Knowledge + Practice

AWS Certified Advanced Networking Specialty ANS-C01 (ANS-C01) — Questions 301–375

1621 questions total · 22pages · All types, answers revealed

Take a mock exam Exam hub

Page 5 of 22

301

MCQmedium

A company is using AWS Transit Gateway to connect multiple VPCs and an on-premises network via AWS Direct Connect. The on-premises network advertises the 10.0.0.0/8 prefix. One VPC has a route to the Transit Gateway for 0.0.0.0/0. Instances in that VPC can reach the internet via a NAT gateway but cannot reach on-premises resources. What is the most likely issue?

A.The security group of the instances does not allow inbound traffic from on-premises

B.The Direct Connect virtual interface is not associated with the Transit Gateway

C.The VPC route table does not have a route to the on-premises CIDR via the Transit Gateway

D.The on-premises router is not advertising the 10.0.0.0/8 prefix to AWS

AnswerC

A specific route for 10.0.0.0/8 via Transit Gateway must exist.

Why this answer

The VPC route table must have a specific route for the on-premises CIDR (10.0.0.0/8) pointing to the Transit Gateway. Without it, traffic destined for on-premises will use the 0.0.0.0/0 default route and go to the NAT gateway instead of the Transit Gateway. Option A is incorrect because the issue is routing, not security groups.

Option B is incorrect because the Direct Connect virtual interface must be associated with the Transit Gateway for connectivity, but the question states it is connected, and the problem is likely missing specific routes. Option D is incorrect because the on-premises router is advertising the prefix, but the VPC route table lacks the specific route.

Full explanation →

302

Multi-Selecteasy

A company has an AWS Direct Connect connection and wants to connect to multiple VPCs in the same region. Which TWO services can be used to achieve this? (Choose TWO.)

Select 2 answers

A.VPC Peering

B.AWS Transit Gateway

C.AWS Site-to-Site VPN

D.Direct Connect Gateway

E.AWS CloudHub

AnswersB, D

Transit Gateway can connect multiple VPCs and Direct Connect.

Why this answer

AWS Transit Gateway (Option B) acts as a central hub that interconnects VPCs and on-premises networks via a single Direct Connect connection, allowing you to connect to multiple VPCs in the same region without needing individual virtual interfaces. Direct Connect Gateway (Option D) enables you to associate multiple VPCs in the same or different regions with a single Direct Connect connection by using a single private virtual interface (VIF) and transit virtual interfaces (VIFs) to reach those VPCs through Transit Gateway or virtual private gateways.

Exam trap

The trap here is that candidates often confuse VPC Peering (Option A) as a way to extend Direct Connect connectivity to multiple VPCs, but VPC Peering does not support transitive routing and cannot be used to route traffic from Direct Connect to multiple VPCs without a central hub like Transit Gateway.

Full explanation →

303

MCQhard

Refer to the exhibit. A network engineer is analyzing a VPC Flow Log record from a VPC with CIDR 10.0.0.0/16. The record indicates a REJECT action. Which component is most likely blocking the traffic?

A.The destination instance's operating system firewall

B.A missing route in the route table

C.The destination instance's security group

D.The network ACL of the destination subnet

AnswerC

Security groups evaluate inbound rules and can REJECT traffic.

Why this answer

Flow logs record traffic after security group and NACL evaluation. A REJECT indicates the traffic was dropped by a security group or NACL. Since the destination port is 80 (HTTP), a security group is likely blocking inbound HTTP.

Option C is correct. Option A is wrong because the source IP is within the VPC. Option B is wrong because there is no indication of a missing route.

Option D is wrong because NACL rules are stateless and would show REJECT if they block, but security groups are more common for instance-level blocking.

Full explanation →

304

MCQhard

A financial services company has a multi-account AWS environment managed via AWS Organizations. The security team needs to enforce that all Amazon S3 buckets across the organization are encrypted with AWS KMS using a specific customer managed key (CMK) from the security account. Currently, some accounts have S3 buckets with SSE-S3 encryption or no encryption. The security team must not be able to read the data in the buckets, but must be able to detect and remediate non-compliant buckets. The solution must use AWS native services and minimize operational overhead. Which combination of actions should the security team take?

A.Enable AWS Config in each member account individually and create a custom rule using AWS Lambda to check bucket encryption, then send compliance results to the security account via Amazon EventBridge.

B.Use a service control policy (SCP) to deny s3:PutObject unless the request includes a specific KMS key ID.

C.Create an AWS Config rule in the security account with an organization conformance pack to check bucket encryption settings, and use an automatic remediation action with AWS Systems Manager Automation to apply the required KMS key.

D.Enable AWS CloudTrail in the security account and create a metric filter to detect PutBucketEncryption API calls, then trigger a Lambda function to remediate.

AnswerC

This solution uses AWS Config rules to continuously evaluate compliance, and automatic remediation ensures non-compliant buckets are fixed. The security team can view compliance status without data access.

Why this answer

AWS Config organization conformance packs allow centralized definition of a custom rule to check S3 bucket encryption settings across all accounts. Automatic remediation via Systems Manager Automation can apply the required KMS key to non-compliant buckets without granting the security team data access. Option A is incorrect because it requires per-account AWS Config setup and custom Lambda rules, increasing operational overhead and lacking centralized enforcement.

Option B is incorrect because SCPs cannot enforce encryption settings on existing buckets and only apply to IAM principals, not to S3 service actions like bucket configuration; they also cannot detect or remediate non-compliant configurations. Option D is incorrect because CloudTrail trails only log API calls and cannot proactively detect existing bucket encryption settings; metric filters are reactive and not suitable for continuous compliance monitoring.

Full explanation →

305

Multi-Selecthard

A company is designing a network security architecture for a multi-tier web application. Which THREE best practices should they implement? (Choose three.)

Select 3 answers

A.Attach an internet gateway to the private subnet for outbound traffic

B.Use security groups as a stateless firewall

C.Use network ACLs as a stateless firewall for subnet-level traffic

D.Place databases in private subnets with no direct internet access

E.Use security groups to control traffic at the instance level

AnswersC, D, E

NACLs are stateless and provide subnet-level filtering.

Why this answer

The correct answers are C, D, and E. Option C is correct because network ACLs provide a stateless firewall at the subnet level. Option D is correct because databases in private subnets have no direct internet access, enhancing security.

Option E is correct because security groups control traffic at the instance level. Option A is wrong because internet gateways should be attached to public subnets, not private. Option B is wrong because security groups are stateful, not stateless.

Full explanation →

306

MCQmedium

Based on the route table, which of the following is true?

A.The route table is the main route table for the VPC

B.The subnet is connected to a Transit Gateway

C.The subnet has a VPN connection to a network with CIDR 172.31.0.0/16

D.The subnet is a private subnet with no internet access

AnswerC

The route to vgw for 172.31.0.0/16 indicates a VPN connection.

Why this answer

The route table includes a route for destination 172.31.0.0/16 pointing to a virtual private gateway (vgw-xxxx), which is used for a VPN connection. This indicates that the subnet associated with this route table has a VPN connection to a network with CIDR 172.31.0.0/16, as the route directs traffic for that CIDR to the VPN gateway.

Exam trap

The trap here is that candidates often confuse a virtual private gateway (used for VPN/Direct Connect) with a Transit Gateway, or assume that any route to a non-local CIDR implies a Transit Gateway, when in fact the route target (vgw vs. tgw) is the key differentiator.

How to eliminate wrong answers

Option A is wrong because the main route table for a VPC cannot have a route pointing to a virtual private gateway unless explicitly added, but more importantly, the route table shown is not identified as the main route table (it lacks the 'Main' designation in the console). Option B is wrong because the route table does not contain any route pointing to a transit gateway (tgw-xxxx); the only gateway target is a virtual private gateway (vgw-xxxx), which is used for VPN or Direct Connect, not Transit Gateway. Option D is wrong because the route table includes a local route for the VPC CIDR and a route to an internet gateway (igw-xxxx) for 0.0.0.0/0, which means the subnet is a public subnet with internet access, not a private subnet.

Full explanation →

307

Multi-Selecthard

A company is using AWS Transit Gateway with multiple VPCs and Direct Connect Gateway. They want to ensure that traffic between VPCs and on-premises is encrypted. Which TWO solutions can achieve this?

Select 2 answers

A.Enable MACsec on the Direct Connect connection

B.Create a VPN attachment on the Transit Gateway and configure IPsec VPN to on-premises

C.Use Transit Gateway IPsec VPN to encrypt traffic between VPCs

D.Enable IPsec on the private virtual interface

E.Use VPC peering with encryption

AnswersA, B

MACsec encrypts at Layer 2 between customer router and AWS.

Why this answer

The correct answers are A and B. MACsec (802.1ae) encrypts traffic at Layer 2 on the Direct Connect connection, providing encryption between the on-premises device and AWS. A VPN attachment on the Transit Gateway establishes an IPsec VPN between the Transit Gateway and an on-premises VPN device, encrypting traffic at Layer 3.

Option C is incorrect because Transit Gateway does not have native IPsec capabilities; it relies on VPN attachments for IPsec. Option D is incorrect because IPsec is not supported over a private virtual interface; IPsec is typically used over a public virtual interface or a VPN connection. Option E is incorrect because VPC peering does not extend to on-premises traffic; it is only between VPCs.

Full explanation →

308

Multi-Selecthard

Which TWO actions are recommended to troubleshoot asymmetric routing in a VPC with multiple NAT gateways?

Select 2 answers

A.Enable source/destination check on all EC2 instances

B.Use a Network Load Balancer to distribute traffic

C.Disable VPC Flow Logs

D.Use a single NAT gateway per Availability Zone

E.Ensure route tables point to the NAT gateway in the same subnet's Availability Zone

AnswersD, E

This ensures consistent routing within an AZ.

Why this answer

Asymmetric routing occurs when traffic takes different paths. Using a single NAT gateway per AZ and ensuring route tables point to the NAT gateway in the same subnet's AZ can prevent this. Additionally, disabling source/destination check on instances that do not need it can help, but for NAT gateways, this is not configurable.

Full explanation →

309

Multi-Selectmedium

A company is using AWS Client VPN to provide remote access to their VPC. Users report that they can connect to the VPN but cannot reach resources in the VPC. Which THREE configuration items should the engineer verify?

Select 3 answers

A.The authorization rules allow access to the VPC's CIDR.

B.The Client VPN endpoint is associated with the correct subnets.

C.The Client VPN endpoint has a public IP address.

D.The security groups attached to the target resources allow traffic from the VPN CIDR.

E.The client certificate is issued by a valid CA.

AnswersA, B, D

Authorization rules define which networks users can access.

Why this answer

Authorization rules in AWS Client VPN define which networks (CIDRs) users are allowed to access. If the rule does not include the VPC's CIDR, traffic to resources in the VPC will be dropped even though the VPN tunnel is established. This is a common misconfiguration that prevents resource reachability.

Exam trap

The ANS-C01 exam often tests the distinction between authentication (certificate validity) and authorization (network access rules), leading candidates to incorrectly select certificate issues when the problem is actually about routing or security group rules.

Full explanation →

310

Multi-Selectmedium

Which TWO options are valid methods to connect multiple VPCs together in a hub-and-spoke topology? (Select TWO.)

Select 2 answers

A.VPC peering

B.AWS Direct Connect

C.VPC Endpoints

D.AWS Site-to-Site VPN

E.AWS Transit Gateway

AnswersA, E

Can be used to create hub-and-spoke.

Why this answer

VPC peering (A) is a valid method because it establishes a direct, one-to-one network connection between two VPCs using the AWS global backbone, enabling private IPv4 or IPv6 communication without gateways or VPNs. AWS Transit Gateway (E) is valid because it acts as a central hub that connects multiple VPCs and on-premises networks through a single, scalable gateway, simplifying the hub-and-spoke topology management.

Exam trap

AWS often tests the misconception that AWS Direct Connect or Site-to-Site VPN can directly interconnect multiple VPCs, but these are designed for on-premises connectivity, not VPC-to-VPC peering or transit routing.

Full explanation →

311

MCQeasy

A company wants to design a highly available architecture for a web application that runs on EC2 instances in an Auto Scaling group across multiple Availability Zones. The application must be able to handle sudden traffic spikes. Which load balancing solution provides the best combination of high availability, automatic scaling, and SSL offloading?

A.Amazon CloudFront with an origin pointing to the Auto Scaling group

B.Network Load Balancer

C.Application Load Balancer

D.Classic Load Balancer

AnswerC

ALB provides SSL termination, health checks, and integrates with Auto Scaling.

Why this answer

The Application Load Balancer (ALB) is the correct choice because it operates at Layer 7, supports content-based routing, integrates natively with Auto Scaling groups for automatic scaling, and provides SSL offloading (TLS termination) at the load balancer. This combination ensures high availability across multiple Availability Zones while handling sudden traffic spikes through elastic scaling of both the ALB and the backend EC2 instances.

Exam trap

The ANS-C01 exam often tests the misconception that a Network Load Balancer (NLB) is always the best for high availability and scaling, but candidates forget that SSL offloading is a Layer 7 function that only the Application Load Balancer (or Classic Load Balancer with limited support) can perform natively.

How to eliminate wrong answers

Option A is wrong because Amazon CloudFront is a content delivery network (CDN) that caches content at edge locations; it does not perform load balancing or SSL offloading for dynamic traffic spikes, and its origin pointing to an Auto Scaling group does not provide the same level of automatic scaling and health-check-driven traffic distribution as a regional load balancer. Option B is wrong because a Network Load Balancer (NLB) operates at Layer 4 and does not support SSL offloading (TLS termination) natively; it forwards encrypted traffic to targets, requiring the backend instances to handle decryption, which contradicts the requirement for SSL offloading. Option D is wrong because the Classic Load Balancer (CLB) is a legacy option that lacks advanced features like path-based routing, native HTTP/2 support, and the same level of integration with Auto Scaling groups; it also has limited scalability and is not recommended for modern architectures.

Full explanation →

312

Multi-Selecthard

A company has a VPC with both IPv4 and IPv6 CIDR blocks. The network engineer needs to capture all traffic between the VPC and the internet. Which THREE resources must have VPC Flow Logs enabled?

Select 3 answers

A.Internet gateway

B.NAT gateway

C.Subnet

D.VPC

E.Egress-only internet gateway

AnswersA, B, E

The internet gateway's ENI captures traffic to/from the internet.

Why this answer

Options A (Internet gateway), B (NAT gateway), and E (Egress-only internet gateway) are correct because each of these resources has an attached network interface that can have VPC Flow Logs enabled to capture all traffic to and from the internet. Specifically, the internet gateway handles IPv4 and IPv6 traffic, the NAT gateway handles IPv4 traffic from private subnets, and the egress-only internet gateway handles IPv6 traffic from private subnets. Option C (Subnet) is incorrect because flow logs are configured on network interfaces, not on subnets directly.

Option D (VPC) is incorrect because flow logs are not attached to the VPC itself; they are attached to individual network interfaces.

Full explanation →

313

MCQhard

A company runs a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all S3 buckets across all accounts are encrypted with AWS KMS and that bucket policies restrict access to specific IAM roles. They have created an SCP that denies s3:PutBucketPolicy unless the bucket is encrypted with KMS (using a condition) and restricts the PutBucketPolicy action to a specific role. After applying the SCP, the development team reports that they cannot update bucket policies even when using the allowed role. The SCP is attached to the root OU. The allowed role is in the dev account and has full S3 permissions via an IAM policy. What is the most likely reason for the failure?

A.The SCP denies s3:PutBucketPolicy for all principals except the allowed role, but the SCP is applied at the root OU and affects all accounts, so the allowed role is still denied because SCPs are deny-by-default and the allow list in the SCP does not override the implicit deny.

B.The SCP must be applied to the dev account specifically, not the root OU, because SCPs attached to OUs do not affect member accounts unless explicitly inherited.

C.The SCP condition key for KMS encryption is incorrect because the s3:PutBucketPolicy action does not support condition keys for encryption.

D.The IAM policy attached to the allowed role does not include s3:PutBucketPolicy permission, even though it has full S3 access.

AnswerA

SCPs are deny-by-default. An SCP that denies an action unless a specific role is used effectively denies all other principals. But if the SCP has an Allow effect for the specific role, it still does not grant permission; it only removes the deny. However, the issue is that the SCP likely has a Deny statement with a condition that the role should not be denied, but if the condition is not met, the deny applies. The stem suggests the SCP restricts PutBucketPolicy to a specific role; if the SCP is written as a Deny for all principals except that role, it works only if the role ARN matches. The most common mistake is that the SCP uses a NotPrincipal element incorrectly, causing the deny to apply to everyone.

Full explanation →

314

MCQhard

A company is using Amazon Route 53 for DNS resolution. They want to restrict access to a private hosted zone so that only authorized VPCs can query it. Which configuration should they use?

A.Configure a network ACL to block UDP port 53 from other VPCs

B.Create an IAM policy to deny DNS queries from other VPCs

C.Configure a security group to block DNS traffic from other VPCs

D.Associate the private hosted zone with the authorized VPCs

AnswerD

Private hosted zones are accessible only to associated VPCs.

Why this answer

Associating a private hosted zone with authorized VPCs allows only those VPCs to resolve records within the zone, restricting access as required. Option A is incorrect because network ACLs control traffic at the subnet level but do not restrict DNS queries to a specific hosted zone. Option B is incorrect because IAM policies control permissions for API actions (e.g., creating or modifying hosted zones), not the actual DNS query traffic.

Option C is incorrect because security groups regulate traffic to and from network interfaces, not the resolution of DNS records in Route 53.

Full explanation →

315

MCQhard

A network engineer is troubleshooting connectivity issues between two VPCs that are connected via VPC peering. The VPCs are in the same region and have overlapping CIDR blocks. The engineer can ping the private IP of an instance in the peered VPC from an instance in the first VPC. However, traffic on TCP port 443 (HTTPS) fails. Which is the most likely cause?

A.The network ACL in the target subnet is blocking inbound HTTPS traffic

B.The security group of the target instance does not allow inbound HTTPS traffic from the source

C.The VPC peering connection is not in the 'active' state

D.The route tables in both VPCs do not have routes to the peered VPC's CIDR

AnswerB

Security groups are stateful; ICMP may be allowed but HTTPS not.

Why this answer

The security group of the target instance must allow inbound HTTPS traffic from the source instance's security group or CIDR. Option A is incorrect because ICMP works, indicating that network ACLs are allowing traffic; network ACLs are stateless and would block ICMP if misconfigured. Option C is incorrect because the VPC peering connection must be active for any traffic to pass, and ICMP works.

Option D is incorrect because route tables must have routes to the peered VPC's CIDR for traffic to flow, and ICMP works.

Full explanation →

316

MCQeasy

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. They need to add an additional non-overlapping CIDR to the VPC. What is a valid CIDR block they can add?

A.10.0.1.0/24

B.10.1.0.0/16

C.10.0.0.0/8

D.10.0.0.0/16

AnswerB

Non-overlapping, valid addition.

Why this answer

(10.1.0.0/16) is correct because it is a non-overlapping IPv4 CIDR block that does not conflict with the existing VPC CIDR of 10.0.0.0/16. In AWS, when adding a secondary CIDR to a VPC, the new block must be from the private IP address ranges (RFC 1918) and must not overlap with any existing CIDR blocks in the VPC. The 10.1.0.0/16 range is entirely separate from 10.0.0.0/16, as they are different /16 subnets within the 10.0.0.0/8 space.

Exam trap

The trap here is that candidates often assume any non-overlapping RFC 1918 block is valid, but they overlook that the new CIDR must not be a subset or superset of the existing CIDR, and AWS specifically requires the new block to be non-overlapping at the VPC level, not just at the subnet level.

How to eliminate wrong answers

Option A (10.0.1.0/24) is wrong because it falls within the existing VPC CIDR of 10.0.0.0/16, causing an overlap that AWS does not allow when adding a secondary CIDR. Option C (10.0.0.0/8) is wrong because it is a superset of the existing 10.0.0.0/16 and would overlap entirely, which is not permitted. Option D (10.0.0.0/16) is wrong because it is identical to the existing CIDR block, resulting in a direct overlap that AWS rejects.

Full explanation →

317

MCQeasy

A company is designing a VPC with a public subnet for web servers and a private subnet for database servers. The web servers must be able to access the internet for software updates, but the database servers must not have direct internet access. Which solution meets these requirements?

A.Use a VPC endpoint for Amazon S3 to provide internet access to the database servers.

B.Deploy a NAT gateway in the public subnet and add a route to it in the private subnet's route table.

C.Set up a VPN connection to an on-premises data center and route traffic through it.

D.Attach an internet gateway to the VPC and add a route to it in the private subnet's route table.

AnswerB

A NAT gateway allows outbound internet traffic from private subnets while blocking inbound traffic.

Why this answer

A NAT gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet while preventing inbound traffic from the internet. Option A is incorrect because a VPC endpoint for Amazon S3 only provides private access to S3, not general internet access. Option C is incorrect because a VPN connection to an on-premises data center does not provide internet access; it connects to the on-premises network.

Option D is incorrect because attaching an internet gateway to a private subnet's route table would allow direct inbound internet traffic, violating the requirement that database servers must not have direct internet access.

Full explanation →

318

Multi-Selecthard

A company has a global application deployed across multiple AWS regions. The application uses Application Load Balancers (ALBs) and Auto Scaling groups. The network team wants to route traffic to the nearest region based on latency, and also wants to failover to another region if the primary region becomes unhealthy. Which THREE services should be used together to achieve this? (Choose THREE.)

Select 3 answers

A.Amazon CloudFront with origin failover

B.Amazon Route 53 latency-based routing

C.Amazon CloudWatch alarms to detect regional health

D.AWS Lambda to update Route 53 records on failover

E.AWS Global Accelerator

AnswersB, C, D

Routes based on latency.

Why this answer

Route 53 latency-based routing (B) directs traffic to the region with the lowest latency. CloudWatch alarms (C) can monitor health metrics like ALB 5xx errors or instance health to detect regional failure. AWS Lambda (D) can be triggered by CloudWatch alarms to automatically update Route 53 records (e.g., change failover records or disable unhealthy records) to redirect traffic to a healthy region.

Option A (CloudFront with origin failover) is for content delivery and static origin failover, not dynamic routing based on latency and regional health. Option E (Global Accelerator) provides anycast IP and global traffic optimization but does not natively support latency-based routing to the nearest region with automatic failover based on CloudWatch alarms in the same manner; it has different health check mechanisms and is not the standard combination described.

Full explanation →

319

MCQhard

A company has a VPC with a CIDR of 10.0.0.0/16. They need to connect to two on-premises data centers, each with overlapping CIDR blocks (192.168.0.0/16). The company wants to use AWS Site-to-Site VPN with dynamic routing (BGP). Which design allows the VPC to reach both data centers without route conflicts?

A.Create two VPN connections to a single virtual private gateway and advertise the same CIDR from both data centers. Use BGP AS_PATH prepending to influence routing.

B.Create a single VPN connection with two tunnels to the same virtual private gateway. Use different BGP ASNs for each data center.

C.Create two separate virtual private gateways, each in a different VPC, and use VPC peering. Alternatively, use a transit gateway with separate VPN attachments and BGP communities to tag routes.

D.Create two VPN connections to the same virtual private gateway. Use static routes with different metric values.

AnswerC

Transit gateway with separate attachments and BGP communities can handle overlapping CIDRs by using route priority or filtering.

Why this answer

Overlapping CIDR blocks cannot be advertised to the same virtual private gateway (VPG) without causing route conflicts. By using a transit gateway with separate VPN attachments, each data center's routes are isolated in separate route tables, and BGP communities can be used to tag and differentiate routes. This design allows the VPC to reach both data centers by leveraging the transit gateway's ability to manage overlapping prefixes through separate route tables and path selection.

Exam trap

AWS often tests the misconception that a single virtual private gateway can handle overlapping CIDRs by using BGP attributes like AS_PATH prepending, but the fundamental limitation is that the VPG's route table cannot store duplicate prefixes, regardless of BGP attributes.

How to eliminate wrong answers

Option A is wrong because advertising the same CIDR from both data centers to a single VPG will cause the VPG to see duplicate routes, and AS_PATH prepending only influences route preference, not route uniqueness; the VPG cannot distinguish between the two overlapping prefixes, leading to routing conflicts. Option B is wrong because a single VPN connection with two tunnels still terminates on one VPG, and using different BGP ASNs does not resolve the issue of overlapping CIDRs; the VPG will still receive identical prefixes from both tunnels and cannot differentiate them. Option D is wrong because static routes with different metric values cannot be used with dynamic routing (BGP) as specified in the question; moreover, static routes to the same VPG for overlapping CIDRs would create ambiguity and the VPG would not know which tunnel to use for a given destination.

Full explanation →

320

MCQeasy

Refer to the exhibit. A flow log record shows ACCEPT for traffic from 10.0.1.5 to 10.0.2.10 on port 443. Which AWS service is most likely the destination?

A.Amazon RDS instance

B.Application Load Balancer

C.NAT Gateway

D.Amazon S3

AnswerB

ALB listens on port 443 for HTTPS.

Why this answer

An Application Load Balancer (ALB) terminates HTTPS (port 443) connections and forwards traffic to targets. Flow logs showing ACCEPT for traffic to port 443 on an ALB's internal IP (10.0.2.10) are expected because the ALB listens on that port for incoming client connections. The ALB operates at Layer 7 and is the only listed service that natively accepts HTTPS traffic on port 443 within a VPC.

Exam trap

AWS often tests the misconception that any service accepting HTTPS traffic must be an Amazon S3 endpoint, but S3 does not have a VPC private IP; the trap here is confusing a service's public endpoint with its internal VPC representation, leading candidates to pick S3 instead of recognizing the ALB's private IP and port 443 listener.

How to eliminate wrong answers

Option A is wrong because an Amazon RDS instance does not accept traffic on port 443 by default; it uses port 3306 (MySQL/Aurora), 5432 (PostgreSQL), or other database-specific ports, and HTTPS is not a native protocol for RDS. Option C is wrong because a NAT Gateway does not accept inbound traffic from private subnets; it only forwards outbound traffic from private instances to the internet and does not listen on port 443 for incoming connections. Option D is wrong because Amazon S3 is a global object storage service accessed via an S3 endpoint (e.g., bucket.s3.amazonaws.com) and does not have a VPC IP address like 10.0.2.10; S3 traffic uses HTTPS but the destination is an S3 API endpoint, not a private IP.

Full explanation →

321

MCQhard

A large financial services company is migrating its on-premises data center to AWS. The network design must meet strict low-latency requirements for trading applications that communicate with external exchanges. The company has two AWS Direct Connect connections from two different providers to two different AWS Direct Connect locations in the same region. They have a VPC with multiple subnets across three Availability Zones. The trading applications are deployed on EC2 instances in private subnets and need to communicate with external exchanges over the Direct Connect connections. The company also requires high availability and automatic failover if one Direct Connect connection fails. The network team has configured two virtual interfaces (VIFs) for private connectivity to the VPC, one on each Direct Connect connection, and has set up BGP sessions. However, during a failover test, traffic does not fail over as expected. The team notices that the VPC route tables have static routes pointing to the virtual private gateway (VGW) with the same prefix, but no BGP routes are propagated. What is the most likely cause of the failover issue, and what should be done to resolve it?

A.The VPC route tables do not have route propagation enabled for the VGW. Enable route propagation in the route tables.

B.The BGP timers are set too high, causing slow convergence. Reduce the BGP keepalive and hold timers.

C.The VPC route tables have static routes that are overriding the BGP routes. Remove the static routes and rely on BGP routes propagated through the VGW.

D.The BGP configuration on the on-premises router is using AS_PATH prepending, making the backup path less preferred. Remove AS_PATH prepending.

AnswerC

Static routes have higher priority than BGP routes, preventing failover.

Why this answer

The failover issue occurs because static routes in the VPC route tables take precedence over BGP-propagated routes, even when the BGP session goes down. Since the static routes point to the virtual private gateway (VGW) with the same prefix, traffic continues to use the failed Direct Connect connection instead of failing over to the active one. Removing the static routes and enabling route propagation allows BGP to dynamically update the route tables based on the availability of the Direct Connect connections.

Exam trap

AWS often tests the misconception that enabling route propagation alone ensures failover, but the trap here is that static routes in the VPC route table take precedence over BGP-propagated routes, so they must be removed for automatic failover to work.

How to eliminate wrong answers

Option A is wrong because route propagation is already implied to be disabled or not the primary issue; the problem is that static routes override BGP routes, not that propagation is missing. Option B is wrong because BGP timers affect convergence speed but do not prevent failover entirely; the core issue is route precedence, not timer values. Option D is wrong because AS_PATH prepending influences path selection on the on-premises side, not within the VPC route tables; the failover failure is due to static routes in the VPC, not BGP path preference.

Full explanation →

322

MCQmedium

A company has an AWS Transit Gateway with multiple VPC attachments. They need to inspect traffic between VPCs using a third-party firewall appliance. What is the best approach?

A.Create a firewall VPC with the appliance and use Transit Gateway route tables to direct traffic through it

B.Use VPC security groups across VPCs

C.Use AWS Network Firewall directly in each VPC

D.Use network ACLs on each VPC subnet

AnswerA

This allows centralized inspection via routing.

Why this answer

The best approach is to create a dedicated firewall VPC that hosts the third-party firewall appliance and use Transit Gateway (TGW) route tables to steer inter-VPC traffic through that VPC. By attaching the firewall VPC to the TGW and configuring route tables with static routes pointing to the firewall VPC attachment, all traffic between other VPCs can be forced to traverse the firewall for inspection. This provides centralized, scalable traffic inspection without requiring changes to individual VPC routing or security group configurations.

Exam trap

The ANS-C01 exam often tests the misconception that security groups or network ACLs can be used for inter-VPC traffic inspection, but they are per-VPC constructs that cannot inspect traffic traversing a Transit Gateway.

How to eliminate wrong answers

Option B is wrong because VPC security groups are stateful, per-instance firewalls that operate at the ENI level and cannot inspect or forward traffic between VPCs; they are not designed for inter-VPC traffic inspection. Option C is wrong because AWS Network Firewall is a managed service that can be deployed in a single VPC but does not natively integrate with Transit Gateway to inspect traffic between multiple VPCs without additional routing complexity and does not support third-party firewall appliances. Option D is wrong because network ACLs are stateless, subnet-level packet filters that cannot perform deep packet inspection or application-layer filtering, and they cannot be used to route traffic through an external firewall appliance.

Full explanation →

323

MCQhard

A company is deploying a latency-sensitive application across two AWS Regions using Application Load Balancers (ALBs) and AWS Global Accelerator. The application uses TCP port 8443. Which configuration ensures the lowest possible latency for global users?

A.Use Amazon CloudFront with the ALBs as origins.

B.Use Amazon Route 53 latency-based routing with ALB endpoints in each Region.

C.Use AWS Global Accelerator with endpoints as the ALBs in each Region.

D.Deploy a Network Load Balancer in each Region and use Route 53 geoproximity routing.

AnswerC

Global Accelerator uses anycast and AWS backbone for lower latency.

Why this answer

AWS Global Accelerator uses the Anycast static IP addresses to route traffic over the AWS global network to the optimal ALB endpoint, minimizing internet hops and latency. For TCP port 8443, Global Accelerator preserves the client IP and provides connection termination at the edge, ensuring the lowest possible latency for global users by avoiding the public internet.

Exam trap

The ANS-C01 exam often tests the misconception that CloudFront can handle any TCP port or that DNS-based routing (Route 53) can match the latency performance of edge-optimized services like Global Accelerator, leading candidates to overlook the protocol limitations and routing inefficiencies.

How to eliminate wrong answers

Option A is wrong because Amazon CloudFront is a content delivery network optimized for HTTP/HTTPS traffic and does not support TCP port 8443 as a custom protocol; it only supports HTTP/HTTPS and WebSocket, so it cannot handle non-HTTP TCP traffic. Option B is wrong because Route 53 latency-based routing relies on DNS resolution, which introduces caching delays and does not provide static IP addresses, leading to suboptimal routing and higher latency compared to Global Accelerator's edge routing. Option D is wrong because deploying Network Load Balancers with Route 53 geoproximity routing still depends on DNS-based routing, which lacks the edge optimization and static IP benefits of Global Accelerator, and NLB does not provide the same application-layer health checks and traffic management as ALB for TCP port 8443.

Full explanation →

324

MCQeasy

A network engineer is troubleshooting high latency to an application hosted in Amazon EC2. The application uses an Application Load Balancer. Which metrics in Amazon CloudWatch should be examined to identify if the load balancer is causing latency?

A.HTTP 5XX Count

B.ActiveConnectionCount

C.TargetResponseTime

D.RequestCount

AnswerC

TargetResponseTime measures the time taken by the target to respond, which directly indicates backend latency.

Why this answer

TargetResponseTime measures the time taken by the target to respond, which directly indicates backend latency. Option A (HTTP 5XX Count) is wrong because it indicates errors, not latency. Option B (ActiveConnectionCount) is wrong because it measures concurrent connections, not latency.

Option D (RequestCount) is wrong because it is a count of requests, not latency.

Full explanation →

325

MCQmedium

A company is designing a multi-region active-active architecture using Application Load Balancers (ALBs) and AWS Global Accelerator. The application servers are in private subnets behind Network Load Balancers (NLBs). The company needs to ensure that traffic from a client is consistently routed to the same ALB endpoint for the duration of a session. Which configuration should be used?

A.Configure cross-zone load balancing on the NLBs and enable stickiness on the target groups.

B.Enable proxy protocol on the NLB target groups and configure stickiness on the NLB.

C.Enable stickiness on the ALB target groups with a duration of 1 second.

D.Enable client IP address preservation on the Global Accelerator endpoint groups and configure stickiness on the ALB based on the client IP.

AnswerD

This ensures sessions are consistently routed to the same ALB based on the client's IP.

Why this answer

Global Accelerator preserves the client IP address when client IP address preservation is enabled on the endpoint group, allowing the ALB to see the original client IP. Configuring stickiness on the ALB based on the client IP ensures that all requests from the same client IP are routed to the same ALB endpoint for the duration of the session, which is essential for session persistence in an active-active multi-region architecture.

Exam trap

The trap here is that candidates often assume stickiness must be configured on the NLB or that proxy protocol is required, but they overlook that Global Accelerator can preserve the client IP, which is the key to enabling ALB-based stickiness using the client IP as the persistence key.

How to eliminate wrong answers

Option A is wrong because cross-zone load balancing and stickiness on the NLB target groups would only ensure persistence at the NLB level, not at the ALB level, and the NLB is not the endpoint that needs session affinity—the ALB is. Option B is wrong because enabling proxy protocol on the NLB target groups passes the client IP in a header, but stickiness on the NLB does not guarantee that the ALB will consistently route traffic to the same ALB endpoint; the ALB must handle stickiness itself. Option C is wrong because setting stickiness duration to 1 second is effectively disabling stickiness, as sessions would not persist long enough to maintain affinity for a meaningful session duration.

Full explanation →

326

MCQhard

A company has a VPC with multiple subnets. They want to enforce that all traffic between subnets must be inspected by a security appliance deployed in a centralized inspection VPC. Which AWS feature should be used to route traffic to the inspection VPC without changing the routing on each subnet?

A.VPC Peering

B.Transit Gateway with route tables

C.NAT Gateway

D.Network Load Balancer

AnswerB

Transit Gateway enables centralized routing and inspection.

Why this answer

A Transit Gateway with route tables allows central routing and inspection. Option A is wrong because VPC peering does not support centralized inspection easily. Option B is correct because Transit Gateway can route traffic between VPCs and subnets with centralized inspection.

Option C is wrong because NAT Gateway is for outbound internet traffic. Option D is wrong because a Network Load Balancer is for load balancing, not routing.

Full explanation →

327

MCQmedium

A network engineer is assigned an IAM policy to manage VPC resources. The engineer attempts to create a VPC with CIDR 10.0.0.0/16 and fails. What is the reason?

A.The resource ARN in the Deny statement does not match the VPC being created.

B.The Deny statement overrides the Allow statement for the specific CIDR.

C.The condition in the Deny statement is not evaluated correctly.

D.The first statement allows only specific actions, not CreateVpc.

AnswerB

Explicit deny overrides allow.

Why this answer

The IAM policy includes an explicit Deny statement that denies the CreateVpc action when the CIDR block equals 10.0.0.0/16. Since explicit Deny statements override any Allow statements, the engineer's attempt to create a VPC with that specific CIDR fails regardless of any Allow permissions. This is a fundamental IAM evaluation logic rule: an explicit Deny always takes precedence over an Allow.

Exam trap

The ANS-C01 exam often tests the misconception that an Allow statement always grants permission, but the trap here is that an explicit Deny statement with a matching condition overrides any Allow, causing the operation to fail even if the user has broad permissions.

How to eliminate wrong answers

Option A is wrong because the resource ARN in a Deny statement for CreateVpc does not need to match the VPC being created — VPCs are created without a pre-existing ARN, and IAM policies for CreateVpc typically use a wildcard ARN (arn:aws:ec2:*:*:vpc/*) or no resource ARN at all; the issue is the CIDR condition, not the ARN. Option C is wrong because the condition in the Deny statement is evaluated correctly — IAM conditions are evaluated as expected, and the Deny statement's condition (StringEquals on the CIDR) matches the requested CIDR, causing the denial. Option D is wrong because the first statement allows specific actions, but the presence of an explicit Deny for CreateVpc with the matching CIDR overrides that Allow; the Allow statement is not the reason for the failure.

Full explanation →

328

MCQeasy

A company is migrating an on-premises application to AWS. The application requires low-latency, high-throughput connectivity between the on-premises data center and the AWS VPC. The company wants a dedicated, private connection that bypasses the internet. Which AWS service should they use?

A.AWS Direct Connect

B.AWS Transit Gateway

C.AWS Site-to-Site VPN

D.VPC Peering

AnswerA

Dedicated, private, high-bandwidth connection.

Why this answer

AWS Direct Connect provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the internet entirely. This ensures low-latency, high-throughput connectivity ideal for latency-sensitive or high-volume workloads, as it uses a physical cross-connect or hosted virtual interface over a private circuit.

Exam trap

The trap here is that candidates often confuse AWS Transit Gateway as a connectivity method itself, when it is actually a hub that requires an underlying connection (Direct Connect or VPN) to reach on-premises networks.

How to eliminate wrong answers

Option B (AWS Transit Gateway) is wrong because it is a network transit hub that interconnects VPCs and on-premises networks via VPN or Direct Connect, but it does not itself provide a dedicated private connection; it requires an underlying connectivity method like Direct Connect or VPN. Option C (AWS Site-to-Site VPN) is wrong because it uses the public internet, encrypted over IPsec tunnels, which introduces latency and throughput variability, failing the requirement to bypass the internet. Option D (VPC Peering) is wrong because it connects two VPCs within AWS using private IP addresses, not an on-premises data center, and cannot extend to external networks.

Full explanation →

329

MCQmedium

A company runs a critical application on EC2 instances in an Auto Scaling group across two Availability Zones in a VPC. The application communicates with an on-premises database over an AWS Direct Connect private VIF. The network team has configured a VPN connection as a backup. Recently, the application experienced intermittent timeouts when accessing the database. The team suspects asymmetric routing because the primary Direct Connect and backup VPN are both active. The network team wants to ensure that all traffic to the on-premises network uses the Direct Connect when it is available, and only fails over to the VPN if Direct Connect goes down. The BGP sessions are configured on both connections. The Direct Connect advertises the on-premises CIDR of 10.0.0.0/16, and the VPN advertises the same CIDR. The team has access to the on-premises router configuration and AWS console. Which action should the team take to resolve the issue?

A.Add a static route in the VPC route table pointing to the Direct Connect virtual interface for the on-premises CIDR.

B.Configure the on-premises router to prepend one or more AS numbers to the routes advertised over the VPN BGP session.

C.Advertise a more specific prefix (e.g., 10.0.0.0/24) over the VPN BGP session to attract traffic.

D.Disable BGP on the VPN connection and use static routes instead.

AnswerB

AS path prepending on the VPN makes the VPN path less preferred, so Direct Connect is used when available.

Why this answer

AS path prepending on the VPN BGP session makes the VPN path less preferred by BGP (longer AS path). Since the Direct Connect path has a shorter AS path, BGP will select the Direct Connect path for all traffic to the on-premises CIDR, ensuring symmetric routing. Option A is incorrect because static routes do not provide dynamic failover and can cause routing issues.

Option C is incorrect because advertising a more specific prefix over VPN would make the VPN path more specific (longest prefix match), causing traffic to prefer the VPN, exacerbating the problem. Option D is incorrect because disabling BGP on the VPN removes dynamic routing and reduces redundancy.

Full explanation →

330

MCQhard

A company uses AWS CloudFormation to deploy a VPC with public and private subnets. The template includes an Internet Gateway and a NAT Gateway. After deployment, instances in the private subnet cannot access the internet. The network engineer checks the route tables and finds that the private subnet route table has a default route pointing to the NAT Gateway. What is the most likely cause of the issue?

A.The NAT Gateway is deployed in the private subnet instead of the public subnet.

B.The security group attached to the NAT Gateway blocks outbound traffic.

C.The private subnet route table does not have a default route (0.0.0.0/0) to the NAT Gateway.

D.The NAT Gateway is in a private subnet and has no route to the internet gateway.

AnswerA

NAT Gateway must be in a public subnet with a route to IGW to function.

Why this answer

The NAT Gateway must be deployed in a public subnet with a route to the Internet Gateway. If it is in a private subnet, it cannot reach the internet, so instances in the private subnet cannot use it for outbound traffic. Option B is incorrect because security groups by default allow outbound traffic.

Option C is incorrect because the question states the private subnet route table has a default route pointing to the NAT Gateway. Option D is incorrect because while the NAT Gateway being in a private subnet and lacking a route to the IGW is a related issue, the most direct cause is that the NAT Gateway itself is in the wrong subnet, as stated in option A.

Full explanation →

331

MCQhard

A company has multiple AWS accounts under AWS Organizations. The security team wants to centrally log all network traffic that is denied by security group rules across all accounts. Which approach meets this requirement with the least operational overhead?

A.Enable AWS Config rules for security group changes and send logs to a central account

B.Create VPC Flow Logs in each account and publish to a central S3 bucket

C.Use AWS CloudTrail to log all API calls and filter for security group events

D.Enable VPC Flow Logs with organization-level aggregation and publish to a central S3 bucket

AnswerD

Organization-level aggregation simplifies cross-account logging of rejected traffic.

Why this answer

VPC Flow Logs can capture rejected traffic, and publishing to a central S3 bucket using Organization-level aggregation simplifies management. Option D is correct because it uses VPC Flow Logs with organization-level aggregation. Option A is wrong because AWS Config does not log network traffic.

Option B is wrong because it requires per-account setup. Option C is wrong because CloudTrail does not capture network flows.

Full explanation →

332

MCQhard

A company is designing a hybrid network with AWS Direct Connect. They have multiple VPCs in the same Region and want to use a single Direct Connect connection to access all VPCs. Which AWS resource should be used?

A.AWS Transit Gateway

B.AWS Site-to-Site VPN

C.Direct Connect Gateway

D.Virtual Private Gateway

AnswerC

Enables multi-VPC access.

Why this answer

A Direct Connect Gateway allows you to associate up to 10 Virtual Private Gateways (VGWs) or Transit Gateways in the same or different AWS accounts, enabling a single Direct Connect connection to reach multiple VPCs in the same Region. This is the correct resource because it acts as a hub that terminates the Direct Connect virtual interfaces (VIFs) and propagates routes to the associated VPCs via their VGWs or Transit Gateways.

Exam trap

The trap here is that candidates often confuse the Direct Connect Gateway with the Transit Gateway, thinking the Transit Gateway alone can terminate the Direct Connect connection, but the Transit Gateway requires a Direct Connect Gateway (via a transit VIF) to be attached to the Direct Connect link.

How to eliminate wrong answers

Option A is wrong because AWS Transit Gateway is a regional network transit hub that can interconnect VPCs and on-premises networks, but it does not directly terminate a Direct Connect connection; you still need a Direct Connect Gateway to attach the Transit Gateway to the Direct Connect link. Option B is wrong because AWS Site-to-Site VPN is an IPsec-based connection over the internet, not a dedicated private connection, and it cannot replace the Direct Connect Gateway for aggregating multiple VPCs over a single Direct Connect link. Option D is wrong because a Virtual Private Gateway is a per-VPC attachment point for VPN or Direct Connect, but it cannot be shared across multiple VPCs; using a single VGW would only provide access to one VPC, not all VPCs.

Full explanation →

333

Multi-Selecthard

A company is designing a multi-account architecture using AWS Organizations. They want to centrally manage and enforce network security policies across all accounts. Which THREE services or features should they use together to achieve this? (Choose THREE.)

Select 3 answers

A.AWS Network Firewall

B.Service Control Policies (SCPs)

C.Security Groups

D.AWS Config

E.AWS Firewall Manager

AnswersA, B, E

AWS Network Firewall provides stateful, managed network firewall service that can be centrally deployed across VPCs and accounts via AWS Firewall Manager.

Why this answer

Options A (AWS Network Firewall), B (Service Control Policies), and E (AWS Firewall Manager) are correct. AWS Network Firewall provides stateful inspection to filter traffic across VPCs. Service Control Policies (SCPs) centrally manage permissions and enforce guardrails across all accounts in the organization.

AWS Firewall Manager centrally manages firewall rules, including AWS Network Firewall policies, across accounts. Option C (Security Groups) is incorrect because security groups are per-resource and cannot be centrally managed across accounts. Option D (AWS Config) is incorrect because AWS Config is for compliance monitoring and auditing, not for enforcing network security policies.

Full explanation →

334

MCQeasy

A network engineer is troubleshooting an AWS Direct Connect connection that is experiencing high latency. The connection is a 1 Gbps dedicated connection. The engineer notices that the link utilization is at 90%. What is the MOST likely cause of the high latency?

A.The virtual interface is configured as private instead of public

B.BGP keepalive timer misconfiguration

C.High bandwidth utilization causing queuing

D.The use of jumbo frames

AnswerC

Correct; when utilization is high, packets are queued, increasing latency.

Why this answer

High bandwidth utilization (90%) leads to queuing delays as packets wait in buffers, increasing latency. Option A is incorrect: the virtual interface type (private vs public) does not directly cause high latency. Option B is incorrect: BGP keepalive timer misconfiguration affects BGP session stability, not latency.

Option D is incorrect: jumbo frames can reduce latency by reducing overhead, not increase it.

Full explanation →

335

MCQeasy

A company wants to ensure that all traffic to and from its VPC is inspected by a security appliance. The appliance must be able to inspect traffic between subnets within the VPC. Which architecture should the company use?

A.Use a Gateway Load Balancer with security appliances in a separate inspection VPC and configure route tables to send traffic to the GWLB endpoint.

B.Deploy a NAT Gateway and route all internet traffic through it.

C.Create a VPC Peering connection to a centralized VPC with security appliances.

D.Attach an Internet Gateway and use Security Groups to log traffic.

AnswerA

GWLB provides transparent inspection of all traffic.

Why this answer

A Gateway Load Balancer (GWLB) with security appliances in a separate inspection VPC allows you to centrally inspect all traffic, including east-west traffic between subnets within the same VPC. By configuring route tables to send traffic to the GWLB endpoint, you can enforce stateful inspection for all inbound, outbound, and inter-subnet traffic without introducing a single point of failure or complex routing.

Exam trap

AWS often tests the misconception that a NAT Gateway or Internet Gateway can provide full traffic inspection, but they only handle specific traffic types and lack the ability to inspect east-west traffic within a VPC.

How to eliminate wrong answers

Option B is wrong because a NAT Gateway only handles outbound internet traffic from private subnets and cannot inspect inbound traffic or traffic between subnets within the VPC. Option C is wrong because a VPC Peering connection does not inherently route traffic through a central inspection point; it simply connects two VPCs, and you would still need additional routing and appliances to force traffic through the security stack. Option D is wrong because an Internet Gateway provides internet access but does not inspect traffic, and Security Groups are stateful firewalls that operate at the instance level, not as inline inspection appliances for all traffic flows.

Full explanation →

336

Multi-Selectmedium

A network engineer is troubleshooting connectivity issues between an Amazon EC2 instance in a public subnet and an on-premises server over AWS Direct Connect. The instance can reach the internet but cannot reach the on-premises server. Which TWO actions should the engineer take to diagnose the issue?

Select 2 answers

A.Check the VPC route table to ensure a route exists for the on-premises CIDR pointing to the virtual private gateway

B.Check the VPN connection status to ensure the tunnel is up

C.Check the security group attached to the EC2 instance to ensure it allows inbound traffic from the on-premises CIDR

D.Enable VPC Flow Logs and analyze them for dropped packets

E.Check the network ACLs for the subnet to ensure they allow inbound traffic from on-premises

AnswersA, C

Correct. The VPC route table must have a route for the on-premises CIDR pointing to the virtual private gateway to route traffic over Direct Connect.

Why this answer

The correct answers are A and C. For connectivity between an EC2 instance in a public subnet and an on-premises server over AWS Direct Connect, two key checks are: (1) The VPC route table must have a route for the on-premises CIDR pointing to the virtual private gateway (VGW) to route traffic to the Direct Connect connection. (2) The security group attached to the EC2 instance must allow inbound traffic from the on-premises CIDR, as security groups act as a stateful firewall for the instance. Option B is incorrect because Direct Connect uses a virtual private gateway, not a VPN tunnel.

Option D is incorrect because VPC Flow Logs are used for analysis, not real-time diagnosis. Option E is incorrect because network ACLs are stateless; outbound traffic does not automatically allow return traffic, so explicit inbound rules are required for the return traffic.

Full explanation →

337

MCQeasy

A company wants to connect multiple VPCs across different AWS accounts to a common on-premises network using AWS Transit Gateway. Which resource should be used to allow cross-account VPC attachments?

A.AWS PrivateLink

B.VPC peering connection

C.AWS Organizations

D.AWS Resource Access Manager (RAM)

AnswerD

RAM enables sharing Transit Gateways with other accounts.

Why this answer

AWS Resource Access Manager (RAM) enables you to share a Transit Gateway with other AWS accounts within your organization or externally. Once shared, the recipient account can attach its VPCs to the shared Transit Gateway, allowing cross-account VPC attachments to a common on-premises network.

Exam trap

The trap here is that candidates often confuse AWS Organizations with the actual resource sharing mechanism, forgetting that Organizations alone does not share resources—RAM is required to perform the cross-account sharing of Transit Gateways.

How to eliminate wrong answers

Option A is wrong because AWS PrivateLink is used to expose services privately across VPCs via interface VPC endpoints, not for sharing Transit Gateway attachments. Option B is wrong because VPC peering connections only connect two VPCs directly and do not support transitive routing through a Transit Gateway or cross-account attachment sharing. Option C is wrong because AWS Organizations provides centralized management of accounts and policies but does not itself enable resource sharing; it must be used with RAM to share Transit Gateways.

Full explanation →

338

MCQhard

A company needs to ensure that all API calls to AWS services are logged and monitored for suspicious activity. Additionally, any API call that creates a security group rule should trigger an immediate notification. Which combination of services should be used?

A.VPC Flow Logs and Amazon CloudWatch

B.AWS CloudTrail and Amazon CloudWatch Events

C.AWS Config and Amazon SNS

D.AWS Shield and AWS WAF

AnswerB

CloudTrail logs API calls; CloudWatch Events can trigger alerts.

Why this answer

AWS CloudTrail records all API calls to AWS services, enabling logging and monitoring. Amazon CloudWatch Events (now Amazon EventBridge) can be configured to trigger notifications based on specific API events, such as creating a security group rule via the ec2:AuthorizeSecurityGroupIngress API call. Option A is incorrect because VPC Flow Logs capture network traffic metadata, not API calls.

Option C is incorrect because AWS Config evaluates resource configuration and compliance, not API call logging; Amazon SNS alone does not provide monitoring capabilities. Option D is incorrect because AWS Shield provides DDoS protection and AWS WAF is a web application firewall, neither of which log API calls.

Full explanation →

339

MCQhard

A financial services company is migrating its on-premises data center to AWS. The company has a three-tier application that consists of web servers, application servers, and a database. The application servers must communicate with the database using a private IP address. The database is hosted on an Amazon RDS for MySQL instance in a private subnet. The application servers are in a public subnet. The company has a security requirement that all traffic between the application servers and the database must be encrypted in transit. The network engineer has created a security group for the RDS instance that allows inbound traffic on port 3306 from the security group of the application servers. The engineer has also enabled encryption at rest for the RDS instance. During a security audit, it is discovered that traffic between the application servers and the database is not encrypted. The application team confirms that the application is configured to connect to the database using standard MySQL client library without any SSL/TLS options. The network engineer must ensure that all traffic between the application servers and the database is encrypted without modifying the application code. What should the network engineer do?

A.Create an AWS Site-to-Site VPN connection between the application servers' subnet and the database subnet to encrypt all traffic.

B.Enable the 'require_secure_transport' parameter in the RDS parameter group and set it to ON.

C.Deploy a Network Load Balancer (NLB) with a TLS listener in front of the RDS instance. Configure the NLB to terminate TLS from the application servers and forward traffic to the RDS instance using TLS.

D.Modify the security group for the RDS instance to only allow traffic from the application servers' security group on port 3306 with the 'tls' protocol.

AnswerB

Incorrect. Enabling 'require_secure_transport' forces the MySQL client to use TLS, but the application does not support TLS, so the connection would be rejected.

Why this answer

Enabling the 'require_secure_transport' parameter in the RDS parameter group ensures that the database only accepts encrypted connections. Although the application currently uses standard MySQL client libraries without SSL/TLS options, the connection configuration can be updated to enable SSL/TLS without modifying the application code—this is a configuration change, not a code change. Once the client is configured, all traffic is encrypted in transit.

Option A is invalid because AWS Site-to-Site VPN is designed for connecting on-premises networks to a VPC, not for subnets within the same VPC. Option C would require the application to initiate a TLS connection to the NLB, which it does not support, and would not encrypt traffic between the NLB and RDS unless also configuring TLS there, adding unnecessary complexity. Option D is incorrect because security groups do not have a 'tls' protocol; they only control IP and port access.

Full explanation →

340

Multi-Selecteasy

Which TWO of the following are benefits of using AWS Global Accelerator? (Choose TWO.)

Select 2 answers

A.Static anycast IP addresses that serve as a fixed entry point

B.Built-in AWS WAF capabilities

C.Content caching similar to CloudFront

D.DNS-based load balancing

E.Improved application performance by using edge locations

AnswersA, E

Provides consistent IP addresses.

Why this answer

AWS Global Accelerator uses static anycast IP addresses that serve as a fixed entry point, allowing traffic to enter the AWS global network at the closest edge location. This eliminates the need to update DNS records or client configurations when backend endpoints change, providing a stable endpoint for applications.

Exam trap

The ANS-C01 exam often tests the misconception that Global Accelerator provides caching or DNS-based load balancing, when in fact it uses anycast IP routing for traffic optimization and does not cache content or rely on DNS resolution for load distribution.

Full explanation →

341

MCQeasy

A company is using AWS Direct Connect to connect its on-premises network to AWS. The company wants to encrypt all traffic between its on-premises network and AWS. Which solution meets this requirement?

A.Use a public virtual interface (VIF) and route traffic through a NAT gateway.

B.Use a private VIF and establish an IPsec VPN tunnel over the Direct Connect connection.

C.Use a private virtual interface (VIF) and enable encryption on the Direct Connect connection.

D.Use a private VIF and enable TLS on all applications.

AnswerB

IPsec provides encryption over the Direct Connect link.

Why this answer

AWS Direct Connect does not natively encrypt traffic; it provides a private, dedicated network connection. To meet the encryption requirement, you can establish an IPsec VPN tunnel over the private VIF, which encrypts all traffic between the on-premises network and the VPC. This approach combines the low latency and reliability of Direct Connect with the security of IPsec encryption.

Exam trap

The trap here is that candidates assume Direct Connect inherently encrypts traffic because it is a private connection, but AWS explicitly states that Direct Connect does not provide encryption, so an overlay like IPsec is required.

How to eliminate wrong answers

Option A is wrong because a public VIF provides access to AWS public services (e.g., S3, DynamoDB) but does not encrypt traffic; routing through a NAT gateway adds no encryption and is unrelated to securing the Direct Connect link. Option C is wrong because Direct Connect does not support native encryption at the physical or link layer; there is no option to 'enable encryption' on the connection itself. Option D is wrong because TLS encrypts only application-layer traffic for specific protocols (e.g., HTTPS), not all IP traffic between networks; it does not provide a general-purpose, network-layer encryption solution.

Full explanation →

342

MCQmedium

A network engineer runs the above command to list VPC endpoints. The engineer notices that the second endpoint (vpce-0b2c3d4e5f6g7h8i9) does not have a policy document displayed. What does this indicate?

A.The endpoint is configured to use an AWS managed policy that is not shown.

B.The endpoint is not active and needs to be recreated.

C.The endpoint is for DynamoDB, which does not support endpoint policies.

D.The endpoint has the default full-access policy.

AnswerD

If no custom policy is specified, the default policy allows full access.

Why this answer

When a VPC endpoint is created without a custom policy document, AWS automatically applies a default full-access policy that allows all principals to perform all actions on all resources through the endpoint. The AWS CLI command `describe-vpc-endpoints` omits the policy field when the default policy is in effect, because the default policy is not stored as a separate document; it is an implicit behavior of the endpoint. Therefore, the absence of a policy document in the output indicates the endpoint is using the default full-access policy, making option D correct.

Exam trap

The trap here is that candidates assume a missing policy document means the endpoint has no policy or is broken, when in fact AWS omits the default full-access policy from the CLI output, leading to confusion with inactive endpoints or service-specific limitations.

How to eliminate wrong answers

Option A is wrong because AWS does not attach a managed policy to a VPC endpoint; endpoint policies are resource-based policies, not IAM managed policies, and the absence of a policy document is not due to a hidden managed policy. Option B is wrong because an inactive endpoint would show a state of 'failed' or 'pending' in the output, not simply a missing policy document; the command still displays the policy field even for inactive endpoints if one was attached. Option C is wrong because DynamoDB endpoints do support endpoint policies; the misconception that they do not is incorrect, and the absence of a policy document in this case is due to the default policy, not a service limitation.

Full explanation →

343

MCQmedium

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company wants to ensure that traffic can only go out to the internet and not be initiated from the internet. Which configuration should be used?

A.Attach an Internet Gateway to the private subnets

B.Deploy a NAT Gateway in a public subnet and update the private subnet route table

C.Set up a VPN connection to an on-premises network

D.Create a VPC endpoint for S3

AnswerB

A NAT Gateway deployed in a public subnet with an Elastic IP enables outbound-only internet access for instances in private subnets, because the gateway translates private source IPs to the public IP and drops unsolicited inbound traffic. This satisfies the constraint that traffic can only be initiated from the private subnets, not from the internet.

Why this answer

A NAT Gateway deployed in a public subnet with an Elastic IP allows private subnet instances to initiate outbound traffic to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. The private subnet’s route table must include a default route (0.0.0.0/0) pointing to the NAT Gateway, which translates the private source IP to the gateway’s Elastic IP for return traffic. This meets the requirement of outbound-only internet access without exposing private instances to inbound initiation.

Exam trap

The trap here is that candidates often confuse an Internet Gateway with a NAT Gateway, assuming both provide outbound-only access, but an Internet Gateway enables bidirectional traffic and requires public IPs on instances, while a NAT Gateway specifically allows outbound-only initiation from private instances.

How to eliminate wrong answers

Option A is wrong because attaching an Internet Gateway directly to private subnets would assign public IPs to instances and allow bidirectional traffic, violating the requirement that traffic cannot be initiated from the internet. Option C is wrong because a VPN connection to an on-premises network provides private connectivity to a corporate data center, not direct internet access for software updates; it would route traffic through the on-premises network, adding latency and complexity without solving the internet access need. Option D is wrong because a VPC endpoint for S3 only provides private connectivity to Amazon S3, not general internet access for software updates from arbitrary internet hosts.

Full explanation →

344

Multi-Selecteasy

A solutions architect is designing a VPC with public and private subnets. The application in the private subnet needs to download patches from the internet. Which TWO options allow outbound internet access while keeping the EC2 instance in the private subnet without a public IP address?

Select 2 answers

A.Attach an Internet Gateway to the VPC and assign a public IP to the instance.

B.Set up a Direct Connect connection to an on-premises data center.

C.Create a VPC endpoint for Amazon S3 and update the route table.

D.Establish a VPN connection to a third-party proxy service.

E.Deploy a NAT Gateway in a public subnet and update the private subnet route table to point 0.0.0.0/0 to the NAT Gateway.

AnswersC, E

VPC endpoint allows private access to S3 without internet.

Why this answer

A VPC endpoint for Amazon S3 allows private subnet instances to access S3 buckets (where patches can be stored) without traversing the internet, using the AWS network backbone. This keeps the EC2 instance private (no public IP) while enabling outbound access to a specific AWS service. Option E is correct because a NAT Gateway in a public subnet provides source network address translation (SNAT) for private instances, translating their private IPs to the NAT Gateway's Elastic IP for outbound internet traffic, while the private instance itself remains without a public IP.

Exam trap

The ANS-C01 exam often tests the misconception that a NAT Gateway requires a public IP on the private instance, but in reality, the NAT Gateway itself has the public IP and performs SNAT, so the private instance never needs a public IP.

Full explanation →

345

MCQmedium

A company is migrating on-premises workloads to AWS using AWS Direct Connect. The company has two Direct Connect connections from different providers for redundancy. Which configuration ensures seamless failover with automatic traffic rerouting?

A.Create two Direct Connect gateways, each attached to a separate Transit Gateway, and advertise the same prefixes via BGP.

B.Use one Direct Connect connection as primary and the other as standby with static routes.

C.Connect both Direct Connect connections to the same Virtual Private Gateway (VGW) and enable BGP.

D.Use a VPN connection over the internet as a backup for the Direct Connect links.

AnswerA

Enables automatic failover using BGP path selection.

Why this answer

Using two Direct Connect gateways, each attached to a separate Transit Gateway, with the same BGP prefixes advertised from both connections enables active-active or active-passive failover via BGP path selection (e.g., AS_PATH prepending or MED). This design ensures automatic traffic rerouting if one connection fails, as BGP withdraws the failed path and the remaining path takes over without manual intervention.

Exam trap

The trap here is that candidates assume both Direct Connect connections must terminate on the same Virtual Private Gateway (VGW) for redundancy, but AWS does not support multiple Direct Connect connections to a single VGW, making the dual Direct Connect gateway and Transit Gateway design the correct approach.

How to eliminate wrong answers

Option B is wrong because static routes require manual intervention or additional scripting to fail over, and they do not provide automatic, seamless rerouting like BGP does. Option C is wrong because connecting both Direct Connect connections to the same Virtual Private Gateway (VGW) is not supported — a VGW can only be associated with a single Direct Connect connection at a time, and using two connections with the same VGW would cause BGP conflicts and asymmetric routing. Option D is wrong because using a VPN over the internet as a backup introduces latency, bandwidth limitations, and potential security concerns; it is not a seamless failover solution for Direct Connect and does not leverage the same BGP-based automatic rerouting.

Full explanation →

346

MCQeasy

A company needs to allow a specific IP address range (203.0.113.0/24) to access an Amazon RDS database in a private subnet. The RDS instance is deployed in a VPC with no public access. Which configuration step is required?

A.Add a security group rule allowing inbound traffic from 203.0.113.0/24

B.Create an AWS Site-to-Site VPN connection and update route tables to route the on-premises CIDR to the virtual private gateway

C.Assign a public IP address to the RDS instance

D.Modify the network ACL of the private subnet to allow inbound traffic from 203.0.113.0/24

AnswerB

A VPN provides a secure tunnel from on-premises to the VPC, and route tables direct traffic to the VPN gateway.

Why this answer

The RDS instance is in a private subnet with no public access, so it cannot be reached directly from the internet. To allow an on-premises IP range (203.0.113.0/24) to access it, you need a private connection such as an AWS Site-to-Site VPN. This creates an encrypted tunnel over the internet, and the route tables must be updated to direct traffic for the on-premises CIDR to the virtual private gateway (VGW), enabling private IP communication.

Exam trap

The trap here is that candidates often focus on firewall rules (security groups or NACLs) without realizing that a private subnet has no direct internet path, so a VPN or Direct Connect is required first to establish Layer 3 connectivity.

How to eliminate wrong answers

Option A is wrong because security group rules control traffic at the instance level, but the RDS instance in a private subnet has no public endpoint; inbound traffic from the internet cannot reach it without a VPN or Direct Connect. Option C is wrong because assigning a public IP address to an RDS instance is not supported; RDS instances in a VPC are accessed via DNS names that resolve to private IPs, and public access would require a publicly accessible RDS instance, which still uses a security group but is not the correct solution for a private subnet. Option D is wrong because network ACLs are stateless and operate at the subnet level, but they cannot enable internet access to a private subnet; the fundamental issue is the lack of a private network path, not just firewall rules.

Full explanation →

347

Multi-Selecthard

A company is designing a multi-account AWS environment using AWS Transit Gateway. They have 10 VPCs in separate accounts that need to communicate with each other and with an on-premises network via Direct Connect. Which three components are required to enable this connectivity? (Choose three.)

Select 3 answers

A.AWS Resource Access Manager to share the Transit Gateway with other accounts

B.Direct Connect Gateway attached to the Transit Gateway

C.AWS Transit Gateway in the network account

D.VPC Peering connections between each pair of VPCs

E.AWS Site-to-Site VPN connection from the Transit Gateway to the on-premises network

AnswersA, B, C

RAM allows sharing the Transit Gateway with VPCs in other accounts.

Why this answer

Options A, B, and C are correct. AWS Transit Gateway (C) in a central network account acts as a hub for inter-VPC and on-premises connectivity. AWS Resource Access Manager (A) is required to share the Transit Gateway with other accounts so that VPCs in those accounts can attach to it.

A Direct Connect Gateway (B) attached to the Transit Gateway provides connectivity to the on-premises network via Direct Connect. Option D is incorrect because VPC Peering is unnecessary when using Transit Gateway. Option E is incorrect because a Site-to-Site VPN is not required when Direct Connect is already used for on-premises connectivity.

Full explanation →

348

MCQhard

A company is deploying a multi-tier web application on EC2 instances behind an Application Load Balancer (ALB). The security team requires that the web servers only accept traffic from the ALB and that the ALB only accepts traffic from the internet on ports 80 and 443. Additionally, the web servers should be able to make outbound connections to the internet for updates. Which combination of security group rules meets these requirements?

A.Use network ACLs instead: public subnet NACL allow 80/443 inbound, private subnet NACL allow from ALB on app port

B.ALB SG: inbound 0.0.0.0/0 on 80/443, outbound to web SG on app port; Web SG: inbound from ALB SG on app port, outbound to 0.0.0.0/0 on ephemeral

C.ALB SG: inbound 0.0.0.0/0 on 80/443, outbound deny all; Web SG: inbound from ALB SG on app port, outbound allow all

D.ALB SG: inbound 0.0.0.0/0 on 80/443, outbound to web SG on app port; Web SG: inbound from VPC CIDR on app port, outbound to 0.0.0.0/0 on ephemeral

AnswerB

Correct use of security group references.

Why this answer

The ALB security group should allow inbound from 0.0.0.0/0 on ports 80 and 443, and outbound to the web server security group on the application port. The web server security group should allow inbound from the ALB security group on the application port, and outbound to 0.0.0.0/0 on ephemeral ports to allow outbound internet access for updates. Option B correctly describes these rules.

Option A is incorrect because it suggests using NACLs instead, which are stateless and less granular for security group requirements. Option C is incorrect because the ALB outbound rule should allow traffic to web servers, not deny all. Option D is incorrect because the web server inbound should be from the ALB security group, not the VPC CIDR, to ensure only ALB traffic is received.

Full explanation →

349

Multi-Selecthard

Which THREE considerations are important when implementing a multi-region Direct Connect architecture? (Choose 3)

Select 3 answers

A.Ensure Direct Connect connections are in at least two separate geographic locations.

B.Use a single Direct Connect connection to reduce complexity.

C.Connect all Direct Connect connections to the same AWS Direct Connect device.

D.Use diverse paths and providers for the Direct Connect connections.

E.Set up a VPN connection as a backup to Direct Connect.

AnswersA, D, E

Diverse locations provide redundancy against site failures.

Why this answer

Implementing Direct Connect connections in at least two separate geographic locations ensures physical diversity and resilience against regional outages. This aligns with AWS best practices for high availability, as a single location failure (e.g., due to natural disaster or fiber cut) would not impact all connections, maintaining connectivity to your VPCs.

Exam trap

The trap here is that candidates often assume a single Direct Connect connection with a VPN backup is sufficient for multi-region architectures, but the question specifically requires multi-region Direct Connect, where physical and path diversity across locations is mandatory, not just a backup VPN.

Full explanation →

350

Multi-Selecthard

A financial services company must meet PCI DSS compliance. They have a VPC with public and private subnets. The private subnets host applications that process credit card data. The security team wants to ensure that no data leaves the VPC to the internet except through a controlled egress point. Which THREE measures should be implemented? (Choose three.)

Select 3 answers

A.Implement a central inspection VPC with AWS Network Firewall to inspect all outbound traffic.

B.Create VPC endpoints for Amazon S3 and DynamoDB to keep traffic within the AWS network.

C.Configure security groups to deny all outbound traffic from private subnets.

D.Attach an Internet Gateway to the VPC and allow all outbound traffic.

E.Deploy a NAT gateway in a public subnet and route private subnet traffic to it for internet access.

AnswersA, B, E

Correct: Central inspection provides controlled egress with inspection.

Why this answer

To meet PCI DSS compliance, the company needs to control and inspect outbound traffic from private subnets. Option A is correct because a central inspection VPC with AWS Network Firewall can inspect and control all outbound traffic, providing a controlled egress point. Option B is correct because VPC endpoints for S3 and DynamoDB keep traffic to these services within the AWS network, avoiding the internet.

Option E is correct because a NAT gateway allows private subnets to access the internet for necessary updates or patches, but combined with other controls (like Network Firewall) it provides a controlled egress. Option C is incorrect because security groups deny all outbound traffic by default, but that would block all necessary outbound connections, including to AWS services; it does not provide a controlled egress point. Option D is incorrect because an Internet Gateway allows direct outbound access without inspection or control, violating PCI DSS requirements for controlled egress.

Full explanation →

351

MCQhard

A network engineer is configuring an AWS Site-to-Site VPN with dynamic routing (BGP). The customer gateway device is a Cisco router. The VPN tunnel is established, but BGP is not forming. Which configuration on the Cisco router is most likely missing?

A.The VPN connection's local IP address.

B.The correct IP address for the tunnel interface.

C.The pre-shared key for IKE phase 1.

D.The BGP neighbor statement with the correct Amazon ASN (64512).

AnswerD

ASN mismatch is a common cause of BGP not forming.

Why this answer

The VPN tunnel is established, indicating IKE phase 1 and IPsec are functioning, so options A, B, and C are not the issue. For BGP to form, the Cisco router must have a BGP neighbor statement pointing to the correct Amazon ASN (64512) and the tunnel interface IP. Without this, BGP will not establish a session.

Options A, B, and C are incorrect because the tunnel is up, so local IP, tunnel interface IP, and pre-shared key are properly configured.

Full explanation →

352

MCQeasy

A network engineer is troubleshooting intermittent connectivity issues between an on-premises data center and AWS over a Direct Connect connection. The issue occurs only during peak business hours. CloudWatch metrics show increased latency and packet loss at the Direct Connect virtual interface. What is the MOST likely cause?

A.VPN tunnel misconfiguration over Direct Connect

B.Asymmetric routing between on-premises and AWS

C.BGP peering session flapping

D.Insufficient bandwidth on the Direct Connect connection

AnswerD

Congestion during peak hours causes latency and packet loss.

Why this answer

Insufficient bandwidth leads to congestion during peak hours, causing increased latency and packet loss. Option A is incorrect because VPN over Direct Connect is not a common configuration and would not cause these symptoms. Option B is incorrect because asymmetric routing would cause persistent connectivity issues, not intermittent latency and packet loss.

Option C is incorrect because BGP peering session flapping would result in complete loss of connectivity, not just increased latency and packet loss.

Full explanation →

353

Multi-Selecthard

A company wants to implement a network monitoring solution that provides real-time traffic analysis and anomaly detection. Which THREE AWS services should be used together?

Select 3 answers

A.AWS Config

B.Amazon GuardDuty

C.VPC Flow Logs

D.AWS CloudTrail

E.Amazon CloudWatch

AnswersB, C, E

GuardDuty provides anomaly detection using VPC Flow Logs data.

Why this answer

The correct answers are B (Amazon GuardDuty), C (VPC Flow Logs), and E (Amazon CloudWatch). VPC Flow Logs capture network traffic information, which can be sent to CloudWatch for metrics and alarms, and GuardDuty provides anomaly detection using threat intelligence. Option A (AWS Config) is incorrect because it is used for resource configuration tracking, not network traffic analysis.

Option D (AWS CloudTrail) is incorrect because it logs API calls, not network traffic.

Full explanation →

354

MCQhard

A company has deployed a multi-tier application across three VPCs (VPC-A, VPC-B, VPC-C) in the us-east-1 region. Each VPC has its own CIDR block (10.0.0.0/16, 10.1.0.0/16, 10.2.0.0/16 respectively). All VPCs are attached to an AWS Transit Gateway. The web tier is in VPC-A, the application tier is in VPC-B, and the database tier is in VPC-C. The application servers in VPC-B need to connect to the database servers in VPC-C on TCP port 3306. The database servers are in a private subnet with a security group (sg-db) that allows inbound traffic from the application server security group (sg-app). The application servers have a security group (sg-app) that allows outbound traffic to the database servers. However, the application servers cannot connect to the database servers. The route tables in VPC-B and VPC-C have routes pointing to the Transit Gateway for the other VPC CIDRs. The Transit Gateway has attachments in all three VPCs and has a default route table with propagation enabled. What is the MOST likely cause of the connectivity failure?

A.The Transit Gateway attachments are not associated with the same route table

B.The network ACLs in VPC-B or VPC-C are blocking the traffic

C.The Transit Gateway does not support transitive routing between VPCs

D.The security group sg-app does not allow outbound traffic to the database server's security group

AnswerA

Correct; without association, routes are not propagated to the attachments.

Why this answer

The most likely cause is that the Transit Gateway attachments are not associated with the same route table. In AWS Transit Gateway, for traffic to flow between VPCs, the attachments must be associated with a route table that contains routes for the destination VPC CIDRs. Even though propagation is enabled on the default route table, if the attachments are associated with different route tables (or the default route table is not shared), transitive routing will fail.

Without a common route table association, the Transit Gateway cannot forward traffic between VPC-B and VPC-C.

Exam trap

The trap here is that candidates assume enabling propagation on the default route table automatically allows all inter-VPC traffic, but they overlook the requirement that all attachments must be associated with the same route table for transitive routing to work.

How to eliminate wrong answers

Option B is wrong because network ACLs are stateless and, by default, allow all inbound and outbound traffic; unless explicitly modified, they would not block TCP port 3306 traffic. Option C is wrong because AWS Transit Gateway natively supports transitive routing between all attached VPCs when route tables are properly configured; this is a core feature of the service. Option D is wrong because the security group sg-app allows outbound traffic to the database servers, as stated in the question; the issue is not with outbound rules but with the Transit Gateway routing configuration.

Full explanation →

355

MCQeasy

A company is setting up a Direct Connect connection to AWS. They have a virtual private gateway (VGW) attached to their VPC. They need to establish a single logical connection over the Direct Connect link to access all subnets in the VPC. Which resource should they create on the Direct Connect virtual interface?

A.A private virtual interface (VIF) with a BGP session to the VGW.

B.A hosted virtual interface (VIF) provided by an AWS Partner.

C.A public virtual interface (VIF) with a BGP session to the VGW.

D.A transit virtual interface (VIF) to the VGW.

AnswerA

Private VIF allows access to the entire VPC via the VGW.

Why this answer

A private virtual interface (VIF) is the correct resource because it allows you to connect your on-premises network directly to a VPC via a Direct Connect link. By associating the private VIF with a virtual private gateway (VGW) and establishing a BGP session, you create a single logical connection that provides Layer 3 access to all subnets in the VPC, as the VGW handles routing between the Direct Connect link and the VPC's route tables.

Exam trap

The trap here is that candidates confuse a public VIF with private VPC access, mistakenly thinking a public VIF can reach private subnets via the VGW, but a public VIF only provides access to AWS public endpoints and cannot be associated with a VGW.

How to eliminate wrong answers

Option B is wrong because a hosted virtual interface is provisioned by an AWS Partner and is typically used when you do not own the Direct Connect connection; it still requires a private VIF or transit VIF to connect to a VGW, and it does not inherently provide a single logical connection to all subnets. Option C is wrong because a public virtual interface provides access to AWS public services (e.g., S3, DynamoDB) using public IP addresses, not to private VPC subnets; it cannot be associated with a VGW for VPC access. Option D is wrong because a transit virtual interface is used to connect a Direct Connect gateway to a transit gateway for multi-VPC or hybrid network architectures, not to directly attach to a single VGW for a single VPC; it is overkill for this requirement and requires additional components.

Full explanation →

356

MCQeasy

A company is deploying a web application in a VPC and wants to protect it from common web exploits like cross-site scripting (XSS). Which AWS service should be used to filter and monitor HTTP requests?

A.Security Group

B.Network ACL

C.AWS WAF

D.AWS Shield Advanced

AnswerC

AWS WAF provides rules to filter HTTP requests and block attacks like XSS.

Why this answer

AWS WAF, is the correct choice because it is a web application firewall specifically designed to filter and monitor HTTP/HTTPS requests to protect against common web exploits like cross-site scripting (XSS), SQL injection, and other OWASP Top 10 threats. Option A is incorrect because Security Groups act as a virtual firewall at the instance level, controlling inbound and outbound traffic based on IP addresses and ports, not at the application layer. Option B is incorrect because Network ACLs are stateless subnet-level firewalls that also operate at the network layer, not the application layer.

Option D is incorrect because AWS Shield Advanced provides DDoS protection, not web application filtering or monitoring of HTTP requests.

Full explanation →

357

MCQhard

A company has a Direct Connect connection with a private VIF to a VPC. They want to use BGP to advertise a specific /24 prefix from their on-premises network to AWS. After configuration, the prefix is not visible in the VPC route tables. The BGP session is established. What should the company check?

A.Verify that the prefix is included in the allowed prefixes list for the Direct Connect virtual interface

B.Ensure that route propagation is enabled on the VPC route table

C.Check that the BGP ASN on the customer gateway is unique and not conflicting

D.Add a static route in the VPC route table for the on-premises prefix

AnswerA

The virtual private gateway only accepts prefixes that are in the allowed prefix list.

Why this answer

When a BGP session is established but the advertised prefix does not appear in VPC route tables, the most likely cause is that the prefix is not included in the allowed prefixes list configured on the Direct Connect virtual interface. AWS uses this list as a prefix filter; any prefix received via BGP that is not in the allowed list is silently ignored and not installed in the VPC route tables.

Exam trap

The ANS-C01 exam often tests the misconception that a BGP session being up guarantees routes are accepted, but the trap here is that AWS applies a mandatory prefix authorization list on Direct Connect virtual interfaces, and candidates overlook this filter when troubleshooting missing routes.

How to eliminate wrong answers

Option B is wrong because route propagation is enabled by default on VPC route tables when a Direct Connect virtual interface is attached, and if it were disabled, no routes from any BGP advertisement would appear, not just a specific /24. Option C is wrong because a BGP ASN conflict would prevent the BGP session from establishing or cause session flapping, but the question states the BGP session is already established. Option D is wrong because adding a static route for the on-premises prefix would bypass the BGP-learned route entirely and does not fix the missing BGP advertisement; the issue is with the BGP route not being accepted by AWS.

Full explanation →

358

MCQmedium

A company has a VPC with an internet gateway and wants to restrict outbound traffic from a private subnet to only allow traffic to specific AWS services, such as S3 and DynamoDB. Which solution should be used?

A.Configure a security group on the instances in the private subnet to allow outbound traffic only to the IP ranges of the AWS services.

B.Use a NAT gateway in the public subnet and add a route to it in the private subnet.

C.Attach an internet gateway to the VPC and add a route to it in the private subnet.

D.Create VPC endpoints for S3 and DynamoDB, and attach a policy to the endpoints to restrict access.

AnswerD

VPC endpoints provide private connectivity to AWS services and can be restricted with policies.

Why this answer

VPC endpoints (Gateway endpoints for S3 and DynamoDB) allow private subnet instances to access these AWS services without traversing the internet, and endpoint policies can restrict access to specific services and actions. Option A is incorrect because security groups cannot filter by destination service; they filter by IP address, and AWS services use dynamic IP ranges. Option B is incorrect because a NAT gateway allows all outbound traffic to the internet, not just to specific services, and would not restrict to only S3 and DynamoDB.

Option C is incorrect because an internet gateway would allow unrestricted outbound traffic to the internet, not just to specific AWS services.

Full explanation →

359

Multi-Selectmedium

A company wants to securely store secrets such as database credentials and API keys. Which TWO AWS services can be used for this purpose? (Choose two.)

Select 2 answers

A.AWS Systems Manager Parameter Store

B.Amazon S3

C.AWS CloudFormation

D.AWS Secrets Manager

E.AWS Identity and Access Management (IAM)

AnswersA, D

Parameter Store can store secrets securely with encryption.

Why this answer

(AWS Systems Manager Parameter Store) and Option D (AWS Secrets Manager) are correct. Parameter Store can store secrets securely with encryption and integrates with AWS KMS. Secrets Manager is designed for secrets with automatic rotation and fine-grained access control.

Option B (Amazon S3) is not secure by default and requires additional configuration. Option C (AWS CloudFormation) is for infrastructure as code, not for storing secrets. Option E (AWS Identity and Access Management) is for managing users and roles, not for storing secrets.

Full explanation →

360

MCQmedium

A network engineer has configured an AWS Site-to-Site VPN connection between a VPC and an on-premises network. The engineer checks the VPN status and sees the output above. What is the MOST likely cause of Tunnel2 being down?

A.The BGP ASN on the on-premises device is misconfigured.

B.The route tables in the VPC do not have a route to the on-premises network.

C.The IKE pre-shared key used for Tunnel2 is incorrect.

D.The IPsec encryption or integrity algorithms do not match between the AWS VPN endpoint and the on-premises device.

AnswerD

Mismatched IPsec parameters cause Phase 2 negotiation failure.

Why this answer

Tunnel2 is down while Tunnel1 is up, indicating a per-tunnel configuration mismatch. The most common cause is a mismatch in IPsec security parameters (encryption, integrity, or DH group) between the AWS VPN endpoint and the on-premises device for that specific tunnel. AWS uses separate pre-shared keys and IPsec settings per tunnel, so a mismatch in algorithms would affect only the misconfigured tunnel.

Exam trap

AWS often tests the distinction between IKE phase 1 (pre-shared key, authentication) and IPsec phase 2 (encryption/integrity algorithms); candidates mistakenly attribute a single tunnel failure to a pre-shared key mismatch, but AWS assigns unique keys per tunnel, so a key error would affect only that tunnel—making algorithm mismatch the more subtle and likely cause when only one tunnel is down.

How to eliminate wrong answers

Option A is wrong because a misconfigured BGP ASN would affect BGP session establishment, but the tunnel itself (IPsec phase 1 and 2) would still come up; the tunnel status shows IPsec layer status, not BGP peering. Option B is wrong because VPC route tables do not affect the tunnel's IPsec negotiation; they only control traffic forwarding once the tunnel is established. Option C is wrong because an incorrect IKE pre-shared key would prevent both IKE phase 1 authentication and the tunnel from coming up, but the question states Tunnel1 is up, and each tunnel uses a unique pre-shared key; if Tunnel2's key were wrong, it would fail, but the more precise cause given the output is an algorithm mismatch, as AWS generates unique keys per tunnel and the key mismatch would be equally likely to affect either tunnel.

Full explanation →

361

MCQhard

A company has a multi-account AWS environment using AWS Organizations. They want to centralize VPC flow logs from all accounts into a single Amazon S3 bucket in the management account. The management account S3 bucket policy allows the log delivery service to write logs. However, flow logs are failing to deliver from member accounts. What is the most likely reason?

A.Flow logs cannot be delivered cross-account; they must be in the same account

B.The member account's IAM role for flow logs does not have permission to write to the bucket

C.The S3 bucket policy does not include a principal condition for the member account's log delivery service

D.The S3 bucket uses SSE-KMS encryption and the member account does not have access to the KMS key

AnswerC

The bucket policy must allow the log delivery service from the member account.

Why this answer

The S3 bucket policy must explicitly allow the log delivery service principal (delivery.logs.amazonaws.com) from the member account to write objects. Option A is incorrect because flow logs can be delivered cross-account with proper permissions. Option B is incorrect because the bucket policy is evaluated, not the member account's VPC flow log role.

Option D is incorrect because encryption is not the issue.

Full explanation →

362

MCQmedium

A network engineer is troubleshooting connectivity issues from an on-premises data center to an Amazon VPC via an AWS Site-to-Site VPN. The VPN tunnel is up, but ping from an on-premises host (10.0.0.5) to an EC2 instance (172.16.1.10) fails. The VPC CIDR is 172.16.0.0/16. The on-premises CIDR is 10.0.0.0/8. The customer gateway device has a route for 172.16.0.0/16 pointing to the VPN tunnel. The VPC route table has a route for 10.0.0.0/8 pointing to the virtual private gateway. Security groups and NACLs allow ICMP. What is the MOST likely cause?

A.The on-premises host does not have a route to the VPC CIDR

B.The customer gateway device is not configured with the correct pre-shared key

C.The route table associated with the EC2 instance's subnet does not have a route for the on-premises CIDR

D.The virtual private gateway is not attached to the correct VPC

AnswerC

Correct; the subnet route table must include a route for the on-premises CIDR pointing to the virtual private gateway.

Why this answer

The most likely cause is that the subnet route table associated with the EC2 instance's subnet does not have a route for the on-premises CIDR (10.0.0.0/8). Although the VPC's main route table has a route for 10.0.0.0/8 pointing to the virtual private gateway, the EC2 instance's subnet may be using a custom route table that lacks this route. Without it, the EC2 instance's return ICMP traffic to 10.0.0.5 is sent via the local route (which only covers the VPC CIDR 172.16.0.0/16) and does not reach the VPN tunnel, causing the ping to fail.

Full explanation →

363

Multi-Selecthard

A company has a Direct Connect connection with a private VIF to a VPC. They want to add redundant connectivity using a second Direct Connect connection from a different provider. They need to ensure that if the primary connection fails, traffic automatically fails over to the secondary. Which THREE components are required?

Select 3 answers

A.An AWS Site-to-Site VPN as a backup

B.A second private VIF on the same Direct Connect connection

C.A second Direct Connect connection from a different provider

D.A Direct Connect Gateway

E.BGP sessions on both connections advertising the same prefixes

AnswersC, D, E

Diverse provider ensures no single point of failure.

Why this answer

The requirement specifies redundant connectivity using a second Direct Connect connection from a different provider. This ensures diverse physical paths and provider independence, which is essential for true high availability. A single provider or connection cannot provide the required fault isolation.

Exam trap

The trap here is that candidates often think a second VIF on the same connection provides redundancy, but it does not protect against physical link failure; true redundancy requires separate connections from different providers, a Direct Connect Gateway, and identical BGP prefix advertisements.

Full explanation →

364

MCQmedium

A company is deploying a VPC with public and private subnets in two Availability Zones. The public subnets contain NAT gateways for outbound internet access from the private subnets. The private subnets host web servers that need to make API calls to an external service over the internet. After implementation, the web servers cannot reach the internet. Which configuration is the most likely cause?

A.The NAT gateway is placed in a private subnet and does not have a route to the internet gateway.

B.The route table for the private subnets is not associated with the VPC's main route table.

C.The private subnets have a default route (0.0.0.0/0) pointing to an internet gateway instead of the NAT gateway.

D.The public subnets have a default route pointing to the NAT gateway instead of the internet gateway.

AnswerA

NAT gateways must reside in a public subnet with a route to an internet gateway. If placed in a private subnet, outbound traffic cannot reach the internet.

Why this answer

A NAT gateway must be placed in a public subnet with a route to an internet gateway (IGW) to translate private IP addresses for outbound traffic. If the NAT gateway is in a private subnet, it cannot reach the IGW, so the private web servers' traffic destined for the internet (via the 0.0.0.0/0 route pointing to the NAT gateway) will fail, as the NAT gateway itself has no path to the internet.

Exam trap

The trap here is that candidates often assume a NAT gateway can be placed in any subnet and still function, but AWS explicitly requires the NAT gateway to reside in a public subnet with a route to an IGW for outbound connectivity.

How to eliminate wrong answers

Option B is wrong because route table association with the VPC's main route table is not required for private subnets; private subnets can have their own custom route table, and the issue is about the NAT gateway's placement, not the route table association. Option C is wrong because if the private subnets had a default route pointing to an IGW, the web servers would be able to reach the internet directly (though this would bypass the NAT gateway and expose private IPs), so this would not cause a failure to reach the internet. Option D is wrong because public subnets having a default route pointing to a NAT gateway instead of an IGW would break outbound internet access from the public subnets themselves, but it would not prevent private subnets from reaching the internet via the NAT gateway, as the NAT gateway's own routing is the critical factor.

Full explanation →

365

MCQhard

A company has a VPC with multiple subnets. An EC2 instance in a private subnet needs to access an S3 bucket to download files. The company wants to avoid using a NAT gateway and minimize latency. Which solution should be used?

A.Create a VPC endpoint for S3 and attach it to the private subnet's route table.

B.Place the instance in a public subnet and use a NAT gateway.

C.Use a VPC endpoint for EC2.

D.Use an internet gateway and a route to 0.0.0.0/0.

AnswerA

Provides private, low-latency access to S3.

Why this answer

A VPC endpoint for S3 allows the EC2 instance in the private subnet to access S3 directly over the AWS network, avoiding internet-bound traffic and eliminating the need for a NAT gateway. This minimizes latency because traffic stays within the AWS backbone and does not traverse the public internet. Attaching the endpoint to the private subnet's route table ensures that S3-bound traffic is routed through the endpoint.

Exam trap

The ANS-C01 exam often tests the misconception that a NAT gateway is required for private subnet internet access, but the trap here is that S3 can be accessed via a VPC endpoint without any internet gateway or NAT, and candidates may confuse VPC endpoints for S3 with those for other services like EC2 or DynamoDB.

How to eliminate wrong answers

Option B is wrong because placing the instance in a public subnet and using a NAT gateway would still route traffic through the internet, increasing latency and incurring NAT gateway costs, which contradicts the requirement to avoid a NAT gateway. Option C is wrong because a VPC endpoint for EC2 does not exist; VPC endpoints are available for services like S3 and DynamoDB, not for EC2 itself. Option D is wrong because using an internet gateway with a default route to 0.0.0.0/0 would require the instance to be in a public subnet with a public IP, which violates the private subnet requirement and introduces internet latency.

Full explanation →

366

Multi-Selectmedium

A company is designing a highly available network architecture using AWS Direct Connect. Which TWO actions should be taken to ensure redundancy?

Select 2 answers

A.Create a single private VIF on the Direct Connect connection

B.Set up a VPN connection over the internet as a backup

C.Provision two Direct Connect connections at different locations

D.Use a single Direct Connect connection with multiple VIFs

E.Configure BGP with different ASNs on each connection

AnswersC, E

Two connections at different locations provide physical diversity.

Why this answer

To ensure redundancy for AWS Direct Connect, you should provision two Direct Connect connections at different locations (option C) to eliminate a single point of failure, and configure BGP with different ASNs on each connection (option E) to enable path diversity and automatic failover. Option A is incorrect because a single private VIF (or multiple VIFs) on a single connection still creates a single point of failure. Option B is incorrect because while a VPN backup provides some redundancy, it is not one of the two required actions for a highly available Direct Connect architecture—the question specifically asks for actions using Direct Connect.

Option D is incorrect because multiple VIFs on a single connection do not provide physical path diversity; they share the same underlying connection.

Full explanation →

367

MCQeasy

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to add IPv6 connectivity to the VPC and allow resources in a private subnet to access the internet via IPv6. Which design should be used?

A.Allocate an IPv6 CIDR block and add a route to an Internet Gateway from the private subnet.

B.Use a NAT instance with IPv6 support in a public subnet.

C.Allocate an IPv6 CIDR block and use a NAT Gateway for IPv6 traffic.

D.Allocate an IPv6 CIDR block, create an egress-only Internet Gateway, and add a route to it from the private subnet.

AnswerD

Egress-only IGW allows outbound IPv6 traffic but blocks inbound.

Why this answer

An egress-only Internet Gateway (EIGW) is the correct AWS-managed service for enabling outbound-only IPv6 traffic from a VPC's private subnet to the internet, while preventing any unsolicited inbound connections. Unlike an Internet Gateway (IGW), which allows bidirectional traffic, an EIGW is specifically designed for IPv6 and ensures that resources in private subnets can initiate outbound connections without being directly reachable from the internet.

Exam trap

The trap here is that candidates confuse the egress-only Internet Gateway with a NAT Gateway or assume that a standard Internet Gateway can be used for private subnets, not realizing that IPv6 requires a different outbound-only mechanism to maintain subnet privacy.

How to eliminate wrong answers

Option A is wrong because adding a route to an Internet Gateway from a private subnet would make the subnet effectively public, allowing inbound IPv6 traffic and violating the requirement for a private subnet. Option B is wrong because NAT instances do not support IPv6; NAT is an IPv4-only function, and AWS NAT Gateways/instances cannot translate IPv6 traffic. Option C is wrong because a NAT Gateway is designed for IPv4 traffic only and does not support IPv6; using it for IPv6 would fail to provide connectivity.

Full explanation →

368

MCQeasy

A company uses AWS WAF to protect its web application. The security team wants to block requests that contain SQL injection attempts. Which WAF rule type should be used?

A.Geographic match rule

B.SQL injection match condition

C.IP set rule

D.Rate-based rule

AnswerB

AWS WAF includes managed rules for SQL injection.

Why this answer

AWS WAF allows you to create a SQL injection match condition to inspect requests for malicious SQL code and block them. Option A is wrong because geographic match rules filter based on the geographic origin of requests, not SQL injection. Option C is wrong because IP set rules block requests from specific IP addresses, not SQL injection patterns.

Option D is wrong because rate-based rules limit the rate of requests from a source, not inspect for SQL injection.

Full explanation →

369

MCQhard

A company has a VPC with public and private subnets. They want to provide outbound internet access to instances in private subnets while preventing inbound internet traffic. The solution must be highly available and scale automatically. Which combination of services should be used?

A.NAT instances in each Availability Zone

B.VPC endpoint for S3 and DynamoDB

C.Internet Gateway attached to the VPC with route tables pointing to the Internet Gateway

D.NAT Gateway in each Availability Zone with route tables pointing to the NAT Gateway

AnswerD

NAT Gateways are managed, highly available within an AZ, and scale automatically. Using one per AZ provides AZ-level redundancy.

Why this answer

D is correct because a NAT Gateway in each Availability Zone provides highly available, automatically scaling outbound internet access for private subnets while blocking unsolicited inbound traffic. NAT Gateways are managed by AWS, scale up to 45 Gbps, and are redundant per AZ, meeting the requirements for high availability and automatic scaling without manual intervention.

Exam trap

The ANS-C01 exam often tests the misconception that a single NAT Gateway in one Availability Zone provides high availability, but the trap is that high availability requires a NAT Gateway in each Availability Zone to survive an AZ failure, as a single NAT Gateway is a single point of failure within its zone.

How to eliminate wrong answers

Option A is wrong because NAT instances are single EC2 instances that require manual configuration for high availability (e.g., auto-scaling groups, health checks) and do not automatically scale; they also have bandwidth limits based on instance type. Option B is wrong because VPC endpoints for S3 and DynamoDB provide private connectivity to those specific AWS services, not general outbound internet access to all destinations. Option C is wrong because an Internet Gateway attached to the VPC with route tables pointing to it would allow inbound internet traffic to private subnets, violating the requirement to prevent inbound traffic; Internet Gateways are used for public subnets, not private subnets needing outbound-only access.

Full explanation →

370

MCQeasy

A security engineer needs to audit all API calls that modify security group rules in a VPC. Which AWS service should be used to record these API calls?

A.AWS CloudTrail

B.Amazon Inspector

C.AWS Config

D.VPC Flow Logs

AnswerA

AWS CloudTrail records API calls for security group modifications, including the caller identity and timestamp.

Why this answer

AWS CloudTrail records all API calls made to the AWS API, including modifications to security group rules. Option A is correct. AWS Config records resource configuration changes but not API calls.

VPC Flow Logs capture network traffic logs, not API calls. Amazon Inspector is for vulnerability assessment.

Full explanation →

371

MCQeasy

A network engineer runs the AWS CLI command shown in the exhibit. The VPC has an Amazon Route 53 private hosted zone associated. What is the impact of this setting?

A.No instances in the VPC can resolve DNS records from the private hosted zone.

B.Only instances in public subnets can resolve private hosted zone records.

C.The DHCP option set must be updated to provide DNS resolution.

D.The private hosted zone is automatically deleted.

AnswerA

DNS support disabled means no DNS resolution via VPC.

Why this answer

The AWS CLI command shown in the exhibit sets the `enableDnsHostnames` and `enableDnsSupport` attributes to `false` for the VPC. When `enableDnsSupport` is false, Amazon Route 53 private hosted zones cannot be resolved by instances within that VPC because the VPC's DNS resolution is disabled entirely. This means no instances in the VPC can query the Route 53 Resolver for private hosted zone records, making option A correct.

Exam trap

The trap here is that candidates often confuse `enableDnsHostnames` (which controls instance hostname assignment) with `enableDnsSupport` (which controls DNS resolution), or assume that DHCP option sets can independently enable private hosted zone resolution without the VPC-level DNS support being enabled.

How to eliminate wrong answers

Option B is wrong because disabling DNS support (`enableDnsSupport: false`) affects all instances in the VPC regardless of subnet type; public subnets do not bypass this VPC-level setting. Option C is wrong because the DHCP option set cannot override the VPC-level `enableDnsSupport` attribute; even if the DHCP option set specifies custom DNS servers, the VPC's DNS resolution must be enabled for Route 53 private hosted zones to work. Option D is wrong because the private hosted zone is not automatically deleted when DNS support is disabled; it remains associated with the VPC but becomes non-functional until DNS support is re-enabled.

Full explanation →

372

MCQmedium

A company has an AWS Site-to-Site VPN connection between its on-premises network and a VPC. The tunnel status is up, but traffic from on-premises cannot reach an EC2 instance in the VPC. The instance's security group allows inbound traffic from the on-premises CIDR. Which configuration should be checked first?

A.Ensure the VPN connection is attached to a transit gateway instead of a virtual private gateway.

B.Check the network ACL associated with the EC2 instance's subnet to ensure it allows inbound traffic from on-premises.

C.Verify that the VPC route table includes a route to the on-premises CIDR with the VPN gateway as target.

D.Confirm that BGP session is established and exchanging routes.

AnswerC

Traffic from on-premises enters the VPC via VPN, but the return traffic needs a route back to the VPN gateway.

Why this answer

For traffic from on-premises to reach an EC2 instance in a VPC via a Site-to-Site VPN, the VPC route table must contain a route pointing the on-premises CIDR to the VPN gateway (virtual private gateway or transit gateway). Without this route, the VPC has no path to send return traffic back to on-premises, causing asymmetric routing and connectivity failure even if the tunnel is up.

Exam trap

The trap here is that candidates often jump to checking BGP or tunnel status first, but the tunnel being up only confirms Layer 3 connectivity between the VPN endpoints, not that the VPC has a valid route to forward traffic back to on-premises.

How to eliminate wrong answers

Option A is wrong because the VPN connection can be attached to either a transit gateway or a virtual private gateway; the attachment type is not the primary issue when the tunnel is up but traffic fails. Option B is wrong because network ACLs are stateless and must allow both inbound and outbound traffic, but the question states the security group (stateful) already allows inbound from on-premises; the more common first check is the route table, not the NACL. Option D is wrong because if the tunnel status is up, BGP may or may not be used (static routes are also possible); even if BGP is established, the VPC route table still needs a route to the on-premises CIDR, so checking BGP first is premature.

Full explanation →

373

Multi-Selectmedium

Which THREE of the following are features of AWS Transit Gateway? (Select THREE.)

Select 3 answers

A.Multicast support

B.Built-in NAT capabilities

C.Transitive routing between multiple VPCs

D.Centralized routing and management

E.Edge-to-edge routing for VPN connections

AnswersA, C, D

Transit Gateway supports multicast groups.

Why this answer

AWS Transit Gateway supports multicast traffic by acting as a multicast router within a VPC, enabling you to send a single stream of data to multiple receivers across different VPCs. This is achieved through the creation of a multicast domain and the association of subnets as sources or members, using IGMPv2 for group membership management.

Exam trap

The trap here is that candidates may confuse Transit Gateway's support for multicast with built-in NAT capabilities, or assume that edge-to-edge routing is a distinct feature when it is simply a consequence of Transit Gateway's ability to route between any attached networks.

Full explanation →

374

MCQmedium

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Direct Connect. The network team notices that traffic from an on-premises data center to a VPC is intermittently dropping. CloudWatch metrics show no errors on the Direct Connect virtual interface. What is the most likely cause of the intermittent drops?

A.Latency spikes on the Direct Connect link due to AWS VPN backup path

B.MTU mismatch causing packet fragmentation for jumbo frames

C.BGP keepalive timer mismatch between the on-premises router and the Direct Connect router

D.Asymmetric routing due to missing or incorrect route propagation in Transit Gateway route tables

AnswerD

Asymmetric routing can cause intermittent drops if return traffic takes a different path.

Why this answer

The most likely cause of intermittent traffic drops from on-premises to a VPC via Direct Connect and Transit Gateway is asymmetric routing due to missing or incorrect route propagation. Asymmetric routing can occur when the forward path (on-premises to VPC) is valid, but the return path (VPC to on-premises) lacks a specific route in the Transit Gateway route table. This causes packets to be dropped intermittently as route propagation changes or routing tables are updated.

Option A is incorrect because latency spikes are not typical of intermittent drops, and the VPN backup path is not mentioned as active. Option B is incorrect because MTU mismatch usually causes consistent packet loss for large packets, not intermittent drops. Option C is incorrect because BGP keepalive timer mismatches would cause sustained session loss rather than intermittent drops.

Therefore, option D is correct.

Full explanation →

375

MCQeasy

A company wants to centralize VPC flow log management from multiple accounts into a single S3 bucket in the management account. Which combination of AWS services should be used?

A.AWS CloudTrail and Amazon S3

B.AWS Lambda and Amazon S3

C.Amazon Kinesis Data Firehose and Amazon S3

D.AWS Organizations and Amazon S3 bucket policy

AnswerD

Using Organizations, you can set a bucket policy that allows flow logs from member accounts to be delivered to the central bucket.

Why this answer

AWS Organizations with SCP can allow cross-account S3 bucket policies. AWS CloudTrail is not needed for flow logs. Option D is correct.

Options A, B, and C either miss key services or include unnecessary ones.

Full explanation →

Page 5 of 22

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

Practice ANS-C01 by domain

Target a specific domain to shore up weak areas.

Network Management and Operations Network Security, Compliance and Governance Network Design Network Implementation

See all domains with question counts →