jumbo frames on the transit gateway and EC2 instances allows larger MTU, reducing packet fragmentation and the associated packet loss and latency. The high 'TunnelData' bytes and packet loss on the attachment suggest MTU mismatch. Option B is incorrect because adding a second VPN tunnel with ECMP increases bandwidth but does not fix MTU issues.

Option C is incorrect because Direct Connect is not available yet and the problem is not routing. Option D is incorrect because stronger encryption does not affect MTU.

Exam trap

Candidates might think that increasing bandwidth (option B) is the solution, but the problem is likely MTU-related packet loss, not bandwidth limitation.

Full explanation →

262

MCQeasy

A network engineer needs to allow an EC2 instance in a private subnet to access an S3 bucket without traversing the internet. Which AWS service should be used?

A.VPC Peering

B.VPC Gateway Endpoint

C.Internet Gateway

D.NAT Gateway

AnswerB

Gateway Endpoint allows private access to S3.

Why this answer

A VPC Gateway Endpoint allows private subnet resources to access S3 without traversing the internet by routing traffic through AWS's internal network. It uses prefix lists and route table entries to direct S3-bound traffic to a highly available, horizontally scaled gateway endpoint, avoiding NAT or internet gateway costs and latency.

Exam trap

The trap here is that candidates often confuse Gateway Endpoints with Interface Endpoints (for services like DynamoDB or API Gateway) or assume a NAT Gateway is needed for private subnet outbound traffic, missing the specific requirement to avoid internet transit for S3.

How to eliminate wrong answers

Option A is wrong because VPC Peering connects two VPCs for private IP communication, but does not provide access to AWS services like S3; it would still require a gateway or proxy to reach S3. Option C is wrong because an Internet Gateway enables internet access for public subnets, but the EC2 instance is in a private subnet and the requirement is to avoid traversing the internet entirely. Option D is wrong because a NAT Gateway allows outbound internet access from private subnets, but traffic still traverses the internet to reach S3, violating the 'without traversing the internet' constraint.

Full explanation →

263

Multi-Selectmedium

A company is designing a network for a VPC with a CIDR of 10.0.0.0/16. The VPC has three private subnets in three different Availability Zones. The company needs to provide internet access to instances in the private subnets for software updates. The architecture must be highly available and cost-effective. Which TWO actions should the network engineer take?

Select 2 answers

A.Configure each private subnet's route table to route 0.0.0.0/0 to the NAT Gateway in the same Availability Zone.

B.Use a NAT instance in an Auto Scaling group.

C.Deploy a NAT Gateway in each Availability Zone.

D.Use a single route table for all private subnets and route to one NAT Gateway.

E.Deploy a single NAT Gateway in one Availability Zone.

AnswersA, C

This ensures traffic uses the NAT Gateway in the same AZ.

Why this answer

Configuring each private subnet's route table to route 0.0.0.0/0 to the NAT Gateway in the same Availability Zone ensures that traffic from instances in that subnet uses a NAT Gateway that is in the same AZ, avoiding cross-AZ data transfer costs and maintaining high availability. Option C is correct because deploying a NAT Gateway in each Availability Zone provides redundancy; if one AZ fails, the other NAT Gateways continue to provide internet access, meeting the high availability requirement while remaining cost-effective compared to using NAT instances with Auto Scaling.

Exam trap

The ANS-C01 exam often tests the misconception that a single NAT Gateway is sufficient for high availability, but the trap here is that a NAT Gateway is an AZ-scoped resource, so you need one per AZ to avoid a single point of failure and cross-AZ data transfer costs.

Full explanation →

264

MCQhard

A company has a Direct Connect connection with a public VIF to access AWS public services. The on-premises network team reports that they can reach S3 but not DynamoDB. The route table on the customer router shows a default route to the public VIF. What is the most likely cause?

A.The Direct Connect connection is degraded and only supports S3 traffic.

B.The BGP session between the customer router and AWS is down.

C.The on-premises firewall is blocking outbound traffic to the DynamoDB IP ranges.

D.The VPC route table does not have a route to the DynamoDB endpoint.

AnswerC

Different AWS services have different IP ranges; firewall may block DynamoDB.

Why this answer

DynamoDB uses a different set of public IP ranges than S3, and the on-premises firewall might block access to those ranges. Option A is wrong because the Direct Connect connection is a single physical link; if it were degraded, it would affect all traffic, not just DynamoDB. Option B is wrong because the public VIF does use BGP, but the customer router has a default route to the public VIF, indicating the BGP session is established and routes are being received.

Option D is wrong because the public VIF accesses AWS public services directly, not through the VPC route table.

Full explanation →

265

MCQhard

A company has multiple VPCs connected via AWS Transit Gateway. They need to inspect all inter-VPC traffic using a centralized firewall appliance. What is the most efficient way to achieve this?

A.Attach the firewall appliance to the Transit Gateway and configure Transit Gateway route tables to send traffic to the appliance

B.Enable VPC Flow Logs and analyze traffic patterns

C.Create VPC Gateway Endpoints for each VPC and route traffic through them

D.Use a Network Load Balancer to distribute traffic to the firewall appliance

AnswerA

This centralizes inspection by routing inter-VPC traffic through the firewall appliance.

Why this answer

Attaching the firewall appliance to the Transit Gateway and configuring Transit Gateway route tables to send traffic to the appliance is the most efficient method because it allows the Transit Gateway to act as a central hub, directing all inter-VPC traffic through the firewall for inspection without requiring complex peering or per-VPC routing changes. This leverages the Transit Gateway's route table capabilities to create a single inspection point, minimizing latency and administrative overhead.

Exam trap

The trap here is that candidates often confuse Transit Gateway route tables with VPC route tables, assuming they can simply point VPC routes to the firewall, but the Transit Gateway's centralized route table is the key to efficiently steering all inter-VPC traffic through a single inspection point without per-VPC configuration.

How to eliminate wrong answers

Option B is wrong because VPC Flow Logs only capture metadata about traffic (e.g., source/destination IPs, ports) for monitoring and analysis, but they cannot inspect or filter traffic; they provide no mechanism to enforce security policies or block malicious traffic. Option C is wrong because VPC Gateway Endpoints (e.g., for S3 or DynamoDB) are used for private connectivity to AWS services, not for routing or inspecting inter-VPC traffic; they do not support traffic inspection or firewall functionality. Option D is wrong because a Network Load Balancer operates at Layer 4 and distributes traffic based on IP/port, but it does not inspect traffic content; using it with a firewall appliance would add unnecessary complexity and latency without providing centralized routing control like the Transit Gateway.

Full explanation →

266

MCQmedium

A company has multiple VPCs across different AWS Regions and wants to enable communication between them using AWS's global network backbone. Which solution meets these requirements with minimal operational overhead?

A.Use AWS Transit Gateway with inter-Region peering.

B.Set up AWS Direct Connect connections to each VPC.

C.Create VPC peering connections between each pair of VPCs.

D.Use AWS Site-to-Site VPN between VPCs.

AnswerA

Simplifies connectivity across Regions.

Why this answer

AWS Transit Gateway with inter-Region peering is correct because it allows you to connect multiple VPCs across different AWS Regions using AWS's global network backbone, providing a hub-and-spoke architecture that scales easily. This solution minimizes operational overhead by centralizing routing and eliminating the need to manage individual connections between each VPC, as Transit Gateway automatically handles route propagation and traffic distribution across peered transit gateways.

Exam trap

AWS often tests the misconception that VPC peering is the simplest solution for multi-VPC connectivity, but the trap here is that VPC peering lacks transitive routing and requires a full mesh for more than two VPCs, making it operationally heavy for multi-region setups, whereas Transit Gateway with inter-Region peering provides a scalable, centrally managed alternative.

How to eliminate wrong answers

Option B is wrong because AWS Direct Connect is a dedicated physical connection from on-premises to AWS, not designed for inter-VPC or inter-Region VPC communication, and would require additional virtual interfaces and complex routing to connect multiple VPCs across regions, increasing operational overhead. Option C is wrong because VPC peering does not support transitive routing, meaning you would need to create a full mesh of peering connections between every pair of VPCs, which becomes unmanageable as the number of VPCs grows and does not leverage AWS's global backbone for inter-Region traffic efficiently. Option D is wrong because AWS Site-to-Site VPN is typically used for connecting on-premises networks to AWS VPCs over the public internet, not for inter-VPC communication within AWS, and it introduces latency and complexity compared to using Transit Gateway peering over the AWS global network.

Full explanation →

267

MCQmedium

A company uses AWS Transit Gateway to connect multiple VPCs and an on-premises network via VPN. The on-premises network advertises a route for 10.0.0.0/8. One VPC has a CIDR of 10.0.1.0/24. How does Transit Gateway handle the overlapping route?

A.The Transit Gateway uses the longest prefix match; the VPC route 10.0.1.0/24 is more specific.

B.The Transit Gateway prefers the on-premises route because it is learned via BGP.

C.The Transit Gateway drops traffic to 10.0.1.0/24 due to conflict.

D.The Transit Gateway summarises the on-premises route to 10.0.0.0/16.

AnswerA

Longest prefix match determines forwarding.

Why this answer

AWS Transit Gateway uses the longest prefix match (LPM) rule to select the most specific route when multiple routes overlap. In this case, the on-premises network advertises 10.0.0.0/8 via BGP, while the VPC has a directly attached CIDR of 10.0.1.0/24. Since /24 is more specific than /8, traffic destined for 10.0.1.0/24 is routed to the VPC, not the on-premises network.

Exam trap

The trap here is that candidates assume BGP-learned routes are always preferred over directly attached VPC routes, but Transit Gateway strictly uses longest prefix match, not route source priority.

How to eliminate wrong answers

Option B is wrong because Transit Gateway does not prefer a route based solely on it being learned via BGP; it always applies longest prefix match first, regardless of route source. Option C is wrong because overlapping routes do not cause traffic to be dropped; Transit Gateway resolves conflicts by selecting the most specific prefix. Option D is wrong because Transit Gateway does not summarise or modify routes advertised by on-premises networks; it uses the exact prefix as received.

Full explanation →

268

MCQhard

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises router is advertising a default route (0.0.0.0/0) via BGP. The VPC has an internet gateway attached, and the route table has a default route to the internet gateway. The network team notices that traffic from on-premises to the internet is not working as expected. What is the most likely cause?

A.The BGP session is not established.

B.The on-premises router is advertising a default route, causing a routing conflict.

C.The VPC route table does not have a route to the internet gateway for the on-premises traffic.

D.The private VIF is associated with the wrong VLAN.

AnswerB

The default route from Direct Connect may override the internet gateway route, breaking internet access for on-premises traffic.

Why this answer

The on-premises router advertising a default route (0.0.0.0/0) via BGP over the private VIF causes a routing conflict because the VPC route table already has a default route pointing to the internet gateway. When traffic from on-premises destined for the internet enters the VPC, it matches the more specific BGP-learned default route and is forwarded back toward the on-premises router (or black-holed), rather than being sent to the internet gateway. This creates a routing loop or asymmetric routing, breaking internet connectivity from on-premises.

Exam trap

AWS often tests the misconception that a default route advertised via BGP over Direct Connect is harmless or that the internet gateway route will always take precedence, but in reality, the VPC route table matches the most specific route (both are /0), and the BGP-learned route over the virtual private gateway is preferred for traffic entering the VPC from on-premises, causing the conflict.

How to eliminate wrong answers

Option A is wrong because if the BGP session were not established, the on-premises router would not be advertising any routes, and the issue described (traffic not working) would be due to a lack of routing, not a conflict; the scenario explicitly states the on-premises router is advertising a default route, implying BGP is established. Option C is wrong because the VPC route table does have a default route to the internet gateway (as stated in the question), so the absence of such a route is not the cause. Option D is wrong because a private VIF associated with the wrong VLAN would prevent the VIF from functioning at Layer 2, causing complete loss of connectivity (not just internet traffic), and the question indicates that the BGP session is established and routes are being exchanged, which requires correct VLAN association.

Full explanation →

269

MCQmedium

A company uses AWS Transit Gateway to interconnect multiple VPCs and on-premises networks. They notice that traffic between two VPCs is taking a suboptimal path through the on-premises network instead of staying within AWS. What configuration change should be made to ensure optimal routing?

A.Enable route propagation from the VPC attachments into the Transit Gateway route table.

B.Disable cross-zone load balancing on the Transit Gateway.

C.Add static routes to the Transit Gateway route table pointing to the VPN attachment.

D.Modify the VPC route tables to add routes to the other VPC via the Transit Gateway.

AnswerA

Route propagation allows VPC routes to be exchanged, enabling direct routing.

Why this answer

Transit Gateway route tables control the path; enabling route propagation from VPC attachments will add routes for direct VPC-to-VPC communication. Option B is incorrect because cross-zone load balancing is a feature of load balancers, not Transit Gateway routing. Option C is incorrect because adding static routes to the VPN attachment would force traffic through the VPN, which is suboptimal.

Option D is incorrect because modifying VPC route tables to point to the Transit Gateway is necessary for VPCs to send traffic to the Transit Gateway, but it does not control the Transit Gateway's internal path selection; the issue is about the Transit Gateway route table, not VPC route tables.

Full explanation →

270

Multi-Selectmedium

Which THREE of the following are valid configurations for an AWS Direct Connect virtual interface? (Choose three.)

Select 3 answers

A.VPN virtual interface

B.Private virtual interface

C.Hosted virtual interface

D.Transit virtual interface

E.Public virtual interface

AnswersB, D, E

Correct: A private virtual interface is a valid type for connecting to a VPC using private IP addresses.

Why this answer

AWS Direct Connect supports three types of virtual interfaces: private, public, and transit. A private virtual interface (B) connects your on-premises network to an Amazon VPC using private IP addresses. A public virtual interface (E) provides access to AWS public services (e.g., S3, DynamoDB) over the Direct Connect link.

A transit virtual interface (D) enables connectivity from a Direct Connect gateway to one or more transit gateways, allowing access to multiple VPCs and VPN connections. All three are valid configurations.

Exam trap

AWS often tests the distinction between the three valid virtual interface types (private, public, transit) and tricks candidates by including 'VPN virtual interface' or 'Hosted virtual interface' as plausible-sounding options, exploiting confusion about how VPNs and partner-provisioned connections relate to Direct Connect.

Full explanation →

271

MCQeasy

A solutions architect needs to design a highly available web application that uses an Application Load Balancer (ALB) and spans multiple Availability Zones (AZs) in a single region. The application must be able to handle a sudden increase in traffic without manual intervention. Which feature should the architect enable on the ALB to meet this requirement?

A.Enable connection draining

B.Enable sticky sessions

C.Enable cross-zone load balancing

D.Enable deletion protection

AnswerC

Cross-zone load balancing distributes traffic evenly across instances in all AZs, allowing the ALB to handle spikes by using all healthy instances effectively.

Why this answer

Cross-zone load balancing distributes incoming traffic evenly across all registered targets in all enabled Availability Zones, rather than sending traffic only to targets in the same AZ as the load balancer node. This ensures that if one AZ receives more traffic than another, the ALB can still balance the load across all healthy instances, allowing the application to handle sudden traffic spikes without manual scaling intervention.

Exam trap

The trap here is that candidates often confuse cross-zone load balancing with auto scaling, but cross-zone load balancing is a feature of the ALB itself that distributes existing traffic more evenly, whereas auto scaling handles capacity changes; the question specifically asks for a feature to handle sudden traffic increase without manual intervention, and cross-zone load balancing ensures the ALB can use all available capacity across AZs immediately.

How to eliminate wrong answers

Option A is wrong because connection draining (also known as deregistration delay) is used to complete in-flight requests before an instance is deregistered, not to handle sudden traffic increases. Option B is wrong because sticky sessions (session affinity) bind a user's session to a specific target, which can cause uneven load distribution and does not help with handling traffic spikes. Option D is wrong because deletion protection prevents accidental deletion of the ALB, but has no effect on traffic handling or scalability.

Full explanation →

272

MCQhard

A company runs a critical application on Amazon EC2 instances in a VPC. The application receives data from an on-premises data center over an AWS Direct Connect connection. The company wants to add redundant connectivity using a VPN connection over the internet. They need to ensure that traffic from on-premises to AWS uses the Direct Connect connection when it is healthy, and only fails over to the VPN if Direct Connect fails. Which configuration achieves this?

A.Advertise a more specific prefix over Direct Connect and a less specific prefix over VPN, and set a higher MED value on the VPN routes.

B.Advertise the same prefix over both connections but prepend AS_PATH multiple times on the Direct Connect routes.

C.Set a higher BGP weight on the VPN routes.

D.Set a lower BGP local preference on the Direct Connect routes.

AnswerA

BGP prefers more specific prefixes. Higher MED on VPN makes Direct Connect routes preferred when both are available.

Why this answer

Advertising a more specific prefix (e.g., /24) over Direct Connect and a less specific prefix (e.g., /20) over VPN, combined with a higher MED value on the VPN routes, ensures that the Direct Connect path is preferred when healthy. BGP selects the most specific prefix first, and if prefixes are identical, lower MED is preferred; here, the more specific prefix over Direct Connect wins, and the higher MED on VPN acts as a tie-breaker for any overlapping less specific routes, guaranteeing failover only when Direct Connect is unavailable.

Exam trap

The ANS-C01 exam often tests the misconception that AS_PATH prepending or local preference adjustments alone can force primary path selection, but the trap here is that candidates overlook the critical role of prefix specificity in BGP path selection, which takes precedence over MED, AS_PATH, and local preference when prefixes differ.

How to eliminate wrong answers

Option B is wrong because prepending AS_PATH multiple times on Direct Connect routes makes that path appear longer (higher AS_PATH length), which would cause BGP to prefer the VPN path instead, defeating the requirement to prefer Direct Connect. Option C is wrong because setting a higher BGP weight on VPN routes makes them more preferred (higher weight is preferred), which would cause traffic to use the VPN over Direct Connect, opposite of the desired behavior. Option D is wrong because setting a lower BGP local preference on Direct Connect routes makes them less preferred (lower local preference is less preferred), which would cause BGP to select the VPN path as primary, again failing the requirement.

Full explanation →

273

MCQeasy

A company is using AWS Client VPN to provide remote access to its VPC. Users report that they can connect but cannot access any resources. The VPN is configured with a security group that allows all traffic. What should the administrator check?

A.The client VPN security group inbound rules

B.The client VPN endpoint certificate

C.The client VPN route table

D.The client VPN authorization rules

AnswerD

Authorization rules define which networks clients can access.

Why this answer

Client VPN uses an authorization rule to allow access to specific networks. Without an authorization rule, even if the security group allows traffic, the VPN will not forward traffic.

Full explanation →

274

MCQmedium

A company has a VPC with public and private subnets. The security team wants to detect and alert on any SSH traffic (port 22) that originates from the internet to any EC2 instance in the VPC. Which solution achieves this with minimal operational overhead?

A.Enable VPC Flow Logs, publish to CloudWatch Logs, and create a metric filter for SSH traffic.

B.Configure a security group rule to deny inbound SSH and enable security group logging.

C.Use AWS Config to detect security group rules that allow SSH from 0.0.0.0/0.

D.Enable Amazon GuardDuty and rely on its threat detection.

AnswerA

This approach logs traffic and alerts on SSH without manual inspection.

Why this answer

VPC Flow Logs can be published to CloudWatch Logs, and a CloudWatch Logs filter metric can detect SSH traffic. Security Groups can deny traffic but not alert. AWS Config can track configuration changes.

GuardDuty detects threats but not specifically SSH traffic alerts.

Full explanation →

275

MCQhard

A network engineer is designing a VPC with public and private subnets. The private subnets must have outbound internet access for software updates but must not be directly reachable from the internet. The company wants to minimize cost and operational overhead. Which solution meets these requirements?

A.Deploy a NAT Gateway in a public subnet and add a route in the private subnet route table pointing 0.0.0.0/0 to the NAT Gateway.

B.Use an egress-only internet gateway and route 0.0.0.0/0 to it from the private subnets.

C.Create a VPC peering connection to a VPC with internet access and route 0.0.0.0/0 through the peering connection.

D.Attach an internet gateway to the VPC and add a route in the private subnet route table pointing 0.0.0.0/0 to the internet gateway.

AnswerA

NAT Gateway allows outbound traffic from private subnets while blocking unsolicited inbound traffic.

Why this answer

A NAT Gateway, deployed in a public subnet with an associated Elastic IP, enables instances in private subnets to initiate outbound IPv4 connections to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet. Adding a default route (0.0.0.0/0) in the private subnet route table pointing to the NAT Gateway satisfies the requirement for outbound-only internet access with minimal cost and operational overhead, as NAT Gateway is a managed service that scales automatically.

Exam trap

AWS often tests the misconception that an egress-only internet gateway can be used for IPv4 outbound traffic, or that VPC peering can be used to route internet-bound traffic through another VPC, when in fact both are invalid for this scenario.

How to eliminate wrong answers

Option B is wrong because an egress-only internet gateway is designed for IPv6 traffic only; it cannot provide outbound internet access for IPv4 traffic, which is required for software updates. Option C is wrong because VPC peering does not support transitive routing; routing 0.0.0.0/0 through a peering connection to another VPC would not provide internet access unless that VPC has its own internet gateway and proper routing, and it violates AWS peering rules (cannot route to internet via peering). Option D is wrong because adding a route to an internet gateway in a private subnet route table would make instances directly reachable from the internet (if they have public IPs) or would not work at all for instances without public IPs; an internet gateway requires a public IP on the instance for outbound traffic, and it does not provide the required inbound restriction.

Full explanation →

276

MCQmedium

A company uses AWS Organizations with SCPs to enforce security controls. The security team wants to prevent users from disabling Amazon GuardDuty or modifying its configuration in any member account. Which SCP effect should be used?

A.Deny

B.Prevent

C.Allow

D.Block

AnswerA

Deny explicitly prohibits the specified actions in SCPs.

Why this answer

'Deny' because SCPs use Deny to explicitly block actions. Allow is used to whitelist, but SCPs default to Allow, so Deny is needed to override. 'Block' and 'Prevent' are not valid SCP effects.

Full explanation →

277

MCQmedium

A company has a multi-account AWS environment using AWS Transit Gateway with a centralized network account. The network team wants to ensure that only specific VPCs can communicate with each other. What is the best practice to achieve this?

A.Configure security groups in each VPC to allow traffic only from specific VPC CIDRs.

B.Use VPC peering connections between the VPCs that need to communicate.

C.Create multiple Transit Gateway route tables and associate each VPC attachment with the appropriate route table.

D.Use AWS Network Manager to create routing policies.

AnswerC

Multiple Transit Gateway route tables allow you to isolate VPC attachments and control which VPCs can communicate by managing route propagation and static routes.

Why this answer

Transit Gateway route tables allow you to control routing between VPC attachments. By creating multiple route tables and associating each VPC attachment with the appropriate one, you can isolate or allow communication as needed. Option A is wrong because security groups operate at the instance/ENI level, not at the transit gateway level, so they cannot control VPC-to-VPC communication via Transit Gateway.

Option B is wrong because VPC peering is point-to-point and does not scale well, nor does it leverage the centralized Transit Gateway. Option D is wrong because AWS Network Manager is used for monitoring and visualizing global networks, not for defining routing policies.

Full explanation →

278

MCQeasy

A company is deploying a VPC with public and private subnets in two Availability Zones. The public subnets are used for NAT gateways and an Application Load Balancer (ALB). The private subnets host EC2 instances running a web application. What is the most cost-effective and highly available configuration for internet access from the private instances?

A.Deploy a NAT gateway in each public subnet and configure private route tables with a default route to the NAT gateway in the same AZ.

B.Create a single NAT gateway in one public subnet and route all private traffic to it.

C.Attach an internet gateway to the VPC and add a default route to it in the private subnets.

D.Launch a NAT instance in each public subnet and configure the private route tables.

AnswerA

Provides high availability (each AZ independent) and uses managed service, cost-effective for moderate traffic.

Why this answer

Deploying a NAT gateway in each public subnet (one per Availability Zone) ensures that private instances in each AZ can route outbound traffic through a NAT gateway in the same AZ, providing both high availability (no single point of failure) and cost efficiency (no cross-AZ data transfer charges). This configuration uses the default route (0.0.0.0/0) in the private route tables pointing to the NAT gateway in the same AZ, which avoids the per-GB data transfer costs that would occur if traffic crossed AZs to reach a single NAT gateway.

Exam trap

The ANS-C01 exam often tests the misconception that a single NAT gateway is sufficient for high availability, but the trap here is that a single NAT gateway is a single point of failure and incurs cross-AZ data transfer costs, making per-AZ NAT gateways the correct cost-effective and highly available design.

How to eliminate wrong answers

Option B is wrong because a single NAT gateway in one AZ creates a single point of failure and incurs cross-AZ data transfer costs for private instances in other AZs, reducing both availability and cost-effectiveness. Option C is wrong because attaching an internet gateway directly to private subnets would expose the private EC2 instances to the internet, bypassing NAT and violating security best practices; private subnets must not have a default route to an internet gateway. Option D is wrong because NAT instances are less cost-effective and less reliable than NAT gateways; they require manual scaling, patching, and high-availability management, and they have limited bandwidth compared to the managed NAT gateway service.

Full explanation →

279

Multi-Selectmedium

Which TWO of the following are valid ways to encrypt data in transit between an on-premises data center and an Amazon VPC? (Choose two.)

Select 2 answers

A.Use AWS Site-to-Site VPN.

B.Use AWS Direct Connect without any additional encryption.

C.Use AWS Direct Connect with a VPN tunnel over the connection.

D.Use VPC peering.

E.Use an internet gateway with a security group.

AnswersA, C

Site-to-Site VPN uses IPSec to encrypt traffic between on-premises and VPC.

Why this answer

Options A and C are correct. AWS Site-to-Site VPN creates an IPSec tunnel, encrypting all traffic. AWS Direct Connect can be combined with a VPN over the connection to encrypt traffic.

Option B is incorrect because Direct Connect alone does not provide encryption. Option D is incorrect because VPC peering does not encrypt traffic. Option E is incorrect because internet gateway does not encrypt traffic.

Full explanation →

280

Multi-Selectmedium

A company has a VPC with public and private subnets. The security team wants to inspect all traffic between the private subnets and the internet using a centralized inspection VPC. The company uses AWS Network Firewall and wants to ensure that traffic cannot bypass the firewall. Which TWO actions should the company take? (Choose TWO.)

Select 2 answers

A.Configure an AWS WAF web ACL and associate it with the internet gateway.

B.Deploy the Network Firewall in a dedicated inspection VPC and use a VPC peering or transit gateway to route traffic from the workload VPC to the inspection VPC.

C.Enable VPC Flow Logs on the private subnets to monitor traffic.

D.Configure the private subnet route table in the workload VPC to route 0.0.0.0/0 traffic to the Network Firewall endpoint.

E.Create an internet gateway in the workload VPC and attach it to the private subnets.

AnswersB, D

A centralized inspection VPC allows the firewall to inspect traffic without being in the workload VPC.

Why this answer

Deploying AWS Network Firewall in a dedicated inspection VPC and using a transit gateway (or VPC peering) allows centralized traffic inspection. This architecture ensures that all traffic between the workload VPC and the internet is routed through the inspection VPC, preventing bypass. The transit gateway enables transitive routing, while VPC peering can also be used with proper route table entries to force traffic through the firewall.

Exam trap

The trap here is that candidates often confuse AWS WAF with Network Firewall, thinking WAF can inspect all network traffic, when in fact WAF only inspects HTTP/HTTPS traffic at the application layer and cannot inspect non-web protocols like SSH, RDP, or custom TCP/UDP traffic.

Full explanation →

281

MCQhard

A company is designing a multi-account AWS environment using AWS Organizations. The company wants to centralize outbound internet traffic from all VPCs in all accounts through a single VPC in a shared services account. The shared services account has a VPC with a NAT gateway and an internet gateway. Which architecture meets this requirement?

A.Create VPC gateway endpoints for all AWS services in each VPC.

B.Set up a VPN connection from each VPC to the shared services VPC and use the latter's internet gateway.

C.Attach all VPCs to a transit gateway and route traffic through a shared services VPC that has NAT gateway and internet gateway.

D.Peer each VPC to the shared services VPC and configure a default route pointing to the shared services VPC's NAT gateway.

AnswerC

Transit gateway enables transitive routing and centralized internet.

Why this answer

A transit gateway allows you to centrally route traffic from multiple VPCs across different AWS accounts to a shared services VPC. By attaching all VPCs to a transit gateway and configuring route tables appropriately, you can force all outbound internet traffic from the spoke VPCs to go through the shared services VPC's NAT gateway and internet gateway, centralizing egress traffic.

Exam trap

The trap here is that candidates often assume VPC peering can be used as a hub-and-spoke solution for internet egress, but they forget that VPC peering does not support transitive routing and that NAT gateways are not reachable across a peering connection, making Option D invalid.

How to eliminate wrong answers

Option A is wrong because VPC gateway endpoints only provide private connectivity to specific AWS services (e.g., S3, DynamoDB) and do not route general outbound internet traffic; they cannot replace a NAT gateway or internet gateway. Option B is wrong because setting up a VPN connection from each VPC to the shared services VPC introduces unnecessary complexity, latency, and bandwidth limitations compared to using a transit gateway, and VPNs are typically used for hybrid connectivity, not for routing internet-bound traffic between VPCs within the same AWS environment. Option D is wrong because VPC peering does not support transitive routing; a default route in a peered VPC pointing to the shared services VPC's NAT gateway would not work because the NAT gateway's IP address is not reachable across a peering connection (NAT gateways are not transitive), and peering also does not allow a single shared services VPC to act as a hub for many VPCs without complex full-mesh peering.

Full explanation →

282

MCQmedium

A company is using AWS Site-to-Site VPN connections to connect multiple branch offices to a central VPC. The network team wants to ensure high availability and automatic failover if one VPN tunnel goes down. Which configuration should be implemented?

A.Configure a second VPN connection to the same customer gateway and use BGP with equal-cost multipath

B.Use the two tunnels provided by the VPN connection with dynamic routing (BGP)

C.Use a single tunnel and rely on AWS automatic recovery

D.Configure static routes with a higher metric for the secondary tunnel

AnswerB

Two tunnels with BGP provide automatic failover.

Why this answer

Each AWS Site-to-Site VPN connection provides two tunnels for high availability. By using dynamic routing (BGP) with both tunnels, the VPN automatically fails over to the second tunnel if the first goes down, without manual intervention. This meets the requirement for automatic failover and high availability.

Exam trap

The trap here is that candidates assume a single VPN connection with two tunnels is not enough, and they over-engineer by adding a second VPN connection or using static routes, missing that AWS's built-in dual-tunnel design with BGP already provides automatic failover.

How to eliminate wrong answers

Option A is wrong because configuring a second VPN connection to the same customer gateway with BGP and ECMP does not provide automatic failover within a single VPN connection; it adds complexity and is not the standard AWS HA design. Option C is wrong because a single tunnel lacks redundancy; AWS automatic recovery only restores a failed tunnel, but there is no failover path during the recovery period, causing downtime. Option D is wrong because static routes with a higher metric for the secondary tunnel do not support automatic failover with BGP; static routing requires manual intervention or additional scripting to detect failure and switch routes, and it does not leverage BGP's dynamic path selection.

Full explanation →

283

Multi-Selecthard

Which THREE are best practices for designing a highly available AWS Direct Connect connection? (Choose 3.)

Select 3 answers

A.Use a single Direct Connect connection with redundant virtual interfaces

B.Use multiple Direct Connect connections to different AWS Direct Connect locations

C.Configure BGP with graceful restart and fast failover timers

D.Connect to multiple AWS Direct Connect routers in the same location

E.Use a single large Direct Connect connection instead of multiple smaller ones

AnswersB, C, D

Diverse locations provide geographical redundancy.

Why this answer

Using multiple Direct Connect connections to different AWS Direct Connect locations provides geographic redundancy. If one location experiences an outage, traffic can fail over to the other location, ensuring high availability. This aligns with AWS best practices for resilient hybrid networking.

Exam trap

AWS often tests the misconception that redundant virtual interfaces on a single physical connection provide high availability, but the physical link itself remains a single point of failure.

Full explanation →

284

MCQhard

An engineer is trying to create a VPC Flow Log that delivers to a CloudWatch Logs log group in the same account. The IAM role used has the above trust policy. However, the flow log creation fails with an error. What is the most likely reason?

A.The log group does not exist yet.

B.The trust policy incorrectly specifies the service principal; it should be 'ec2.amazonaws.com'.

C.The IAM role lacks a permissions policy that grants the actions on the log group.

D.The resource ARN in the trust policy does not include the log group name.

AnswerC

The trust policy allows the service to assume the role, but the role needs a permissions policy to perform the actions.

Why this answer

The trust policy shown trusts the VPC Flow Logs service principal, but the IAM role itself must have a permissions policy that allows the actions on the log group. The exhibit only shows the trust policy; the permissions policy is missing. The error likely indicates that the role does not have the necessary permissions to perform the actions.

Full explanation →

285

MCQmedium

A company uses AWS Direct Connect with a public VIF to access Amazon S3. The network team notices that S3 traffic is taking a suboptimal path over the internet instead of the Direct Connect. Which configuration is MOST likely missing?

A.The VPC route tables are not updated to include the Direct Connect route

B.The public VIF is not associated with the VPC

C.A Direct Connect gateway is not attached to the VPC

D.A VPC endpoint for S3 is not configured

AnswerD

Correct. If S3 traffic originates from a VPC, a VPC endpoint for S3 is needed to keep traffic private. Without it, traffic may take a suboptimal path over the internet.

Why this answer

For a public VIF, S3 traffic from on-premises should use Direct Connect if the on-premises router is configured to route S3 prefixes to the Direct Connect connection. The provided options do not address this missing configuration. None of the options (VPC route tables, VIF association, Direct Connect gateway, or VPC endpoint) are correct for this scenario.

The question may need to be revised to include an appropriate option.

Exam trap

Candidates often think VPC route tables need updating for public VIF, but the real issue is on-premises routing or, in this case, missing VPC endpoint for S3.

Full explanation →

286

MCQeasy

A company is deploying an internet-facing application in AWS. The application must only accept traffic from specific IP addresses of business partners. Which AWS service should be used to enforce this restriction?

A.Network ACLs with inbound allow rules

B.Security Groups with inbound allow rules

C.Amazon Route 53 geoproximity routing

D.AWS WAF with an IP set rule

AnswerD

AWS WAF can filter traffic based on IP addresses using IP sets.

Why this answer

AWS WAF with an IP set rule is the correct choice because it operates at the application layer (Layer 7) and can inspect HTTP/HTTPS requests to allow or block traffic based on source IP addresses. This service is specifically designed to filter web traffic to internet-facing applications, making it ideal for enforcing IP-based restrictions from business partners. Network ACLs and Security Groups operate at the network and instance levels, respectively, and cannot provide the granular, application-layer control required for this use case.

Exam trap

The ANS-C01 exam often tests the misconception that Security Groups or Network ACLs are sufficient for application-layer IP filtering, but they operate at lower network layers and cannot inspect HTTP traffic or be applied to services like CloudFront or ALB for IP-based allow lists.

How to eliminate wrong answers

Option A is wrong because Network ACLs are stateless and operate at the subnet level (Layer 3/4), not at the application layer, and they cannot inspect HTTP/HTTPS traffic or provide the granular IP-based filtering needed for an internet-facing application. Option B is wrong because Security Groups are stateful and operate at the instance level (Layer 3/4), but they are designed for EC2 instance traffic control and cannot be applied directly to an internet-facing application like an Application Load Balancer or CloudFront distribution for IP-based allow lists. Option C is wrong because Amazon Route 53 geoproximity routing is a DNS-based traffic routing policy that directs users based on geographic location, not a security mechanism to enforce IP allow lists; it does not block traffic at the application layer.

Full explanation →

287

MCQeasy

A company has a VPC with a CIDR of 10.0.0.0/16. They have two subnets: 10.0.1.0/24 (public) and 10.0.2.0/24 (private). An EC2 instance in the private subnet needs to download patches from the internet. The team creates a NAT gateway in the public subnet and updates the private subnet route table to route 0.0.0.0/0 to the NAT gateway. The EC2 instance still cannot reach the internet. The team confirms the NAT gateway has an elastic IP and the public subnet has an internet gateway. What is the MOST likely cause?

A.The private subnet route table does not have a route for the NAT gateway's IP.

B.The network ACL for the private subnet denies outbound traffic to the internet.

C.The public subnet does not have a route to the internet gateway.

D.The NAT gateway does not have source/destination check disabled.

AnswerB

Network ACL must allow outbound ephemeral ports and inbound return traffic.

Why this answer

The most likely cause is that the network ACL (NACL) for the private subnet denies outbound traffic to the internet. Even though the route table correctly points 0.0.0.0/0 to the NAT gateway, the NACL is a stateless firewall that can block outbound traffic if it doesn't allow the necessary ephemeral ports. It must also allow inbound return traffic.

Option A is incorrect because the private subnet route table already has a route to the NAT gateway. Option C is incorrect because the public subnet already has a route to the internet gateway. Option D is incorrect because the NAT gateway is a managed service with source/destination check automatically disabled.

Full explanation →

288

Multi-Selecthard

A company has a VPC with public and private subnets. The security team wants to inspect all traffic leaving the VPC to the internet for malicious activity. Which THREE services should be used together to achieve this? (Choose three.)

Select 3 answers

A.VPC Flow Logs

B.Internet gateway

C.Amazon GuardDuty

D.AWS Network Firewall

E.NAT gateway

AnswersA, C, E

Captures network traffic metadata for analysis.

Why this answer

A NAT gateway (E) enables outbound traffic from private subnets to the internet. VPC Flow Logs (A) capture metadata of traffic flows. Amazon GuardDuty (C) can analyze flow logs to detect malicious activity.

Together, these three services allow inspection of all outbound traffic. Option B (Internet gateway) is for inbound traffic from the internet. Option D (AWS Network Firewall) can also inspect traffic but is not part of this common three-service combination.

Full explanation →

289

MCQhard

A company is designing a network for a real-time gaming application that requires the lowest possible latency across AWS Regions. The application uses UDP traffic. Which AWS service should be used to optimize traffic routing?

A.AWS Direct Connect with multiple connections.

B.AWS Global Accelerator.

C.Amazon Route 53 with latency-based routing.

D.Amazon CloudFront with custom origins.

AnswerB

Global Accelerator supports UDP and uses the AWS backbone to reduce latency.

Why this answer

AWS Global Accelerator uses the Anycast IP address concept to route UDP traffic over the AWS global network, minimizing latency by directing traffic to the nearest healthy endpoint. It is specifically designed for real-time applications like gaming that require low latency and jitter, and it supports UDP traffic natively.

Exam trap

AWS often tests the misconception that DNS-based routing (like Route 53 latency routing) provides the same latency optimization as Global Accelerator, but the trap is that DNS routing only affects the initial resolution and does not control the actual network path for ongoing UDP traffic, while Global Accelerator optimizes every packet in real time.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect provides dedicated private connectivity but does not optimize traffic routing across regions for latency; it is a physical connection to a single region and does not use Anycast or global path optimization. Option C is wrong because Amazon Route 53 with latency-based routing operates at the DNS level, which introduces DNS caching and resolution delays, and it does not optimize the actual network path for UDP traffic after the initial DNS lookup. Option D is wrong because Amazon CloudFront is a content delivery network optimized for HTTP/HTTPS traffic and does not support UDP traffic; it is designed for web content acceleration, not real-time gaming UDP streams.

Full explanation →

290

MCQeasy

A company wants to monitor network traffic between VPCs in the same AWS Region that are connected via VPC Peering. Which AWS service can provide visibility into the traffic?

A.VPC Flow Logs

B.AWS Config

C.AWS Direct Connect

D.AWS CloudTrail

AnswerA

VPC Flow Logs captures IP traffic for network interfaces, including those involved in VPC peering connections.

Why this answer

VPC Flow Logs can be enabled on the peering connection to capture traffic. Option B is wrong because AWS Config does not capture network traffic. Option C is wrong because AWS Direct Connect is for on-premises connectivity, not VPC traffic monitoring.

Option D is wrong because AWS CloudTrail does not capture network traffic (it logs API calls).

Full explanation →

291

MCQhard

A company has a VPC with public and private subnets. The public subnet has a NAT gateway for outbound internet access from private subnets. The private subnets have EC2 instances that need to access an S3 bucket in the same region. The company wants to minimize data transfer costs and avoid traversing the internet. What is the MOST cost-effective solution?

A.Configure an S3 bucket policy that restricts access to the VPC's public IP addresses.

B.Create a VPC Gateway Endpoint for S3 and attach a policy allowing access from the private subnets.

C.Route traffic to the NAT gateway and then to the S3 bucket using a VPC peering connection.

D.Create a VPC Interface Endpoint for S3 and associate with the private subnets.

AnswerB

Gateway endpoints are free and keep traffic within AWS network.

Why this answer

A VPC Gateway Endpoint for S3 allows private subnet instances to access S3 over the AWS network without traversing the internet or a NAT gateway, eliminating data transfer costs for the NAT gateway and avoiding internet egress charges. This is the most cost-effective solution because gateway endpoints are free and use prefix lists in the route table to direct traffic to S3 via the AWS backbone.

Exam trap

AWS often tests the misconception that interface endpoints are always the best choice for AWS service access, but for S3 and DynamoDB, gateway endpoints are the most cost-effective because they are free and avoid the per-GB data processing charges of interface endpoints.

How to eliminate wrong answers

Option A is wrong because restricting access to the VPC's public IP addresses does not address routing; private instances still need a path to S3, and this policy alone does not prevent traffic from going through the NAT gateway or internet. Option C is wrong because routing traffic to the NAT gateway and then to S3 via a VPC peering connection is unnecessary, incurs NAT gateway data processing and hourly charges, and VPC peering is not used for S3 access—S3 is a service endpoint, not a peered VPC. Option D is wrong because a VPC Interface Endpoint for S3 incurs hourly charges and per-GB data processing costs, making it more expensive than a gateway endpoint, which is free and designed for S3 and DynamoDB access within the same region.

Full explanation →

292

MCQmedium

Refer to the exhibit. A company has attached the IAM policy to an S3 bucket named example-bucket. Users report they cannot access objects in the bucket even when coming from the allowed IP range. What is the most likely cause?

A.The policy syntax is invalid because of the Principal element

B.The IP address range in the condition does not match the users' IP

C.The condition uses aws:SourceIp incorrectly

D.S3 Block Public Access settings are enabled, overriding the policy

AnswerD

Block Public Access denies all public access even if the bucket policy allows it.

Why this answer

The policy allows anonymous access (Principal: "*") from a specific IP range. However, S3 Block Public Access settings can override bucket policies by blocking any public access. If S3 Block Public Access is enabled at the account or bucket level, it will deny all public access regardless of the bucket policy.

Thus, even though the policy is valid, the Block Public Access setting prevents access. Option D is correct because S3 Block Public Access settings override the policy. Option A is incorrect because the Principal element of "*" is valid for a bucket policy.

Option B is incorrect because the condition correctly restricts to the specified IP range; the issue is broader than IP mismatch. Option C is incorrect because aws:SourceIp is used correctly in the condition.

Full explanation →

293

MCQmedium

A company has a Direct Connect connection with a private virtual interface to a VPC. They want to use the same Direct Connect connection to access another VPC in the same region. Which solution should they implement?

A.Create a second private virtual interface to the second VPC.

B.Set up a Site-to-Site VPN over the Direct Connect connection to the second VPC.

C.Use a Transit Gateway and a transit virtual interface.

D.Order a second Direct Connect connection.

AnswerC

Transit VIF connects to TGW, which can attach to multiple VPCs.

Why this answer

A Transit Gateway (TGW) allows you to attach multiple VPCs and a Direct Connect Gateway (DXGW) via a transit virtual interface (VIF). This enables a single Direct Connect connection to route traffic to multiple VPCs in the same region without additional physical connections or private VIFs. The TGW acts as a central hub, simplifying network architecture and reducing operational overhead.

Exam trap

The ANS-C01 exam often tests the misconception that a private virtual interface can be shared across multiple VPCs directly, but the correct approach requires a Transit Gateway and a transit virtual interface to aggregate connectivity.

How to eliminate wrong answers

Option A is wrong because a private virtual interface is a Layer 2 connection that can only be associated with a single VPC (or a single Direct Connect Gateway); creating a second private VIF on the same Direct Connect connection would require a separate VLAN and is not supported for multiple VPCs without a Transit Gateway. Option B is wrong because a Site-to-Site VPN over Direct Connect is unnecessary and inefficient; it adds encryption overhead and complexity when the traffic is already within the AWS network, and it does not leverage the native Direct Connect integration for multi-VPC connectivity. Option D is wrong because ordering a second Direct Connect connection is an expensive and redundant solution; the existing connection can be reused with a Transit Gateway and a transit VIF to connect multiple VPCs, avoiding additional cost and provisioning delays.

Full explanation →

294

MCQeasy

A company has a VPC with a public subnet containing a NAT gateway and a private subnet containing EC2 instances. The EC2 instances need to download patches from the internet. The security team wants to ensure that the EC2 instances cannot initiate outbound connections to any other internet destinations. What should the network engineer do?

A.Remove the NAT gateway and attach an Internet Gateway to the private subnet route table.

B.Attach an egress-only Internet Gateway to the VPC and route private subnet traffic to it.

C.Configure a network ACL on the private subnet to allow outbound traffic only to the patch server's IP address.

D.Assign a security group to the EC2 instances that allows outbound HTTPS traffic only to the patch server's IP address.

AnswerD

Correct: Security groups can restrict outbound traffic to specific destinations.

Why this answer

Security groups act as a virtual firewall for EC2 instances, allowing you to specify outbound rules that restrict traffic to only the necessary destinations, such as the patch server's IP address on HTTPS. This provides granular control over outbound traffic. Option A is incorrect because removing the NAT gateway and attaching an internet gateway to the private subnet would give instances direct internet access, violating the restriction.

Option B is incorrect because an egress-only internet gateway is used for IPv6 traffic only, not IPv4. Option C is incorrect because network ACLs are stateless and apply to the subnet as a whole, making them less suitable for per-instance granular control; they also require rules for return traffic, complicating the configuration.

Full explanation →

295

MCQmedium

A company has multiple VPCs connected via VPC peering. They want to simplify network management and reduce the number of peering connections. Which AWS service should they use?

A.AWS PrivateLink

B.AWS VPN CloudHub

C.AWS Transit Gateway

D.AWS Direct Connect Gateway

AnswerC

Transit Gateway provides hub-and-spoke connectivity.

Why this answer

Transit Gateway acts as a hub to connect multiple VPCs and on-premises networks, reducing the need for full mesh peering.

Full explanation →

296

MCQeasy

A company has a Direct Connect connection with a private virtual interface to a VPC. The network team wants to monitor the bandwidth utilization of the Direct Connect connection. They have enabled VPC Flow Logs for the VPC, but the flow logs do not show traffic that traverses the Direct Connect. The team needs a solution to capture the bandwidth usage of the Direct Connect connection. Which solution should they implement?

A.Use CloudWatch metrics for the Direct Connect connection.

B.Enable AWS CloudTrail for the Direct Connect connection.

C.Enable VPC Flow Logs on the Direct Connect virtual interface.

D.Use AWS Config rules to monitor bandwidth.

AnswerA

CloudWatch provides Direct Connect metrics.

Why this answer

Direct Connect publishes metrics to CloudWatch, including bandwidth utilization, connection state, and BGP status. These metrics can be used to monitor the bandwidth usage of the Direct Connect connection. VPC Flow Logs capture IP traffic within the VPC, not traffic on the Direct Connect physical connection.

Option B is wrong because CloudTrail logs API calls, not bandwidth metrics. Option C is wrong because flow logs cannot be enabled on a Direct Connect virtual interface; they only capture traffic on VPC network interfaces. Option D is wrong because AWS Config rules are used for compliance and configuration monitoring, not for bandwidth metrics.

Full explanation →

297

MCQhard

A network engineer is troubleshooting intermittent connectivity issues between an EC2 instance in a private subnet and an RDS database in another VPC connected via a VPC peering connection. The connection works for a few minutes and then drops. CloudWatch logs show no errors on the peering connection. What should the engineer check first?

A.The DNS resolution settings of the VPC peering connection.

B.The network ACL of the subnet where the EC2 instance resides.

C.The security group attached to the RDS database allowing traffic from the EC2 instance.

D.The route tables in both VPCs to ensure they have routes pointing to the peering connection for the respective CIDR blocks.

AnswerD

Missing or incorrect routes can cause asymmetric routing and drops.

Why this answer

Intermittent connectivity over a VPC peering connection is often caused by missing or incorrect route table entries. Traffic must be able to return from the RDS database VPC to the EC2 instance VPC, so both VPCs need routes pointing to the peering connection for the respective CIDR blocks. Option A is incorrect because DNS resolution settings affect name resolution, not connectivity drops.

Option B is incorrect because network ACLs are stateless and would cause consistent blocking, not intermittent drops. Option C is incorrect because security groups are stateful and allow return traffic automatically; they would not cause intermittent issues once allowed.

Full explanation →

298

MCQhard

A company has a VPC with a CIDR block of 10.0.0.0/16. It has two subnets: subnet A (10.0.1.0/24) and subnet B (10.0.2.0/24). Both subnets have a route to an Internet Gateway. An EC2 instance in subnet A has a security group that allows inbound HTTP from 0.0.0.0/0. The instance's network ACL allows inbound HTTP from 0.0.0.0/0. Users report they cannot access the web server. What is the most likely cause?

A.The instance does not have a public IP address

B.The network ACL inbound rule is incorrectly configured

C.The security group is not associated with the instance

D.The route table does not have a route to the Internet Gateway

AnswerA

Without a public IP, the instance is not reachable from the internet.

Why this answer

The most likely cause is that the EC2 instance does not have a public IP address. Even though the security group and network ACL allow inbound HTTP from 0.0.0.0/0, and the subnet has a route to an Internet Gateway (IGW), the instance must have a public IPv4 address (or an Elastic IP) for the IGW to translate its private IP to a public IP and route traffic from the internet. Without a public IP, the IGW cannot forward inbound traffic to the instance, making it unreachable from the internet.

Exam trap

The trap here is that candidates often assume that allowing traffic in both the security group and network ACL is sufficient, overlooking the fundamental requirement of a public IP address for internet-facing communication via an Internet Gateway.

How to eliminate wrong answers

Option B is wrong because the network ACL inbound rule is explicitly stated as allowing HTTP from 0.0.0.0/0, so it is correctly configured and not the cause. Option C is wrong because the security group is described as allowing inbound HTTP from 0.0.0.0/0, and if it were not associated with the instance, the instance would have no security group rules (default deny), but the question implies it is associated; the issue is not association but the lack of a public IP. Option D is wrong because the question states both subnets have a route to an Internet Gateway, so the route table is correctly configured.

Full explanation →

299

MCQhard

An organization uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. They want to implement traffic inspection between VPCs using a third-party firewall appliance in a central VPC. The firewall must inspect traffic for all inter-VPC flows. Which architecture meets this requirement?

A.Configure Transit Gateway route tables to send inter-VPC traffic to the inspection VPC's attachment, and enable appliance mode on the attachment.

B.Create VPC peering connections between all VPCs and route traffic through the central VPC.

C.Use a Network Load Balancer in the central VPC to distribute traffic to the firewall appliances.

D.Set up Direct Connect gateways and route all traffic through the on-premises network for inspection.

AnswerA

Appliance mode ensures that return traffic is sent back through the same firewall, enabling stateful inspection.

Why this answer

Enabling appliance mode on a Transit Gateway attachment forces the Transit Gateway to preserve the source MAC address and use flow hash-based load balancing for traffic sent to the inspection VPC. This ensures that all inter-VPC traffic is routed through the third-party firewall appliance in the central VPC, allowing stateful inspection to work correctly. Without appliance mode, the Transit Gateway would perform MAC address rewriting, breaking the firewall's ability to track sessions.

Exam trap

The trap here is that candidates often assume VPC peering or a Network Load Balancer can be used for transitive routing or traffic interception, but they fail to recognize that Transit Gateway with appliance mode is the only AWS-native way to force all inter-VPC traffic through a central inspection VPC while preserving stateful firewall session integrity.

How to eliminate wrong answers

Option B is wrong because VPC peering connections do not support transitive routing; traffic between two peered VPCs cannot be routed through a third VPC, making it impossible to force all inter-VPC flows through a central inspection VPC. Option C is wrong because a Network Load Balancer (NLB) in the central VPC cannot intercept traffic that is not destined for it; inter-VPC traffic flows directly between VPC attachments in the Transit Gateway, and an NLB would only handle traffic explicitly sent to its target group, not all inter-VPC flows. Option D is wrong because using Direct Connect gateways to route all traffic through on-premises for inspection adds unnecessary latency, complexity, and cost, and does not leverage the Transit Gateway's native inspection capabilities; it also violates the requirement of using a central VPC within AWS.

Full explanation →

300

MCQeasy

A company is designing a multi-tier application with web servers in public subnets and database servers in private subnets. The database servers should only be accessible from the web servers. Which AWS feature should be used to enforce this?

A.Security groups that reference the web server security group as a source

B.VPC endpoints to restrict access to the database servers

C.Network ACLs with allow rules for the web server subnet CIDR

D.Network ACLs with deny rules for all traffic except from the web server subnet

AnswerA

Security groups allow you to specify another security group as the source, enabling fine-grained access control.

Why this answer

Security groups are stateful and act as a virtual firewall for individual instances. By referencing the web server security group as a source in the database security group's inbound rules, you allow traffic only from instances in that security group. This provides granular control at the instance level.

Option B is incorrect because VPC endpoints are used to privately connect to AWS services, not to restrict database access. Options C and D are incorrect because network ACLs are stateless and applied at the subnet level, not at the instance level, and they require explicit allow rules for return traffic. Using a NACL with allow rules for the web server subnet CIDR would still allow any instance in that subnet, not just the web servers, and would require managing ephemeral ports.

Full explanation →

Page 4 of 22

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

Practice ANS-C01 by domain

Target a specific domain to shore up weak areas.

Network Management and Operations Network Security, Compliance and Governance Network Design Network Implementation

See all domains with question counts →