Courseiva

AWS Certified Advanced Networking Specialty ANS-C01 (ANS-C01) — Questions 376–450

1621 questions total · 22pages · All types, answers revealed

Take a mock examExam hub
Page 5

Page 6 of 22

Page 7
376
MCQeasy

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to connect two separate branch offices using AWS Client VPN. Each branch office has a different subnet: Branch A uses 10.0.1.0/24 and Branch B uses 10.0.2.0/24. The Client VPN endpoint is configured with a CIDR range of 10.0.3.0/24. The route table for the VPC has the local route and routes to the Client VPN endpoint. Users from both branches can connect to the VPN but cannot communicate with each other. What is the most likely reason?

A.The branch subnets 10.0.1.0/24 and 10.0.2.0/24 are part of the VPC CIDR, so the VPC routes traffic locally instead of via the VPN
B.The route tables in the branch subnets do not have routes to the Client VPN endpoint
C.The Client VPN endpoint is configured with a CIDR that overlaps with the branch subnets
D.The security group for the Client VPN endpoint does not allow inbound traffic from branch subnets
AnswerA

Local routes take precedence.

Why this answer

Branch subnets overlap with the VPC CIDR, causing routing conflicts. The VPC sees 10.0.1.0/24 and 10.0.2.0/24 as local, thus traffic destined to those addresses is routed locally within the VPC, not to the VPN. Options B and C are not relevant to inter-branch communication.

Option D would not cause the issue because branch subnets are within the VPC CIDR.

Full explanation →
377
MCQhard

A network administrator attached the IAM policy shown to a user. The user tries to create an internet gateway in us-east-1 without any tags. What will happen?

A.The internet gateway creation fails because the first statement does not allow it in us-east-1.
B.The internet gateway is created but the user receives a warning.
C.The internet gateway creation is denied because the Deny statement applies.
D.The internet gateway is created successfully because the first statement allows it.
AnswerC

Without the required tag, the Deny blocks the action.

Why this answer

The first statement allows CreateInternetGateway in us-east-1. The second statement denies CreateInternetGateway if the resource tag 'purpose' is not 'production'. When creating a resource without tags, the condition StringNotEquals evaluates to true (since no tag, it's not equal to 'production'), so the Deny applies.

The Deny overrides the Allow, so the action is denied. Therefore, option C is correct because the Deny statement applies. Option A is incorrect because the first statement does allow it in us-east-1, but the Deny overrides.

Option B is incorrect because the creation is denied, not permitted with a warning. Option D is incorrect because the Deny overrides the Allow.

Full explanation →
378
MCQhard

A company has a VPC with a public subnet hosting a web server and a private subnet hosting a database. The web server must connect to the database on port 3306. Security groups are configured: Web SG allows inbound HTTP/HTTPS from 0.0.0.0/0 and outbound to DB SG on port 3306. DB SG allows inbound from Web SG on port 3306. Network ACLs are default. The web server can connect to the database, but the security team notices that the database is also receiving connections from an unexpected IP address. What is the MOST likely cause?

A.The network ACL on the private subnet allows inbound traffic from all IPs.
B.The DB security group has an inbound rule allowing traffic from 0.0.0.0/0 on port 3306.
C.An unauthorized EC2 instance has been launched with the same Web security group attached.
D.Security groups are stateful, so the DB SG automatically allows inbound responses.
AnswerC

Correct: Any instance with Web SG can access DB due to the inbound rule.

Why this answer

Security groups are stateful and allow outbound responses automatically, but the unexpected connections are likely due to another instance with the Web SG attached. The DB SG inbound rule allows traffic from the Web SG, which applies to all instances with that SG, including unauthorized ones. Option A is incorrect because default NACLs allow all traffic, but inbound NACL rules could be the issue if they were modified, but they are default.

Option B is incorrect because the DB SG inbound rule is from the Web SG, not 0.0.0.0/0. Option D is incorrect because while security groups are stateful, that does not cause unexpected connections; it only ensures return traffic is allowed.

Full explanation →
379
MCQmedium

A company has a VPC with multiple subnets. They want to monitor all network traffic to and from an EC2 instance for troubleshooting. Which AWS service should they use?

A.Amazon Inspector
B.AWS Config
C.VPC Flow Logs
D.AWS CloudTrail
AnswerC

VPC Flow Logs capture information about IP traffic going to and from network interfaces in a VPC.

Why this answer

VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including metadata such as source/destination IPs, ports, protocols, and packet accept/reject decisions. This makes it the correct service for monitoring all network traffic to and from an EC2 instance for troubleshooting purposes.

Exam trap

The trap here is that candidates often confuse VPC Flow Logs (which capture network traffic metadata) with AWS CloudTrail (which captures API calls), leading them to incorrectly select CloudTrail when the question specifically asks about monitoring network traffic to and from an EC2 instance.

How to eliminate wrong answers

Option A is wrong because Amazon Inspector is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, not a tool for capturing raw network traffic logs. Option B is wrong because AWS Config evaluates and records resource configuration changes and compliance against rules, but it does not capture or log network traffic flows. Option D is wrong because AWS CloudTrail records API activity and management events for governance and auditing, not the actual network packets or flow-level traffic data.

Full explanation →
380
MCQhard

A network engineer created a VPC endpoint for the service shown in the exhibit. The endpoint is in the 'available' state, but instances in the VPC cannot resolve the private DNS name 'example.com'. What is the most likely cause?

A.The VPC does not have a Route 53 private hosted zone for example.com
B.The VPC does not have an internet gateway
C.The endpoint does not have 'Private DNS names enabled'
D.The security group for the endpoint is blocking DNS traffic
AnswerC

Without enabling this option, the private DNS name is not resolved.

Why this answer

The private DNS name is only resolved via Route 53 private hosted zone if 'Private DNS names enabled' is set. The exhibit shows the service has a PrivateDnsName, but the endpoint must have 'Private DNS names enabled' for resolution to work.

Full explanation →
381
MCQmedium

A company has a VPC with public and private subnets. The security team wants to analyze all traffic to and from the internet for security incidents. Which AWS service should be used to capture and analyze this traffic?

A.AWS Shield Advanced
B.AWS Network Firewall
C.AWS WAF
D.VPC Flow Logs
AnswerD

Flow Logs capture IP traffic metadata for analysis.

Why this answer

VPC Flow Logs capture IP traffic information for network interfaces, including traffic to/from the internet, allowing analysis of all traffic for security incidents. Option A (AWS Shield Advanced) is incorrect because it provides DDoS protection, not traffic analysis. Option B (AWS Network Firewall) is incorrect because it provides firewall capabilities but does not provide detailed traffic logs like VPC Flow Logs.

Option C (AWS WAF) is incorrect because it filters web traffic but does not capture or analyze all internet traffic.

Full explanation →
382
MCQhard

A company has deployed a multi-tier application in a VPC with public and private subnets. The web tier runs on EC2 instances in public subnets, and the application tier runs on EC2 instances in private subnets. The application tier must only accept traffic from the web tier security group. The security group for the application tier has an inbound rule allowing HTTP traffic from the web tier security group. However, the application team reports that the web tier instances cannot connect to the application tier instances. The network administrator has verified that the web tier instances can resolve the private DNS names of the application tier instances, and the route tables are correctly configured. What is the MOST likely cause of the connectivity issue?

A.The application tier instances do not have a route to the web tier instances.
B.The application tier security group's inbound rule is stateful, but the outbound rule is not configured to allow return traffic.
C.The web tier security group's outbound rules do not allow traffic to the application tier security group.
D.The network ACL for the private subnet is blocking inbound traffic from the public subnet.
AnswerC

If the web tier security group does not have an outbound rule allowing traffic to the application tier, connections will fail.

Why this answer

Security groups are stateful, meaning that if you allow inbound traffic, the return traffic is automatically allowed regardless of outbound rules. However, the outbound rules of the initiating security group (the web tier) must permit the traffic to reach the destination. Since the web tier instances initiate the connection to the application tier, the web tier security group's outbound rules must allow HTTP traffic to the application tier security group.

If those outbound rules are missing or too restrictive, the connection will fail even though the application tier's inbound rule is correct.

Exam trap

AWS often tests the misconception that security groups are stateless like network ACLs, leading candidates to incorrectly assume that outbound rules on the destination security group are needed for return traffic, when in fact the issue is the outbound rules on the source security group.

How to eliminate wrong answers

Option A is wrong because the route tables are correctly configured and the web tier can resolve private DNS names, indicating that routing is functional; the application tier does not need a specific route back to the web tier because the VPC's implicit router handles return traffic as long as the destination is within the VPC. Option B is wrong because security groups are stateful, so if the inbound rule allows traffic, the outbound return traffic is automatically permitted regardless of outbound rules; no separate outbound rule is needed for return traffic. Option D is wrong because network ACLs are stateless and must allow both inbound and outbound traffic separately, but the question states route tables are correctly configured and does not mention any NACL misconfiguration; moreover, the default NACL allows all traffic, and custom NACLs would need explicit rules, but the issue is more likely at the security group level given the symptom.

Full explanation →
383
Multi-Selectmedium

A company is deploying a multi-tier web application across multiple Availability Zones in a VPC. The architecture includes public-facing Application Load Balancers, Amazon EC2 instances in private subnets, and an Amazon RDS for MySQL Multi-AZ DB instance. To meet compliance requirements, all traffic between the web tier and database tier must be encrypted and must not traverse the internet. Which TWO actions should the company take to implement this securely? (Choose two.)

Select 2 answers
A.Establish an AWS Site-to-Site VPN between the web tier subnets and the database subnet.
B.Create a VPC endpoint for Amazon RDS and route database traffic through it.
C.Enable SSL/TLS encryption on the RDS DB instance and configure the web servers to connect using SSL.
D.Assign an Elastic IP address to the RDS DB instance to ensure a stable IP for the web tier.
E.Use the RDS endpoint (DNS name) that resolves to a private IP within the same VPC.
AnswersC, E

Encrypts traffic between web and database tiers.

Why this answer

Enabling SSL/TLS encryption on the RDS DB instance and configuring the web servers to connect using SSL ensures that all traffic between the web tier and database tier is encrypted in transit. This satisfies the compliance requirement for encrypted traffic without needing external connectivity. Option E is correct because using the RDS endpoint (DNS name) that resolves to a private IP within the same VPC ensures that database traffic remains within the VPC and does not traverse the internet, meeting the compliance requirement for no internet traversal.

Exam trap

The trap here is that candidates may confuse VPC endpoints (which are used for AWS services like S3 or DynamoDB) with the need for private connectivity to RDS, but RDS within the same VPC already uses private IPs, and the real focus is on enabling SSL/TLS encryption and using the private DNS endpoint to keep traffic internal.

Full explanation →
384
MCQhard

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16 and needs to add IPv6 support for its public-facing web application. The application must be accessible via both IPv4 and IPv6. The VPC already has an Internet Gateway attached. What is the correct set of steps to enable IPv6?

A.Assign a custom IPv6 CIDR block from your own range to the VPC and add a route to the Internet Gateway.
B.Associate an Amazon-provided IPv6 CIDR block to the VPC, add a route for ::/0 to the Internet Gateway, and allocate IPv6 addresses to the subnets.
C.Associate an IPv6 CIDR block, create an Egress-Only Internet Gateway, and route ::/0 to it.
D.Associate a /64 IPv6 CIDR block to the VPC, add a route for ::/0 to the Internet Gateway, and assign IPv6 addresses to instances.
AnswerB

Standard procedure for public IPv6 access.

Why this answer

To enable IPv6 in a VPC, you must associate an Amazon-provided IPv6 CIDR block (a /56 block by default), add a route for the IPv6 default route (::/0) to the Internet Gateway, and allocate IPv6 addresses to the subnets. The Internet Gateway already supports IPv6 traffic natively, so no additional gateway is required for public-facing IPv6 access.

Exam trap

The trap here is that candidates often confuse the need for an Egress-Only Internet Gateway with public-facing IPv6 access, but for inbound traffic, the regular Internet Gateway works for both IPv4 and IPv6.

How to eliminate wrong answers

Option A is wrong because you cannot assign a custom IPv6 CIDR block from your own range to a VPC; AWS only supports associating an Amazon-provided IPv6 CIDR block or using an IPv6 CIDR block from an IPAM pool. Option C is wrong because an Egress-Only Internet Gateway is used for outbound-only IPv6 traffic from private subnets, not for public-facing web applications that require inbound IPv6 access. Option D is wrong because the IPv6 CIDR block assigned to a VPC is a /56 block, not a /64, and you must allocate IPv6 addresses to subnets, not directly to instances.

Full explanation →
385
MCQeasy

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team notices that traffic between two VPCs is taking a suboptimal path through the on-premises network instead of staying within AWS. What is the MOST likely cause?

A.The Transit Gateway route tables do not have a route for the destination VPC CIDR, so traffic is sent to the on-premises network via a default route.
B.The subnet route tables in each VPC have a route pointing to the other VPC's CIDR via the Internet Gateway.
C.The VPCs are peered directly, bypassing the Transit Gateway.
D.Security groups are blocking traffic between the VPCs.
AnswerA

Correct: Missing route causes blackhole or fallback to default route.

Why this answer

When a Transit Gateway route table lacks a specific route for the destination VPC CIDR, traffic destined for that VPC is evaluated against the remaining routes. If a default route (0.0.0.0/0) exists pointing to an on-premises network attachment (e.g., a VPN or Direct Connect), the traffic will be forwarded over that path, resulting in a suboptimal route that leaves AWS and re-enters through the on-premises network. This is the most likely cause because the Transit Gateway performs destination-based routing, and missing a specific VPC route forces fallback to the default route.

Exam trap

The trap here is that candidates often assume suboptimal routing is caused by asymmetric routing or security group misconfigurations, but the real issue is a missing specific route in the Transit Gateway route table, causing fallback to a default route that sends traffic on-premises.

How to eliminate wrong answers

Option B is wrong because a subnet route table pointing to an Internet Gateway for another VPC's CIDR would send traffic to the internet, not to the other VPC, and would not cause suboptimal routing through on-premises; it would simply break connectivity. Option C is wrong because if the VPCs were peered directly, traffic would stay within AWS and not traverse the on-premises network, contradicting the observed suboptimal path. Option D is wrong because security groups operate at the instance level (stateful packet filtering) and do not influence routing decisions; they can block traffic but cannot cause traffic to take a different network path.

Full explanation →
386
Multi-Selecthard

A security engineer is designing a VPC with public and private subnets. The company requires that instances in the private subnet can initiate outbound connections to the internet but cannot receive inbound connections from the internet. Which TWO components are necessary? (Choose 2)

Select 2 answers
A.VPC Gateway Endpoint for S3
B.Security group allowing inbound traffic from 0.0.0.0/0
C.NAT Gateway in the public subnet
D.Internet Gateway attached to the private subnet
E.Route in the private subnet route table pointing to the NAT Gateway
AnswersC, E

NAT Gateway enables outbound internet from private subnets.

Why this answer

To allow instances in a private subnet to initiate outbound internet connections while preventing inbound connections, a NAT Gateway placed in a public subnet is required. The NAT Gateway translates private IPs to its own public IP. Additionally, the private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway to direct outbound traffic.

Option A (VPC Gateway Endpoint for S3) is for private access to S3, not general internet. Option B (security group allowing inbound from 0.0.0.0/0) would allow inbound connections, violating the requirement. Option D (Internet Gateway attached to private subnet) is incorrect because an Internet Gateway is attached to the VPC, not a subnet, and would allow inbound traffic if used in a route table.

Full explanation →
387
MCQmedium

A company has a VPC with a public subnet and a private subnet. The public subnet contains a NAT gateway and a bastion host. The private subnet contains several EC2 instances that need to download software updates from the internet. The security team has configured the following: - A security group on the EC2 instances allows outbound traffic to 0.0.0.0/0 on ports 443 and 80. - The private subnet's route table has a default route (0.0.0.0/0) pointing to the NAT gateway. - The NAT gateway is in the public subnet with an Elastic IP and its security group allows inbound traffic from the private subnet CIDR on ports 443 and 80, and outbound to 0.0.0.0/0 on all ports. Despite this, the EC2 instances cannot reach the internet. What is the most likely cause?

A.The NAT gateway's security group inbound rule is too restrictive
B.The NAT gateway does not have an Elastic IP associated
C.The route table of the private subnet does not have a route to the NAT gateway
D.The EC2 instances' security group does not allow inbound traffic from the NAT gateway
AnswerA

Incorrect. NAT gateways are managed services and do not support security group associations. The premise of a security group on the NAT gateway is invalid.

Why this answer

The most likely cause is that the NAT gateway's security group inbound rule is too restrictive. NAT gateways are managed services and do not have security groups; if one were hypothetically attached, its inbound rule allowing only ports 443 and 80 would block return traffic on ephemeral ports. More critically, security groups are stateful—if outbound traffic is allowed, return traffic is automatically permitted regardless of inbound rules.

Therefore, option D is incorrect. Option B is incorrect because the NAT gateway has an Elastic IP, and option C is incorrect because the private subnet route table has a default route to the NAT gateway.

Full explanation →
388
Multi-Selecthard

Which THREE are benefits of using AWS Transit Gateway over VPC peering in a multi-VPC environment? (Select THREE.)

Select 3 answers
A.Centralized management of network policies
B.Higher bandwidth per connection
C.Simpler configuration for a few VPCs
D.Lower cost compared to VPC peering
E.Transitive routing between all attached VPCs
.Ability to attach VPN and Direct Connect connections
AnswersA, E

Correct. Centralized management allows consistent policy enforcement across multiple VPCs.

Why this answer

AWS Transit Gateway offers a hub-and-spoke architecture that provides three key benefits over VPC peering: (1) the ability to attach VPN connections and Direct Connect virtual interfaces, enabling hybrid connectivity; (2) centralized management of network policies such as routing, security, and access controls from a single point; and (3) transitive routing between all attached VPCs, eliminating the need for full mesh peering.

Exam trap

AWS often tests the misconception that Transit Gateway always reduces cost or complexity compared to VPC peering, but the trap here is that for small numbers of VPCs (e.g., 2-3), VPC peering is simpler and cheaper, while Transit Gateway's benefits (centralized management, transitive routing, hybrid connectivity) only become advantageous at scale.

Full explanation →
389
MCQeasy

A company is running a web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application needs to store session state in an ElastiCache Redis cluster. The Redis cluster should not be accessible from the internet. Which network design should be used?

A.Place the Redis cluster in a public subnet and restrict access via security group.
B.Place the Redis cluster in a private subnet and the EC2 instances in a private subnet, with a NAT Gateway for outbound traffic.
C.Place the Redis cluster in a private subnet and the EC2 instances in a public subnet.
D.Place both the EC2 instances and the Redis cluster in private subnets with appropriate security groups.
AnswerD

Both in private subnets, security groups allow traffic from EC2 to Redis.

Why this answer

Placing both the EC2 instances and the ElastiCache Redis cluster in private subnets ensures that the Redis cluster is not accessible from the internet, meeting the security requirement. The EC2 instances can communicate with the Redis cluster within the same VPC using private IP addresses, and security groups can be used to restrict traffic to only the necessary ports (e.g., TCP 6379 for Redis) from the EC2 instances' security group. This design avoids exposing the Redis cluster to any public network, aligning with best practices for internal caching layers.

Exam trap

The trap here is that candidates may think a NAT Gateway is required for EC2 instances in private subnets to communicate with ElastiCache, but in reality, VPC internal traffic uses private IPs and does not require a NAT Gateway, which is only for outbound internet access.

How to eliminate wrong answers

Option A is wrong because placing the Redis cluster in a public subnet exposes it to the internet, even with a security group restriction, as public subnets have a route to an internet gateway, which violates the requirement that the Redis cluster should not be accessible from the internet. Option B is wrong because while the Redis cluster is in a private subnet, the EC2 instances are also in a private subnet, but the mention of a NAT Gateway for outbound traffic is unnecessary and irrelevant for internal communication between EC2 and Redis; the NAT Gateway is only needed for outbound internet access, which is not required here. Option C is wrong because placing the EC2 instances in a public subnet exposes them to the internet, which is unnecessary for a web application behind an ALB (the ALB handles public traffic), and it does not directly affect Redis accessibility, but the design is suboptimal and introduces unnecessary risk.

Full explanation →
390
MCQeasy

A company is designing a network for a three-tier web application in a single VPC. The web tier must be accessible from the internet, but the application and database tiers must not have direct internet access. The application servers need to make outbound calls to a third-party API. Which architecture meets these requirements?

A.Web servers in public subnets, application and database servers in private subnets with an internet gateway for outbound traffic.
B.All servers in public subnets with security groups restricting access.
C.Web servers in public subnets with an Application Load Balancer, application servers in private subnets with a NAT gateway, and database servers in private subnets.
D.All servers in private subnets and a VPN connection to the internet.
AnswerC

This follows best practices for a three-tier architecture.

Why this answer

It places web servers in public subnets with an Application Load Balancer for inbound internet traffic, while application and database servers reside in private subnets without direct internet access. A NAT gateway in a public subnet enables the application servers to initiate outbound connections to a third-party API, with return traffic automatically routed back, meeting the requirement for outbound-only internet access.

Exam trap

The trap here is that candidates often confuse an internet gateway with a NAT gateway, assuming an internet gateway can provide outbound-only access from private subnets, but an internet gateway requires public IPs and allows bidirectional traffic, while a NAT gateway specifically enables outbound-only traffic from private subnets.

How to eliminate wrong answers

Option A is wrong because an internet gateway in a private subnet does not provide outbound-only access; internet gateways require a public IP and route table entry for bidirectional traffic, which would expose private instances to inbound internet traffic, violating the no-direct-internet-access requirement. Option B is wrong because placing all servers in public subnets, even with security groups, still assigns public IPs and allows potential inbound internet access to application and database servers, failing the requirement to restrict their internet access. Option D is wrong because a VPN connection to the internet would route all traffic through a VPN, but private subnets without a NAT gateway or internet gateway cannot initiate outbound connections to the internet; the VPN alone does not provide outbound internet access for private instances.

Full explanation →
391
MCQeasy

A company is deploying an application across multiple Availability Zones in a single AWS Region. The application requires that all traffic between EC2 instances in the same subnet be inspected by a network appliance. Which configuration should be used to meet this requirement?

A.Set up a VPC peering connection between the subnets
B.Use a Transit Gateway to route traffic through the appliance
C.Deploy AWS Network Firewall in the subnet
D.Create a Gateway Load Balancer and configure the appliance as a target
AnswerD

GWLB can be used to inspect all traffic between instances in the same subnet via a Gateway Load Balancer Endpoint.

Why this answer

A Gateway Load Balancer (GWLB) can inspect intra-subnet traffic between EC2 instances in the same subnet. Traffic between instances in the same subnet is Layer 2 and does not traverse route tables, so traditional routing methods cannot intercept it. GWLB uses Geneve encapsulation to transparently redirect traffic at the hypervisor level to the appliance targets without modifying the route table.

The appliance must be configured to handle this encapsulation. Other options do not support inspection of same-subnet traffic.

Exam trap

The ANS-C01 exam often tests the misconception that intra-subnet traffic can be intercepted by a firewall or routing construct, but in AWS, traffic between instances in the same subnet is Layer 2 and never hits a route table, so only a Gateway Load Balancer (or an inline appliance with proxy ARP) can inspect it.

How to eliminate wrong answers

Option A is wrong because VPC peering connects different VPCs, not subnets within the same VPC, and it does not provide any traffic inspection capability. Option B is wrong because a Transit Gateway is used for inter-VPC or hybrid connectivity, not for routing traffic within a single subnet; it cannot intercept intra-subnet traffic without complex overlay configurations. Option C is wrong because AWS Network Firewall is a managed firewall service that inspects traffic at the VPC or subnet boundary (e.g., ingress/egress), but it cannot inspect traffic between instances within the same subnet because that traffic does not traverse a route table or a firewall endpoint.

Full explanation →
392
MCQmedium

A security engineer reviews VPC Flow Logs and sees the entries shown. The last entry shows a REJECT for traffic from 203.0.113.5 to 10.0.1.5 on port 443. However, the third entry shows ACCEPT for traffic from 10.0.1.5 to 203.0.113.5 on port 443. What is the most likely reason for the REJECT?

A.The network ACL associated with the subnet of 10.0.1.5 does not allow inbound traffic from 203.0.113.5.
B.AWS WAF is blocking the inbound traffic.
C.The security group attached to the instance 10.0.1.5 does not allow inbound traffic from 203.0.113.5.
D.The route table for the subnet of 10.0.1.5 does not have a route to the internet.
AnswerA

NACLs are stateless and require explicit inbound rules for response traffic.

Why this answer

The VPC Flow Logs show outbound traffic from 10.0.1.5 to 203.0.113.5 on port 443 was allowed (ACCEPT), but the inbound response was rejected. Security groups are stateful, so they automatically allow return traffic for established connections. Therefore, a security group (Option C) would not cause this REJECT.

Network ACLs are stateless and require explicit inbound rules; if the inbound rule for traffic from 203.0.113.5 is missing, the response is dropped, resulting in a REJECT. Option A correctly identifies this. Option B (AWS WAF) operates at the application layer (Layer 7) and is not reflected in VPC Flow Logs, which capture Layer 3/4 traffic.

Option D (route table) would cause a lack of connectivity, not a REJECT entry in flow logs.

Full explanation →
393
MCQmedium

A company has a VPC with a public subnet and a private subnet. They have a NAT Gateway in the public subnet. They also have an EC2 instance in the private subnet that needs to access the internet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway. The security group for the EC2 instance allows outbound HTTPS traffic. The network ACL for the private subnet allows inbound and outbound ephemeral ports. However, the EC2 instance cannot reach the internet. The network engineer checks the NAT Gateway and sees that it has an Elastic IP attached. The engineer also checks the route table for the public subnet and finds no route to the internet. What should the engineer do to fix the issue?

A.Deploy a second NAT Gateway in the private subnet.
B.Add a route in the public subnet route table to 0.0.0.0/0 via the internet gateway.
C.Add a route in the private subnet route table to 0.0.0.0/0 via the internet gateway.
D.Attach a second Elastic IP to the NAT Gateway.
AnswerB

This allows the NAT gateway to reach the internet.

Why this answer

The NAT Gateway resides in the public subnet, and for the NAT Gateway to forward traffic to the internet, the public subnet's route table must have a default route (0.0.0.0/0) pointing to an internet gateway. Without that route, the NAT Gateway cannot send traffic to the internet, even though the private subnet's route points to the NAT Gateway. Options A, C, and D are incorrect: A is unnecessary because a NAT Gateway in the private subnet would not have direct internet access; C would bypass the NAT Gateway and require a route to the internet gateway directly from the private subnet, which is not the standard design; D is wrong because adding another Elastic IP does not solve the missing route issue.

Full explanation →
394
MCQhard

A company is designing a hybrid network with a Direct Connect connection. The VPC has multiple subnets that need to communicate with on-premises. The company wants to use a single VIF for both private and public traffic. Which type of VIF should be used?

A.Public VIF
B.Hosted VIF
C.A single VIF cannot carry both private and public traffic
D.Private VIF
AnswerC

Private and public VIFs are separate; you need two VIFs.

Why this answer

A single Virtual Interface (VIF) on an AWS Direct Connect connection is designed to carry either private traffic (VPC-to-on-premises via private IPs) or public traffic (to AWS public services like S3, DynamoDB via public IPs), but not both simultaneously. This is because a Private VIF uses BGP to exchange routes over private IP addresses within a VPC, while a Public VIF uses BGP to exchange routes for AWS public IP prefixes. The two traffic types require separate BGP sessions and separate VLANs, making it impossible to combine them into one VIF.

Exam trap

The trap here is that candidates assume a single VIF can be 'multiplexed' to carry both private and public traffic, similar to a VPN tunnel, but AWS Direct Connect enforces strict separation between Private and Public VIFs at the BGP and VLAN level.

How to eliminate wrong answers

Option A is wrong because a Public VIF only provides access to AWS public services (e.g., S3, DynamoDB) using public IP addresses and cannot route traffic to private VPC subnets. Option B is wrong because a Hosted VIF is a type of VIF provided by an AWS Direct Connect Partner, but it still functions as either a Private or Public VIF and cannot carry both traffic types simultaneously. Option D is wrong because a Private VIF only connects to a single VPC using private IP addresses and cannot carry traffic to AWS public endpoints.

Full explanation →
395
MCQmedium

A company has a VPC with an Application Load Balancer (ALB) in front of EC2 instances. The security group for the ALB allows inbound HTTP traffic from 0.0.0.0/0. The security group for the EC2 instances allows inbound traffic only from the ALB security group. However, the health checks are failing. What is the most likely cause?

A.The target group is not configured with the correct health check path
B.The ALB is in a private subnet
C.The EC2 security group does not allow inbound traffic from the ALB security group
D.The ALB security group does not allow outbound traffic
AnswerA

Correct. An incorrect health check path will cause the ALB to receive non-200 responses, marking instances unhealthy.

Why this answer

The most likely cause of health check failures is an incorrect health check path configured in the target group. The security group configuration described in the stem should allow health check traffic because the EC2 security group explicitly allows inbound traffic from the ALB security group. However, if the target group's health check path does not match the actual endpoint on the EC2 instances (e.g., it expects a 200 response from a specific URL that is not available), the health checks will fail.

Option B is incorrect because ALBs can be placed in private subnets without issue. Option C is incorrect because the stem states the EC2 security group allows inbound traffic from the ALB security group. Option D is incorrect because outbound rules on the ALB security group do not affect inbound health checks.

Full explanation →
396
MCQeasy

A company is using AWS Direct Connect to connect its on-premises data center to a VPC. The company wants to use a single Direct Connect connection to connect to multiple VPCs in different AWS accounts. Which AWS service should be used to achieve this?

A.Direct Connect Gateway
B.Transit Gateway
C.AWS Site-to-Site VPN
D.VPC Peering
AnswerA

Direct Connect Gateway enables connectivity to multiple VPCs over a single Direct Connect connection.

Why this answer

A Direct Connect Gateway (DX Gateway) is the correct service because it allows a single Direct Connect connection to be associated with multiple VPCs across different AWS accounts and regions. The DX Gateway acts as a regional or global transit hub, enabling private connectivity from on-premises to multiple VPCs without needing separate Direct Connect connections for each VPC. This is achieved by associating the DX Gateway with virtual private gateways (VGWs) in each target VPC, and then using AWS Resource Access Manager (RAM) to share the DX Gateway with other accounts.

Exam trap

The trap here is that candidates often confuse Transit Gateway with Direct Connect Gateway, thinking Transit Gateway can natively handle multi-account Direct Connect sharing, but Transit Gateway requires a Direct Connect Gateway attachment to do so, making the Direct Connect Gateway the essential component for this specific use case.

How to eliminate wrong answers

Option B (Transit Gateway) is wrong because Transit Gateway is a network transit hub for connecting VPCs and on-premises networks within a single account, but it does not natively support sharing a single Direct Connect connection across multiple AWS accounts without additional configuration like a Direct Connect Gateway. Option C (AWS Site-to-Site VPN) is wrong because it is an IPsec VPN-based solution that uses the public internet, not a dedicated private Direct Connect connection, and it cannot leverage a single Direct Connect link for multiple VPCs across accounts. Option D (VPC Peering) is wrong because VPC Peering is a one-to-one connection between two VPCs, does not support transitive routing, and cannot be used to connect an on-premises data center to multiple VPCs via a single Direct Connect connection.

Full explanation →
397
Multi-Selectmedium

Which TWO options are valid methods to connect a VPC to an on-premises network? (Choose 2)

Select 2 answers
A.Internet gateway
B.AWS Direct Connect
C.VPC endpoint
D.VPC peering connection
E.AWS Site-to-Site VPN
AnswersB, E

Direct Connect provides a dedicated private connection from on-premises to AWS.

Why this answer

AWS Site-to-Site VPN and AWS Direct Connect are the two primary services for hybrid connectivity. VPC peering is for VPC-to-VPC, not on-premises. VPC endpoints are for accessing AWS services privately.

Internet gateway is for public internet access.

Full explanation →
398
MCQeasy

A company is using AWS Transit Gateway to connect multiple VPCs and an on-premises network via AWS Direct Connect. They need to ensure that traffic between VPCs is inspected by a centralized security appliance. How should they design the routing?

A.Use Network ACLs on the subnets to restrict traffic and allow inspection.
B.Create VPC peering connections between all VPCs and route traffic through a security appliance in a central VPC.
C.Use security groups on the security appliance to inspect traffic.
D.Create a Transit Gateway with separate route tables. Attach each VPC and the Direct Connect virtual interface to the Transit Gateway. In the route tables, propagate routes and add static routes to send inter-VPC traffic to the security appliance VPC.
AnswerD

Transit Gateway route tables allow you to centralize routing through an inspection VPC.

Why this answer

AWS Transit Gateway supports separate route tables, allowing you to isolate traffic domains. By attaching each VPC and the Direct Connect virtual interface to the Transit Gateway, you can create a centralized inspection VPC. Static routes in the Transit Gateway route tables direct inter-VPC traffic to the security appliance VPC, ensuring all traffic between VPCs is inspected before reaching its destination.

Exam trap

The trap here is that candidates often confuse the transitive routing capability of Transit Gateway with VPC peering, assuming VPC peering can route through a central VPC, but VPC peering does not support transitive routing, making Option B invalid.

How to eliminate wrong answers

Option A is wrong because Network ACLs are stateless and operate at the subnet level, not at the routing level; they cannot redirect traffic to a centralized security appliance for inspection. Option B is wrong because VPC peering connections do not support transitive routing, meaning traffic between VPCs cannot be routed through a central VPC without complex and non-scalable configurations. Option C is wrong because security groups are stateful and apply to individual ENIs, not to routing; they can filter traffic but cannot force traffic to traverse a security appliance for inspection.

Full explanation →
399
MCQhard

A company uses AWS CloudFormation to deploy resources. The security team wants to ensure that no IAM user can modify the stack set if they are not authorized via a specific IAM policy. Which feature should be used?

A.AWS Config rule with remediation
B.CloudFormation stack policy
C.Service control policy (SCP) in AWS Organizations
D.IAM permissions boundary
AnswerC

Can deny CloudFormation actions across accounts.

Why this answer

Service control policies (SCPs) in AWS Organizations can be used to centrally deny CloudFormation stack set modifications at the organization, OU, or account level, ensuring that only authorized IAM policies can allow such actions. Option A is wrong because AWS Config rules with remediation only detect and automatically fix noncompliant resources, not prevent modifications. Option B is wrong because CloudFormation stack policies protect resources within a stack (e.g., prevent deletion), not control who can update the stack set.

Option D is wrong because IAM permissions boundaries set the maximum permissions for an IAM user or role, but they do not provide a global deny across accounts like SCPs do.

Full explanation →
400
MCQhard

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to communicate with an on-premises server using an IPsec VPN. The company has set up a Virtual Private Gateway (VGW) and a Customer Gateway (CGW) with a Site-to-Site VPN connection. The VPN tunnel is established. However, the EC2 instance cannot ping the on-premises server. The security groups and network ACLs allow all traffic. What is the most likely cause?

A.The VGW is not configured with the correct BGP ASN
B.The VGW is not attached to the VPC
C.The VPN tunnel is not in the UP state
D.The private subnet route table does not have a route for the on-premises CIDR pointing to the VGW
AnswerD

Without this route, traffic from the instance to on-premises is dropped.

Why this answer

The most likely cause is that the private subnet's route table lacks a route for the on-premises CIDR pointing to the Virtual Private Gateway (VGW). Even though the VPN tunnel is established, traffic from the EC2 instance in the private subnet will be dropped at the subnet level if there is no explicit route directing the on-premises destination to the VGW. Security groups and network ACLs are permissive, so the issue is routing, not filtering.

Exam trap

The ANS-C01 exam often tests the misconception that a VPN tunnel being 'UP' automatically allows traffic, but in AWS, you must also configure the route tables in the VPC to direct traffic to the VGW for the remote network.

How to eliminate wrong answers

Option A is wrong because the BGP ASN is only relevant for dynamic routing (BGP) configuration; the VPN tunnel can be established and function with static routing, and an incorrect BGP ASN would not prevent ping if the tunnel is up and routes are in place. Option B is wrong because if the VGW were not attached to the VPC, the VPN connection would not have been created or the tunnel would not establish; the question states the VPN tunnel is established, implying the VGW is attached. Option C is wrong because the question explicitly states 'The VPN tunnel is established,' so the tunnel is in the UP state; a down tunnel would prevent all communication, but here the issue is routing, not tunnel status.

Full explanation →
401
MCQhard

A company has a Direct Connect connection with a private VIF to a VPC. They also have a VPN connection as a backup. They want to ensure that traffic always uses the Direct Connect connection when it is available, and only fails over to the VPN if Direct Connect goes down. How should they configure routing?

A.Advertise a more specific prefix over Direct Connect and a less specific prefix over VPN.
B.Use static routes pointing to the Direct Connect virtual interface with a lower metric than the VPN route.
C.Advertise the same prefix over both connections but with a lower AS path length over Direct Connect.
D.Advertise the same prefix over both connections but set a higher weight on the VPN BGP session.
AnswerA

BGP always prefers the most specific prefix (longest match). This ensures Direct Connect is used when available.

Why this answer

BGP selects the most specific prefix (longest prefix match) first, regardless of other attributes. By advertising a more specific prefix (e.g., /24) over Direct Connect and a less specific prefix (e.g., /16) over VPN, traffic will always prefer the Direct Connect path when it is available. If Direct Connect fails, the more specific prefix is withdrawn, and traffic automatically falls back to the VPN using the less specific prefix.

Exam trap

The ANS-C01 exam often tests the misconception that BGP attributes like AS path length or weight are the primary tie-breakers, but in this scenario the longest prefix match rule overrides all BGP path attributes, making prefix specificity the correct mechanism for active/passive failover.

How to eliminate wrong answers

Option B is wrong because static routes with a lower metric (administrative distance) would work only if both routes are static; however, BGP routes have a default administrative distance of 20 for eBGP, and static routes have an AD of 1, so a static route pointing to Direct Connect would actually be preferred over BGP, but the question requires BGP-based failover, and static routes do not dynamically withdraw on failure. Option C is wrong because advertising the same prefix with a lower AS path length over Direct Connect would make Direct Connect preferred only if both prefixes are identical; however, if the Direct Connect fails, the VPN route would still have the same prefix and would be used, but the AS path manipulation does not guarantee failover behavior when the Direct Connect BGP session goes down—the prefix is simply withdrawn. Option D is wrong because setting a higher weight on the VPN BGP session would make the VPN route preferred over Direct Connect, which is the opposite of the desired behavior; weight is a Cisco-proprietary attribute that is locally significant and evaluated before AS path length.

Full explanation →
402
MCQmedium

A company has a VPC with multiple subnets. The network ACL for a subnet is configured to deny all inbound traffic. A security group attached to an EC2 instance in that subnet allows SSH from a specific IP range. Will SSH traffic from that IP range reach the instance?

A.Yes, because the security group allows SSH.
B.No, because the network ACL denies all inbound traffic.
C.Yes, because the security group overrides the network ACL.
D.It depends on the rule number order in the network ACL.
AnswerB

The network ACL is stateless and denies all inbound traffic, so the traffic is blocked.

Why this answer

Network ACLs are stateless and deny all inbound traffic, so even though the security group allows SSH, the network ACL will block the traffic before it reaches the instance. Option A is wrong because security groups are stateful but are evaluated after network ACLs. Option C is wrong because the network ACL operates at the subnet level.

Option D is wrong because the order does not matter for stateless ACLs.

Full explanation →
403
Multi-Selectmedium

Which TWO of the following are true about using a Network Load Balancer (NLB) with AWS PrivateLink? (Choose 2.)

Select 2 answers
A.NLB supports Server Name Indication (SNI)
B.NLB can perform TLS termination
C.NLB supports sticky sessions by default
D.NLB can be assigned Elastic IPs
E.NLB can be used as a service provider in a VPC endpoint service
AnswersD, E

NLB supports static IPs via Elastic IPs.

Why this answer

A Network Load Balancer (NLB) supports the assignment of Elastic IPs (EIPs) per Availability Zone, which provides a static, fixed IP address for the NLB. This is critical for AWS PrivateLink, as the service provider's VPC endpoint service uses the NLB's IP addresses to accept traffic from consumer VPCs, ensuring the endpoint remains reachable even if the underlying instances change.

Exam trap

The trap here is that candidates often confuse NLB's ability to be assigned Elastic IPs with the misconception that NLB can terminate TLS or support SNI, but NLB is a Layer 4 load balancer and does not inspect HTTP headers, making SNI impossible, while TLS termination is an optional feature not inherent to PrivateLink usage.

Full explanation →
404
Multi-Selecteasy

A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can read objects. Which TWO actions should be taken? (Choose two.)

Select 2 answers
A.Assign a security group to the VPC endpoint that allows inbound traffic from the VPC.
B.Create an S3 bucket policy with a condition that allows access only from the VPC endpoint.
C.Attach a VPC endpoint policy that allows the desired actions on the S3 bucket.
D.Configure a network ACL on the subnet to deny all inbound traffic except from the VPC.
E.Use an IAM role to grant the VPC access to the S3 bucket.
AnswersB, C

Correct: S3 bucket policies can use aws:SourceVpce condition to restrict access.

Why this answer

An S3 bucket policy can use the aws:SourceVpce condition key to allow access only from a specific VPC endpoint, restricting requests to those originating from that endpoint. Option C is correct because a VPC endpoint policy controls what actions principals within the VPC can perform on the S3 bucket, providing an additional layer of access control. Option A is incorrect because security groups are not supported for gateway VPC endpoints (which are used for S3); they cannot be assigned to such endpoints.

Option D is incorrect because network ACLs operate at the subnet level and cannot enforce restrictions based on the source VPC or VPC endpoint; they control traffic entering/exiting subnets but do not apply to S3 bucket access directly. Option E is incorrect because IAM roles grant permissions to identities (users or services) but do not restrict traffic origin; they do not limit access to traffic from a specific VPC.

Full explanation →
405
MCQeasy

A company uses AWS CloudFormation to manage its network infrastructure. After a recent update, the stack fails to update, with an error indicating that a security group rule conflicts with an existing rule. What is the most likely cause?

A.The CIDR block in the rule is not in the same VPC.
B.The referenced security group was deleted outside of CloudFormation.
C.The stack update exceeded the service quota for security groups.
D.The template attempts to add a security group rule that already exists.
AnswerD

AWS rejects duplicate rules to avoid ambiguity.

Why this answer

The most likely cause is that the CloudFormation template is attempting to add a security group rule that already exists. AWS CloudFormation does not allow duplicate security group rules; if the same protocol, port range, and source (CIDR or security group) are specified, the update will fail with a conflict error. Option A is incorrect because the CIDR block not being in the same VPC is not a factor for security group rules; they can reference external CIDRs.

Option B is incorrect because a deleted security group would result in a different error (e.g., referencing a non-existent group). Option C is incorrect because exceeding service quotas yields a different error message.

Full explanation →
406
MCQhard

A company has a VPC with multiple subnets across two AZs. The VPC is connected to an on-premises data center via AWS Direct Connect. The company wants to ensure that traffic between the VPC and on-premises is load-balanced across two Direct Connect virtual interfaces (VIFs) for high availability. Which configuration should be used?

A.Configure two VIFs and use BGP to advertise the same prefixes with equal metrics to enable ECMP.
B.Configure a VPN connection over each VIF and use equal-cost routes between the VPN tunnels.
C.Configure a single Direct Connect VIF with a 10 Gbps connection and a single BGP session.
D.Configure two VIFs with static routes pointing to different on-premises IPs.
AnswerA

BGP ECMP allows load balancing across multiple VIFs.

Why this answer

Configuring two Direct Connect virtual interfaces (VIFs) with BGP and advertising the same prefixes with equal metrics (e.g., equal MED or AS-path length) enables Equal-Cost Multi-Path (ECMP) routing. This allows the VPC and on-premises routers to load-balance traffic across both VIFs, providing high availability and active-active utilization of the Direct Connect connections.

Exam trap

The trap here is that candidates often assume VPN tunnels are required for load-balancing or that a single high-bandwidth connection is sufficient, missing the core requirement for active-active load-balancing and high availability via BGP ECMP across multiple VIFs.

How to eliminate wrong answers

Option B is wrong because VPN tunnels over Direct Connect add unnecessary complexity and overhead (IPsec encryption) without providing load-balancing benefits; ECMP is natively supported with BGP over Direct Connect VIFs, not requiring VPN. Option C is wrong because a single VIF, even at 10 Gbps, creates a single point of failure and does not provide load-balancing or high availability across multiple connections. Option D is wrong because static routes cannot dynamically load-balance or failover; they lack the ability to perform ECMP or react to link failures without manual intervention, unlike BGP which supports path selection and equal-cost multipathing.

Full explanation →
407
MCQmedium

A company wants to centralize logging of VPC Flow Logs from multiple accounts into a single Amazon S3 bucket. The logs must be encrypted at rest using an AWS KMS CMK. What is the recommended approach?

A.Enable encryption on VPC Flow Logs using a KMS key in each account and aggregate logs using AWS Logs cross-account subscription.
B.Create a centralized S3 bucket with default encryption using a KMS CMK and a bucket policy that allows cross-account writes from the source accounts.
C.Create a bucket with SSE-S3 encryption and have each account write flow logs directly.
D.Use a single bucket with a bucket policy that denies access unless encryption headers are present, and use a KMS key shared across accounts.
AnswerB

This ensures encryption and centralized logging.

Why this answer

The recommended approach uses a centralized S3 bucket with default encryption using a KMS CMK and a bucket policy that allows cross-account writes. This ensures logs are encrypted at rest centrally without requiring per-account KMS keys. Option A is wrong because KMS keys in each account would complicate key management and cross-account access.

Option C is wrong because SSE-S3 encryption does not use a CMK and does not provide the same level of control. Option D is wrong because denying access unless encryption headers are present is not a reliable way to enforce encryption; bucket policies can be bypassed if headers are not included, and shared KMS keys are not recommended.

Full explanation →
408
MCQmedium

A company is designing a multi-account architecture using AWS Transit Gateway. They need to isolate development and production environments but allow shared services account access to both. What is the most scalable and secure design?

A.Use a single Transit Gateway and configure separate route tables for each environment, attaching VPCs from each account.
B.Use a single Transit Gateway with one route table for all environments and implement security groups to isolate traffic.
C.Create two Transit Gateways: one for development and one for production. Share the Transit Gateways with the shared services account via AWS Resource Access Manager.
D.Use VPC Peering between each VPC and the shared services VPC, and set up Internet Gateway for each environment.
AnswerC

Correct: Separate Transit Gateways provide full isolation, and RAM enables shared services.

Why this answer

Using two separate Transit Gateways (one for dev, one for prod) provides complete network isolation between environments at the routing layer, while AWS Resource Access Manager (RAM) allows the shared services account to attach its VPC to both Transit Gateways. This design is scalable as each environment can grow independently without route table conflicts, and secure because there is no transitive routing path between dev and prod. A single Transit Gateway with separate route tables (Option A) still shares the same data plane, introducing risk of misconfiguration or route leaks, whereas two Transit Gateways enforce hard isolation.

Exam trap

The trap here is that candidates assume separate route tables on a single Transit Gateway provide full isolation, but AWS explicitly warns that route tables share the same data plane and misconfigurations can leak traffic, so the exam expects two Transit Gateways for hard isolation between environments.

How to eliminate wrong answers

Option A is wrong because a single Transit Gateway, even with separate route tables, shares the same forwarding plane and can allow unintended transitive routing if a route is accidentally propagated or a VPC is attached to the wrong route table, violating the isolation requirement. Option B is wrong because using one route table for all environments eliminates isolation entirely, and security groups operate at the instance level (L4) not the network layer, so they cannot prevent traffic from traversing the Transit Gateway between environments. Option D is wrong because VPC Peering is a 1:1 connection that does not scale to many VPCs, requires managing N*(N-1)/2 peering relationships, and does not support transitive routing, making it impractical for a multi-account architecture with shared services.

Full explanation →
409
MCQeasy

A network engineer needs to monitor the network traffic between EC2 instances in a VPC. Which AWS service should be used to capture IP traffic information?

A.VPC Flow Logs
B.AWS Config
C.AWS CloudTrail
D.Amazon CloudWatch Logs
AnswerA

VPC Flow Logs capture IP traffic information for network interfaces.

Why this answer

VPC Flow Logs capture IP traffic information for network interfaces in a VPC. Option B is wrong because AWS Config tracks resource configuration changes, not network traffic. Option C is wrong because CloudTrail records API calls, not IP traffic.

Option D is wrong because CloudWatch Logs can store logs but does not capture network traffic; it is a destination for logs, not a traffic capture service.

Full explanation →
410
MCQeasy

A security engineer needs to audit all changes to security group rules in an AWS account. Which AWS service should be used to record these changes?

A.VPC Flow Logs
B.AWS CloudTrail
C.AWS Config
D.Amazon CloudWatch Logs
AnswerB

AWS CloudTrail records all API calls made in the account, including AuthorizeSecurityGroupIngress and RevokeSecurityGroupEgress, making it the correct service to audit security group rule changes.

Why this answer

AWS CloudTrail records API calls, including changes to security group rules. Option A (VPC Flow Logs) is wrong because it captures network traffic, not API calls. Option C (AWS Config) is wrong because it records configuration changes, but not the API call history.

Option D (Amazon CloudWatch Logs) is wrong because it is used for log storage and monitoring, not for recording API calls.

Full explanation →
411
MCQmedium

A company has a hybrid network architecture with multiple VPCs connected via a transit gateway and on-premises via Direct Connect. The network team wants to automate the response to a BGP session failure on a Direct Connect virtual interface. Which AWS service can be used to monitor the BGP status and trigger an automated action?

A.AWS Lambda with VPC Flow Logs
B.AWS Systems Manager Automation
C.AWS CloudWatch Events (EventBridge) with Direct Connect BGP metric alarms
D.AWS Config rules
AnswerC

EventBridge can trigger actions based on CloudWatch alarms for BGP status.

Why this answer

AWS CloudWatch Events (EventBridge) can monitor Direct Connect BGP session status via the `bgp_session_state` metric in the `AWS/DX` namespace. When the BGP session transitions to the `down` state, you can create an EventBridge rule that triggers an automated action, such as invoking a Lambda function or sending an SNS notification, enabling a rapid response to BGP failures without manual intervention.

Exam trap

AWS often tests the misconception that VPC Flow Logs or AWS Config can monitor BGP status, but candidates must remember that BGP is a control-plane protocol and only Direct Connect metrics in CloudWatch provide the BGP session state for automation.

How to eliminate wrong answers

Option A is wrong because VPC Flow Logs capture IP traffic metadata (e.g., source/destination IPs, ports, protocols) and cannot monitor BGP session state, which is a Layer 3 control-plane protocol between routers. Option B is wrong because AWS Systems Manager Automation is designed for operational tasks on EC2 instances and on-premises resources (e.g., patching, configuration), not for reacting to real-time network events like BGP session failures. Option D is wrong because AWS Config rules evaluate resource configurations for compliance (e.g., checking if a Direct Connect virtual interface has the correct VLAN ID) but cannot monitor dynamic BGP session state changes or trigger actions based on metric thresholds.

Full explanation →
412
MCQeasy

A company is designing a VPC for a three-tier application (web, application, database). The database tier should not be accessible from the internet, but the web tier must be accessible. Which subnet design should the network engineer use?

A.Place web and app servers in public subnets, and database servers in private subnets.
B.Place all servers in private subnets and use a NAT Gateway for internet access.
C.Place web servers in public subnets with an internet gateway, and app and database servers in private subnets.
D.Place all servers in public subnets and rely on security group rules to restrict access.
AnswerC

This follows the traditional security model of isolation for backend tiers.

Why this answer

It places the web servers in a public subnet with an Internet Gateway (IGW) to allow inbound HTTP/HTTPS traffic from the internet, while the application and database servers are placed in private subnets with no direct internet path. This design ensures the database tier is isolated from the internet, meeting the security requirement, while the web tier remains accessible. The application servers can communicate with the database via private IP addresses within the VPC, and outbound internet access for the private subnets (if needed) can be provided through a NAT Gateway in a public subnet.

Exam trap

The trap here is that candidates often assume placing all servers in private subnets with a NAT Gateway provides inbound internet access, confusing outbound-only NAT with the inbound access required for the web tier, or they mistakenly think security groups alone can fully replace subnet-level isolation in a public subnet.

How to eliminate wrong answers

Option A is wrong because placing both web and app servers in public subnets exposes the application tier to the internet unnecessarily, increasing the attack surface and violating the principle of least privilege; the app tier should remain private to mediate traffic between web and database tiers. Option B is wrong because placing all servers in private subnets with a NAT Gateway only provides outbound internet access, not inbound access from the internet; the web tier would not be accessible to external users without an Internet Gateway and a public subnet. Option D is wrong because placing all servers in public subnets and relying solely on security group rules does not prevent direct internet access to the application and database tiers; security groups are stateful firewalls but do not replace the network-level isolation provided by private subnets, and a misconfiguration could expose sensitive tiers.

Full explanation →
413
MCQhard

A Network Engineer is troubleshooting a cross-account VPC endpoint connection. The service provider account (123456789012) has the above IAM policy attached to the endpoint service. The consumer account (111111111111) has created a VPC endpoint (vpce-abc123) and is trying to accept the connection. The consumer receives an 'AccessDenied' error when calling ec2:AcceptVpcEndpointConnections. What is the MOST likely cause?

A.The policy action should be 'ec2:CreateVpcEndpoint' instead.
B.The policy condition 'aws:SourceArn' does not match the consumer's endpoint ARN.
C.The policy resource ARN is incorrect; it should be the endpoint service ARN.
D.The consumer account does not have permission to accept the connection; only the service provider can accept.
AnswerD

The AcceptVpcEndpointConnections API is called by the service provider, not the consumer. The consumer must wait for the provider to accept.

Why this answer

The 'AccessDenied' error occurs because the consumer account (111111111111) is attempting to call ec2:AcceptVpcEndpointConnections, which is an API action that only the service provider account (123456789012) can perform. The IAM policy shown is attached to the endpoint service in the provider account, but the consumer does not have permission to accept its own connection; instead, the provider must accept the endpoint connection request. This is a fundamental AWS VPC endpoint service behavior where the provider controls acceptance, not the consumer.

Exam trap

The ANS-C01 exam often tests the misconception that the consumer can accept its own VPC endpoint connection, but in reality, only the service provider account has permission to call AcceptVpcEndpointConnections, regardless of IAM policies attached to the consumer.

How to eliminate wrong answers

Option A is wrong because ec2:CreateVpcEndpoint is used to create a VPC endpoint, not to accept a connection; the consumer already created the endpoint (vpce-abc123), and the error is on the accept action. Option B is wrong because the 'aws:SourceArn' condition is used to restrict which consumer endpoint ARN can connect, but it does not cause an 'AccessDenied' on the accept API call; the error here is about permissions to call AcceptVpcEndpointConnections, not about the condition matching. Option C is wrong because the policy resource ARN should be the endpoint service ARN (e.g., arn:aws:ec2:region:123456789012:vpc-endpoint-service/vpce-svc-xxx), not the consumer's endpoint ARN; however, the core issue is that the consumer lacks permission to call the accept action, not the resource ARN.

Full explanation →
414
MCQhard

A company is deploying a multi-tier application across multiple VPCs connected via AWS Transit Gateway. The web tier must be able to initiate connections to the app tier, but the app tier must not be able to initiate connections to the web tier. How can this be achieved?

A.Configure network ACLs on the web tier subnets to allow outbound traffic and deny inbound from app tier.
B.Establish VPC peering between the web and app VPCs and restrict routes.
C.Use security groups across the VPCs by referencing each other's CIDR blocks.
D.Deploy a centralized firewall appliance in a shared VPC and use Transit Gateway to route all inter-VPC traffic through it.
AnswerD

Enables stateful inspection and unidirectional rules.

Why this answer

Routing all inter-VPC traffic through a centralized firewall appliance in a shared VPC via Transit Gateway allows you to enforce stateful inspection and access control policies. The firewall can be configured to permit only outbound connections from the web tier to the app tier while blocking any inbound connections initiated by the app tier, thus meeting the requirement without relying on VPC-native constructs that cannot enforce unidirectional stateful filtering across VPCs.

Exam trap

The trap here is that candidates assume security groups or network ACLs can enforce unidirectional traffic across VPCs, but they are either stateless (NACLs) or stateful (security groups) and cannot prevent the app tier from initiating new connections when return traffic is allowed.

How to eliminate wrong answers

Option A is wrong because network ACLs are stateless and operate at the subnet level; they cannot track connection state, so allowing outbound traffic from the web tier would require an ephemeral port range inbound rule that would also permit the app tier to initiate connections back. Option B is wrong because VPC peering provides no mechanism to enforce unidirectional traffic flow; routes are symmetric, and security groups or NACLs would still allow return traffic, not prevent the app tier from initiating new connections. Option C is wrong because security groups cannot be referenced across VPCs by CIDR blocks alone; cross-VPC security group referencing is only supported with VPC peering or Transit Gateway, and even then, security groups are stateful and would allow return traffic, not block the app tier from initiating connections.

Full explanation →
415
MCQmedium

A company has a Direct Connect connection with a private VIF to a VPC. They want to add a second Direct Connect connection for redundancy. The two connections will terminate on different AWS Direct Connect locations. Which configuration will provide the HIGHEST availability?

A.Use the same customer gateway device for both connections
B.Use the same Direct Connect location for both connections
C.Use the same BGP ASN for both connections
D.Use different customer gateway devices and different Direct Connect locations
AnswerD

Using different customer gateway devices and different Direct Connect locations maximizes physical diversity, providing the highest availability through independent failure domains.

Why this answer

Using different customer gateway devices and different Direct Connect locations provides full physical diversity, eliminating single points of failure at both the device and location level. Option A introduces a single point of failure by using the same device. Option B uses the same location, reducing availability in case of location failure.

Option C uses the same BGP ASN, which can cause routing issues but is not the primary concern for physical redundancy.

Full explanation →
416
MCQhard

A security engineer created the above S3 bucket policy to grant public read access to objects in the 'confidential/' prefix. However, users report that they receive 'Access Denied' errors when trying to access objects that have the tag 'classification: public'. What is the most likely cause?

A.The bucket policy does not grant access to objects owned by other AWS accounts.
B.The 's3:GetObjectVersion' action is not allowed because the bucket is not versioned.
C.The objects in the 'confidential/' prefix do not have the required tag 'classification: public'.
D.The condition should use 'StringLike' instead of 'StringEquals' for tag matching.
AnswerC

The condition requires the tag; without it, access is denied.

Why this answer

The bucket policy includes a condition that requires the object to have the tag 'classification: public' (using s3:ExistingObjectTag). If the objects in the 'confidential/' prefix do not have this tag, the condition fails and access is denied, even though the prefix matches. The policy explicitly grants public read access only to objects that satisfy both the prefix and the tag condition.

Exam trap

AWS often tests the interaction between prefix-based and tag-based conditions in S3 bucket policies, leading candidates to overlook that both conditions must be satisfied simultaneously, not just one.

How to eliminate wrong answers

Option A is wrong because the policy grants public access (Principal: '*'), which does not depend on object ownership across AWS accounts; cross-account access would require additional permissions but is not relevant here. Option B is wrong because the 's3:GetObjectVersion' action is not required for accessing the current version of an object; 's3:GetObject' is sufficient, and the bucket being versioned or not does not cause an 'Access Denied' error for this action. Option D is wrong because 'StringEquals' is the correct operator for matching an exact tag value; 'StringLike' would allow wildcard patterns but is not needed for an exact match, and using 'StringLike' would not fix the issue if the tag is missing entirely.

Full explanation →
417
MCQmedium

A company has a VPC with a CIDR of 10.0.0.0/16. It has two public subnets (10.0.1.0/24 and 10.0.2.0/24) and two private subnets (10.0.3.0/24 and 10.0.4.0/24). The company hosts a web application on EC2 instances in the private subnets behind an Application Load Balancer (ALB) in the public subnets. The ALB is internet-facing. The company wants to add a second ALB in the same VPC for a different application but using the same public subnets. The new ALB also needs to be internet-facing. However, when the company tries to create the new ALB, they receive an error: 'The subnet 'subnet-xxxxxxxx' does not have enough free IP addresses to satisfy the request.' The network engineer checks the subnets and finds that the public subnets have only 2 free IP addresses each. The private subnets have plenty of free IP addresses. The company wants to resolve this error without changing the architecture of the existing applications. What should the network engineer do?

A.Create new public subnets with larger CIDR blocks (e.g., /23) and associate them with the same route table.
B.Use the private subnets for the new ALB and add a NAT gateway for internet access.
C.Reduce the size of the existing public subnets by modifying their CIDR blocks.
D.Launch a NAT gateway in one public subnet to free up IP addresses.
AnswerA

New public subnets provide more IP addresses.

Why this answer

The error indicates insufficient free IP addresses in the public subnets. Creating new public subnets with larger CIDR blocks (e.g., /23) provides more IP addresses without affecting the existing subnets or architecture. Option B is incorrect because private subnets cannot host an internet-facing ALB (they lack direct internet access and cannot assign public IPs).

Option C would reduce available IPs and disrupt existing resources. Option D does not free up IP addresses in the subnets.

Full explanation →
418
Multi-Selectmedium

A company is deploying a web application across multiple Availability Zones in a single AWS Region. The application consists of an Application Load Balancer (ALB) in front of EC2 instances in an Auto Scaling group, and an Amazon RDS Multi-AZ database. The company needs to ensure that the application can survive the loss of an entire Availability Zone. Which THREE actions should they take? (Select THREE.)

Select 3 answers
A.Use larger EC2 instance types to handle the load
B.Configure the Auto Scaling group to launch instances in at least two Availability Zones
C.Configure the Application Load Balancer to be internet-facing and enable cross-zone load balancing
D.Enable Multi-AZ deployment for the RDS database
E.Deploy a single NAT Gateway in one AZ for outbound traffic
AnswersB, C, D

Ensures instances are spread across AZs.

Why this answer

Configuring the Auto Scaling group to launch instances in at least two Availability Zones ensures that if one AZ fails, the remaining AZ(s) still have healthy EC2 instances to serve traffic. This is a fundamental requirement for multi-AZ high availability, as the Auto Scaling group will automatically replace failed instances in the remaining AZs.

Exam trap

AWS often tests the misconception that simply enabling cross-zone load balancing on the ALB (Option C) alone is sufficient for AZ resilience, but without the Auto Scaling group spanning multiple AZs (Option B), there would be no healthy targets in the surviving AZs to route traffic to.

Full explanation →
419
Multi-Selecteasy

A company wants to enable communication between two VPCs (VPC A and VPC B) in the same AWS account and region. They want to use private IP addresses and avoid using the internet. Which THREE options can achieve this?

Select 3 answers
A.VPC peering connection
B.AWS Site-to-Site VPN connection between VPCs
C.Internet gateway attached to both VPCs
D.AWS Transit Gateway
E.NAT gateway in each VPC
AnswersA, B, D

Direct private connection between VPCs.

Why this answer

VPC peering connection (Option A) allows direct, private IP connectivity between two VPCs using the AWS global network, with no internet gateway or VPN required. Traffic stays within AWS's internal infrastructure, meeting the requirement for private IP addresses and avoiding the internet.

Exam trap

The trap here is that candidates confuse a NAT gateway with a VPC-to-VPC connectivity solution, but NAT gateways only handle outbound internet traffic and cannot forward traffic between VPCs.

Full explanation →
420
MCQhard

A company uses AWS Direct Connect with a private VIF to connect its data center to a VPC. The VPC has multiple subnets. The on-premises network team reports that they can ping the VPC's private IP addresses but cannot connect to an EC2 instance's port 443. The EC2 instance's security group allows HTTPS from the on-premises CIDR. What should the engineer check NEXT?

A.Check the security group's inbound rules for port 443.
B.Confirm that the Direct Connect virtual interface is in the 'up' state.
C.Check the EC2 instance's operating system firewall (e.g., iptables, Windows Firewall) to see if port 443 is blocked.
D.Verify that the route tables in the VPC have a route back to the on-premises CIDR.
AnswerC

OS firewall can block even if security group allows.

Why this answer

Since the on-premises team can ping the EC2 instance (ICMP works) but cannot connect to port 443 (HTTPS), the network path is functional at Layer 3. The security group already allows HTTPS from the on-premises CIDR, so the next logical step is to check the EC2 instance's OS-level firewall (e.g., iptables, Windows Firewall), which operates at Layer 4 and can independently block TCP port 443 even when the security group permits it.

Exam trap

The trap here is that candidates assume security group rules are the only firewall layer, overlooking the instance's OS firewall, which can independently block specific ports even when Layer 3 connectivity (ICMP) works.

How to eliminate wrong answers

Option A is wrong because the question states the security group already allows HTTPS from the on-premises CIDR, so rechecking it would be redundant and not address the issue. Option B is wrong because ping success confirms the Direct Connect virtual interface is up and passing traffic, so checking the VIF state again is unnecessary. Option D is wrong because ping works, which proves the VPC route tables have a return route to the on-premises CIDR; if the route were missing, ICMP echo replies would not return.

Full explanation →
421
MCQmedium

A company has an AWS account with multiple VPCs. The security team wants to ensure that no VPC has an internet gateway attached. Which AWS service can be used to automatically detect and remediate non-compliant VPCs?

A.Amazon GuardDuty
B.AWS CloudTrail
C.Service control policies (SCPs)
D.AWS Config with a managed rule to detect internet gateways and an automatic remediation action to detach them.
AnswerD

Config can detect and auto-remediate.

Why this answer

AWS Config rules can evaluate compliance of resources and trigger automatic remediation actions. A managed rule such as 'restricted-common-ports' or a custom rule can detect VPCs with internet gateways, and an accompanying remediation action can automatically detach them. Option A (Amazon GuardDuty) is a threat detection service, not a configuration compliance tool.

Option B (AWS CloudTrail) logs API calls but does not evaluate current resource configurations. Option C (Service control policies, SCPs) define permissions boundaries but cannot detect or remediate existing non-compliant resources. Option D is correct.

Full explanation →
422
Matchingmedium

Match each AWS networking service to the OSI layer it primarily operates at.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Layer 4 (Transport)

Layer 7 (Application)

Layer 3 and 4 (Network and Transport)

Layer 3 (Network)

Layer 2 (Data Link) or Layer 1 (Physical)

Why these pairings

AWS Direct Connect provides physical or virtual connections at Layer 2, AWS Site-to-Site VPN encrypts and routes IP packets at Layer 3, CloudFront and ALB handle HTTP/HTTPS at Layer 7. Common confusions include misattributing Direct Connect to Layer 3 or CloudFront to lower layers.

Full explanation →
423
MCQmedium

A company has a web application behind an Application Load Balancer (ALB) in a VPC. The ALB is internet-facing and has a security group that allows inbound HTTP/HTTPS from 0.0.0.0/0. The EC2 instances are in a private subnet with a security group that allows inbound traffic only from the ALB's security group. The application works correctly. However, the security team wants to add an additional layer of protection by using AWS WAF. What is the best way to integrate AWS WAF with the ALB to filter malicious requests?

A.Create a web ACL in AWS WAF and associate it with the ALB.
B.Replace the ALB with a Network Load Balancer and use AWS WAF with it.
C.Configure the security group of the ALB to only allow traffic that passes AWS WAF inspection.
D.Use AWS WAF in front of Amazon CloudFront and then forward requests to the ALB.
AnswerA

WAF can be associated with ALB to filter HTTP/HTTPS requests.

Why this answer

AWS WAF can be associated directly with an ALB to filter incoming requests before they reach the ALB. Option B is incorrect because WAF works at the application layer, not at CloudFront unless CloudFront is used. Option C is incorrect because WAF is not applied at the security group level.

Option D is incorrect because WAF is not a Network Load Balancer feature.

Full explanation →
424
MCQeasy

A company is deploying an application that must use IPv6 for internet-facing traffic. The VPC is currently using IPv4 only. What is the simplest way to enable IPv6?

A.Use an egress-only internet gateway for IPv6 traffic.
B.Associate an IPv6 CIDR block with the VPC and subnets, and update route tables to route IPv6 traffic to an internet gateway.
C.Deploy a NAT64 device to translate IPv6 to IPv4.
D.Set up a VPN connection to an ISP that provides IPv6.
AnswerB

Simplest way to enable IPv6.

Why this answer

The simplest way to enable IPv6 in an existing IPv4-only VPC is to associate an IPv6 CIDR block (e.g., an Amazon-provided /56) with the VPC and subnets, then update the route tables to direct IPv6 traffic (::/0) to an internet gateway. This requires no additional translation or complex infrastructure, as the internet gateway is already dual-stack capable and can handle both IPv4 and IPv6 traffic natively.

Exam trap

The trap here is that candidates confuse the egress-only internet gateway (which is only for outbound IPv6 from private subnets) with the standard internet gateway, or mistakenly think a translation mechanism like NAT64 is required, when in fact the simplest solution is to add an IPv6 CIDR and route to the existing internet gateway.

How to eliminate wrong answers

Option A is wrong because an egress-only internet gateway is used for outbound-only IPv6 traffic from private subnets, not for enabling general internet-facing IPv6 traffic, and it does not allow inbound connections. Option C is wrong because a NAT64 device translates IPv6 to IPv4, which is unnecessary when the goal is to use native IPv6; it adds complexity and latency, and is typically used only when an application cannot be made dual-stack. Option D is wrong because setting up a VPN connection to an ISP that provides IPv6 is overly complex, introduces additional latency, and does not integrate with the VPC's native IPv6 capabilities; the VPC can directly use an IPv6 CIDR and internet gateway without external VPNs.

Full explanation →
425
MCQhard

A company uses AWS Network Firewall to inspect traffic. They notice that some traffic is bypassing the firewall. The VPC has a route table with a default route (0.0.0.0/0) pointing to the firewall endpoint. Which configuration could cause traffic to bypass the firewall?

A.The route table has route propagation enabled
B.The subnet is not associated with the route table
C.The firewall endpoint is in a different Availability Zone
D.The route table has a more specific route for the destination traffic
AnswerD

More specific routes override the default route to the firewall.

Why this answer

A more specific route (e.g., a /32 or /24 for the destination network) in the VPC route table will take precedence over the default route (0.0.0.0/0) that points to the firewall endpoint. This causes traffic destined for that specific network to bypass the firewall. Option A is incorrect because route propagation adds routes from VPN or Direct Connect but does not inherently cause bypass.

Option B is incorrect because if the subnet is not associated with the firewall's route table, it uses the main route table, which could bypass the firewall, but the key issue here is the existence of a more specific route. Option C is incorrect because the firewall endpoint being in a different Availability Zone does not cause traffic to bypass; it can cause increased latency or other issues but not bypass.

Full explanation →
426
MCQhard

A company is deploying a hybrid network using AWS Direct Connect and a VPN backup. The Direct Connect connection is established, and BGP is running over the private VIF. The company wants to use the VPN as a backup only when Direct Connect fails. The network engineer configures BGP communities on the Direct Connect VIF to influence route preference. However, during a Direct Connect failure, failover to VPN takes several minutes. What can the engineer do to reduce failover time?

A.Configure AS path prepending on the VPN BGP session to deprioritize it
B.Use static routes instead of BGP for the Direct Connect VIF
C.Enable Bidirectional Forwarding Detection (BFD) on the Direct Connect VIF
D.Decrease the BGP keepalive and hold timers on both the Direct Connect and VPN BGP sessions
AnswerC

BFD provides fast failure detection (sub-second) and is commonly used with BGP to accelerate failover.

Why this answer

BFD provides sub-second failure detection, which significantly reduces failover time compared to BGP timers. Option A is wrong because AS path prepending influences route preference and does not affect failover detection speed. Option B is wrong because static routes do not provide dynamic failover and increase administrative overhead.

Option D is wrong because while decreasing BGP timers can reduce failover time, BFD is much faster and is the recommended approach.

Full explanation →
427
MCQhard

A company has a Direct Connect connection with a private VIF to a VPC. They want to use the same connection to access another VPC in a different region. What is the simplest way to achieve this?

A.Use a Direct Connect Gateway
B.Create a new private VIF for the second VPC
C.Use a VPN over the internet to connect the VPCs
D.Set up VPC peering between the two VPCs
AnswerA

Direct Connect Gateway enables multi-VPC connectivity across regions over the same private VIF.

Why this answer

A Direct Connect Gateway (DX Gateway) allows you to associate a single private virtual interface (VIF) with multiple VPCs, even across different AWS regions. This is the simplest solution because it avoids creating additional VIFs or complex inter-VPC connectivity, and it supports transitive routing between the on-premises network and all associated VPCs via the same Direct Connect connection.

Exam trap

The ANS-C01 exam often tests the misconception that a private VIF is tied to a single VPC or region, leading candidates to incorrectly choose creating a new VIF for each VPC, when a Direct Connect Gateway is the designed solution for multi-VPC and multi-region connectivity.

How to eliminate wrong answers

Option B is wrong because creating a new private VIF for the second VPC would require an additional physical or logical interface on the same Direct Connect connection, which is more complex and unnecessary when a DX Gateway can handle multiple VPCs. Option C is wrong because using a VPN over the internet introduces latency, bandwidth limitations, and security overhead, and it does not leverage the existing Direct Connect private connectivity. Option D is wrong because VPC peering does not extend the on-premises Direct Connect connection to the second VPC; it only enables direct communication between the two VPCs, but the on-premises network would still need a separate path to reach the second VPC.

Full explanation →
428
MCQeasy

A network engineer needs to monitor network traffic to an Amazon RDS instance for security analysis. Which AWS service should be used to capture and analyze network traffic?

A.Amazon Inspector
B.VPC Flow Logs
C.VPC Traffic Mirroring
D.AWS CloudTrail
AnswerC

Traffic Mirroring captures and inspects network traffic for analysis.

Why this answer

VPC Traffic Mirroring allows capturing and inspecting network traffic from an RDS instance (full packet capture). Option A is wrong because Amazon Inspector is for vulnerability assessment, not network traffic capture. Option B is wrong because VPC Flow Logs provide metadata (IP, port, etc.) about traffic, not full packet capture.

Option D is wrong because AWS CloudTrail records API activity, not network traffic.

Full explanation →
429
MCQhard

A network engineer is designing a hybrid network with Direct Connect and VPN backup. The company has multiple VPCs connected via Transit Gateway. They want to use BGP to exchange routes. Which BGP feature should be configured to fail over from Direct Connect to VPN if the Direct Connect link goes down?

A.BGP communities
B.Multi-Exit Discriminator (MED)
C.Bidirectional Forwarding Detection (BFD)
D.AS_PATH prepending
AnswerA

Correct. BGP communities allow AWS to assign route preference, enabling failover from Direct Connect to VPN by setting higher local preference for Direct Connect routes.

Why this answer

BGP communities allow AWS to tag routes from Direct Connect and VPN with different community values, enabling route preference control. By configuring the VPN routes with a lower preference (higher local preference via communities), traffic prefers Direct Connect when available. If Direct Connect fails, the VPN routes become active, providing failover.

Option B (MED) influences inbound routing from external peers, not outbound preference within AWS. Option C (BFD) detects link failures faster but does not control route selection. Option D (AS_PATH prepending) is used to deprioritize routes outbound, not between Direct Connect and VPN.

Full explanation →
430
MCQhard

A company has a Direct Connect connection with a private VIF attached to a Direct Connect Gateway. The Direct Connect Gateway is associated with a Transit Gateway. The on-premises network advertises a prefix via BGP, but the prefix does not appear in the Transit Gateway route table. What is the most likely cause?

A.Route propagation is not enabled on the Transit Gateway route table.
B.The on-premises router is not sending the BGP community attribute.
C.The Transit Gateway is not associated with the Direct Connect Gateway.
D.The prefix is not included in the allowed prefixes list for the Direct Connect Gateway.
AnswerD

The allowed prefixes list controls which BGP prefixes are accepted.

Why this answer

The Direct Connect Gateway has an allowed prefixes list that filters which BGP prefixes are accepted from the on-premises network. If the prefix is not in that list, it will not be propagated to the Transit Gateway route table. Option A is incorrect because route propagation on the Transit Gateway route table is used for VPC attachments, not for Direct Connect prefixes.

Option B is incorrect because BGP community attributes are used for tagging and influencing routing policies, not as a prerequisite for prefix acceptance. Option C is incorrect because the Transit Gateway association with the Direct Connect Gateway is already present as stated in the question, so this cannot be the cause.

Full explanation →
431
MCQmedium

A company is using AWS CloudFormation to deploy a VPC with two public subnets and two private subnets across two Availability Zones. The template includes an internet gateway and a NAT gateway in each public subnet. The company needs to ensure that instances in the private subnets can access the internet. Which route table configuration should be used?

A.Add a route to the internet gateway in the private subnet route tables.
B.Add a route to the NAT gateway in the public subnet route tables.
C.Add a route 0.0.0.0/0 pointing to the NAT gateway in the same AZ in each private subnet route table.
D.Add a route 0.0.0.0/0 pointing to a single NAT gateway in both private subnet route tables.
AnswerC

Provides high availability and AZ independence.

Why this answer

Private subnets require a default route (0.0.0.0/0) pointing to a NAT gateway in the same Availability Zone to ensure internet-bound traffic is source-NATed. This design maintains high availability by avoiding cross-AZ data transfer costs and single points of failure. The NAT gateway must be placed in a public subnet, and the private subnet route table must explicitly direct traffic to it.

Exam trap

The trap here is that candidates often assume a single NAT gateway is sufficient for cost savings, overlooking the high-availability requirement and cross-AZ data transfer costs that AWS explicitly tests in multi-AZ VPC designs.

How to eliminate wrong answers

Option A is wrong because adding a route to the internet gateway in private subnet route tables would allow direct internet access, bypassing NAT and exposing private instances with public IPs, which violates the requirement for private instances to only have outbound internet access. Option B is wrong because adding a route to the NAT gateway in public subnet route tables is unnecessary; public subnets already route 0.0.0.0/0 to the internet gateway, and NAT gateways are targets for private subnets, not public ones. Option D is wrong because pointing both private subnet route tables to a single NAT gateway creates a single point of failure and incurs cross-AZ data transfer costs, violating best practices for high availability in a multi-AZ deployment.

Full explanation →
432
Drag & Dropmedium

Order the steps to set up a Network Load Balancer with a TCP listener in front of an Auto Scaling group:

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First create the target group, then the load balancer, register targets, associate the target group with the listener, and configure health checks.

Full explanation →
433
Multi-Selecteasy

Which TWO services can be used to centrally manage and monitor VPN connections across multiple AWS accounts? (Choose 2.)

Select 2 answers
A.AWS Network Manager
B.AWS Transit Gateway
C.AWS CloudFormation
D.AWS Organizations
E.AWS Direct Connect Gateway
AnswersA, B

Monitors global network across accounts.

Why this answer

AWS Network Manager centrally manages and monitors VPN connections across multiple AWS accounts by providing a global view of your network topology, including on-premises and AWS resources. It integrates with Transit Gateway to monitor VPN tunnel status and performance metrics, enabling cross-account visibility via resource shares.

Exam trap

AWS often tests the misconception that AWS Organizations itself provides network monitoring, but it only handles account governance, not VPN management or monitoring.

Full explanation →
434
MCQmedium

A company uses a centralized inspection VPC for traffic inspection. All VPCs route traffic to the inspection VPC via Transit Gateway. The security team wants to ensure that all traffic between VPCs is inspected by a network virtual appliance in the inspection VPC. Which Transit Gateway feature should be configured?

A.Transit Gateway flow logs
B.Transit Gateway multicast
C.Transit Gateway route tables
D.Transit Gateway peering
AnswerC

Transit Gateway route tables allow you to control routing between attachments. By configuring route tables to send traffic to the inspection VPC's attachment, you enforce that all inter-VPC traffic is inspected.

Why this answer

To ensure that all traffic between VPCs is inspected by the network virtual appliance in the inspection VPC, you must control the routing. Transit Gateway route tables (Option C) allow you to define which traffic is sent to the inspection VPC by associating attachments with specific route tables and adding static routes or propagating routes. This ensures that inter-VPC traffic is forced through the inspection appliance before reaching its destination.

Transit Gateway flow logs (Option A) only provide visibility into traffic but do not enforce inspection; they are a monitoring tool, not a routing mechanism. Therefore, Option C is correct, while Options A, B, and D are incorrect.

Exam trap

Candidates often confuse monitoring with enforcement. Flow logs show what traffic passes through, but they do not force traffic to go where you want. To actually enforce inspection, you need proper routing configuration via route tables.

Full explanation →
435
MCQmedium

A company is designing a multi-VPC architecture with VPC peering. They need to ensure that traffic between VPCs in different AWS Regions is encrypted. Which solution should they use?

A.Direct Connect gateway with VIFs
B.Transit Gateway VPN attachments
C.VPC peering with VPN encryption
D.Transit Gateway inter-Region peering
AnswerD

Transit Gateway inter-Region peering encrypts traffic automatically.

Why this answer

Transit Gateway inter-Region peering is the correct solution because it provides encrypted traffic between VPCs in different AWS Regions natively, using the AWS global network infrastructure with automatic encryption at the transport layer. This feature supports transitive routing and does not require additional VPN tunnels or third-party appliances, making it the most efficient and scalable option for multi-region VPC connectivity.

Exam trap

AWS often tests the misconception that VPC peering alone provides encryption, or that VPN attachments are required for inter-Region encryption, when in fact Transit Gateway inter-Region peering natively encrypts traffic without additional VPN layers.

How to eliminate wrong answers

Option A is wrong because Direct Connect gateway with VIFs provides private connectivity to AWS but does not inherently encrypt traffic between VPCs in different Regions; it requires additional VPN or MACsec for encryption. Option B is wrong because Transit Gateway VPN attachments are designed for site-to-site VPN connections between on-premises networks and AWS, not for inter-Region VPC peering, and they would introduce unnecessary complexity and latency. Option C is wrong because VPC peering with VPN encryption is not a native AWS feature; VPC peering itself does not support encryption, and adding a VPN overlay would require manual configuration of VPN appliances, which is not a recommended or scalable solution for inter-Region traffic.

Full explanation →
436
MCQhard

A company runs a multi-tier web application in a VPC with public and private subnets across two Availability Zones. The web tier uses an Application Load Balancer (ALB) in the public subnets, and the application tier uses EC2 instances in private subnets. The database tier uses an RDS MySQL Multi-AZ instance in private subnets. The company has implemented a network ACL (NACL) on the private subnets to allow only traffic from the ALB security group. Recently, the application tier instances are unable to connect to the RDS database. The security group for RDS allows inbound traffic on port 3306 from the application tier security group. The network team has verified that the application tier instances can reach the internet through a NAT Gateway. What is the MOST likely cause of the connectivity issue?

A.The NACL on the private subnets is blocking outbound traffic from the application tier to the RDS database.
B.The application tier instances are in a different Availability Zone than the RDS primary instance.
C.The NAT Gateway is blocking traffic to the RDS endpoint.
D.The RDS security group is not allowing inbound traffic from the application tier security group.
AnswerA

Correct: NACL's stateless nature requires explicit outbound rules for ephemeral ports.

Why this answer

The NACL on the private subnets is stateful only for inbound rules; outbound traffic is evaluated separately. Since the NACL allows only inbound traffic from the ALB security group but does not have an outbound rule permitting traffic from the application tier to the RDS database (port 3306), the outbound SYN packets from the application instances are dropped, preventing the TCP handshake from completing.

Exam trap

The trap here is that candidates assume NACLs are stateful like security groups, leading them to overlook the need for explicit outbound rules for traffic initiated from within the subnet.

How to eliminate wrong answers

Option B is wrong because RDS Multi-AZ automatically handles failover across Availability Zones, and the application tier instances can connect to the RDS endpoint regardless of which AZ the primary instance is in; the issue is not AZ-specific. Option C is wrong because the NAT Gateway is used for outbound internet traffic, not for traffic within the VPC to RDS (which uses private IPs); the NAT Gateway is not in the path between the application tier and RDS. Option D is wrong because the question explicitly states that the RDS security group allows inbound traffic on port 3306 from the application tier security group, so this is not the cause.

Full explanation →
437
MCQeasy

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. They need to ensure that traffic between VPCs is inspected by a network virtual appliance. Which architecture should they use?

A.Use a Network Load Balancer in each VPC to forward traffic to the appliance.
B.Attach the appliance directly to each VPC using VPC Peering.
C.Create an inspection VPC with the appliance. Configure Transit Gateway route tables to send inter-VPC traffic to the inspection VPC attachment.
D.Place the appliance in each VPC and configure VPC Peering.
AnswerC

This allows traffic to be routed through the appliance for inspection.

Why this answer

It uses an inspection VPC as a central point for traffic inspection. By attaching the network virtual appliance to a dedicated inspection VPC and configuring Transit Gateway route tables to route inter-VPC traffic to that attachment, all traffic between VPCs is forced through the appliance for inspection. This leverages Transit Gateway's ability to route traffic between attachments based on route table entries, enabling centralized security enforcement without complex peering or per-VPC appliance deployments.

Exam trap

AWS often tests the misconception that you can simply attach a virtual appliance to a Transit Gateway and have it automatically inspect all traffic, but the trap here is that you must explicitly configure Transit Gateway route tables to route inter-VPC traffic to the inspection VPC attachment, otherwise traffic will flow directly between VPC attachments without inspection.

How to eliminate wrong answers

Option A is wrong because a Network Load Balancer (NLB) distributes traffic to targets but does not inherently inspect or route traffic between VPCs; it would require additional configuration and does not solve the need for centralized inspection across multiple VPCs. Option B is wrong because attaching the appliance directly to each VPC using VPC Peering creates a mesh of peering connections that is not scalable, does not centralize inspection, and violates the hub-and-spoke model that Transit Gateway is designed to provide. Option D is wrong because placing the appliance in each VPC and configuring VPC Peering leads to redundant appliances, increased management overhead, and does not leverage Transit Gateway's centralized routing capabilities, making it inefficient and costly.

Full explanation →
438
Multi-Selectmedium

A network engineer is troubleshooting connectivity between two VPCs connected via a VPC peering connection. Security groups and NACLs are configured correctly. The engineer verifies that the route tables have the necessary entries. However, traffic from an EC2 instance in VPC A to an RDS instance in VPC B fails. Which TWO additional checks should be performed? (Choose two.)

Select 2 answers
A.Check that the security group attached to the RDS instance allows inbound traffic from the CIDR block of VPC A.
B.Verify that the network ACLs in both VPCs have appropriate inbound and outbound rules for the traffic.
C.Confirm that the VPCs have an Internet Gateway attached.
D.Check that the EC2 instance has an IAM role that allows it to communicate with RDS.
E.Ensure that the VPC peering connection is in the 'active' state.
AnswersA, E

Correct: Security groups must allow traffic from peer VPC.

Why this answer

The correct checks to perform when troubleshooting VPC peering connectivity are to ensure the VPC peering connection is in the 'active' state (Option E) and that the security group attached to the RDS instance allows inbound traffic from the CIDR block of VPC A (Option A). Without an active peer connection, traffic cannot flow even if route tables are correct. Similarly, security group rules are stateful and must explicitly permit inbound traffic; NACLs are stateless but since the issue is within the same VPC peering, security groups are a likely culprit.

IAM roles and Internet Gateways are not required for VPC peering traffic.

Full explanation →
439
Multi-Selectmedium

A company is designing a VPC with multiple subnets. The company wants to use VPC Flow Logs to monitor network traffic. Which TWO of the following are valid destinations for VPC Flow Logs?

Select 2 answers
A.Amazon RDS
B.Amazon CloudWatch Logs
C.Amazon S3
D.Amazon SQS
E.Amazon Kinesis Data Firehose
AnswersB, C

Supported destination.

Why this answer

VPC Flow Logs can publish flow log records directly to Amazon CloudWatch Logs, where you can view, search, and filter log data using the CloudWatch Logs console or API. This destination is enabled by default when you create a flow log via the AWS Management Console, making it the most common integration point for monitoring and alerting on network traffic patterns.

Exam trap

The ANS-C01 exam often tests that candidates confuse supported destinations with downstream integrations; the trap here is that Kinesis Data Firehose is a valid downstream target via a CloudWatch Logs subscription filter, but it is not a direct destination for VPC Flow Logs.

Full explanation →
440
MCQeasy

A security engineer notices that a security group allows inbound SSH from 0.0.0.0/0. Which immediate action should be taken to reduce risk?

A.Modify the security group inbound rule to allow SSH only from the company's public IP range
B.Add a network ACL deny rule for SSH from 0.0.0.0/0
C.Move the instances to a different subnet with a restrictive NACL
D.Delete the security group and create a new one with the correct rules
AnswerA

Directly reduces attack surface.

Why this answer

The immediate action is to modify the security group inbound rule to restrict SSH access to only the company's public IP range (Option A). This reduces the attack surface by limiting exposure to trusted IPs. Option B is incorrect because adding a network ACL deny rule is not as effective since NACLs are stateless and the security group still allows inbound SSH from anywhere; also, NACLs operate at the subnet level and do not override security group rules for inbound traffic within the VPC.

Option C is incorrect because moving instances to a different subnet is disruptive and does not address the current security group rule. Option D is incorrect because deleting the security group may affect running instances and is not the simplest immediate action.

Full explanation →
441
MCQmedium

A company is experiencing intermittent SSH connection failures to their EC2 instances in a VPC. The instances are in a private subnet with a NAT gateway. The security group allows inbound SSH from the corporate CIDR. The network ACL is set to default allow all. The route table has a route to the NAT gateway for 0.0.0.0/0. What is the most likely cause of the intermittent failures?

A.The network ACL inbound rule is blocking ephemeral ports.
B.The instances are behind a proxy that is not configured.
C.The security group outbound rules are not allowing return traffic.
D.The NAT gateway does not have an Elastic IP associated.
AnswerD

Correct. A NAT gateway must have an Elastic IP associated to function properly. Without it, the NAT gateway cannot translate addresses, causing connectivity issues for instances that require outbound access.

Why this answer

The NAT gateway requires an associated Elastic IP to function correctly. Without it, the NAT gateway cannot be created or fails to operate, leading to intermittent connectivity issues for instances in the private subnet. Since the instances rely on the NAT gateway for outbound traffic (e.g., to reach configuration endpoints or DNS), any failure in the NAT gateway can disrupt SSH sessions that depend on such outbound communication.

Option A is incorrect because the network ACL is set to default allow all, so it does not block ephemeral ports. Option B is incorrect because a proxy is not typically required for SSH connections in this setup. Option C is incorrect because security groups are stateful, meaning outbound rules do not block return traffic from allowed inbound connections.

Exam trap

Many candidates overlook the requirement for a NAT gateway to have an Elastic IP, assuming it works without one. This traps those who focus solely on security group and NACL rules.

Full explanation →
442
Multi-Selectmedium

A company is deploying a multi-tier web application on AWS. The application uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances in private subnets across multiple Availability Zones. The security team requires that all traffic between the ALB and the EC2 instances be encrypted using TLS. The application must also support HTTP health checks from the ALB. Which TWO actions should the network engineer take to meet these requirements? (Choose TWO.)

Select 2 answers
A.Configure the ALB listener to use HTTP and enable stickiness.
B.Install a certificate on each EC2 instance and configure the target group to use HTTPS.
C.Configure the ALB listener to use HTTPS and set the target group protocol to HTTP.
D.Configure the target group health check to use HTTPS.
E.Configure the security group for EC2 instances to allow inbound HTTP traffic from the ALB.
AnswersB, D

Installing a certificate on instances allows TLS termination, and HTTPS target group ensures encrypted health checks.

Why this answer

Installing a certificate on each EC2 instance and configuring the target group to use HTTPS ensures that traffic between the ALB and the EC2 instances is encrypted using TLS. This meets the security requirement for end-to-end encryption, as the ALB will establish a TLS connection with the instances using the installed certificate.

Exam trap

The trap here is that candidates often assume setting the ALB listener to HTTPS is sufficient for end-to-end encryption, overlooking that the target group protocol must also be HTTPS to encrypt the ALB-to-instance traffic.

Full explanation →
443
Multi-Selectmedium

A company has a VPC with multiple subnets. They want to implement network segmentation such that traffic between subnets is controlled by a centralized firewall. Which three components are required? (Choose THREE.)

Select 3 answers
A.AWS Transit Gateway
B.Route tables in each subnet that route traffic to the Transit Gateway
C.Gateway Load Balancer
D.VPC peering connections
E.NAT Gateway
AnswersA, B, C

Provides transitive routing between VPCs.

Why this answer

Centralized firewall inspection requires a Transit Gateway to route traffic to the firewall VPC, a Gateway Load Balancer to distribute traffic to firewall instances, and appropriate route tables to direct traffic accordingly. VPC peering does not support transitive routing. NAT Gateway is for outbound internet access.

Full explanation →
444
MCQhard

A company is setting up a new AWS account and wants to centrally manage VPC network traffic inspection across multiple accounts using a central VPC. The company uses AWS Organizations. Which architecture meets these requirements?

A.Create VPC peering connections between each account's VPC and the central VPC.
B.Use AWS Transit Gateway with a central inspection VPC that has firewall appliances.
C.Use VPC endpoints to route traffic to the central VPC.
D.Deploy a Network Load Balancer in each VPC and route traffic through it.
AnswerB

TGW enables hub-and-spoke architecture with inspection.

Why this answer

AWS Transit Gateway acts as a hub-and-spoke router, enabling centralized network traffic inspection by routing inter-VPC and VPN traffic through a central inspection VPC that hosts firewall appliances (e.g., third-party NGFWs or AWS Network Firewall). This architecture scales across multiple accounts in AWS Organizations using resource sharing via AWS Resource Access Manager, and it supports granular route tables to force traffic through the inspection VPC without requiring peering mesh or single points of failure.

Exam trap

The ANS-C01 exam often tests the misconception that VPC peering can be used for transitive routing (i.e., routing traffic through a third VPC), but VPC peering is non-transitive and cannot forward traffic between two peered VPCs via a central VPC.

How to eliminate wrong answers

Option A is wrong because VPC peering connections create a flat, non-transitive mesh; traffic between two peered VPCs cannot be routed through a third VPC (e.g., the central inspection VPC) without complex and unscalable workarounds, and it does not support centralized inspection across many accounts. Option C is wrong because VPC endpoints (Gateway or Interface endpoints) are designed for private connectivity to AWS services (e.g., S3, DynamoDB) or specific endpoint services, not for routing general inter-VPC or internet-bound traffic through a central inspection VPC. Option D is wrong because a Network Load Balancer operates at Layer 4 and is used for load balancing TCP/UDP traffic, not for routing or inspecting traffic between VPCs; it cannot enforce traffic inspection policies or act as a central routing hub.

Full explanation →
445
MCQhard

A company has a VPC with multiple subnets that are peered with another VPC using a VPC Peering connection. They want to ensure that traffic between the two VPCs is encrypted. What should they do?

A.Configure network ACLs to enforce encryption.
B.Use AWS Transit Gateway with a VPN attachment between the VPCs.
C.Use AWS Direct Connect with a public VIF.
D.Enable encryption on the VPC Peering connection using a security group.
AnswerB

Transit Gateway with VPN can provide encrypted connectivity between VPCs.

Why this answer

VPC Peering does not support encryption of traffic in transit. To encrypt traffic between VPCs, you can use AWS Transit Gateway with a VPN attachment, which establishes an IPsec VPN tunnel that encrypts all traffic between the VPCs. This solution meets the requirement for encrypted inter-VPC communication while still allowing connectivity across multiple subnets.

Exam trap

The trap here is that candidates assume VPC Peering can be encrypted via security groups or ACLs, but AWS does not support encryption on VPC Peering connections, and the correct solution requires a Transit Gateway with a VPN attachment.

How to eliminate wrong answers

Option A is wrong because network ACLs are stateless packet filters that operate at the subnet level and cannot enforce encryption; they only allow or deny traffic based on IP addresses, ports, and protocols. Option C is wrong because AWS Direct Connect with a public VIF provides a dedicated network connection to AWS public services but does not inherently encrypt traffic between VPCs; encryption would require an additional VPN or MACsec. Option D is wrong because VPC Peering connections do not support encryption natively; security groups control traffic at the instance level but cannot enable encryption on the peering link itself.

Full explanation →
446
MCQhard

A company is designing a network for a multi-account architecture using AWS Resource Access Manager (RAM) to share VPC subnets across accounts. They want to ensure that instances in shared subnets can communicate with instances in the owner's VPC using private IP addresses. What is required?

A.Establish a VPC peering connection between the owner and participant accounts.
B.Configure a VPC endpoint for Amazon EC2 to allow cross-account private communication.
C.No additional networking configuration is required; the shared subnet is part of the same VPC.
D.Create a transit gateway and attach both VPCs to it.
AnswerC

Shared subnets are within the same VPC, so routing is inherent.

Why this answer

When you share a subnet using AWS Resource Access Manager (RAM), the shared subnet is part of the owner's VPC. Instances launched into that shared subnet reside in the same VPC as the owner's instances, so they can communicate using private IP addresses by default, with no additional networking configuration required. This is because VPC subnets are a logical subdivision of the VPC's CIDR block, and all instances within the same VPC can route to each other via the VPC's internal router.

Exam trap

The trap here is that candidates mistakenly think cross-account subnet sharing requires additional connectivity like VPC peering or a transit gateway, when in fact the shared subnet is logically part of the same VPC, so no extra networking is needed for private IP communication.

How to eliminate wrong answers

Option A is wrong because VPC peering is used to connect two separate VPCs, but a shared subnet is part of the same VPC as the owner, so peering is unnecessary and would add complexity without benefit. Option B is wrong because a VPC endpoint for EC2 is used to privately access EC2 APIs (e.g., for managing instances) and does not enable instance-to-instance private IP communication; it is a gateway for API calls, not for data-plane traffic between instances. Option D is wrong because a transit gateway is designed to interconnect multiple VPCs or on-premises networks, but since the shared subnet is already within the same VPC, there is no need for a transit gateway; it would introduce unnecessary cost and administrative overhead.

Full explanation →
447
MCQhard

A company runs a critical application on EC2 instances in a VPC. The application needs to send data to an S3 bucket and an SQS queue, both in the same AWS account. The security team requires that all traffic to these AWS services must stay within the AWS network and not traverse the internet. The VPC has private subnets with no NAT gateway or Internet Gateway. The EC2 instances have an IAM role that grants necessary permissions. The S3 bucket and SQS queue are configured with bucket policies and queue policies that deny all access except from the VPC. However, the application is failing to send data to both S3 and SQS. What should the network engineer do to resolve this issue?

A.Deploy an Amazon CloudFront distribution in front of S3 and use its public endpoint
B.Create a NAT gateway in a public subnet and update the route tables to send traffic to it
C.Set up an AWS Direct Connect connection and route traffic through it
D.Create a gateway endpoint for S3 and an interface endpoint for SQS in the VPC, and update the route tables for S3 and the security groups for SQS
AnswerD

Gateway endpoint for S3 uses prefix lists in route tables; interface endpoint for SQS uses ENIs and security groups. Update policies to allow traffic from the VPC endpoints.

Why this answer

VPC endpoints for S3 (Gateway endpoint) and SQS (Interface endpoint) provide private connectivity within the AWS network, meeting the security requirement. Option D is correct because it creates the necessary endpoints and updates route tables and security groups. For the Gateway endpoint, route tables must be updated to direct S3 traffic through the endpoint.

For the Interface endpoint, security groups must allow inbound traffic from the EC2 instances. Option A is wrong because CloudFront is a content delivery service, not a private connectivity solution for S3 or SQS. Option B is wrong because a NAT gateway would route traffic over the internet, violating the requirement.

Option C is wrong because Direct Connect is an overkill and does not directly provide VPC endpoint connectivity for S3 and SQS.

Full explanation →
448
MCQhard

A company runs a critical application on EC2 instances behind an Application Load Balancer. They need to ensure that if an instance fails health checks, it is automatically terminated and replaced. Which AWS service should they use?

A.AWS Lambda
B.EC2 Instance Connect
C.Auto Scaling group
D.Amazon CloudWatch
AnswerC

Auto Scaling groups can use ELB health checks to automatically replace unhealthy instances.

Why this answer

An Auto Scaling group (Option C) is the correct service because it automatically replaces unhealthy EC2 instances by integrating with the Application Load Balancer's health checks. When an instance fails the configured health check (e.g., HTTP 5xx or TCP timeout), the Auto Scaling group marks it as unhealthy, terminates it, and launches a new instance to maintain the desired capacity. This lifecycle management is a core feature of Auto Scaling groups, not available in the other options.

Exam trap

The trap here is that candidates might choose Amazon CloudWatch (Option D) because they know CloudWatch can monitor health checks and trigger actions, but they overlook that CloudWatch alone cannot directly terminate and replace EC2 instances—it requires additional automation (e.g., Lambda or Auto Scaling), making Auto Scaling the correct and complete answer for automatic replacement.

How to eliminate wrong answers

Option A is wrong because AWS Lambda is a serverless compute service for running code in response to events, not for managing EC2 instance lifecycle or health check-based replacement. Option B is wrong because EC2 Instance Connect is a feature for securely connecting to EC2 instances via SSH or RDP using temporary credentials; it has no capability to terminate or replace instances based on health checks. Option D is wrong because Amazon CloudWatch is a monitoring and observability service that can trigger alarms on metrics, but it cannot directly terminate and replace EC2 instances; it would require a separate automation (e.g., Lambda) to act on the alarm, making it an indirect and incomplete solution compared to Auto Scaling groups.

Full explanation →
449
Multi-Selecthard

A company has a VPC with public and private subnets. The public subnet contains a NAT gateway and a bastion host. The private subnet contains application servers. The company wants to ensure that the application servers can download patches from the internet. Which TWO steps should be taken to allow this while maintaining security? (Choose two.)

Select 2 answers
A.Allow outbound HTTPS (port 443) traffic from the application servers in the security group
B.Modify the network ACL of the private subnet to allow all outbound traffic
C.Add a route in the public subnet route table that points 0.0.0.0/0 to the NAT gateway
D.Add a route in the private subnet route table that points 0.0.0.0/0 to the NAT gateway
E.Associate an Elastic IP address with the NAT gateway
AnswersA, D

Correct; security groups must allow outbound traffic.

Why this answer

The application servers need to initiate outbound HTTPS connections (port 443) to download patches from the internet. By allowing outbound HTTPS traffic in the security group associated with the application servers, you permit the necessary traffic while maintaining stateful filtering and restricting other outbound traffic. This is a security best practice that follows the principle of least privilege.

Exam trap

AWS often tests the distinction between where routes are added (public vs. private subnet route tables) and the role of security groups versus network ACLs, leading candidates to incorrectly modify the public subnet's route table or use overly permissive network ACL rules.

Full explanation →
450
MCQmedium

A company has deployed an application across multiple AWS Regions using Application Load Balancers (ALBs). The company wants to route traffic to the nearest healthy endpoint using latency-based routing. Which AWS service should be used to distribute traffic across the ALBs?

A.Amazon CloudFront with multiple origins.
B.AWS Network Load Balancer with cross-zone load balancing.
C.Amazon Route 53 with latency routing policy.
D.AWS Global Accelerator.
AnswerC

Route 53 latency routing routes traffic based on the lowest latency between the client and the endpoint.

Why this answer

Amazon Route 53 with a latency routing policy is the correct choice because it directs traffic to the ALB endpoint that provides the lowest latency for the end user, based on measured round-trip times between the user and each AWS Region. This aligns with the requirement to route traffic to the nearest healthy endpoint using latency-based routing, as Route 53 evaluates health checks on the ALBs and only considers healthy endpoints when determining the lowest latency.

Exam trap

The trap here is that candidates often confuse AWS Global Accelerator's Anycast-based performance routing with latency-based routing, but Global Accelerator uses static IPs and the AWS backbone for geographic proximity, not real-time user-to-endpoint latency measurements like Route 53 latency policy.

How to eliminate wrong answers

Option A is wrong because Amazon CloudFront with multiple origins is a content delivery network (CDN) that caches content at edge locations and routes requests based on geographic proximity or custom origin selection, not real-time latency measurements; it does not perform latency-based routing to the nearest healthy ALB. Option B is wrong because AWS Network Load Balancer with cross-zone load balancing distributes traffic within a single Region across targets in multiple Availability Zones, but it cannot route traffic across multiple AWS Regions or select endpoints based on latency. Option D is wrong because AWS Global Accelerator uses Anycast IPs and the AWS global network to route traffic to the nearest healthy endpoint based on geographic proximity and endpoint health, but it does not use latency-based routing; it optimizes for performance via the AWS backbone, not by measuring user-to-endpoint latency.

Full explanation →
Page 5

Page 6 of 22

Page 7

All pages

12345678910111213141516171819202122

Practice ANS-C01 by domain

Target a specific domain to shore up weak areas.

Network Management and OperationsNetwork Security, Compliance and GovernanceNetwork DesignNetwork Implementation
See all domains with question counts →