Courseiva

AWS Certified Advanced Networking Specialty ANS-C01 (ANS-C01) — Questions 451525

1621 questions total · 22pages · All types, answers revealed

Page 6

Page 7 of 22

Page 8
451
MCQhard

A company is troubleshooting high latency on an AWS Direct Connect connection. The network team notices that the latency increases during peak hours. The connection uses a single virtual interface (VIF) with a 1 Gbps capacity. What is the MOST likely cause of the latency?

A.The VLAN ID is mismatched between the customer router and AWS
B.The bandwidth limit of the virtual interface is being exceeded
C.Jumbo frames are not enabled on the customer router
D.BGP keepalive timers are set too high
AnswerB

Congestion causes packet drops and increased latency.

Why this answer

The most likely cause of increased latency during peak hours is that the bandwidth limit of the virtual interface (VIF) is being exceeded. When traffic approaches or surpasses the 1 Gbps capacity, the router's egress queue begins to fill, causing packet buffering and queuing delay. This queuing delay directly manifests as higher round-trip time (RTT) and is a classic symptom of link saturation.

Exam trap

The trap here is that candidates confuse bandwidth saturation with configuration errors like VLAN mismatches or MTU issues, but only saturation explains the correlation with peak hours and the gradual latency increase.

How to eliminate wrong answers

Option A is wrong because a VLAN ID mismatch would cause a complete loss of connectivity (no link state or BGP adjacency), not a gradual increase in latency during peak hours. Option C is wrong because jumbo frames (MTU 9001) reduce overhead and can improve throughput, but their absence does not cause latency to increase specifically during peak traffic; it would affect performance consistently regardless of load. Option D is wrong because BGP keepalive timers (default 60 seconds, hold time 180 seconds) control the speed of failure detection, not packet forwarding latency; setting them too high would delay route convergence but not increase per-packet delay.

452
MCQeasy

A company is using AWS Client VPN to allow remote employees to access resources in a VPC. The VPN is configured with a server certificate and mutual authentication. Some users report that they cannot connect to the VPN. What should the administrator check FIRST?

A.Check the security group associated with the VPN endpoint.
B.Verify that the server certificate is uploaded to AWS Certificate Manager (ACM).
C.Confirm that the VPN endpoint is associated with all subnets in the VPC.
D.Verify that each user has a valid client certificate installed on their device.
AnswerD

Correct: Mutual authentication requires client certificates.

Why this answer

The question states that mutual authentication is configured, which requires both a server certificate and a valid client certificate on each user's device. Since some users cannot connect while others presumably can, the most likely issue is that the affected users lack a valid client certificate. The administrator should first verify that each user has a valid client certificate installed, as this is a common point of failure in mutual TLS authentication.

Exam trap

AWS often tests the distinction between server-side and client-side authentication requirements in mutual TLS; the trap here is that candidates assume the issue is with the server certificate or network configuration, overlooking that each user must have a valid client certificate for mutual authentication to succeed.

How to eliminate wrong answers

Option A is wrong because security groups are stateful and, by default, allow all outbound traffic; the VPN endpoint's security group controls inbound/outbound traffic but is not the first thing to check when users cannot connect, especially since the issue is likely client-side. Option B is wrong because the server certificate must be uploaded to ACM for the VPN endpoint to function, but if the VPN is already configured and working for some users, the server certificate is already in place; this would be a global issue, not a per-user issue. Option C is wrong because the VPN endpoint does not need to be associated with all subnets in the VPC; it only needs to be associated with at least one subnet to function, and associating it with all subnets is not required and would not cause per-user connectivity failures.

453
Drag & Dropmedium

Order the steps to migrate a VPC from using an Internet Gateway to a NAT gateway for outbound-only internet access:

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First create the NAT gateway, then update routes to use it, remove the IGW route, adjust security, and test.

454
Multi-Selectmedium

A company has a VPC with public and private subnets. The private subnets have a route to a NAT gateway. The network team wants to monitor DNS queries from EC2 instances in private subnets to a custom DNS resolver on-premises over a VPN. Which TWO services can capture this traffic?

Select 2 answers
A.Amazon Route 53 Resolver query logs
B.Amazon CloudWatch
C.VPC Flow Logs
D.AWS Network Firewall
E.AWS CloudTrail
AnswersC, D

Flow logs capture all IP traffic, including DNS queries.

Why this answer

VPC Flow Logs capture IP traffic at the network interface level, including DNS queries (port 53) to any destination, such as a custom on-premises resolver over VPN. AWS Network Firewall can inspect and log DNS traffic that passes through it, including queries to custom resolvers. Option A (Route 53 Resolver query logs) is incorrect because it only logs queries made to Amazon Route 53 Resolver, not to custom on-premises resolvers.

Option B (CloudWatch) is incorrect because CloudWatch does not directly capture network traffic; it can aggregate logs but cannot capture raw DNS packets. Option E (CloudTrail) is incorrect because it logs API calls to AWS services, not network traffic.

455
Multi-Selecteasy

Which TWO statements about AWS WAF are accurate? (Choose 2)

Select 2 answers
A.AWS WAF provides protection against network-layer DDoS attacks
B.AWS WAF can inspect traffic at the VPC level using VPC Flow Logs
C.AWS WAF automatically mitigates DDoS attacks without manual intervention
D.AWS WAF can block or allow web requests based on conditions such as IP addresses, HTTP headers, and URI strings
E.AWS WAF can be deployed on Application Load Balancers, Amazon CloudFront distributions, and Amazon API Gateway APIs
AnswersD, E

Core functionality.

Why this answer

Options D and E are correct statements about AWS WAF. AWS WAF is a web application firewall that can block or allow web requests based on conditions such as IP addresses, HTTP headers, and URI strings (D). It can be deployed on Application Load Balancers, Amazon CloudFront distributions, and Amazon API Gateway APIs (E).

Option A is incorrect because network-layer DDoS protection is provided by AWS Shield, not WAF. Option B is incorrect because WAF does not inspect VPC Flow Logs; it inspects HTTP/HTTPS traffic at the application layer. Option C is incorrect because while WAF can be configured to automatically respond to certain conditions, it does not automatically mitigate DDoS attacks; AWS Shield Advanced provides automatic DDoS mitigation.

456
MCQeasy

A company has a VPC with an application load balancer (ALB) in public subnets and EC2 instances in private subnets. The EC2 instances must only accept traffic from the ALB. Which security group configuration achieves this?

A.Allow inbound traffic from 0.0.0.0/0 on the application port.
B.Allow inbound traffic from the VPC CIDR on the application port.
C.Allow inbound traffic from the private subnet CIDR on the application port.
D.Allow inbound traffic from the ALB's security group on the application port.
AnswerD

This ensures only traffic from the ALB is accepted.

Why this answer

Referencing the ALB's security group as the source in the EC2 instances' inbound rule ensures that only traffic originating from the ALB is allowed. This leverages AWS security group referencing, which dynamically resolves to the private IP addresses of the ALB's elastic network interfaces (ENIs), providing a secure and scalable solution without exposing the instances to broader network ranges.

Exam trap

The ANS-C01 exam often tests the misconception that allowing traffic from the VPC CIDR or private subnet CIDR is sufficient, but the trap here is that those rules are too broad and do not restrict traffic exclusively to the ALB, which is a common oversight when candidates confuse network-level access with application-level access.

How to eliminate wrong answers

Option A is wrong because allowing inbound traffic from 0.0.0.0/0 on the application port would permit any internet host to reach the EC2 instances, bypassing the ALB and violating the requirement. Option B is wrong because allowing inbound traffic from the VPC CIDR would permit any resource within the VPC (including other EC2 instances, NAT gateways, or services) to access the instances, not just the ALB. Option C is wrong because allowing inbound traffic from the private subnet CIDR would permit any instance in the private subnets to reach the EC2 instances, which is overly permissive and does not restrict traffic solely to the ALB.

457
MCQmedium

A company is implementing a multi-region active-active application. They want to route users to the nearest healthy endpoint using DNS. Which AWS service should be used?

A.Elastic Load Balancer (ELB)
B.Amazon CloudFront
C.Amazon Route 53 latency-based routing
D.AWS Global Accelerator
AnswerC

Routes based on lowest latency.

Why this answer

Amazon Route 53 latency-based routing directs traffic based on the lowest network latency between the user and the endpoint, making it ideal for routing users to the nearest healthy endpoint in a multi-region active-active setup. It continuously monitors endpoint health via health checks and only routes to healthy endpoints, ensuring high availability and performance.

Exam trap

The trap here is that candidates confuse AWS Global Accelerator (which also routes to the nearest healthy endpoint) with DNS-based routing, but Global Accelerator uses Anycast at the network layer, not DNS, so it does not meet the 'using DNS' requirement specified in the question.

How to eliminate wrong answers

Option A is wrong because Elastic Load Balancer (ELB) operates within a single AWS region and cannot route traffic across multiple regions based on user proximity or latency. Option B is wrong because Amazon CloudFront is a content delivery network (CDN) that caches content at edge locations and does not perform DNS-based routing to the nearest healthy application endpoint; it is designed for static and dynamic content acceleration, not for active-active multi-region routing. Option D is wrong because AWS Global Accelerator uses Anycast IPs and the AWS global network to route traffic to the nearest healthy endpoint, but it operates at the network layer (Layer 3/4) and is not a DNS-based routing service; the question specifically asks for DNS-based routing, which is a key differentiator.

458
Multi-Selecthard

Which THREE components are required to establish a site-to-site VPN connection between an on-premises network and AWS? (Choose THREE.)

Select 3 answers
A.AWS Direct Connect
B.AWS Transit Gateway
C.Virtual Private Gateway
D.Customer Gateway
E.VPN Connection
AnswersC, D, E

AWS side VPN endpoint.

Why this answer

A Virtual Private Gateway (VGW) is required as the AWS-side VPN concentrator for a site-to-site VPN connection. It attaches to a VPC and terminates the IPsec tunnels from the on-premises network, enabling encrypted traffic between the VPC and the remote network.

Exam trap

The trap here is that candidates often confuse optional components like Transit Gateway or Direct Connect as mandatory for a site-to-site VPN, when in fact only the VGW, CGW, and VPN Connection are strictly required.

459
MCQeasy

A security engineer reviews the above security group configuration for a web server. What is a security concern with this configuration?

A.The outbound rule allows all traffic, which could be used for data exfiltration if the server is compromised.
B.The inbound rule for SSH allows traffic from a large CIDR block (10.0.0.0/8), which could include unauthorized internal hosts.
C.The outbound rule allows all traffic, which is necessary for the server to function.
D.The inbound rule for HTTP is too permissive because it allows traffic from all IP addresses.
AnswerA

A restrictive egress rule is a best practice to limit the impact of a breach.

Why this answer

The security concern is that the outbound rule allows all traffic to any destination, which could be used for data exfiltration if the server is compromised. This is option A. Option D is not a concern because allowing HTTP from anywhere is typical for a web server.

Option B is incorrect because SSH from 10.0.0.0/8 is internal and acceptable. Option C is incorrect because the outbound rule is overly permissive, not necessary.

460
MCQeasy

A company uses AWS Direct Connect with a private VIF to connect to their VPC. They want to monitor the network latency between their on-premises router and the AWS Direct Connect location. Which AWS service should they use?

A.AWS Direct Connect metrics in CloudWatch
B.AWS X-Ray
C.VPC Flow Logs
D.Amazon CloudWatch Synthetics
AnswerA

Direct Connect publishes metrics like latency to CloudWatch.

Why this answer

AWS Direct Connect publishes metrics such as latency (round-trip time) and BGP session state to CloudWatch. These metrics can be used to monitor network latency between on-premises and the Direct Connect location. Option B is incorrect because AWS X-Ray is for tracing application requests, not network infrastructure latency.

Option C is incorrect because VPC Flow Logs capture IP traffic metadata (e.g., sources, destinations, ports), not latency. Option D is incorrect because CloudWatch Synthetics monitors endpoint availability and response times via canaries, not Direct Connect link latency.

461
MCQhard

A company is using a centralized egress VPC model with a NAT gateway for outbound traffic from multiple VPCs. The network team notices that some EC2 instances are having connectivity timeouts when accessing the internet. The team has verified the route tables and security groups. Which additional check should be performed to troubleshoot the issue?

A.Check the security group rules for outbound traffic
B.Check the VPC Flow Logs for denied traffic
C.Check the route tables for the internet gateway
D.Check the NAT gateway CloudWatch metrics for error packets and connection counts
AnswerD

High connection counts or error packets indicate resource exhaustion.

Why this answer

NAT Gateway CloudWatch metrics, specifically `ErrorPortAllocation` and `PacketsDropCount`, directly indicate whether the NAT Gateway is running out of available ports or dropping packets due to connection limits. In a centralized egress model with multiple VPCs, high connection counts can exhaust the NAT Gateway's ephemeral port capacity (65,535 per IP), causing connectivity timeouts even when route tables and security groups are correctly configured.

Exam trap

AWS often tests the misconception that VPC Flow Logs or security group checks are sufficient for diagnosing NAT Gateway issues, when in fact the root cause is often port exhaustion or packet drops at the NAT Gateway itself, which requires CloudWatch metrics to identify.

How to eliminate wrong answers

Option A is wrong because the team has already verified security groups, and outbound rules are typically permissive by default; the issue is at the NAT Gateway level, not the instance's security group. Option B is wrong because VPC Flow Logs capture traffic metadata but do not show NAT Gateway-specific errors like port exhaustion; denied traffic would appear as 'ACCEPT' or 'REJECT' based on security group/NACL rules, not NAT Gateway capacity. Option C is wrong because route tables for the internet gateway are irrelevant in a centralized egress model where traffic is routed through the NAT Gateway in the egress VPC, not directly to an IGW from the spoke VPCs.

462
MCQmedium

A company is using AWS WAF to protect a web application behind an Application Load Balancer. They want to block requests that contain SQL injection attacks. Which WAF rule type should they use?

A.IP set rule
B.Managed rule group for SQL injection
C.Rate-based rule
D.Geographic match rule
AnswerB

AWS WAF managed rules include SQL injection detection.

Why this answer

AWS WAF provides managed rule groups specifically designed to detect common web threats, including SQL injection attacks. The 'Managed rule group for SQL injection' contains pre-configured rules that inspect request components (such as query strings, URI, and body) for SQL injection patterns, making it the correct choice for blocking such attacks without requiring custom rule authoring.

Exam trap

The trap here is that candidates may confuse a rate-based rule (which controls request frequency) with a content-inspection rule, or assume that an IP set rule can block attacks based on source reputation, when in fact only managed rule groups or custom rules with SQL injection match conditions can inspect request content for injection patterns.

How to eliminate wrong answers

Option A is wrong because an IP set rule matches requests based on source IP addresses, not on the content of the request, so it cannot detect SQL injection patterns. Option C is wrong because a rate-based rule limits the number of requests from a source IP over a time window, which is used for DDoS protection, not for inspecting request payloads for SQL injection. Option D is wrong because a geographic match rule filters traffic based on the country of origin of the IP address, which has no relation to SQL injection detection.

463
MCQeasy

A network engineer is troubleshooting SSH connectivity to an EC2 instance in subnet subnet-0abcd1234efgh5678, which is associated with the network ACL shown. The security group allows inbound SSH. Why can't the engineer SSH to the instance?

A.The security group is blocking SSH traffic
B.The network ACL is not associated with the subnet
C.The network ACL has a rule that denies all traffic (rule 300) which overrides the allow rule
D.The network ACL rule 200 denies SSH traffic, overriding rule 100
AnswerD

Correct. The network ACL has rule 200 that explicitly denies SSH traffic. Because rule 100 only allows HTTP, not SSH, rule 200 is the first matching rule for SSH and denies it.

Why this answer

The network ACL exhibit shows inbound rule 100 allowing HTTP traffic (port 80) and rule 200 denying SSH traffic (port 22). Since NACL rules are evaluated in ascending order, when an SSH packet arrives, rule 100 does not match (it allows HTTP, not SSH), so rule 200 matches and denies the traffic. Thus, SSH is blocked.

Option A is wrong because the security group allows SSH. Option B is wrong because the subnet is associated with the NACL as stated. Option C is wrong because rule 300 is a higher-numbered rule and would only be evaluated if no earlier rule matched; here rule 200 already matches and denies SSH.

Exam trap

Candidates often assume that an allow rule with a lower number always overrides a deny rule with a higher number. However, the allow rule must match the specific traffic; if it does not, the deny rule will apply.

464
Multi-Selecteasy

Which THREE of the following are considerations when designing a Direct Connect implementation for high availability? (Choose three.)

Select 3 answers
A.Use a single connection with high bandwidth.
B.Configure static routes to the on-premises network.
C.Use BGP to advertise the same prefixes over both connections.
D.Use two or more Direct Connect connections.
E.Connect to different Direct Connect locations.
AnswersC, D, E

Enables automatic failover.

Why this answer

Using BGP to advertise the same prefixes over both Direct Connect connections enables active-active or active-passive load balancing and automatic failover. BGP’s route selection and AS_PATH prepending allow you to control traffic flow, ensuring that if one connection fails, the other continues to advertise the same prefixes, maintaining connectivity without manual intervention.

Exam trap

The ANS-C01 exam often tests the misconception that high bandwidth alone or static routes provide high availability, but the key is dynamic routing with BGP and redundant physical connections to separate locations.

465
Multi-Selecthard

A company is using AWS Global Accelerator to improve performance for a global application. The application uses an Application Load Balancer (ALB) in each region. The network team wants to ensure that traffic is distributed evenly across regions and that failover happens quickly. Which THREE steps should the team take? (Select THREE.)

Select 3 answers
A.Configure multiple endpoint groups, one per region, and set traffic dials to distribute load
B.Enable health checks on each endpoint and set a low threshold for failure detection
C.Set the traffic dial for each endpoint group to a value that reflects the desired distribution
D.Enable client IP address preservation on the Global Accelerator
E.Use Route 53 weighted routing in front of Global Accelerator
AnswersA, B, C

Traffic dials control the percentage of traffic to each region.

Why this answer

Options A, B, and C are correct. A: Multiple endpoint groups with traffic dials allow distributing traffic across regions based on desired percentages. B: Enabling health checks with a low threshold for failure detection ensures fast failover by quickly marking unhealthy endpoints.

C: Setting traffic dials for each endpoint group allows fine-tuning the distribution of traffic. Option D is incorrect because client IP address preservation is not related to traffic distribution or failover; it affects source IP visibility. Option E is incorrect because Route 53 weighted routing is unnecessary; Global Accelerator can handle distribution via endpoint groups and traffic dials.

466
MCQhard

A financial services company must meet PCI DSS compliance requirements. They have a VPC with public and private subnets. The web servers in the public subnets must only accept traffic from the internet on ports 80 and 443. The application servers in the private subnets must only accept traffic from the web servers. Which network design ensures least-privilege access?

A.Use security groups on web servers allowing 0.0.0.0/0 on ports 80/443, and on app servers allowing the web servers' CIDR block
B.Use a Network ACL on the public subnet allowing inbound ports 80 and 443 from 0.0.0.0/0, and security groups on web and app servers with the app servers' security group referencing the web servers' security group
C.Use a single Network ACL for both public and private subnets with allow rules for ports 80 and 443
D.Use a single Network ACL on the private subnet allowing inbound ports 80 and 443 from the public subnet CIDR
AnswerB

This provides least-privilege with stateful security groups and stateless NACL.

Why this answer

It uses security groups for stateful, least-privilege access control. The web servers' security group allows inbound ports 80 and 443 from 0.0.0.0/0, and the app servers' security group references the web servers' security group as the source, ensuring only traffic from the web servers is permitted. This design leverages security group chaining, which automatically handles return traffic and avoids the need for explicit CIDR management, aligning with PCI DSS least-privilege requirements.

Exam trap

The trap here is that candidates often default to using Network ACLs for subnet-level control, forgetting that security groups provide stateful, instance-level filtering with the ability to reference other security groups, which is more aligned with least-privilege and PCI DSS requirements.

How to eliminate wrong answers

Option A is wrong because allowing the web servers' CIDR block on the app servers' security group is less flexible and scalable than referencing the web servers' security group; it also fails to leverage stateful security group chaining, potentially requiring manual updates if web server IPs change. Option C is wrong because using a single Network ACL for both subnets would apply the same rules to all subnets, violating least-privilege by allowing inbound traffic from the internet to the private subnet and not differentiating between web and app server traffic. Option D is wrong because a Network ACL on the private subnet allowing inbound ports 80 and 443 from the public subnet CIDR is stateless, requiring explicit outbound rules for return traffic, and does not provide the granularity of security group references; it also unnecessarily exposes the private subnet to the entire public subnet CIDR.

467
MCQeasy

A security engineer needs to ensure that all traffic between two VPCs in the same region is encrypted in transit. The VPCs are connected via a VPC peering connection. What should the engineer do to meet this requirement?

A.Set up a VPN connection between the two VPCs and route traffic through it.
B.Configure network ACLs to enforce encryption.
C.No additional configuration needed; VPC peering traffic is automatically encrypted.
D.Use AWS Transit Gateway to connect the VPCs and enable encryption.
AnswerC

AWS encrypts inter-region VPC peering traffic by default.

Why this answer

VPC peering traffic within the same region is automatically encrypted using AWS's physical network encryption. No additional configuration is required. Option A (VPN) adds unnecessary complexity and cost since encryption already exists.

Option B (NACLs) does not encrypt traffic. Option D (Transit Gateway) uses the same underlying encryption, so it does not add extra encryption beyond what VPC peering provides.

468
MCQmedium

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Direct Connect. The network team wants to monitor BGP session status for all Transit Gateway attachments. Which AWS service should be used?

A.AWS Config
B.VPC Flow Logs
C.AWS Transit Gateway Network Manager
D.Amazon CloudWatch with Transit Gateway metrics
AnswerC

Network Manager provides a central dashboard for monitoring BGP sessions and connectivity.

Why this answer

AWS Transit Gateway Network Manager provides monitoring of BGP sessions, network topology, and VPN/Transit Gateway attachment status. Option A is incorrect because AWS Config tracks resource configuration changes but does not monitor real-time BGP session status. Option B is incorrect because VPC Flow Logs capture IP traffic metadata, not routing protocol status.

Option D is incorrect because Amazon CloudWatch with Transit Gateway metrics can monitor some metrics (e.g., bytes in/out) but does not directly provide BGP session status.

469
MCQmedium

A company has a VPC with an IPv6 CIDR and wants to provide internet access to instances in a private subnet using IPv6. Which AWS service should be used?

A.VPC Gateway Endpoint
B.Internet Gateway
C.NAT Gateway
D.Egress-Only Internet Gateway
AnswerD

Egress-only internet gateway provides outbound-only IPv6 access.

Why this answer

An Egress-Only Internet Gateway (EIGW) is the correct AWS service for providing outbound-only IPv6 internet access to instances in a private subnet. Unlike IPv4, IPv6 addresses are globally unique and publicly routable by default, so a NAT-like translation is unnecessary; the EIGW allows outbound traffic while preventing unsolicited inbound connections, aligning with the private subnet's security posture.

Exam trap

The trap here is that candidates confuse the Egress-Only Internet Gateway with a NAT Gateway, mistakenly thinking IPv6 requires address translation, or they select the Internet Gateway without realizing it would expose private instances to inbound IPv6 traffic.

How to eliminate wrong answers

Option A is wrong because a VPC Gateway Endpoint provides private connectivity to AWS services (e.g., S3, DynamoDB) over the AWS network, not internet access. Option B is wrong because an Internet Gateway enables bidirectional IPv6 traffic; attaching it to a private subnet would allow inbound connections from the internet, violating the requirement for a private subnet. Option C is wrong because a NAT Gateway supports only IPv4 traffic; it cannot process IPv6 packets and is irrelevant for IPv6 internet access.

470
MCQhard

A company has a VPC with public and private subnets in two Availability Zones. They have a NAT gateway in each AZ for outbound internet access. They recently added a third AZ and created a new private subnet. Instances in the new private subnet cannot reach the internet. The route table for the new subnet has a default route (0.0.0.0/0) pointing to a NAT gateway in the same AZ. What is the most likely cause?

A.The security group attached to the NAT gateway blocks outbound traffic
B.The route table in the new private subnet does not have a route to the NAT gateway
C.The NAT gateway in the new AZ does not have an Elastic IP address attached
D.The NAT gateway is not in a public subnet in the new AZ
AnswerC

A NAT gateway requires an Elastic IP to function; without it, outbound traffic fails.

Why this answer

A NAT gateway requires an Elastic IP (EIP) address to function for outbound internet traffic. Without an EIP attached, the NAT gateway cannot translate private source IPs to a public IP, so instances in the new private subnet cannot reach the internet even though the route table correctly points to the NAT gateway in the same AZ.

Exam trap

The ANS-C01 exam often tests the misconception that a NAT gateway only needs a route to the internet gateway, but the trap here is that candidates overlook the mandatory Elastic IP attachment, which is a prerequisite for the NAT gateway to function as an internet-facing device.

How to eliminate wrong answers

Option A is wrong because security groups are not attached to NAT gateways; they are attached to ENIs (elastic network interfaces) of instances, and NAT gateways are managed services that do not use security groups—instead, network ACLs on the subnet control traffic. Option B is wrong because the route table in the new private subnet already has a default route (0.0.0.0/0) pointing to the NAT gateway, so the route exists; the issue is not a missing route but the NAT gateway's lack of an EIP. Option D is wrong because while a NAT gateway must reside in a public subnet (with a route to an internet gateway), the question states the NAT gateway is in the same AZ, implying it is in a public subnet; the core problem is the missing EIP, not the subnet type.

471
MCQhard

A company is designing a network for a real-time gaming application that requires low latency and high throughput between game servers in multiple regions. The application uses UDP traffic. Which AWS service should be used to route traffic between regions?

A.AWS Transit Gateway
B.AWS Global Accelerator
C.Amazon CloudFront
D.Amazon Route 53
AnswerB

Supports UDP and TCP, provides anycast IPs.

Why this answer

AWS Global Accelerator uses the Anycast IP address and the AWS global network to route UDP traffic from users to the optimal regional endpoint, minimizing latency and jitter. It is designed for real-time applications like gaming that require low-latency and high-throughput UDP traffic between regions, as it bypasses the public internet and leverages AWS's internal backbone.

Exam trap

The trap here is that candidates often confuse Amazon Route 53's latency-based routing with actual network path optimization, but Route 53 only controls DNS resolution and does not accelerate or route the UDP traffic itself after the initial connection.

How to eliminate wrong answers

Option A is wrong because AWS Transit Gateway is a hub-and-spoke connectivity service for VPC-to-VPC or on-premises routing within a single region, not designed for inter-region traffic optimization or low-latency UDP routing. Option C is wrong because Amazon CloudFront is a content delivery network (CDN) optimized for HTTP/HTTPS traffic and does not support UDP traffic for real-time gaming applications. Option D is wrong because Amazon Route 53 is a DNS service that resolves domain names to IP addresses and can route traffic via policies like latency-based routing, but it does not optimize the network path or provide any acceleration for UDP traffic; it only controls initial DNS resolution.

472
Multi-Selecteasy

A company is designing a highly available architecture for a web application using an Application Load Balancer (ALB) across multiple Availability Zones. Which TWO actions should be taken to ensure high availability?

Select 2 answers
A.Use a Network Load Balancer instead of an ALB.
B.Register EC2 instances in multiple Availability Zones.
C.Place the EC2 instances in a single Availability Zone.
D.Configure the ALB as internal.
E.Configure the ALB as internet-facing.
AnswersB, E

Multi-AZ provides fault tolerance.

Why this answer

Registering EC2 instances in multiple Availability Zones ensures that if one AZ becomes unavailable, the ALB can route traffic to healthy instances in another AZ. This is a fundamental requirement for high availability because the ALB distributes incoming traffic across targets in different AZs, and if all instances are in a single AZ, that AZ becomes a single point of failure.

Exam trap

The ANS-C01 exam often tests the misconception that using a Network Load Balancer instead of an Application Load Balancer improves high availability, but the trap is that high availability depends on distributing targets across multiple AZs, not on the load balancer type, and the question explicitly requires an ALB for Layer 7 features.

473
MCQhard

A company is using AWS Database Migration Service (DMS) to replicate data from an on-premises Oracle database to an Amazon RDS for Oracle instance. The replication is failing intermittently with connection timeouts. The network connectivity uses a Direct Connect private VIF. What should the network team investigate first?

A.The MTU settings on the on-premises router and the AWS Direct Connect interface.
B.The route table of the VPC to ensure it has a route to the on-premises CIDR via the Direct Connect virtual interface.
C.The VPN connection status as a backup path.
D.The security group of the RDS instance to ensure it allows traffic from the on-premises IP range.
AnswerA

MTU mismatch can cause intermittent connectivity issues, especially with DMS.

Why this answer

Correct answer: Option A is correct because MTU mismatch between the on-premises router and AWS Direct Connect interface can cause packet fragmentation or drops, leading to intermittent connection timeouts. The default MTU for Direct Connect is 1500 bytes, but if the on-premises router uses a larger MTU (e.g., 9001 for jumbo frames), packets may be dropped or fragmented, causing timeouts. Option B is incorrect because routing misconfiguration would cause persistent failure, not intermittent.

Option C is incorrect because a VPN is not used as a primary path when Direct Connect is available. Option D is incorrect because security groups apply to traffic within the VPC, not to on-premises traffic over Direct Connect.

474
MCQhard

A company has a VPC with a public subnet and a private subnet. They have a NAT Gateway in the public subnet. Instances in the private subnet need to download patches from the internet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway. However, instances cannot reach the internet. What is a possible cause?

A.The route table for the NAT Gateway's subnet does not have a route to an Internet Gateway.
B.The NAT Gateway is in a private subnet.
C.The network ACL on the private subnet is blocking outbound traffic.
D.The NAT Gateway does not have a security group allowing outbound traffic.
AnswerA

NAT Gateway needs a route to IGW for internet access.

Why this answer

For a NAT Gateway to route traffic to the internet, its subnet must have a route to an Internet Gateway (IGW). The NAT Gateway resides in the public subnet, and the public subnet's route table must include a default route (0.0.0.0/0) pointing to the IGW. Without this route, the NAT Gateway cannot forward traffic from the private subnet to the internet, even though the private subnet's route table correctly points to the NAT Gateway.

Exam trap

AWS often tests the misconception that configuring the private subnet's route table to point to the NAT Gateway is sufficient, while ignoring that the NAT Gateway's own subnet must have a route to the Internet Gateway for outbound connectivity.

How to eliminate wrong answers

Option B is wrong because the NAT Gateway is explicitly stated to be in the public subnet, and placing it in a private subnet would prevent it from reaching the internet, but that is not the scenario here. Option C is wrong because network ACLs are stateless and, by default, allow all outbound traffic; unless explicitly modified to block outbound traffic, they would not prevent internet access. Option D is wrong because NAT Gateways do not have security groups; they are managed by AWS and cannot be associated with security groups, so this is not a possible cause.

475
MCQeasy

A company wants to provide internet access to instances in a private subnet using a NAT gateway. The NAT gateway is deployed in a public subnet with an Elastic IP. The private subnet route table has a default route pointing to the NAT gateway. However, instances in the private subnet cannot access the internet. What is the most likely cause?

A.The public subnet route table does not have a route to the internet gateway.
B.The security group assigned to the NAT gateway blocks outbound traffic.
C.The private subnet route table has a route to the internet gateway instead of the NAT gateway.
D.The NAT gateway does not have an Elastic IP associated.
AnswerA

NAT gateway needs internet gateway route in its subnet.

Why this answer

The NAT gateway is deployed in a public subnet, but for it to route traffic to the internet, the public subnet's route table must have a default route (0.0.0.0/0) pointing to an internet gateway (IGW). Without this route, the NAT gateway cannot forward traffic from the private subnet to the internet, even though the private subnet's route table correctly points to the NAT gateway. This is the most likely cause because the NAT gateway itself needs internet access via the IGW to translate and forward traffic.

Exam trap

AWS often tests the misconception that a NAT gateway automatically has internet access simply because it is in a public subnet, but the critical missing piece is the explicit route to the internet gateway in that subnet's route table.

How to eliminate wrong answers

Option B is wrong because security groups are not assigned to NAT gateways; NAT gateways are controlled by network ACLs, not security groups, and security groups cannot be attached to NAT gateways. Option C is wrong because if the private subnet route table had a route to the internet gateway, instances would attempt direct internet access, which would fail since they are in a private subnet without a public IP, but the question states the route points to the NAT gateway, so this is not the issue. Option D is wrong because the question explicitly states the NAT gateway has an Elastic IP associated, so this cannot be the cause of the failure.

476
MCQhard

A company runs a web application on EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application must only accept traffic from known corporate IP addresses, but the company also needs to allow healthy traffic from AWS health checkers. Which architecture meets these requirements securely?

A.Configure the Application Load Balancer's security group to allow inbound from corporate IPs, and the EC2 instances' security group to allow inbound from the ALB's security group.
B.Create two target groups: one for corporate traffic and one for health check traffic, each with different security groups.
C.Use AWS WAF on the ALB to create an IP set containing corporate IPs, and allow all traffic from ALB to instances.
D.Use a network ACL on the VPC subnet to allow inbound traffic from corporate IPs and AWS health checker IP ranges.
AnswerA

This ensures that only traffic through the ALB (including health checks) reaches the instances, and the ALB only accepts corporate IP traffic.

Why this answer

The correct approach is to use security groups. The ALB security group should allow inbound from corporate IPs, and the EC2 instances' security group should allow inbound only from the ALB's security group. This ensures that traffic from the internet first passes through the ALB, which performs health checks using its private IPs (which are part of the ALB's security group).

Option B is incorrect because having multiple target groups does not control traffic filtering. Option C (WAF) can filter by IP but still requires allowing health check traffic, and it adds unnecessary complexity. Option D (NACL) is stateless and would require complex rules to allow return traffic and health checks, making it less secure and manageable.

477
MCQeasy

A company wants to connect an on-premises data center to AWS using a dedicated private connection that does not traverse the internet. Which AWS service should they use?

A.AWS Transit Gateway
B.AWS Site-to-Site VPN
C.AWS Direct Connect
D.VPC Peering
AnswerC

Dedicated private connection.

Why this answer

AWS Direct Connect is the correct choice because it provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the internet entirely. This service uses industry-standard 802.1Q VLANs to create a private virtual interface (VIF) that connects directly to a virtual private gateway or AWS Transit Gateway, ensuring low latency, consistent bandwidth, and compliance with data sovereignty requirements.

Exam trap

AWS often tests the misconception that AWS Transit Gateway itself provides a dedicated private connection, but it is a routing service that requires an underlying physical or virtual link to extend to on-premises networks.

How to eliminate wrong answers

Option A is wrong because AWS Transit Gateway is a network transit hub that interconnects VPCs and on-premises networks, but it is not a dedicated private connection service; it requires an underlying connection like Direct Connect or VPN to extend to on-premises. Option B is wrong because AWS Site-to-Site VPN creates an encrypted tunnel over the public internet, which does not meet the requirement of a dedicated private connection that does not traverse the internet. Option D is wrong because VPC Peering connects VPCs within AWS using the AWS global network, but it cannot connect an on-premises data center to AWS.

478
Multi-Selectmedium

A security team needs to implement a solution to detect and alert on suspicious network traffic within a VPC. The solution should analyze VPC Flow Logs and generate findings for potential threats. Which THREE AWS services can be used together to achieve this?

Select 3 answers
A.VPC Flow Logs
B.Amazon Detective
C.Amazon GuardDuty
D.AWS CloudTrail
E.AWS Config
AnswersA, B, C

Captures network traffic metadata.

Why this answer

The correct combination is A (VPC Flow Logs) as the data source, B (Amazon Detective) for deep investigation of findings, and C (Amazon GuardDuty) which automatically analyzes VPC Flow Logs for threat detection. Options D (AWS CloudTrail) is incorrect because it logs API calls, not network traffic. Option E (AWS Config) is incorrect as it tracks resource configuration changes.

479
Multi-Selectmedium

A network engineer must design a solution to monitor and troubleshoot connectivity from an on-premises data center to a VPC over an AWS Direct Connect connection. The solution must provide visibility into BGP routing, packet loss, and latency. Which TWO services or features should the engineer use? (Choose two.)

Select 2 answers
A.Amazon CloudWatch Logs for Direct Connect
B.AWS CloudTrail
C.Amazon CloudWatch metrics for Direct Connect
D.VPC Flow Logs
E.AWS X-Ray
AnswersA, C

Can ingest Direct Connect logs for monitoring.

Why this answer

Amazon CloudWatch metrics for Direct Connect can monitor BGP session state, packet loss, and latency. AWS CloudTrail logs API calls but not network performance. VPC Flow Logs capture IP traffic metadata but not BGP details or latency.

AWS X-Ray is for application tracing. Amazon Inspector is for security assessments.

480
Multi-Selectmedium

A company has a VPC with an internet gateway and a NAT Gateway. The private subnet route table has a default route to the NAT Gateway. The company wants to enable instances in the private subnet to access an S3 bucket in the same region without traversing the internet. Which TWO actions should the company take?

Select 2 answers
A.Remove the default route to the NAT Gateway from the private subnet route table.
B.Add a route to the S3 prefix list via the gateway endpoint in the private subnet route table.
C.Create a gateway VPC endpoint for S3.
D.Add a route to the S3 prefix list via the NAT Gateway in the private subnet route table.
E.Create an interface VPC endpoint for S3.
AnswersB, C

This enables private access.

Why this answer

Adding a route to the S3 prefix list via the gateway endpoint directs traffic destined for S3 through the VPC endpoint, keeping it within the AWS network. Option C is correct because a gateway VPC endpoint for S3 provides a private, scalable connection to S3 without requiring internet access or a NAT Gateway. Together, these actions allow private subnet instances to access S3 privately and efficiently.

Exam trap

The trap here is that candidates often confuse gateway endpoints with interface endpoints, incorrectly assuming S3 requires an interface endpoint, or they think the NAT Gateway must be removed entirely, when in fact the NAT Gateway should remain for other outbound traffic and only the S3-specific route needs to be added via the gateway endpoint.

481
MCQmedium

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The company wants to centralize network security by inspecting all traffic between VPCs and between VPCs and on-premises. Which architecture should be used?

A.Attach all VPCs to a Transit Gateway and use route tables to send traffic through a firewall appliance in one VPC.
B.Use VPN connections between all VPCs and on-premises.
C.Use VPC peering between all VPCs and configure security groups.
D.Use Network Load Balancer to distribute traffic across VPCs.
AnswerA

Transit Gateway route tables can direct traffic to a inspection VPC.

Why this answer

AWS Transit Gateway supports centralized routing through a shared services VPC. By attaching all VPCs and VPN connections to the Transit Gateway and configuring route tables to point default or inter-VPC routes to a network firewall appliance (e.g., a third-party firewall or AWS Network Firewall) in a dedicated inspection VPC, all traffic between VPCs and between VPCs and on-premises can be forced through the firewall for inspection. This architecture leverages Transit Gateway route tables and blackhole routes to enforce traffic steering without requiring complex peering or VPN meshes.

Exam trap

The ANS-C01 exam often tests the misconception that VPC peering or VPN meshes can achieve centralized inspection, but the trap is that only Transit Gateway with a dedicated inspection VPC provides transitive routing and a single point of policy enforcement without requiring a full mesh of connections.

How to eliminate wrong answers

Option B is wrong because using VPN connections between all VPCs and on-premises creates a full-mesh VPN topology that does not centralize inspection; each VPN tunnel would require separate routing and firewall policies, and traffic between VPCs would not be inspected unless routed through an additional appliance. Option C is wrong because VPC peering does not support transitive routing; to inspect traffic between all VPCs, you would need a full mesh of peering connections and manual routing through a firewall in each VPC, which is unscalable and does not centralize inspection. Option D is wrong because a Network Load Balancer distributes traffic at Layer 4 and does not provide routing or inspection capabilities; it cannot force traffic through a firewall or make forwarding decisions between VPCs or to on-premises.

482
MCQhard

Refer to the exhibit. A company has created a VPC endpoint for S3. However, an EC2 instance in the subnet associated with the route table cannot access S3 via the endpoint. The route table has a route to the endpoint. What is the most likely cause?

A.The endpoint is in 'pending' state
B.The route table is not associated with the subnet
C.Private DNS is not enabled
D.The security group is blocking traffic
AnswerC

Without Private DNS, the instance does not resolve S3 to the endpoint IP.

Why this answer

The endpoint policy is set to Allow all, which is fine. However, the PrivateDnsEnabled is false, meaning that DNS resolution for S3 endpoints does not resolve to the endpoint IP. To use the endpoint, either enable Private DNS or use the endpoint-specific DNS name.

Option A is wrong because the endpoint state is 'available'. Option B is wrong because the route table is associated. Option D is wrong because the security group is not specified (empty), but default SG allows all outbound traffic.

483
MCQhard

Refer to the exhibit. A network engineer is creating an IAM policy for a junior engineer who needs to set up a VPC with public and private subnets and an internet gateway. The junior engineer reports that they cannot create a VPC peering connection. Based on the policy, what is the most likely reason?

A.The policy has an explicit Deny statement for ec2:CreateVpcPeeringConnection.
B.The policy allows ec2:CreateVpc which implicitly denies peering.
C.The policy requires multi-factor authentication to create VPC peering connections.
D.The policy does not allow the ec2:CreateVpcPeeringConnection action.
AnswerA

The explicit Deny overrides any Allow and prevents the action.

Why this answer

The policy includes an explicit Deny statement for the ec2:CreateVpcPeeringConnection action. In IAM, an explicit Deny overrides any Allow, so even though the policy allows other VPC-related actions, the Deny prevents the junior engineer from creating VPC peering connections. Therefore, the most likely reason is that the policy has an explicit Deny for that action, which corresponds to option A.

Option B is incorrect because the policy does allow ec2:CreateVpc and does not implicitly deny peering; an explicit Deny is required. Option C is irrelevant because the policy does not mention MFA. Option D is incorrect because the policy does not allow the action, but the explicit Deny is the stronger reason and is listed as option A.

484
MCQeasy

A company wants to securely connect two VPCs in the same region. The VPCs must be able to communicate using private IP addresses, and connectivity should be highly available. Which solution meets these requirements?

A.Set up a VPN connection between the two VPCs using virtual private gateways.
B.Create an inter-region VPC peering connection.
C.Create a VPC peering connection between the two VPCs.
D.Use an AWS Transit Gateway to connect the two VPCs.
AnswerC

VPC peering provides low-latency, private connectivity between VPCs in the same region.

Why this answer

A VPC peering connection allows two VPCs in the same region to communicate using private IPv4 or IPv6 addresses as if they were on the same network, with no single point of failure. It is highly available by design since traffic flows directly between the VPCs using the AWS global network infrastructure, without any intermediate devices or bandwidth limits.

Exam trap

AWS often tests the misconception that a VPN connection is required for private IP communication between VPCs, but VPC peering provides direct, private, and highly available connectivity without the overhead of VPN tunnels.

How to eliminate wrong answers

Option A is wrong because a VPN connection between two VPCs using virtual private gateways introduces a single point of failure (the VPN tunnel endpoints) unless multiple tunnels are configured, and it adds complexity and latency compared to a native VPC peering solution. Option B is wrong because an inter-region VPC peering connection is used for VPCs in different AWS regions, not for VPCs in the same region, and the question specifies same-region connectivity. Option D is wrong because while an AWS Transit Gateway can connect two VPCs, it introduces an additional cost and a central hub that, although highly available, is unnecessary for a simple two-VPC scenario and adds complexity beyond the requirements.

485
MCQhard

A company has a VPC with public and private subnets. The private subnets need to access the internet through a NAT gateway. The security team wants to ensure that traffic from the private subnets cannot bypass the NAT gateway. Which configuration should be used?

A.Deploy a forward proxy in a public subnet and configure the private subnets to use it
B.Use an egress-only internet gateway for the private subnets
C.Add a route in the private subnet route table with destination 0.0.0.0/0 pointing to the NAT gateway
D.Attach a security group to the NAT gateway that only allows outbound traffic
AnswerC

This forces all outbound traffic to go through the NAT gateway.

Why this answer

A route table with a default route (0.0.0.0/0) pointing to the NAT gateway ensures all outbound traffic from private subnets goes through the NAT gateway, preventing bypass. Option A is wrong because a forward proxy in a public subnet would still require routing and does not enforce the NAT gateway path. Option B is wrong because an egress-only internet gateway is for IPv6 only.

Option D is wrong because a security group on the NAT gateway controls allowed traffic but does not enforce routing.

486
Multi-Selectmedium

A company wants to design a multi-region active-active architecture with Amazon Route 53 latency-based routing and failover using health checks. Which TWO configurations are necessary? (Choose two.)

Select 2 answers
A.Use geolocation routing to direct users to the nearest region
B.Assign a weight to each record for traffic distribution
C.Configure a latency alias record for each region's resource
D.Create a health check for each resource and associate it with the record
E.Set the failover record type to 'Active-Active'
AnswersC, D

Latency-based routing uses latency alias records.

Why this answer

Latency-based routing in Route 53 uses alias records to route traffic based on the lowest latency for the end user. Configuring a latency alias record for each regional resource (e.g., an Application Load Balancer) allows Route 53 to respond with the IP of the resource that provides the best latency. Option D is correct because health checks must be associated with each latency record to enable failover; if a resource fails its health check, Route 53 removes it from the pool of healthy endpoints, ensuring traffic is only routed to healthy regions.

Exam trap

The trap here is that candidates often confuse latency-based routing with geolocation routing, or incorrectly assume that a failover record type must be explicitly set to 'Active-Active', when in fact the active-active behavior is achieved by combining latency-based routing with health checks, not by a specific record type.

487
MCQmedium

A company is designing a hybrid network architecture using AWS Direct Connect. They have a single Direct Connect connection with a private virtual interface (VIF) to a VPC in us-east-1. The on-premises network uses BGP to advertise a prefix (10.0.0.0/8) to AWS. The VPC has a CIDR of 10.1.0.0/16. The company wants to add a second VPC (10.2.0.0/16) in the same region and allow on-premises to communicate with both VPCs. They plan to use a Transit Gateway to connect the VPCs and the Direct Connect gateway. The Direct Connect gateway is associated with the Transit Gateway. The on-premises router is advertising 10.0.0.0/8. After configuration, the on-premises network can communicate with 10.1.0.0/16 but not with 10.2.0.0/16. The network engineer verifies that the Transit Gateway route table has routes for both VPC attachments and that the Direct Connect gateway is associated with the Transit Gateway. What is the MOST likely issue?

A.The Direct Connect gateway is not associated with the Transit Gateway route table that contains the 10.2.0.0/16 route
B.The Transit Gateway route table does not have a route for 10.2.0.0/16
C.The private virtual interface is not configured to support multiple VPCs
D.The on-premises router is not advertising the 10.2.0.0/16 prefix
AnswerA

If the Direct Connect gateway attachment is in a different route table, it won't propagate the VPC CIDR to on-premises.

Why this answer

When using a Direct Connect gateway with a Transit Gateway, the Direct Connect gateway propagates routes to the Transit Gateway. The Transit Gateway route table must have a route for the on-premises prefix (10.0.0.0/8) pointing to the Direct Connect gateway attachment. Also, the Transit Gateway must propagate the VPC CIDRs to the Direct Connect gateway so that on-premises can learn them.

The issue is likely that the 10.2.0.0/16 route is not being propagated to the Direct Connect gateway. This can happen if the Transit Gateway route table does not have the VPC attachment associated or if the route propagation is disabled for that VPC attachment. The engineer verified routes in the Transit Gateway route table, so the issue might be that the Direct Connect gateway is not receiving the route for 10.2.0.0/16.

Typically, the Transit Gateway automatically propagates routes from attachments to the Direct Connect gateway if the route table is associated. However, if the VPC attachment is not associated with the same route table as the Direct Connect gateway attachment, propagation may not happen. The most likely fix is to ensure that both VPC attachments and the Direct Connect gateway attachment are in the same Transit Gateway route table.

488
Multi-Selectmedium

A company is designing a network for a multi-account AWS environment using AWS Organizations. They need to centralize network management and enable VPC connectivity across accounts. Which THREE services should they consider? (Choose THREE.)

Select 3 answers
A.AWS Resource Access Manager
B.AWS CloudFormation StackSets
C.VPC Peering
D.AWS Direct Connect
E.AWS Transit Gateway
AnswersA, B, E

Shares Transit Gateway and other resources across accounts.

Why this answer

AWS Resource Access Manager (RAM) is correct because it enables you to share centrally managed resources, such as Transit Gateways and VPC subnets, across multiple AWS accounts within an AWS Organization. This eliminates the need to create duplicate resources in each account and allows for centralized network management without requiring cross-account IAM roles or complex peering configurations.

Exam trap

The trap here is that candidates often select VPC Peering because it is a familiar, simple connectivity option, but they overlook that it lacks transitive routing and centralized management, making it unsuitable for a multi-account architecture where AWS Transit Gateway is the correct scalable solution.

489
MCQhard

A company uses AWS Shield Advanced to protect its web application from DDoS attacks. The application is fronted by Amazon CloudFront and an Application Load Balancer. The security team wants to receive notifications when a DDoS attack is detected. Which AWS service should be used to receive these notifications?

A.AWS Config
B.Amazon CloudWatch
C.VPC Flow Logs
D.Amazon GuardDuty
AnswerB

Shield Advanced publishes metrics to CloudWatch, and CloudWatch Alarms can be set up to send notifications.

Why this answer

AWS Shield Advanced integrates with Amazon CloudWatch to emit DDoS detection metrics. You can create a CloudWatch alarm based on these metrics (e.g., DDoSDetected) to send notifications via SNS. Option A (AWS Config) is for resource configuration auditing, not DDoS notifications.

Option C (VPC Flow Logs) captures network traffic metadata but does not provide Shield-specific alerts. Option D (Amazon GuardDuty) is a threat detection service, but it does not directly provide Shield Advanced event notifications.

490
MCQmedium

A network engineer is troubleshooting connectivity issues between two VPCs that are peered. The VPCs are in the same region and the peering connection is in the 'active' state. Security groups in both VPCs allow all traffic. However, instances in VPC A cannot reach instances in VPC B. What is the most likely cause?

A.Security groups are blocking traffic between the VPCs
B.The VPC peering connection is in the 'pending-acceptance' state
C.Route tables in one or both VPCs do not have routes pointing to the peering connection
D.Network ACLs are blocking traffic between the VPCs
AnswerC

Without proper routes, traffic is not directed to the peering connection.

Why this answer

VPC peering requires route table entries in both VPCs to direct traffic to the peering connection. Option C is correct because missing routes are a common issue. Option A is wrong because security groups allow all traffic.

Option B is wrong because the peering connection is active. Option D is wrong because network ACLs are not mentioned as blocking, and they are stateless but the issue is more likely routing.

491
Multi-Selecteasy

A company has a VPC with public and private subnets. They want to allow instances in the private subnet to download software updates from the internet while blocking inbound internet traffic. Which TWO components are required? (Select TWO.)

Select 2 answers
A.A Virtual Private Gateway.
B.An Internet Gateway attached to the VPC.
C.A VPC Peering connection.
D.A NAT Gateway in a public subnet.
E.A route in the private subnet's route table pointing to the NAT Gateway.
AnswersD, E

NAT Gateway enables outbound internet access.

Why this answer

To allow instances in a private subnet to download updates from the internet (outbound only), a NAT Gateway in a public subnet (D) is required, along with a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT Gateway (E). An Internet Gateway (B) alone would allow inbound traffic, which is not desired, and it is not used for private subnets. A Virtual Private Gateway (A) is for VPN connections to on-premises, not for internet access.

VPC Peering (C) connects VPCs, not to the internet.

492
MCQhard

A company has a Direct Connect connection with a private VIF to a VPC in us-east-1. The VPC has two subnets: a public subnet and a private subnet. The public subnet has an internet gateway attached. The private subnet has a NAT gateway. The company's on-premises network uses the 10.0.0.0/8 IP range. The VPC CIDR is 10.1.0.0/16. The on-premises router is advertising 10.1.0.0/16 over BGP to the Direct Connect router. The company needs EC2 instances in the private subnet to initiate outbound connections to the internet for updates. The NAT gateway is in the public subnet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT gateway. However, the on-premises network team reports that they can ping the private IP of the NAT gateway (10.1.0.10) but not the private IP of an EC2 instance in the private subnet (10.1.1.50). The EC2 instance's security group allows ICMP from the on-premises IP range. The VPC's main route table has a route for 10.0.0.0/8 pointing to the virtual private gateway. The VPC is attached to a virtual private gateway. What is the most likely cause?

A.The virtual private gateway is not attached to the VPC.
B.The NAT gateway is not reachable from the on-premises network.
C.The security group on the EC2 instance is blocking ICMP from the on-premises IP range.
D.The private subnet's route table does not have a route for the on-premises CIDR (10.0.0.0/8) pointing to the virtual private gateway.
AnswerD

Without a route for the on-premises CIDR in the private subnet's route table, traffic from on-premises to the EC2 instance is not forwarded to the VGW.

Why this answer

The on-premises network can ping the NAT gateway because the NAT gateway is in the public subnet, and the route table for the public subnet likely has a route to the virtual private gateway for the on-premises CIDR. However, the EC2 instance is in the private subnet, and the private subnet's route table does not have a route for the on-premises CIDR (10.0.0.0/8) pointing to the virtual private gateway. The VPC's main route table has such a route, but the private subnet is not using the main route table; it likely has a custom route table that only has the default route to the NAT gateway.

Therefore, traffic from on-premises to the EC2 instance's private IP is not routed to the virtual private gateway. Option D is correct. Option A is incorrect because the security group allows ICMP.

Option B is incorrect because the NAT gateway is reachable. Option C is incorrect because the virtual private gateway is attached.

493
MCQmedium

A company uses AWS Network Firewall to inspect traffic between VPCs in a transit gateway setup. They have a rule group that allows HTTP and HTTPS traffic to a web server in a production VPC. Recently, the security team added a new Suricata IPS rule to block traffic from a specific IP address. After deploying the updated rule group, they notice that all traffic to the web server is being dropped, even from allowed IPs. The firewall logs show the new rule is triggering for all traffic, not just the specific IP. What is the most likely cause?

A.The web server's security group is blocking traffic from the firewall's IP range after the firewall adds its source IP.
B.The new Suricata rule uses the 'drop' action instead of 'reject', causing all packets to be dropped.
C.The new rule is placed before the allow rules in the rule group, and due to the order of evaluation, the drop rule matches first and drops all traffic because the rule's source IP is set to 'any' instead of the specific IP.
D.The rule group is attached to the firewall policy in the wrong direction (e.g., outbound instead of inbound).
AnswerC

In Suricata rules, order matters. If the new rule has an incorrect source IP (e.g., using 'any' or a broad range), it will match all traffic and drop it before allow rules are evaluated. The rule should have the specific IP to block.

494
MCQmedium

A company is designing a hybrid network with AWS Direct Connect and AWS Site-to-Site VPN as backup. The primary Direct Connect connection uses a private VIF to a VPC. If the Direct Connect fails, traffic should automatically fail over to the VPN connection. What is the MOST reliable way to achieve this failover?

A.Use BGP on Direct Connect and static routes on the VPN connection, with a higher metric for the VPN static route.
B.Configure static routes on the customer gateway device with a lower metric for the Direct Connect interface.
C.Use BGP on both connections and prepend AS paths on the VPN routes to make them less preferred.
D.Use BGP on both connections and set a lower local preference on the Direct Connect routes.
AnswerC

Incorrect. Prepending AS paths on Direct Connect routes makes them less preferred, causing VPN to be used as primary, which contradicts the requirement that Direct Connect be primary.

Why this answer

Using BGP on both connections allows for dynamic routing and automatic failover. By prepending AS paths on the VPN routes, you make the VPN path less preferred, ensuring that Direct Connect is the primary path. If Direct Connect fails, the BGP session drops and the VPN routes become active.

This method provides symmetric failover in both directions and is recommended by AWS.

Exam trap

A common mistake is to prepend AS paths on the primary Direct Connect connection, which would make it less preferred and cause the VPN to become the primary path. Always prepend on the backup connection to deprioritize it.

How to eliminate wrong answers

Option A is wrong because mixing BGP on Direct Connect with static routes on the VPN creates an asymmetric routing control plane; static routes cannot dynamically react to Direct Connect failure, and a higher metric on the static route would actually make the VPN less preferred, not a backup. Option B is wrong because configuring static routes on the customer gateway device with a lower metric for Direct Connect does not provide dynamic failover; if the Direct Connect link fails, the static route remains in the routing table until manually removed or a connectivity check fails, leading to blackholing. Option D is wrong because setting a lower local preference on Direct Connect routes would make them less preferred than VPN routes, causing traffic to use the VPN as the primary path, which is the opposite of the desired design where Direct Connect is primary.

495
MCQeasy

A company wants to connect an Amazon RDS for SQL Server database instance in a VPC to an on-premises application. The connection must be encrypted in transit and should traverse the AWS backbone network. Which solution meets these requirements?

A.Set up an AWS Client VPN endpoint and connect the on-premises application
B.Create a VPC endpoint for RDS and connect on-premises to the endpoint
C.Establish an AWS Site-to-Site VPN connection over AWS Direct Connect
D.Configure ClassicLink to connect the on-premises network to the VPC
AnswerC

A VPN over Direct Connect provides encrypted IPsec tunnels over the private AWS backbone.

Why this answer

An AWS Site-to-Site VPN connection over AWS Direct Connect provides an encrypted IPSec tunnel that traverses the AWS backbone network, ensuring encryption in transit and meeting the requirement to keep traffic off the public internet. Direct Connect provides a private physical connection to AWS, and the Site-to-Site VPN adds encryption over that link, which is ideal for connecting an on-premises application to an RDS for SQL Server instance in a VPC.

Exam trap

The trap here is that candidates may think Direct Connect alone provides encryption, but it does not; the question explicitly requires encryption in transit, so a Site-to-Site VPN must be layered over Direct Connect, not just Direct Connect or a VPN alone.

How to eliminate wrong answers

Option A is wrong because AWS Client VPN is a remote access VPN solution for individual clients (e.g., laptops) and does not provide a site-to-site connection for an on-premises application; it also does not inherently traverse the AWS backbone network. Option B is wrong because a VPC endpoint for RDS (Gateway or Interface endpoint) is used for private connectivity within AWS or from a VPC, but it cannot be directly connected from on-premises networks without additional VPN or Direct Connect; it does not provide a site-to-site encrypted tunnel. Option D is wrong because ClassicLink is a legacy feature for linking EC2-Classic instances to a VPC, not for connecting on-premises networks, and it does not support encryption in transit or traverse the AWS backbone.

496
MCQmedium

A company has a VPC peered with another VPC in a different account. They want to ensure that only specific ports are allowed from the peered VPC to their application servers. Which configuration should they use?

A.Use a VPC peering route table to restrict traffic
B.Configure a Security Group rule with the CIDR of the peered VPC
C.Configure a Security Group rule with the security group ID of the peered VPC
D.Configure a Network ACL rule with the CIDR of the peered VPC
AnswerC

Security Groups can reference security groups in peered VPCs for fine-grained access.

Why this answer

You can reference a security group from a peered VPC as the source in a security group rule, allowing fine-grained control based on the security group ID rather than CIDR blocks. Option A is wrong because VPC peering route tables control routing, not traffic filtering. Option B is wrong because security groups can reference the CIDR of a peered VPC, but that does not allow specifying individual ports from the peered VPC's resources; it's less specific than referencing the security group ID.

Option D is wrong because Network ACLs cannot reference security groups; they only allow CIDR-based rules, and they are stateless.

497
MCQeasy

A company wants to encrypt data at rest in Amazon S3 using server-side encryption. They require that the encryption keys are managed by AWS and rotated automatically. Which encryption option should they choose?

A.SSE-C
B.Client-side encryption
C.SSE-S3
D.SSE-KMS
AnswerC

SSE-S3 uses Amazon S3-managed keys with automatic rotation.

Why this answer

SSE-S3 (Option C) is the correct choice because it uses server-side encryption with Amazon S3-managed keys that are automatically rotated. SSE-C (Option A) requires the customer to provide and manage their own encryption keys. SSE-KMS (Option D) uses AWS Key Management Service (KMS) keys, which are managed by AWS but do not automatically rotate unless you enable automatic key rotation.

Client-side encryption (Option B) is not a form of server-side encryption, as the data is encrypted before being sent to S3.

498
Multi-Selectmedium

A company uses AWS WAF to protect their web application. They have a rate-based rule that blocks IPs after 100 requests in 5 minutes. However, they notice that legitimate users behind a corporate NAT gateway are being blocked because the aggregate traffic from the NAT IP exceeds the threshold. Which TWO actions would resolve this issue without compromising security? (Choose TWO.)

Select 2 answers
A.Implement a custom WAF rule to allow traffic from the corporate IP range.
B.Change the rate-based rule to count instead of block.
C.Use AWS Shield Advanced for automatic mitigation.
D.Use a scope-down statement to exclude traffic from the corporate NAT IP range.
E.Increase the rate limit threshold to a higher value.
AnswersD, E

Excluding the known corporate IP range prevents blocking legitimate users.

499
MCQeasy

A company needs to resolve DNS names within a VPC using a custom domain. Which AWS service should be used?

A.Elastic Load Balancing
B.Amazon CloudFront
C.Amazon Route 53 Resolver
D.AWS WAF
AnswerC

DNS resolution for VPC.

Why this answer

Amazon Route 53 Resolver provides recursive DNS resolution for VPCs and supports custom domain names via inbound and outbound endpoints. It integrates with on-premises DNS through conditional forwarding, enabling resolution of custom private domains within the VPC without exposing them to the internet.

Exam trap

AWS often tests the misconception that Route 53 public hosted zones or CloudFront can resolve custom VPC DNS names, but only Route 53 Resolver with private hosted zones or forwarding rules handles custom domain resolution within a VPC.

How to eliminate wrong answers

Option A is wrong because Elastic Load Balancing is a traffic distribution service for load balancing incoming requests, not a DNS resolution service; it does not resolve custom domain names within a VPC. Option B is wrong because Amazon CloudFront is a content delivery network (CDN) that caches and delivers content at edge locations, not a DNS resolver for VPC internal name resolution. Option D is wrong because AWS WAF is a web application firewall that protects against common web exploits, not a DNS service; it cannot resolve custom domain names.

500
Multi-Selecteasy

A company is deploying an application across multiple VPCs using AWS Transit Gateway. They need to ensure that only specific VPCs can communicate with each other. Which TWO methods can be used to isolate traffic?

Select 2 answers
A.Use Transit Gateway Network Manager to create a network segmentation design.
B.Create separate Transit Gateway route tables for different groups of VPCs and associate the VPC attachments accordingly.
C.Configure network ACLs on the VPC subnets to allow or deny traffic.
D.Use security groups on the Transit Gateway attachments.
E.Implement VPC endpoints for inter-VPC communication.
AnswersA, B

Network Manager helps visualize and manage segmentation.

Why this answer

Transit Gateway Network Manager provides a centralized view and allows you to create network segmentation designs by grouping resources and defining routing policies, which helps isolate traffic between specific VPCs. Option B is correct because by creating separate Transit Gateway route tables for different groups of VPCs and associating VPC attachments accordingly, you control which VPCs can route traffic to each other, effectively isolating traffic between groups.

Exam trap

The trap here is that candidates often confuse network ACLs or security groups as mechanisms for inter-VPC traffic control, but these operate within a VPC and cannot be applied to Transit Gateway attachments, which require route table segmentation for isolation.

501
Multi-Selectmedium

Which TWO of the following are valid methods to connect multiple VPCs in the same AWS region using AWS native services? (Choose two.)

Select 2 answers
A.Software VPN appliance
B.VPC peering
C.AWS Direct Connect
D.Amazon ClassicLink
E.AWS Transit Gateway
AnswersB, E

Native service for VPC-to-VPC connectivity.

Why this answer

VPC peering (B) is a valid AWS-native method to connect multiple VPCs in the same region, using the AWS backbone to route traffic between VPCs via private IPv4 or IPv6 addresses with no single point of failure or bandwidth bottleneck. AWS Transit Gateway (E) is also a native service that acts as a hub-and-spoke router, enabling transitive connectivity between thousands of VPCs and on-premises networks using a single gateway, supporting both same-region and inter-region peering attachments.

Exam trap

The ANS-C01 exam often tests the misconception that AWS Direct Connect can directly interconnect VPCs, but it is a physical connection to on-premises only, not a VPC-to-VPC connectivity method.

502
MCQmedium

A company uses AWS Direct Connect with a private VIF to connect to a VPC. The VPC has a virtual private gateway (VGW). The on-premises network uses BGP to exchange routes with the VGW. The company wants to route traffic from the VPC to an on-premises subnet 192.168.1.0/24. The on-premises router advertises 192.168.1.0/24 over BGP. However, instances in the VPC cannot reach that subnet. The VPC route table has the local route and a route to the VGW for 0.0.0.0/0. What is the most likely cause?

A.BGP route propagation is disabled on the VPC route table
B.The 192.168.1.0/24 subnet overlaps with the VPC CIDR, causing the local route to take precedence
C.The VPC route table does not have a specific route for 192.168.1.0/24 pointing to the virtual private gateway
D.The Direct Connect virtual interface does not have the allowed prefixes configured
AnswerB

Local routes have higher priority than propagated routes.

Why this answer

If the on-premises subnet 192.168.1.0/24 overlaps with the VPC CIDR (e.g., VPC CIDR 192.168.0.0/16), the VPC's local route takes precedence over any propagated BGP routes. Traffic destined for 192.168.1.0/24 stays within the VPC and never reaches the virtual private gateway, even though the on-premises router is advertising the route. Option A is incorrect because BGP route propagation is enabled by default for Direct Connect private VIFs, and even if disabled, a static route to the VGW would be needed.

Option C is incorrect because if the subnet overlaps, a specific route to the VGW would be ignored due to the local route's higher priority. Option D is incorrect because allowed prefixes are configured on the Direct Connect gateway, not the VIF, and the route is being advertised successfully.

503
MCQhard

A company has a VPC with public and private subnets in two Availability Zones. The private subnets host EC2 instances that need to access the internet for software updates but must not be accessible from the internet. Which combination of resources meets these requirements with the least operational overhead?

A.A VPC endpoint for Amazon S3 in each private subnet
B.A NAT Gateway in each public subnet, with a route in the private route tables pointing to the NAT Gateway
C.A NAT instance in each public subnet, with a route in the private route tables pointing to the NAT instance
D.An Internet Gateway attached to the VPC with a route in the private route tables pointing to the Internet Gateway
AnswerB

NAT Gateway is managed and provides outbound internet access.

Why this answer

A NAT Gateway in each public subnet provides outbound-only internet access for instances in private subnets, with no inbound accessibility from the internet. This solution requires minimal operational overhead because NAT Gateways are fully managed by AWS, automatically handle failover across Availability Zones, and scale up to 45 Gbps without manual intervention. The private route table simply needs a default route (0.0.0.0/0) pointing to the NAT Gateway, which forwards traffic to the Internet Gateway attached to the VPC.

Exam trap

The ANS-C01 exam often tests the misconception that a VPC endpoint can replace a NAT Gateway for general internet access, but VPC endpoints only work for specific AWS services (like S3 or DynamoDB) and cannot reach arbitrary internet hosts for software updates.

How to eliminate wrong answers

Option A is wrong because a VPC endpoint for Amazon S3 only provides private connectivity to S3, not general internet access for software updates from arbitrary internet hosts. Option C is wrong because a NAT instance is a self-managed EC2 instance that requires manual configuration, patching, and failover handling, resulting in higher operational overhead compared to a managed NAT Gateway. Option D is wrong because placing a route to the Internet Gateway directly in private subnets would make those instances publicly accessible from the internet, violating the requirement that they must not be accessible from the internet.

504
MCQmedium

A security team has attached the above IAM policy to a user. The user tries to add an inbound rule to a security group that allows traffic from 0.0.0.0/0. The request is denied. However, the user is able to add a rule allowing traffic from 203.0.113.10. Which statement explains this behavior?

A.The Deny statement incorrectly uses the condition ec2:AuthorizeSecurityGroupIngress, which is not a valid condition key, so the Deny is ignored.
B.The Deny statement denies all ec2:AuthorizeSecurityGroupIngress actions, so the user cannot add any inbound rules.
C.The Allow statement allows all ec2:AuthorizeSecurityGroupIngress actions from IPs in 203.0.113.0/24, so the user can add any rule.
D.The Deny statement only denies the action when the CIDR is 0.0.0.0/0, which overrides the Allow for that specific case. For other CIDRs, the Allow applies because the user's source IP is within the allowed range.
AnswerD

The Deny is conditional on the CIDR being 0.0.0.0/0; other CIDRs are not denied, so the Allow statement permits the action.

Why this answer

The Deny statement denies the ec2:AuthorizeSecurityGroupIngress action only when the condition is satisfied—specifically, when the CIDR being added is 0.0.0.0/0. The Allow statement permits the action when the user's source IP falls within 203.0.113.0/24. Since the user's IP is 203.0.113.10, the Allow applies.

However, the Deny overrides the Allow for the specific case of 0.0.0.0/0. For other CIDRs, such as 203.0.113.10, the Deny condition is not met, so the Allow takes effect. Option A is incorrect because the condition key is valid; Option B is incorrect because the Deny does not block all ingress actions; Option C is incorrect because the Allow is not unconditional—it depends on the user's source IP.

505
MCQhard

A company has a Direct Connect connection with multiple virtual interfaces (VIFs). They want to ensure that traffic from on-premises to a specific VPC uses a specific VIF for security compliance. The VPC is associated with a virtual private gateway. Which configuration ensures this?

A.Configure the on-premises router to use a different BGP ASN for each VIF
B.Use BGP community tags on the Direct Connect gateway to influence routing
C.Assign different IP addresses to each VIF and add static routes
D.Create a separate virtual private gateway for each VIF
AnswerB

BGP communities allow you to tag routes and influence path selection.

Why this answer

To steer traffic from on-premises to a specific VPC over a specific VIF, you can use BGP community tags on the Direct Connect gateway. This allows you to influence routing decisions by tagging routes. Option A does not achieve traffic steering because different ASNs are not used for that purpose.

Option C (static routes) would not provide the flexibility and dynamic routing capabilities needed. Option D is unnecessary and does not solve the requirement. Therefore, option B is correct.

506
MCQhard

A company has a requirement to encrypt all data in transit between EC2 instances and an RDS database. The database is in a private subnet, and the application connects using an SSL connection. The security team wants to ensure that even if the network is compromised, the data remains confidential. What additional measure should be taken?

A.Deploy a VPN connection between the EC2 instances and the RDS database.
B.Use a client-side encryption library to encrypt data before sending.
C.Enable encryption at rest on the RDS instance.
D.Use IAM database authentication with SSL.
AnswerB

Client-side encryption encrypts the data before SSL, providing an additional layer that protects data even if SSL is compromised or bypassed.

Why this answer

Client-side encryption adds an additional layer of security beyond SSL. Even if the network is compromised and SSL is bypassed, the data remains encrypted, ensuring confidentiality. Option D is incorrect: IAM database authentication provides authentication, not encryption; it does not enhance data confidentiality beyond what SSL already offers.

Option A is wrong: a VPN between EC2 and RDS adds unnecessary complexity and does not replace or augment SSL encryption. Option C is wrong: encryption at rest protects stored data, not data in transit.

Exam trap

Candidates often confuse authentication with encryption. IAM database authentication improves access control but does not add encryption; the question specifically asks for data confidentiality beyond SSL.

507
Multi-Selecthard

A company is designing a multi-region architecture with VPCs connected via VPC peering. They need to ensure high availability and low latency. Which THREE design principles should they follow? (Choose three.)

Select 3 answers
A.Use VPC endpoints for all AWS service access
B.Deploy redundant VPN connections to each region
C.Use a single NAT gateway for all outbound traffic
D.Use AWS Direct Connect for low-latency connectivity
E.Use a transit gateway for inter-region peering
AnswersB, D, E

Ensures high availability.

Why this answer

Options B, D, and E are correct. Deploying redundant VPN connections ensures high availability and failover between regions. AWS Direct Connect provides consistent low-latency connectivity for inter-region traffic.

Using a transit gateway simplifies inter-region peering with transitive routing and centralized management. Option A is incorrect because VPC endpoints are for accessing AWS services privately, not for inter-region connectivity. Option C is incorrect because a single NAT gateway creates a single point of failure and does not support inter-region traffic.

508
MCQmedium

A company's VPC includes a public subnet with a NAT gateway and a private subnet with EC2 instances. The EC2 instances in the private subnet need to access the internet for software updates. The NAT gateway's Elastic IP is associated correctly, and the route tables are configured. However, the EC2 instances cannot reach the internet. What is the most likely cause?

A.The NAT gateway is in the private subnet.
B.The route table for the private subnet is missing a default route pointing to the NAT gateway.
C.The network ACL for the private subnet is blocking outbound traffic.
D.The security group for the EC2 instances does not allow outbound traffic.
AnswerB

This is the most likely cause; without a default route to the NAT gateway, traffic cannot be routed out.

Why this answer

The most common issue is that the route table for the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT gateway. Without this route, traffic from the private subnet cannot be directed to the NAT gateway, and thus cannot reach the internet.

509
MCQeasy

A company needs to connect its on-premises data center to AWS using a dedicated, low-latency connection. Which AWS service should be used?

A.AWS Direct Connect
B.AWS Transit Gateway
C.AWS Site-to-Site VPN
D.VPC Peering
AnswerA

Direct Connect provides a dedicated, low-latency connection from on-premises to AWS.

Why this answer

AWS Direct Connect is the correct choice because it provides a dedicated, private, low-latency network connection from an on-premises data center directly to AWS, bypassing the public internet. This service uses industry-standard 802.1Q VLANs to create virtual interfaces, ensuring consistent performance and reduced latency for mission-critical workloads.

Exam trap

The trap here is that candidates often confuse AWS Site-to-Site VPN as a dedicated connection, but it is encrypted over the public internet and does not guarantee low latency or dedicated bandwidth, unlike Direct Connect.

How to eliminate wrong answers

Option B is wrong because AWS Transit Gateway is a network transit hub that interconnects VPCs and on-premises networks, but it does not itself provide a dedicated physical connection; it relies on underlying connectivity like Direct Connect or VPN. Option C is wrong because AWS Site-to-Site VPN uses the public internet with IPSec tunnels, introducing variable latency and potential bandwidth constraints, which does not meet the requirement for a dedicated, low-latency connection. Option D is wrong because VPC Peering connects only VPCs within AWS and cannot extend to an on-premises data center; it is not designed for hybrid connectivity.

510
MCQmedium

A company uses AWS Direct Connect to connect its data center to a VPC. The security team wants to ensure that only the on-premises network can initiate connections to EC2 instances in the VPC, but the EC2 instances should be allowed to initiate outbound connections to the internet. Which configuration should be implemented?

A.Configure a network ACL with inbound allow from on-premises CIDR and outbound allow to 0.0.0.0/0
B.Configure a security group with inbound allow from on-premises CIDR and outbound allow to 0.0.0.0/0
C.Configure a network ACL with inbound allow from 0.0.0.0/0 and outbound allow to 0.0.0.0/0
D.Configure a security group with inbound deny from 0.0.0.0/0 and outbound allow to 0.0.0.0/0
AnswerB

Security groups are stateful and track connections.

Why this answer

Security groups are stateful, so allowing inbound from on-premises and outbound to 0.0.0.0/0 works. Option B is correct because security groups automatically allow return traffic. Option A is wrong because NACLs are stateless and require explicit rules for return traffic; allowing inbound from on-premises and outbound to 0.0.0.0/0 would not automatically allow return traffic, so responses from EC2 instances to on-premises would be blocked.

Option C is wrong because it would allow all inbound traffic from any source, not limiting to on-premises. Option D is wrong because it would deny all inbound traffic, blocking necessary connections from on-premises.

511
MCQeasy

A company has a VPC with a public subnet and a private subnet. The private subnet instances need to access an S3 bucket. Which configuration provides the most secure and efficient access without traversing the internet?

A.Establish a VPN connection to on-premises and route to S3 from there.
B.Use a NAT Gateway in the public subnet to route traffic to S3.
C.Create a VPC Gateway Endpoint for Amazon S3 and associate it with the private subnet route table.
D.Configure a proxy server in the public subnet.
AnswerC

Gateway Endpoint provides private, secure access to S3 without internet.

Why this answer

A VPC Gateway Endpoint for Amazon S3 allows instances in a private subnet to access S3 directly over the AWS network without traversing the internet, using a route table entry that targets the endpoint's prefix list. This provides the most secure and efficient access by keeping traffic within the AWS backbone, avoiding NAT Gateway costs and internet exposure.

Exam trap

AWS often tests the misconception that a NAT Gateway is required for private subnet internet access, but the trap here is that S3 can be accessed privately via a Gateway Endpoint without any internet gateway or NAT, making options like B and D seem plausible but incorrect.

How to eliminate wrong answers

Option A is wrong because routing traffic to S3 via a VPN connection to on-premises adds unnecessary latency, complexity, and cost, and still requires internet traversal from on-premises to S3 unless the on-premises network also has a direct connection like Direct Connect. Option B is wrong because a NAT Gateway in the public subnet forces traffic to traverse the internet to reach S3, which is less secure (exposes traffic to internet routing) and less efficient (adds NAT processing and potential bandwidth costs) compared to a Gateway Endpoint. Option D is wrong because a proxy server in the public subnet introduces a single point of failure, additional management overhead, and still requires traffic to go through the internet or NAT, defeating the purpose of secure and efficient private access.

512
MCQeasy

A company has an application that requires fixed IP addresses for whitelisting by third-party partners. The application is hosted on an Application Load Balancer (ALB) in a VPC. Which solution provides static IP addresses for the ALB?

A.Place an AWS Global Accelerator in front of the ALB.
B.Use Amazon CloudFront with the ALB as origin.
C.Assign an Elastic IP to the ALB.
D.Replace the ALB with a Network Load Balancer (NLB).
AnswerA

Global Accelerator provides static IPs for ALB.

Why this answer

AWS Global Accelerator provides two static IP addresses that act as fixed entry points for traffic. By placing it in front of an Application Load Balancer (ALB), you can whitelist these static IPs with third-party partners while the ALB itself remains dynamic. Global Accelerator uses the AWS global network to route traffic to the ALB, preserving the ALB's native HTTP/HTTPS features.

Exam trap

The trap here is that candidates assume CloudFront provides static IPs (it does not — it uses a shared, dynamic IP range) or that an ALB can be assigned an Elastic IP (only NLBs support Elastic IP assignment), leading them to choose B or C instead of Global Accelerator.

How to eliminate wrong answers

Option B is wrong because Amazon CloudFront does not guarantee static IP addresses; its IP ranges change over time and are published as a list, not fixed for whitelisting. Option C is wrong because an Application Load Balancer (ALB) does not support Elastic IP assignment — Elastic IPs are only available for Network Load Balancers (NLBs) or EC2 instances. Option D is wrong because replacing the ALB with an NLB would lose HTTP/HTTPS-specific features (e.g., path-based routing, host-based routing, and WebSocket support) that the application likely requires.

513
MCQmedium

A company has a VPC with a CIDR of 10.0.0.0/16. It has six subnets: three public (10.0.1.0/24, 10.0.2.0/24, 10.0.3.0/24) and three private (10.0.4.0/24, 10.0.5.0/24, 10.0.6.0/24). The company wants to launch an RDS instance in a private subnet. Which subnet should the RDS instance be placed in to maximize high availability and follow best practices?

A.Place the RDS instance in a public subnet and use security groups to restrict access.
B.Place the RDS instance in all three private subnets to maximize availability.
C.Place the RDS instance in two private subnets that are in different Availability Zones.
D.Place the RDS instance in a single private subnet with a large CIDR for future scaling.
AnswerC

This allows Multi-AZ deployment for high availability.

Why this answer

Amazon RDS Multi-AZ deployments require the RDS instance to be placed in at least two subnets that reside in different Availability Zones (AZs) within the same VPC. This configuration enables synchronous standby replication across AZs, providing automatic failover and high availability. The subnets must be private to ensure the database is not directly exposed to the internet, aligning with security best practices.

Exam trap

The trap here is that candidates often assume a single subnet is sufficient for high availability, but AWS RDS Multi-AZ explicitly requires subnets in at least two different Availability Zones to enable automatic failover and synchronous replication.

How to eliminate wrong answers

Option A is wrong because placing an RDS instance in a public subnet exposes it to the internet, violating the security best practice of keeping databases in private subnets; security groups alone do not eliminate the risk of misconfiguration or the inherent exposure of a public subnet. Option B is wrong because an RDS instance cannot be placed in all three private subnets simultaneously; RDS Multi-AZ supports only one primary and one standby in two different AZs, not three. Option D is wrong because placing the RDS instance in a single private subnet creates a single point of failure and does not provide high availability; RDS requires subnets in at least two AZs for Multi-AZ deployments.

514
MCQhard

A company is migrating a legacy on-premises application to AWS. The application uses a large number of short-lived TCP connections and requires low latency. The network team is considering using either a Network Load Balancer (NLB) or a Gateway Load Balancer (GWLB). Which of the following is a key advantage of using NLB over GWLB for this use case?

A.NLB can forward traffic to third-party virtual appliances.
B.NLB can handle higher throughput than GWLB.
C.NLB preserves the client source IP, while GWLB does not by default.
D.NLB supports TLS termination, while GWLB does not.
AnswerC

NLB preserves source IP; GWLB uses GENEVE encapsulation and hides original source IP.

Why this answer

For an application using a large number of short-lived TCP connections requiring low latency, NLB is the optimal choice because it operates at Layer 4 and preserves the client source IP address by default, which is critical for applications that need to log or process the original client IP. GWLB, by design, uses GENEVE encapsulation (UDP port 6081) to tunnel traffic to backend appliances, which replaces the client source IP with the NLB's private IP unless explicit configuration (e.g., proxy protocol) is used. This makes NLB the better fit for preserving source IP without additional overhead.

Exam trap

The trap here is that candidates often confuse GWLB's transparent inline appliance support with NLB's source IP preservation, assuming that GWLB also preserves source IP by default, when in fact it uses GENEVE encapsulation that obscures the original client IP unless additional configuration is applied.

How to eliminate wrong answers

Option A is wrong because forwarding traffic to third-party virtual appliances is a key feature of Gateway Load Balancer (GWLB), not NLB; NLB targets EC2 instances, IP addresses, or Lambda functions, not transparent inline appliances. Option B is wrong because both NLB and GWLB can handle extremely high throughput (up to millions of packets per second), and neither has a documented throughput advantage over the other in AWS documentation; throughput is limited by the underlying instance types and scaling policies, not the load balancer type. Option D is wrong because NLB does not support TLS termination natively; it can offload TLS to targets using TLS listeners, but it does not terminate TLS itself—that is a feature of Application Load Balancer (ALB), not NLB.

515
Multi-Selecthard

Which THREE of the following are valid considerations when designing a multi-Region active-active application using AWS Global Accelerator?

Select 3 answers
A.Global Accelerator supports sticky sessions (session affinity) based on client IP.
B.You can assign different weights to endpoints in different Regions to control traffic distribution.
C.Global Accelerator performs health checks on endpoints and routes traffic only to healthy endpoints.
D.Global Accelerator can preserve the client IP address when using Network Load Balancer as an endpoint.
E.Global Accelerator provides a set of static IP addresses that are unique to each Region.
AnswersB, C, D

Weights allow traffic splitting across endpoints.

Why this answer

AWS Global Accelerator allows you to assign different weights to endpoints in different Regions, enabling granular control over traffic distribution for active-active architectures. This is achieved through endpoint group weights, where you can adjust the proportion of traffic sent to each Regional endpoint group, supporting scenarios like gradual rollouts or load balancing across Regions.

Exam trap

AWS often tests the misconception that Global Accelerator provides per-Region unique static IPs, but the trap here is that the static IPs are global anycast addresses, not Regional, and candidates may confuse sticky sessions with Global Accelerator's lack of session affinity.

516
MCQeasy

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They have two subnets: a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). They launch an EC2 instance in the private subnet that needs to download software updates from the internet. The company configures a NAT gateway in the public subnet and adds a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway. The NAT gateway is assigned an Elastic IP address. However, the EC2 instance cannot reach the internet. The security group for the EC2 instance allows all outbound traffic. What is the MOST likely cause?

A.The NAT gateway is not associated with a security group that allows outbound traffic.
B.The NAT gateway's Elastic IP address is not properly allocated.
C.The public subnet's route table does not have a route to an internet gateway.
D.The private subnet's route table does not have a route to the NAT gateway.
AnswerC

Correct. The public subnet's route table must have a route to an internet gateway (IGW) for the NAT gateway to send traffic to the internet. Without this route, the NAT gateway is unable to forward packets from the private subnet to the internet.

Why this answer

The NAT gateway is in the public subnet, but the public subnet's route table must have a route to an internet gateway (0.0.0.0/0 -> IGW) for the NAT gateway to forward traffic to the internet. Without that route, the NAT gateway cannot communicate with the internet. Option A is incorrect because NAT gateways do not use security groups.

Option B is incorrect because the NAT gateway has an Elastic IP and is properly allocated; the issue is not with the Elastic IP. Option D is incorrect because the private subnet's route table already has a route to the NAT gateway (0.0.0.0/0 -> NAT), which is correctly configured.

517
MCQmedium

A company is experiencing intermittent connectivity issues between two VPCs connected via a VPC peering connection. The VPCs are in different AWS regions. VPC A has CIDR 10.0.0.0/16 and VPC B has CIDR 10.1.0.0/16. The route tables in both VPCs have been updated to include routes pointing to the peering connection. Security groups and network ACLs are configured to allow all traffic for testing. However, traffic from VPC A to VPC B fails intermittently. Which of the following is the most likely cause of this intermittent failure?

A.The security group rules in VPC A are not allowing inbound traffic from VPC B's CIDR. The security group must reference the VPC B CIDR explicitly.
B.The route tables in both VPCs must include explicit routes for each other's CIDR blocks, but they should also include routes to the internet gateway for proper routing.
C.The VPCs are in different regions, and cross-region VPC peering is not supported. A transit gateway must be used instead.
D.The VPC peering connection does not support transitive routing. If any traffic is being routed through an intermediate device (e.g., a NAT instance or a VPN connection), the peering connection will not forward that traffic.
AnswerD

VPC peering does not support transitive routing, and intermittent failures suggest that some traffic is being sent through an unsupported path.

Why this answer

The intermittent failure is most likely due to VPC peering's lack of transitive routing. If traffic from VPC A to VPC B is routed through an intermediate device (e.g., a NAT instance, VPN connection, or another VPC), the VPC peering connection will not forward that traffic because it does not support transitive routing. This can cause intermittent failures when the intermediate device's route or state changes, even though direct routes and security groups are correctly configured.

Exam trap

The trap here is that candidates assume security groups or route table misconfigurations are the cause, but the real issue is the fundamental non-transitive nature of VPC peering, which AWS tests by describing an intermittent failure that points to a transitive routing dependency.

How to eliminate wrong answers

Option A is wrong because the security groups in VPC A are explicitly configured to allow all traffic for testing, and the issue is intermittent, not a persistent inbound rule mismatch. Option B is wrong because adding routes to an internet gateway is irrelevant for VPC peering traffic; the route tables already have the correct peering routes, and internet gateway routes are for internet-bound traffic, not inter-VPC traffic. Option C is wrong because cross-region VPC peering is fully supported by AWS; the statement that it is not supported is incorrect, and a transit gateway is not required for this scenario.

518
MCQeasy

A network engineer is monitoring network traffic using VPC Flow Logs. The engineer wants to capture traffic that is rejected by security groups and network ACLs. Which flow log format should be used?

A.Default format
B.Flow logs are delivered to CloudWatch Logs with DNS query logs
C.Custom format with 'srcaddr' and 'dstaddr' only
D.Custom format with 'action' field
AnswerD

The action field shows ACCEPT or REJECT.

Why this answer

The default VPC Flow Log format includes the action field, so it does capture ACCEPT/REJECT information. However, a common myth is that the default format omits the action field. In reality, both default and custom formats can capture rejected traffic.

The correct answer is D because a custom format that explicitly includes the action field is the targeted way to capture only the rejection status, reducing log volume and making analysis easier. Option A is incorrect because it is not the most efficient approach; it logs many unnecessary fields. Options B and C are irrelevant or incomplete.

Exam trap

Be careful: The default format actually includes the action field. Many candidates mistakenly think it does not, leading them to choose D over A. While D is still the best answer, A is not invalid due to lacking the action field.

519
MCQeasy

A company wants to restrict outbound traffic from a VPC to only allow HTTPS traffic to a specific list of domains. Which AWS service can be used to achieve this?

A.AWS Network Firewall
B.Security groups
C.Amazon Route 53
D.Application Load Balancer
AnswerA

Network Firewall can filter outbound traffic by domain name using stateful rules.

Why this answer

AWS Network Firewall is the correct choice because it provides stateful, managed firewall rules that can inspect and filter outbound traffic based on domain names (FQDN) for HTTPS (port 443) using TLS inspection or domain list rules. This allows you to create a rule group that permits outbound HTTPS traffic only to a specified list of domains, while blocking all other outbound traffic.

Exam trap

The ANS-C01 exam often tests the misconception that security groups can filter by domain names because they are stateful and support DNS names in rules, but in reality, security groups only support IP-based rules and cannot resolve or filter by FQDNs.

How to eliminate wrong answers

Option B is wrong because security groups are stateful and can only filter traffic based on IP addresses, CIDR blocks, or other security groups; they cannot filter by domain names or FQDNs. Option C is wrong because Amazon Route 53 is a DNS service that resolves domain names to IP addresses; it does not perform traffic filtering or firewall functions. Option D is wrong because an Application Load Balancer distributes incoming traffic to targets and can terminate TLS, but it is not designed to filter outbound traffic from a VPC or restrict traffic based on domain names.

520
MCQeasy

A company needs to connect its on-premises data center to AWS using a site-to-site VPN. The on-premises firewall does not support IPsec. What alternative solution can the company use?

A.Create a VPC peering connection between the on-premises router and the VPC.
B.Use AWS Client VPN to establish a VPN connection from the on-premises network.
C.Deploy an AWS Transit Gateway and attach the on-premises network via a VPC attachment.
D.Use AWS Direct Connect to establish a dedicated physical link.
AnswerB

Client VPN can terminate on a firewall running OpenVPN.

Why this answer

AWS Client VPN is a managed, OpenVPN-based service that allows on-premises clients to securely access AWS resources without requiring IPsec support on the on-premises firewall. Since the firewall does not support IPsec, Client VPN provides an alternative by using TLS-based VPN tunnels that only require standard TCP/UDP ports (typically 443) to be open, making it compatible with nearly any firewall.

Exam trap

The ANS-C01 exam often tests the misconception that any VPN requires IPsec, but AWS Client VPN uses TLS-based tunnels (OpenVPN) as an alternative when the on-premises device lacks IPsec support.

How to eliminate wrong answers

Option A is wrong because VPC peering connects two VPCs within AWS and cannot extend to an on-premises router; it is not a VPN or hybrid connectivity solution. Option C is wrong because an AWS Transit Gateway VPC attachment connects a VPC to the Transit Gateway, not an on-premises network; the on-premises network would still need an IPsec VPN or Direct Connect to attach to the Transit Gateway. Option D is wrong because AWS Direct Connect requires a dedicated physical link from the on-premises data center to an AWS Direct Connect location, which does not solve the firewall's lack of IPsec support and involves significant physical infrastructure and lead time.

521
Multi-Selectmedium

A company has a VPC with public and private subnets. They have a NAT gateway in a public subnet for outbound internet access from private instances. Which TWO of the following are required for the NAT gateway to function correctly?

Select 2 answers
A.The NAT gateway is deployed in a private subnet
B.A security group attached to the NAT gateway
C.A route in the public subnet's route table to an internet gateway
D.A network ACL attached to the NAT gateway's subnet that allows inbound traffic from the internet
E.An Elastic IP address assigned to the NAT gateway
AnswersC, E

The NAT gateway must be in a public subnet with internet access.

Why this answer

A NAT gateway must be placed in a public subnet and requires an Elastic IP address (E) to enable outbound internet traffic with a source IP that can be routed back. Additionally, the public subnet where the NAT gateway resides must have a route in its route table that points to an internet gateway (C) for the NAT gateway to reach the internet. Security groups are not attached to NAT gateways (they use security groups for attached instances, but NAT gateways themselves are not security group–aware).

Network ACLs control traffic at the subnet level but are not a requirement specific to NAT gateway functionality; they can be configured as needed. Deploying the NAT gateway in a private subnet (A) would prevent it from accessing the internet because private subnets do not have direct routes to an internet gateway. Therefore, only options C and E are required.

522
MCQmedium

A company manages multiple VPCs connected via a transit gateway. Each VPC has a VPN connection to an on-premises data center. The network team wants to monitor the bandwidth utilization on each VPN connection. Which approach is the most efficient?

A.Use Amazon CloudWatch metrics for the VPN tunnels.
B.Enable VPC Flow Logs on each VPC and aggregate them in CloudWatch Logs Insights.
C.Use Transit Gateway Network Manager to view VPN bandwidth.
D.Use AWS Config rules to monitor VPN bandwidth changes.
AnswerA

CloudWatch provides built-in metrics for VPN tunnel throughput.

Why this answer

CloudWatch metrics for VPN tunnels provide bandwidth utilization. Option B is wrong because VPC Flow Logs are for packet-level logs, not metrics. Option C is wrong because AWS Config tracks configuration.

Option D is wrong because Transit Gateway Network Manager provides topology, not bandwidth metrics.

523
MCQeasy

A company has a VPC with public and private subnets. The private subnets need internet access for updates, but must not be directly reachable from the internet. Which AWS service should be used?

A.NAT gateway
B.Internet gateway
C.VPN connection
D.VPC endpoint
AnswerA

A NAT gateway enables outbound internet access for private subnets.

Why this answer

A NAT gateway enables instances in a private subnet to initiate outbound IPv4 traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet. It resides in a public subnet with an Elastic IP and uses the internet gateway for outbound traffic, but it does not allow inbound traffic to reach the private instances directly.

Exam trap

AWS often tests the misconception that an internet gateway can be used for private subnets by adding a default route to it, but the trap here is that an internet gateway alone does not provide outbound-only access—it allows inbound traffic unless explicitly blocked by a network ACL, which still exposes the subnet to direct inbound connections.

How to eliminate wrong answers

Option B is wrong because an internet gateway allows bidirectional traffic between the VPC and the internet, which would make private subnets directly reachable from the internet if attached to their route table. Option C is wrong because a VPN connection provides encrypted connectivity to an on-premises network, not direct internet access for updates. Option D is wrong because a VPC endpoint provides private connectivity to AWS services (e.g., S3, DynamoDB) without traversing the internet, but it does not provide general internet access for updates.

524
Multi-Selecthard

A company has a VPC with a CIDR of 10.0.0.0/16. They have two Availability Zones, each with a public and a private subnet. They want to connect their on-premises network (192.168.0.0/16) to the VPC using a site-to-site VPN. Which THREE resources are needed to establish the VPN connection? (Choose THREE.)

Select 3 answers
A.Customer Gateway
B.AWS Direct Connect
C.VPN Connection
D.AWS Transit Gateway
E.Virtual Private Gateway
AnswersA, C, E

Required to represent the on-premises router.

Why this answer

A Customer Gateway (option A) is required because it represents the on-premises VPN device in AWS, providing the public IP address and routing information needed to establish the IPsec tunnel. A VPN Connection (option C) is the logical resource that ties together the Customer Gateway and the Virtual Private Gateway, defining the tunnel settings, pre-shared keys, and routing options. A Virtual Private Gateway (option E) is the AWS-side endpoint attached to the VPC that terminates the VPN tunnels and routes traffic between the VPC and the on-premises network.

Exam trap

The trap here is that candidates often confuse AWS Transit Gateway as a mandatory component for VPNs, but it is only needed when connecting multiple VPCs or VPNs centrally, not for a single VPC-to-on-premises VPN.

525
MCQhard

A company has a VPC with a public subnet and a private subnet. The private subnet hosts a web application that needs to access an external API over the internet. The private subnet uses a NAT Gateway in the public subnet for outbound internet access. The web application is failing to reach the external API. The engineer has verified the following: the NAT Gateway has an Elastic IP attached, the route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway, the security group for the web application allows outbound HTTPS (TCP 443) to 0.0.0.0/0, the network ACL for the private subnet allows inbound and outbound TCP ephemeral ports (1024-65535) from and to 0.0.0.0/0, and the IAM role attached to the EC2 instance allows outbound HTTPS. The engineer also confirmed that the NAT Gateway is in the public subnet which has a route to an Internet Gateway. Despite all these checks, the web application still cannot reach the external API. What should the engineer do next?

A.Add an inbound rule to the security group for the external API's IP address.
B.Move the NAT Gateway to the private subnet.
C.Verify that the route table is correctly associated with the private subnet.
D.Add a specific route for the external API's IP address to the route table.
AnswerC

Misassociation is a common issue.

Why this answer

Even though the route table contains a default route to the NAT Gateway, it may not be associated with the private subnet. If the route table is not associated, the private subnet uses the main route table, which might not have the default route. The engineer should verify that the correct route table is associated with the private subnet.

Option A is incorrect because the security group already allows outbound HTTPS. Option B is incorrect because the NAT Gateway must be in a public subnet. Option D is incorrect because a specific route is unnecessary when a default route already exists.

Page 6

Page 7 of 22

Page 8