Knowledge + Practice

AWS Certified Advanced Networking Specialty ANS-C01 (ANS-C01) — Questions 526–600

1621 questions total · 22pages · All types, answers revealed

Take a mock exam Exam hub

Page 8 of 22

526

MCQmedium

A network engineer runs the above command and sees an ENI (eni-0a1b2c3d4e5f6g7h8) with status 'in-use' but no InstanceId attached. What AWS service is most likely using this ENI?

A.A VPC endpoint (Interface type).

B.An Amazon RDS database instance.

C.A NAT gateway.

D.An AWS Transit Gateway.

AnswerB

RDS uses managed ENIs with 'RDS-managed' description.

Why this answer

An Amazon RDS database instance uses an Elastic Network Interface (ENI) as its primary network interface, and when the RDS instance is in a 'stopped' or 'failed' state, the ENI may remain in 'in-use' status without an InstanceId attached. This is because RDS manages its own ENI independently of EC2 instances, and the ENI persists even when the database instance is not running.

Exam trap

The ANS-C01 exam often tests the misconception that an ENI in 'in-use' status must always be attached to an EC2 instance, leading candidates to overlook managed services like RDS that use ENIs without exposing the InstanceId.

How to eliminate wrong answers

Option A is wrong because a VPC endpoint (Interface type) creates an ENI with a specific service name and typically shows an 'available' status when not attached to an instance, not 'in-use' without an InstanceId. Option C is wrong because a NAT gateway uses an ENI that is always associated with the NAT gateway resource itself, and the ENI will show the NAT gateway's ID in the description or attachment, not a missing InstanceId. Option D is wrong because an AWS Transit Gateway does not use ENIs directly; it operates at the VPC attachment level using transit gateway attachments, not individual ENIs.

Full explanation →

527

MCQeasy

A network engineer is configuring a new AWS Direct Connect connection and needs to establish BGP peering with the AWS side. The engineer has received the BGP configuration from the AWS Direct Connect endpoint. Which information is required to complete the BGP configuration on the on-premises router?

A.The AWS Side BGP password and MD5 hash

B.The AWS BGP peer IP address and the BGP ASN

C.The Amazon side routing table and prefix list

D.The Direct Connect virtual interface ID and VLAN ID

AnswerB

These are the key BGP parameters.

Why this answer

B is correct because BGP peering requires the remote peer's IP address and Autonomous System Number (ASN) to establish a TCP connection and exchange routing information. AWS provides these two values in the Direct Connect endpoint configuration, and the on-premises router must use them to configure the BGP neighbor statement. Without both, the BGP session cannot be established.

Exam trap

The trap here is that candidates often confuse Layer 2 parameters (VLAN ID, VIF ID) with Layer 3 BGP requirements, or assume authentication is mandatory, when in fact only the BGP peer IP and ASN are essential to establish the BGP session.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect does not require a BGP password or MD5 hash for basic BGP peering; MD5 authentication is optional and not a mandatory parameter. Option C is wrong because the Amazon side routing table and prefix list are not needed for BGP configuration; routes are learned dynamically via BGP after peering is established. Option D is wrong because the Direct Connect virtual interface ID and VLAN ID are used for Layer 2 configuration (802.1Q tagging) and are not part of the BGP peering configuration on the router.

Full explanation →

528

MCQmedium

A company is using AWS Shield Advanced to protect against DDoS attacks. They want to receive notifications when an attack is detected. Which AWS service should they integrate with to receive notifications?

A.Amazon Simple Queue Service (SQS)

B.AWS Lambda

C.Amazon CloudWatch and Amazon Simple Notification Service (SNS)

D.Amazon Kinesis Data Streams

AnswerC

Shield metrics in CloudWatch can trigger SNS notifications.

Why this answer

AWS Shield Advanced sends metrics to CloudWatch, and you can create CloudWatch alarms to trigger SNS notifications. Option A (SQS) is for queuing. Option B (Lambda) can be triggered but SNS is simpler.

Option D (Kinesis) is for streaming.

Full explanation →

529

Multi-Selecthard

A company is designing a network architecture for a multi-account AWS environment using AWS Transit Gateway. They need to meet the following requirements: (1) Centralized inspection of traffic between VPCs using a firewall appliance. (2) Isolated development environments that cannot communicate with each other but can access the internet via a centralized NAT gateway. (3) Compliance with PCI DSS for production workloads, requiring encryption in transit between VPCs. Which TWO actions should they take?

Select 2 answers

A.Use VPC Peering for all inter-VPC communication

B.Create a dedicated inspection VPC with a firewall appliance and attach it to the Transit Gateway. Use Transit Gateway route tables to route traffic from all VPCs through the inspection VPC.

C.Use AWS Site-to-Site VPN between each VPC and a central VPN hub

D.Create separate Transit Gateway route tables for production and development environments. For development VPCs, add a static route for 0.0.0.0/0 pointing to a NAT Gateway in a shared services VPC.

E.Use AWS Client VPN to connect development VPCs to the production VPC

AnswersB, D

Provides centralized inspection.

Why this answer

It enables centralized traffic inspection by attaching a dedicated inspection VPC with a firewall appliance to the Transit Gateway and using separate route tables to force all inter-VPC traffic through that inspection VPC. This design meets the requirement for centralized inspection without requiring complex peering or VPN configurations.

Exam trap

The trap here is that candidates often assume VPC Peering or VPNs are simpler solutions for multi-VPC connectivity, but they fail to recognize that Transit Gateway is specifically designed for transitive routing and centralized inspection at scale, and that separate route tables are essential for isolating development environments while sharing a common NAT gateway.

Full explanation →

530

MCQhard

A network engineer examines the route table above. The VPC has a CIDR of 10.0.0.0/16. There is a VPC peering connection (pcx-...) to a VPC with CIDR 192.168.0.0/16. However, instances in this route table's subnet cannot communicate with the peered VPC. What is the most likely cause?

A.The route table is not associated with the subnet.

B.The VPC peering connection is in 'pending-acceptance' state.

C.The security group or network ACL in the source subnet is blocking traffic.

D.The route to the peered VPC is missing from the route table.

AnswerC

Even with correct routing, security groups/NACLs can block traffic.

Why this answer

The route table shown includes a route for the peered VPC (192.168.0.0/16 via pcx-...), and the route table is associated with the subnet (implied by the question stating 'this route table's subnet'). Since routing is in place, the most likely remaining cause is that a security group (stateful, blocking inbound/outbound traffic) or a network ACL (stateless, blocking inbound/outbound traffic) is filtering the traffic between the subnets. Security groups and network ACLs operate at the instance and subnet level respectively, and misconfigured rules can prevent communication even when routes are correct.

Exam trap

The ANS-C01 exam often tests the misconception that a missing route is the only cause for VPC peering communication failure, but the trap here is that the route is present, so candidates must consider security group or network ACL filtering as the next most likely cause.

How to eliminate wrong answers

Option A is wrong because the question explicitly states 'instances in this route table's subnet', which implies the route table is associated with the subnet; if it were not associated, the subnet would use the main route table, and the engineer would not be examining this specific route table. Option B is wrong because if the VPC peering connection were in 'pending-acceptance' state, the route would not be in the route table (the route is only added after acceptance), and the question shows the route is present, so the connection must be in 'active' state. Option D is wrong because the route table shown includes a route for 192.168.0.0/16 with the peering connection as target, so the route is not missing; the issue lies elsewhere.

Full explanation →

531

Multi-Selectmedium

Which TWO statements about AWS Direct Connect are correct? (Select TWO.)

Select 2 answers

A.Direct Connect traffic is encrypted by default

B.Direct Connect supports multiple virtual interfaces (VIFs) over a single connection

C.Direct Connect is a managed VPN service

D.Direct Connect can be provisioned in minutes without any physical infrastructure

E.Direct Connect provides a consistent network experience with lower latency and higher bandwidth than internet-based VPN

AnswersB, E

You can have public, private, and transit VIFs.

Why this answer

AWS Direct Connect allows you to create multiple virtual interfaces (VIFs) — including private VIFs, public VIFs, and transit VIFs — over a single physical Direct Connect connection. This enables you to segment traffic to different AWS services (e.g., VPCs via private VIF, public AWS endpoints via public VIF) without needing separate physical cables, leveraging 802.1Q VLAN tagging to isolate each VIF.

Exam trap

The trap here is that candidates confuse Direct Connect's private, dedicated nature with inherent encryption, but AWS explicitly states that encryption is optional and must be added by the customer (e.g., using IPsec or TLS).

Full explanation →

532

MCQhard

A network engineer has created a gateway VPC endpoint for S3 as shown in the exhibit. The endpoint is associated with route table rtb-12345678. An EC2 instance in a subnet that uses route table rtb-12345678 tries to download an object from my-bucket. The request fails with an access denied error. Which change should the engineer make to resolve the issue?

A.Associate the endpoint with a different route table.

B.Add a bucket policy to my-bucket that allows access from the VPC endpoint.

C.Modify the endpoint policy to allow all S3 actions.

D.Add a route in route table rtb-12345678 that sends traffic to the S3 service via the VPC endpoint.

AnswerD

Gateway endpoints require a route in the associated route table with destination the S3 prefix list and target the endpoint ID.

Why this answer

The endpoint policy requires the aws:SourceVpc condition to match the VPC ID, but the condition key is misspelled or the value is incorrect? Actually, the condition is correct. However, the error is likely because the route table does not have a route to the endpoint. Gateway endpoints require a route in the associated route table that points to the endpoint.

Option A is wrong because the endpoint policy already allows s3:GetObject. Option B is wrong because the endpoint is already associated with the route table. Option C is wrong because the bucket policy is not shown; but the issue is likely the route.

Option D is correct: add a route to the S3 service in route table rtb-12345678.

Full explanation →

533

MCQeasy

A company wants to allow their employees to access internal web applications hosted on EC2 instances in a private subnet. The employees are outside the corporate network and connect via the internet. Which AWS service would provide secure, managed remote access without requiring a VPN client on each employee's device?

A.AWS Direct Connect

B.AWS Application Load Balancer with AWS WAF and Cognito authentication

C.AWS Client VPN

D.AWS Site-to-Site VPN

AnswerB

An ALB with Cognito user pools provides authentication and can be public-facing, allowing users to access internal apps via the internet with security controls.

Full explanation →

534

MCQhard

A company has an AWS Direct Connect connection with a private VIF to a VPC. They also have a VPN connection as a backup. They want to use BGP attributes to prefer the Direct Connect path. On the customer router, they set a lower local preference for routes received via the VPN. However, traffic still uses the VPN. What could be the reason?

A.Local preference is not supported by AWS for BGP sessions; use AS path prepending instead

B.The weight attribute is set higher on the VPN routes

C.Bidirectional Forwarding Detection (BFD) is not enabled on the Direct Connect connection

D.The BGP MED attribute is not set on the VPN routes

AnswerA

AWS does not accept local preference; AS path prepending is used to influence outbound traffic.

Why this answer

AWS does not honor the local preference attribute set on the customer router for routes received via the VPN. In AWS, BGP local preference is not considered; instead, AS path prepending is the standard method to influence route selection on the customer side. Option B is incorrect because weight is a Cisco-proprietary attribute that is not used in AWS BGP sessions.

Option C is incorrect because BFD is used for fast failure detection, not path selection. Option D is incorrect because MED is used to influence inbound traffic from AWS, not to prefer the Direct Connect path on the customer router.

Full explanation →

535

MCQeasy

A company has a VPC with two subnets: subnet A (10.0.1.0/24) and subnet B (10.0.2.0/24). An EC2 instance in subnet A needs to communicate with an EC2 instance in subnet B. The instances are in the same VPC. What is the default behavior?

A.Communication is not allowed by default; a VPC peering connection is required

B.Communication is allowed only if they are in the same subnet

C.Communication is allowed only if a transit gateway is attached

D.Communication is allowed by default because they are in the same VPC

AnswerD

Instances in the same VPC can communicate by default.

Why this answer

By default, all instances within the same VPC can communicate with each other regardless of which subnet they reside in, as long as the VPC's main route table and network ACLs allow the traffic. The VPC's implicit router provides connectivity between all subnets, and the default security group allows inbound traffic from other members of the same security group. Therefore, an EC2 instance in subnet A can communicate with an instance in subnet B without any additional configuration.

Exam trap

The trap here is that candidates often confuse subnet isolation with VPC isolation, mistakenly thinking that different subnets require a peering or gateway to communicate, when in fact the VPC's internal routing handles it automatically.

How to eliminate wrong answers

Option A is wrong because VPC peering is used to connect different VPCs, not subnets within the same VPC; the VPC's internal router already provides connectivity. Option B is wrong because instances in different subnets within the same VPC can communicate by default; subnet boundaries do not block traffic unless explicitly configured with network ACLs or security groups. Option C is wrong because a transit gateway is used to connect multiple VPCs or on-premises networks, not for routing between subnets within a single VPC.

Full explanation →

536

Multi-Selecteasy

Which TWO of the following are valid methods to connect an on-premises data center to a VPC in AWS? (Choose 2.)

Select 2 answers

A.AWS Direct Connect

B.VPC endpoint

C.Transit Gateway

D.AWS Site-to-Site VPN

E.VPC peering

AnswersA, D

Direct Connect provides a dedicated private connection.

Why this answer

AWS Direct Connect is a correct answer because it provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet for consistent latency and higher bandwidth. This service uses industry-standard 802.1Q VLANs to create virtual interfaces, enabling direct access to VPCs via private virtual interfaces (VIFs) or transit virtual interfaces for use with Transit Gateway.

Exam trap

The ANS-C01 exam often tests the distinction between connectivity services and routing constructs, so the trap here is that candidates may confuse Transit Gateway (a routing hub) with a direct connection method, or think VPC peering can extend on-premises connectivity, when it only works between VPCs within AWS.

Full explanation →

537

MCQmedium

A network engineer needs to ensure that all traffic between two VPCs (VPC A and VPC B) is encrypted in transit. The VPCs are in the same region and are connected via a VPC peering connection. What should the engineer do?

A.Establish a VPN connection between the VPCs over the peering connection.

B.No additional action is required; all traffic over VPC peering is automatically encrypted.

C.Implement application-level encryption such as TLS.

D.Use AWS Transit Gateway with VPN attachments between VPCs.

AnswerB

AWS encrypts all traffic within the AWS network.

Why this answer

VPC peering traffic within the same AWS region is automatically encrypted at the physical layer by AWS, ensuring data in transit is encrypted without additional configuration. Option A is incorrect because VPN over VPC peering is not supported and unnecessary. Option C is incorrect while application-level encryption like TLS can be added for extra security, it is not required as the traffic is already encrypted.

Option D is incorrect because AWS Transit Gateway with VPN attachments adds unnecessary complexity and cost when VPC peering already provides encrypted connectivity.

Full explanation →

538

Multi-Selecthard

A company has a VPC with CIDR 10.0.0.0/16 and two subnets: 10.0.1.0/24 (public) and 10.0.2.0/24 (private). The company wants to add a new subnet for a third tier. Which of the following are valid subnet CIDRs that can be added? (Select TWO.)

Select 2 answers

A.10.0.1.128/25

B.10.0.3.0/24

C.10.0.0.0/24

D.10.1.0.0/16

E.10.0.2.64/26

AnswersB, C

This is within the VPC CIDR and does not overlap with existing subnets.

Why this answer

(10.0.3.0/24) is correct because it falls within the VPC CIDR 10.0.0.0/16 and does not overlap with the existing subnets (10.0.1.0/24 and 10.0.2.0/24). The /24 prefix length matches the existing subnet structure, and the third octet (3) is outside the range of the first two subnets, ensuring no IP address conflict.

Exam trap

AWS often tests the misconception that a subnet can be a subset of an existing subnet (e.g., 10.0.1.128/25 within 10.0.1.0/24), but AWS explicitly prohibits overlapping CIDR blocks within a VPC.

Full explanation →

539

MCQhard

A company has a Direct Connect connection with a private VIF to a VPC. The VPC has a subnet that hosts an EC2 instance with a sensitive database. The company wants to add an extra layer of encryption for traffic between the on-premises network and the EC2 instance. Which solution should be used?

A.Enable TLS on the EC2 instance

B.Use an SSL certificate on the on-premises router

C.Use AWS Key Management Service (KMS) to encrypt the traffic

D.Set up an IPsec VPN tunnel over the Direct Connect private VIF

AnswerD

IPsec VPN provides encryption at the network layer over the Direct Connect connection.

Why this answer

An IPsec VPN tunnel over a Direct Connect private VIF adds an extra layer of encryption to traffic between on-premises and the EC2 instance. Direct Connect private VIFs provide a private, isolated connection but do not encrypt data by default; IPsec encrypts the IP payload at Layer 3, ensuring confidentiality over the physical link. This meets the requirement for an additional encryption layer without altering the application or network stack on the EC2 instance.

Exam trap

The ANS-C01 exam often tests the misconception that Direct Connect private VIFs are inherently encrypted, leading candidates to overlook the need for an additional encryption layer like IPsec, or they confuse encryption at rest (KMS) with encryption in transit.

How to eliminate wrong answers

Option A is wrong because enabling TLS on the EC2 instance only encrypts application-layer traffic (e.g., HTTPS) and does not encrypt all IP traffic between on-premises and the instance; it also requires application support and does not cover non-TLS protocols. Option B is wrong because an SSL certificate on the on-premises router is used for authentication and encryption in SSL/TLS sessions, but it does not create a secure tunnel for all traffic; it is typically used for HTTPS inspection or VPN termination, not for encrypting a Direct Connect VIF. Option C is wrong because AWS Key Management Service (KMS) is a key management service for encrypting data at rest (e.g., EBS volumes, S3 objects) and cannot encrypt network traffic in transit; it does not provide a mechanism to encrypt IP packets flowing over a Direct Connect connection.

Full explanation →

540

MCQmedium

A company has a VPC with public and private subnets in two Availability Zones. The private subnets host EC2 instances that need to access the internet for software updates. The company must ensure that traffic from the private instances uses a single, predictable public IP address. What is the MOST cost-effective solution?

A.Attach an Internet Gateway to the VPC and update the private subnet route table with a default route to the Internet Gateway.

B.Create a Transit Gateway with a VPC attachment and route traffic through a central egress VPC.

C.Deploy a NAT Gateway in a public subnet in one Availability Zone, and route private subnet traffic to it.

D.Launch a NAT instance in a public subnet and configure source/destination check.

AnswerC

Correct: A single NAT Gateway provides outbound internet with a predictable IP, and is cost-effective.

Why this answer

A NAT Gateway in a public subnet provides outbound-only internet access for private instances, and it uses a single Elastic IP address, ensuring a predictable public IP. This is the most cost-effective managed solution, as NAT Gateways are highly available within an Availability Zone and require no manual instance management.

Exam trap

The trap here is that candidates may choose Option D (NAT instance) thinking it is cheaper, but they overlook the operational overhead and the fact that a NAT Gateway is fully managed and more cost-effective when factoring in maintenance and availability.

How to eliminate wrong answers

Option A is wrong because attaching an Internet Gateway to the VPC and adding a default route to it in private subnets would allow direct outbound traffic, but private instances lack public IPs, so traffic would be dropped; this configuration also bypasses NAT, exposing private instances to inbound traffic. Option B is wrong because a Transit Gateway with a central egress VPC introduces unnecessary complexity and cost (Transit Gateway hourly charges and cross-AZ data transfer) for a simple outbound-only requirement that can be met with a single NAT Gateway. Option D is wrong because a NAT instance requires manual management (e.g., patching, scaling, failover) and source/destination check must be disabled for it to forward traffic, but it is less cost-effective than a NAT Gateway when considering operational overhead and potential downtime.

Full explanation →

541

MCQmedium

A company uses AWS WAF to protect a web application behind an Application Load Balancer. The security team notices that a specific IP address is generating a high number of requests and wants to block it immediately. What is the MOST efficient way to block this IP address?

A.Add the IP address to an IP set in AWS WAF and update the rule to block it

B.Add a deny rule in the security group attached to the ALB

C.Update the Network ACL associated with the ALB subnets to deny inbound traffic from the IP address

D.Create a new web ACL in AWS WAF and associate it with the ALB

AnswerA

This is the most efficient and targeted method.

Why this answer

AWS WAF allows adding an IP address to an existing IP set and updating the associated rule to block it, which takes effect quickly and is the most efficient method. Option B is wrong because security groups are stateful and cannot explicitly deny inbound traffic; they only allow rules. Option C is wrong because Network ACLs operate at the subnet level and require updating both inbound and outbound rules, which is slower and less granular than WAF IP sets.

Option D is wrong because creating a new web ACL and associating it takes more steps than updating an existing rule, making it less immediate.

Full explanation →

542

MCQmedium

A company's security team is investigating a potential data exfiltration incident. They notice that an EC2 instance in a private subnet is making HTTPS connections to an unknown external IP address. The instance's security group only allows outbound HTTPS to a specific set of IPs. What is the MOST likely cause of the traffic?

A.The instance is routing traffic through a NAT Gateway that has a route to the internet

B.The instance is using a VPC Endpoint to connect to the external IP

C.The security group outbound rules are being overridden by a Network ACL

D.The instance has a public IP address and is using an Internet Gateway directly

AnswerA

The security group allows outbound HTTPS to certain IPs, but if the traffic goes through a NAT Gateway, the destination IP seen by the security group is the NAT Gateway's IP, not the final destination.

Why this answer

A NAT Gateway in a public subnet can allow outbound traffic to any destination, bypassing security group restrictions if the security group allows traffic to the NAT Gateway. Option B is wrong because security groups are stateful; outbound rules apply regardless. Option C is wrong because an Internet Gateway is not in a private subnet.

Option D is wrong because a VPC Endpoint is for AWS services, not external IPs.

Full explanation →

543

MCQhard

A company is migrating its on-premises data center to AWS and wants to extend its Layer 2 network to AWS using AWS Outposts. The company has an existing VLAN with IP subnet 10.0.1.0/24 that hosts a legacy application requiring direct Layer 2 connectivity between on-premises servers and Outposts racks. The network engineer has installed an Outposts rack in the data center and connected it to the on-premises network via a local gateway (LGW) with a VLAN interface. The engineer has created a subnet in the Outposts VPC with CIDR 10.0.1.0/24 and launched EC2 instances. However, the on-premises servers cannot communicate with the Outposts instances. The LGW is configured correctly. Which action should the engineer take to resolve the issue?

A.Configure the LGW VLAN interface with the correct VLAN ID that matches the on-premises VLAN.

B.Create a VPC peering connection between the Outposts VPC and the on-premises network via the LGW.

C.Set up a Direct Connect private virtual interface from the on-premises router to the Outposts VPC.

D.Attach the Outposts VPC to a Transit Gateway and peer with on-premises network.

AnswerA

The VLAN ID must match for Layer 2 connectivity.

Why this answer

The LGW VLAN interface must be configured with the same VLAN ID as the on-premises VLAN to allow Layer 2 communication. Option B is incorrect because a VPC peering connection operates at Layer 3, not Layer 2. Option C is incorrect because Direct Connect is not required for this Layer 2 extension.

Option D is incorrect because a Transit Gateway does not provide Layer 2 extension.

Full explanation →

544

Multi-Selectmedium

Which TWO actions should be taken to secure a VPC that hosts a web application? (Choose TWO.)

Select 2 answers

A.Allow all ICMP traffic from the internet to the VPC.

B.Set the default route (0.0.0.0/0) to a virtual private gateway.

C.Use a VPC Gateway Endpoint for S3 to allow private access.

D.Configure Security Groups to allow only required inbound traffic.

E.Allow all outbound traffic from the application instances.

AnswersC, D

Provides secure access to S3 without internet.

Why this answer

To secure a VPC hosting a web application, you should use Security Groups to allow only required inbound traffic (Option D) and use a VPC Gateway Endpoint for S3 to allow private access to S3 without traversing the internet (Option C). Option A is incorrect because allowing all ICMP from the internet increases attack surface. Option B is incorrect because the default route should point to an Internet Gateway for internet access, not a virtual private gateway unless for VPN.

Option E is incorrect because allowing all outbound traffic may permit unauthorized data exfiltration.

Full explanation →

545

MCQhard

A company is migrating its on-premises data center to AWS. As part of the migration, they need to establish connectivity between their on-premises network (10.0.0.0/8) and multiple VPCs in a single region. They are using AWS Transit Gateway with a Direct Connect gateway. They have two Direct Connect connections, each with a private virtual interface (VIF) to the Direct Connect gateway. The on-premises routers are configured with BGP and are advertising 10.0.0.0/8. The Transit Gateway has three VPC attachments: VPC1 (10.1.0.0/16), VPC2 (10.2.0.0/16), and VPC3 (10.3.0.0/16). All VPC attachments are in the same Transit Gateway route table, which also includes the Direct Connect gateway attachment. Initially, all VPCs can communicate with on-premises. After a maintenance window, the network team adds a new on-premises subnet (10.4.0.0/16) and updates the BGP advertisement to include 10.4.0.0/16. However, after the change, instances in VPC3 can no longer reach on-premises resources in any subnet, while VPC1 and VPC2 can still communicate with all on-premises subnets including the new one. The network engineer checks the Transit Gateway route table and sees that the route for 10.0.0.0/8 is present, pointing to the Direct Connect gateway attachment. What is the MOST likely cause of the issue?

A.The VPC3 subnet route tables have a static route for 10.0.0.0/8 that points to a non-existent or unavailable target

B.The BGP advertisement for 10.4.0.0/16 exceeded the allowed prefix limit on the Direct Connect gateway

C.The Direct Connect gateway is not propagating routes to the Transit Gateway for VPC3

D.The Transit Gateway route table has a route for 10.4.0.0/16 that is blackholed

AnswerA

A more specific static route in the VPC route table can override the Transit Gateway route, causing blackhole.

Why this answer

The issue is specific to VPC3. Since the route table has a route for 10.0.0.0/8, all VPCs should be able to reach on-premises. However, if VPC3 has a more specific route that conflicts, it might cause issues.

But the most common cause is that the VPC3 route table (in the VPC itself) might have a local route or a VPN route that is more specific and overriding the Transit Gateway route. Alternatively, the Transit Gateway route table might have a specific route for VPC3 that is misconfigured. However, the description says the Transit Gateway route table has the correct route.

The issue could be that VPC3's subnet route tables have a route for the on-premises CIDR pointing to a different target (like a VPN connection) that is now inactive or incorrect. But the question says after adding the new subnet, VPC3 lost connectivity entirely. Perhaps the BGP update caused a route flap or a prefix limit was exceeded on the Direct Connect gateway, but that would affect all VPCs.

Since only VPC3 is affected, it's likely a VPC-specific issue. The most plausible is that the VPC3's route tables have a static route for the on-premises CIDR that was manually added and is now incorrect or conflicting. However, the best answer among the options is that the Transit Gateway route table has a blackhole route for 10.4.0.0/16, but that wouldn't affect all on-premises subnets.

Let's think: The Direct Connect gateway might have a prefix limit that was exceeded when adding 10.4.0.0/16, causing the BGP session to drop, but that would affect all VPCs. The most likely single-VPC issue is that VPC3's route tables have a route for the on-premises CIDR pointing to an incorrect attachment, like a peering connection or VPN that is not working. But the options given might include such a scenario.

I'll go with: The VPC3 route tables have a static route for 10.0.0.0/8 pointing to a network interface that no longer exists.

Full explanation →

546

MCQeasy

A company needs to provide internet access to a VPC that has both public and private subnets. They have already created an Internet Gateway and attached it to the VPC. What else must be configured for instances in the public subnet to be reachable from the internet?

A.Launch a NAT Gateway in the public subnet.

B.Add a route to the public subnet's route table pointing 0.0.0.0/0 to the Internet Gateway.

C.Attach the VPC to an AWS Transit Gateway.

D.Establish a VPN connection to the Internet Gateway.

AnswerB

This enables traffic to flow between the subnet and the internet.

Why this answer

For instances in a public subnet to be reachable from the internet, the subnet's route table must include a default route (0.0.0.0/0) pointing to the Internet Gateway (IGW). The IGW itself is a horizontally scaled, redundant component that provides a target for internet-bound traffic, but without the route, traffic from the internet cannot reach the instances. This route enables bidirectional communication: the IGW performs NAT for instances with public IPs, translating their private IPs to the associated Elastic IP or public IP.

Exam trap

The trap here is that candidates often confuse the purpose of a NAT Gateway (outbound-only) with the requirement for inbound internet reachability, mistakenly thinking a NAT Gateway is needed for public subnet instances, when in fact a route to the IGW is the only missing piece.

How to eliminate wrong answers

Option A is wrong because a NAT Gateway is used to provide outbound internet access to instances in private subnets, not to make instances in public subnets reachable from the internet; it does not allow inbound connections initiated from the internet. Option C is wrong because an AWS Transit Gateway is a network transit hub used to interconnect VPCs and on-premises networks, not to provide internet access to a VPC; it does not replace the need for an IGW and a route to it. Option D is wrong because a VPN connection is used for secure site-to-site connectivity between on-premises networks and a VPC, not for direct internet access; the Internet Gateway is the correct attachment point for internet traffic, and a VPN cannot be established to an IGW.

Full explanation →

547

Multi-Selecthard

An organization is designing a hybrid network using AWS Direct Connect with a private VIF. They want to ensure high availability and failover. Which THREE components should be part of the design?

Select 3 answers

A.A NAT gateway in each Availability Zone.

B.Two separate Direct Connect connections from different providers or locations.

C.BGP with multiple sessions and AS-path prepending for route preference.

D.A VPN connection as a backup to the Direct Connect.

E.A single Direct Connect connection with multiple VLANs.

AnswersB, C, D

Redundant physical connections prevent a single point of failure.

Why this answer

Using two separate Direct Connect connections from different providers or locations ensures physical diversity, eliminating single points of failure. This design meets the high availability requirement by providing redundant paths for traffic, even if one connection or provider experiences an outage.

Exam trap

The trap here is that candidates often think a single Direct Connect connection with multiple VLANs provides redundancy, but VLANs only separate traffic logically and do not protect against physical link failure, so multiple physical connections are required for true high availability.

Full explanation →

548

MCQeasy

A company wants to allow their employees to securely access resources in a VPC from their home offices. Which AWS service should they use?

A.AWS Client VPN

B.AWS Direct Connect

C.AWS Site-to-Site VPN

D.Amazon CloudFront

AnswerA

Client VPN provides secure remote access for individual users.

Why this answer

AWS Client VPN is a managed, cloud-based VPN service that allows individual users to securely access AWS resources from remote locations, such as home offices, using a VPN client installed on their device. It supports OpenVPN-based connections and integrates with Active Directory for user authentication, making it ideal for remote employee access to a VPC without requiring dedicated hardware or complex site-to-site configurations.

Exam trap

AWS often tests the distinction between user-based VPN (Client VPN) and network-based VPN (Site-to-Site VPN), where candidates mistakenly choose Site-to-Site VPN for remote employees because they overlook the requirement for individual client software and user authentication.

How to eliminate wrong answers

Option B (AWS Direct Connect) is wrong because it provides a dedicated, private network connection from an on-premises data center to AWS, which is designed for high-bandwidth, consistent throughput and is not suitable for individual home office users due to high cost and physical installation requirements. Option C (AWS Site-to-Site VPN) is wrong because it creates a persistent VPN tunnel between an on-premises network (e.g., a corporate office with a router) and a VPC, requiring a customer gateway device and static routing, which is impractical for individual remote employees without a fixed network infrastructure. Option D (Amazon CloudFront) is wrong because it is a content delivery network (CDN) that caches and delivers static and dynamic content at edge locations, not a VPN service for secure network access to VPC resources.

Full explanation →

549

MCQhard

A company has a VPC with multiple subnets. The security team requires that all outbound traffic from the VPC to the internet must traverse a centralized inspection appliance for traffic inspection. Which architecture should be used?

A.Use VPC Peering between all VPCs

B.Configure a NAT Gateway in each Availability Zone

C.Use Transit Gateway with VPC attached and route traffic through a shared services VPC containing the inspection appliance

D.Use AWS Direct Connect to route traffic on-premises

AnswerC

Transit Gateway enables routing traffic through an inspection VPC.

Why this answer

A Transit Gateway with a shared services VPC architecture allows centralized inspection of all outbound internet traffic. By attaching the VPCs to a Transit Gateway and routing traffic through a shared services VPC that hosts the inspection appliance (e.g., a firewall or proxy), you can enforce security policies. The Transit Gateway acts as a hub, enabling transitive routing between VPCs while directing internet-bound traffic to the inspection appliance before it reaches an internet gateway or NAT gateway.

Exam trap

AWS often tests the misconception that VPC Peering or NAT Gateway can provide centralized inspection, but they lack the transitive routing and traffic forwarding capabilities required for a hub-and-spoke inspection model.

How to eliminate wrong answers

Option A is wrong because VPC Peering does not support transitive routing; traffic between peered VPCs cannot be routed through a centralized inspection appliance in another VPC without complex and unscalable full-mesh peering. Option B is wrong because a NAT Gateway only provides outbound internet connectivity with source NAT and does not support traffic inspection; it cannot forward traffic to an inspection appliance for deep packet inspection. Option D is wrong because AWS Direct Connect is used for private connectivity to on-premises networks, not for routing outbound internet traffic through an inspection appliance; it does not inherently provide internet access or traffic inspection capabilities.

Full explanation →

550

MCQeasy

A company wants to connect two VPCs in the same AWS region using a hub-and-spoke model. Which AWS service should be used to route traffic between the VPCs through a central inspection VPC?

A.AWS Direct Connect

B.AWS Transit Gateway

C.AWS VPN CloudHub

D.VPC Peering

AnswerB

Transit Gateway enables hub-and-spoke connectivity with centralized routing and inspection.

Why this answer

AWS Transit Gateway is the correct choice because it acts as a central hub that connects multiple VPCs and on-premises networks in a hub-and-spoke topology. It allows you to route traffic between VPCs through a central inspection VPC for security or compliance purposes, using route tables to control traffic flow without requiring individual peering connections.

Exam trap

The ANS-C01 exam often tests the misconception that VPC Peering can be used for hub-and-spoke topologies, but candidates must remember that VPC Peering does not support transitive routing, so traffic cannot pass through a central inspection VPC.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect is a dedicated network connection from on-premises to AWS, not a service for routing traffic between VPCs within the same region. Option C is wrong because AWS VPN CloudHub connects multiple VPN sites to a single VPN gateway, but it does not support VPC-to-VPC routing through a central inspection VPC. Option D is wrong because VPC Peering creates a direct, one-to-one connection between two VPCs and does not support transitive routing through a central VPC, making it unsuitable for a hub-and-spoke model with inspection.

Full explanation →

551

MCQmedium

A company has a VPC with a public subnet and a private subnet. They launch an EC2 instance in the private subnet with a private IP only. The instance needs to download patches from the internet. Which configuration is required?

A.Launch a NAT instance in the private subnet and configure source/destination check.

B.Create a VPC endpoint for the patch service.

C.Create a NAT gateway in the public subnet and add a default route to the NAT gateway in the private subnet's route table.

D.Attach an internet gateway to the VPC and add a default route to it in the private subnet's route table.

AnswerC

NAT gateway enables outbound internet access for private instances while preventing inbound traffic.

Why this answer

A NAT gateway in the public subnet provides outbound internet access for instances in the private subnet while preventing inbound connections from the internet. By adding a default route (0.0.0.0/0) in the private subnet's route table pointing to the NAT gateway, traffic from the EC2 instance destined for the internet is forwarded to the NAT gateway, which then uses its Elastic IP to communicate with the internet. This allows the instance to download patches without requiring a public IP or direct internet gateway access.

Exam trap

The ANS-C01 exam often tests the misconception that a NAT instance or gateway can be placed in a private subnet, but the key trap is that NAT devices must reside in a public subnet with an internet gateway route to function correctly for outbound internet access.

How to eliminate wrong answers

Option A is wrong because launching a NAT instance in the private subnet would not allow outbound internet access, as the private subnet has no direct path to the internet; NAT instances must be placed in a public subnet with an internet gateway route. Option B is wrong because a VPC endpoint for the patch service is not a general solution—it only works if the patch service is an AWS service (e.g., Systems Manager) and does not provide internet access for arbitrary patch repositories. Option D is wrong because attaching an internet gateway to the VPC and adding a default route to it in the private subnet's route table would expose the private instance directly to the internet, violating the private subnet's isolation and bypassing NAT, which is not a secure or valid configuration.

Full explanation →

552

Multi-Selecthard

A company is designing a global network with multiple VPCs connected via AWS Transit Gateway. The company wants to route traffic between VPCs through a centralized inspection VPC that hosts firewalls. Which configurations are required? (Choose THREE.)

Select 3 answers

A.Configure a default route (0.0.0.0/0) in the Transit Gateway route table pointing to the inspection VPC attachment.

B.Create VPC endpoints for the inspection services.

C.Add static routes in the Transit Gateway route tables for VPC attachments.

D.Propagate VPC attachment routes to a dedicated route table.

E.Establish VPC peering connections between each VPC and the inspection VPC.

AnswersA, C, D

Directs all inter-VPC traffic to inspection VPC.

Why this answer

Configuring a default route (0.0.0.0/0) in the Transit Gateway route table pointing to the inspection VPC attachment forces all inter-VPC traffic that does not match a more specific route to be sent to the inspection VPC for firewall inspection. This is a common pattern for centralized inspection, where the inspection VPC acts as a next hop for all traffic between VPCs.

Exam trap

AWS often tests the misconception that VPC peering can be used for transitive routing or that VPC endpoints can replace Transit Gateway for inter-VPC traffic inspection, but neither supports the required centralized inspection pattern.

Full explanation →

553

MCQhard

Refer to the exhibit. An EC2 instance launched in subnet-1a is unable to access the internet. Which is the most likely cause?

A.The route table rtb-main does not have a default route to the internet gateway.

B.The VPC does not have DNS hostnames enabled.

C.Subnet-1a does not assign public IP addresses automatically.

D.Subnet-1a is not associated with any route table.

AnswerC

MapPublicIpOnLaunch is false, so instances lack public IPs.

Why this answer

If subnet-1a does not have the 'Auto-assign public IPv4 address' setting enabled, EC2 instances launched in that subnet will not receive a public IP address automatically. Without a public IP, the instance cannot communicate with the internet through an internet gateway, even if the route table has a default route (0.0.0.0/0) pointing to the internet gateway. The instance would need an Elastic IP or a public IP assigned at launch to enable internet access.

Exam trap

The ANS-C01 exam often tests the misconception that a missing default route is the only cause for internet access failure, but the trap here is that even with a correct route, the instance must have a public IP (via auto-assign or Elastic IP) for the internet gateway to forward traffic back to it.

How to eliminate wrong answers

Option A is wrong because the route table rtb-main could still have a default route to the internet gateway; the question does not indicate it is missing, and the issue is specifically about the subnet's public IP assignment. Option B is wrong because DNS hostnames are not required for internet access; they only affect DNS resolution for instances within the VPC, not the ability to route traffic to the internet. Option D is wrong because every subnet is implicitly associated with the main route table if no explicit association exists, so subnet-1a would still have a route table (rtb-main) and not be without one.

Full explanation →

554

MCQeasy

A network engineer is troubleshooting a Site-to-Site VPN connection between an on-premises network and AWS. The VPN tunnel is up, but traffic is not flowing from the on-premises network to a VPC. The VPC has a virtual private gateway attached, and the route table has a route pointing to the virtual private gateway for the on-premises CIDR (192.168.0.0/16). The on-premises firewall shows that traffic is being sent to the VPN tunnel. What should the engineer check next?

A.Verify that the virtual private gateway is attached to the VPC.

B.Verify that the on-premises route table has a route to the VPC CIDR via the VPN tunnel.

C.Verify that the on-premises firewall is not blocking UDP port 500 for IKE.

D.Verify that the VPN tunnel's pre-shared key matches on both sides.

AnswerB

Without a return route, traffic from on-premises may not reach the VPC.

Why this answer

Since the VPN tunnel is up and the on-premises firewall confirms traffic is being sent to the tunnel, the issue is likely on the on-premises routing side. For traffic to flow from on-premises to the VPC, the on-premises router must have a route pointing to the VPC CIDR via the VPN tunnel interface. Without this route, packets will not be forwarded into the tunnel, even though the tunnel itself is operational.

Exam trap

The trap here is that candidates assume a 'tunnel up' status guarantees traffic flow, but the ANS-C01 exam tests the distinction between control plane (tunnel establishment) and data plane (routing) issues.

How to eliminate wrong answers

Option A is wrong because the virtual private gateway is already attached to the VPC (the route table has a route pointing to it, and the VPN tunnel is up, which requires attachment). Option C is wrong because UDP port 500 (IKE) is used for tunnel establishment, not for data plane traffic; since the tunnel is up, IKE negotiation succeeded. Option D is wrong because a mismatched pre-shared key would prevent the tunnel from coming up; the tunnel is up, so the keys match.

Full explanation →

555

MCQmedium

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network uses BGP to advertise its prefixes. Recently, the on-premises router started advertising a more specific route (10.0.0.0/24) that overlaps with the VPC's CIDR (10.0.0.0/16). What is the impact on traffic destined to 10.0.0.5?

A.The instance becomes unreachable from on-premises.

B.Return traffic from the instance to on-premises is routed through Direct Connect instead of staying within the VPC.

C.Traffic destined to the instance is blackholed.

D.Traffic is load-balanced between the VPC and Direct Connect.

AnswerB

More specific route is preferred.

Why this answer

When an on-premises router advertises a more specific route (10.0.0.0/24) via BGP over a Direct Connect private VIF, the VPC propagates this route into its route tables. For traffic destined to 10.0.0.5, the VPC now has a more specific route (10.0.0.0/24) pointing to the virtual private gateway (VGW), overriding the local VPC route (10.0.0.0/16). This causes return traffic from the instance to on-premises to be routed through Direct Connect instead of staying within the VPC, as the VPC's route table prefers the longest prefix match.

Exam trap

The ANS-C01 exam often tests the misconception that a more specific BGP route will cause the instance to become unreachable or blackholed, but the actual impact is asymmetric routing where return traffic is forced out through Direct Connect.

How to eliminate wrong answers

Option A is wrong because the instance remains reachable from on-premises; the on-premises router can still send traffic to 10.0.0.5 via the Direct Connect connection, and the VPC will forward it locally. Option C is wrong because traffic is not blackholed; the more specific route directs traffic to the VGW, which forwards it to the on-premises network, so packets are not dropped. Option D is wrong because there is no load-balancing; the VPC route table selects a single path based on the longest prefix match, and the more specific route (10.0.0.0/24) takes precedence over the local VPC route (10.0.0.0/16).

Full explanation →

556

MCQhard

A security engineer attaches the above IAM policy to an IAM user. The user then attempts to launch an EC2 instance from an IP address outside the 10.0.0.0/8 range. What will happen?

A.The request will be allowed because the policy allows ec2:* on all resources.

B.The request will be denied because the condition is not satisfied.

C.The request will be denied because the policy does not include a Deny statement.

D.The request will be allowed because the condition evaluates to true.

AnswerB

Since the source IP is outside the allowed range, the condition fails, resulting in implicit deny.

Why this answer

The policy allows ec2:* only when the source IP is within 10.0.0.0/8. If the user is coming from outside that range, the condition is not met, so the action is not allowed. The default is implicit deny, so the request will be denied.

Option B is correct. Option A is wrong because the condition is not met. Option C is wrong because the policy does not deny explicitly; it just doesn't allow.

Option D is wrong because the condition evaluates to false.

Full explanation →

557

MCQeasy

A company has a VPC with multiple EC2 instances that need to access an Amazon S3 bucket. The network team wants to ensure that traffic to S3 stays within the AWS network and does not traverse the internet. The VPC has a VPC endpoint for S3 (Gateway type). The team has created the endpoint and attached the appropriate policy allowing access to the specific S3 bucket. However, EC2 instances in a private subnet cannot access the S3 bucket. The private subnet route table has a default route pointing to a NAT Gateway. Which change should the network team make to allow private instances to access S3 via the endpoint?

A.Modify the VPC endpoint policy to allow all principals.

B.Change the private subnet route table's default route to point to the VPC endpoint.

C.Remove the default route from the private subnet route table.

D.Add a route in the private subnet route table for the S3 prefix list (com.amazonaws.region.s3) pointing to the VPC endpoint.

AnswerD

This ensures S3 traffic uses the endpoint instead of the NAT Gateway.

Why this answer

For a Gateway VPC endpoint to work, the route table associated with the subnet must include a route for the S3 prefix list (e.g., com.amazonaws.region.s3) pointing to the endpoint ID. The existing default route to the NAT Gateway would otherwise route S3 traffic to the internet, bypassing the endpoint. Adding the specific route for the S3 prefix list ensures that traffic destined for S3 uses the VPC endpoint and stays within the AWS network.

Therefore, option D is correct.

Full explanation →

558

MCQeasy

A company has a VPC with a CIDR block of 10.0.0.0/16. The company needs to peer with another VPC that has a CIDR block of 10.0.0.0/16. What should the network engineer do to enable connectivity between the two VPCs?

A.Use an AWS Transit Gateway with Network Address Translation (NAT) to resolve overlapping CIDRs.

B.Use an internet gateway to route traffic between the VPCs.

C.Create a VPC peering connection and add routes in both route tables.

D.Create a VPC peering connection and use a network address translation (NAT) device.

AnswerA

Transit Gateway can support overlapping CIDRs with NAT.

Why this answer

When two VPCs have overlapping CIDR blocks (both 10.0.0.0/16), a standard VPC peering connection cannot be established due to route table conflicts. An AWS Transit Gateway can be used with Network Address Translation (NAT) to translate the overlapping IP addresses, enabling connectivity between the VPCs by allowing traffic to be routed through the Transit Gateway with NAT applied to resolve the address conflict.

Exam trap

The trap here is that candidates assume VPC peering can always be established and then fixed with NAT, but AWS VPC peering explicitly requires non-overlapping CIDR blocks at the time of creation, making peering impossible regardless of later NAT configuration.

How to eliminate wrong answers

Option B is wrong because an internet gateway is designed to enable communication between a VPC and the internet, not between two VPCs; it cannot route traffic directly between VPCs. Option C is wrong because VPC peering requires non-overlapping CIDR blocks to add routes in both route tables; with identical 10.0.0.0/16 CIDRs, the routes would conflict, making peering impossible. Option D is wrong because a VPC peering connection cannot be created with overlapping CIDRs in the first place, so adding a NAT device after peering is not feasible; the peering request itself would fail due to the CIDR conflict.

Full explanation →

559

MCQeasy

A company is using AWS Direct Connect to connect its on-premises data center to AWS. The network team wants to monitor the latency and packet loss on the Direct Connect virtual interfaces. Which AWS service should be used to measure these metrics?

A.AWS Config

B.AWS CloudWatch

C.AWS X-Ray

D.AWS CloudTrail

AnswerB

CloudWatch metrics for Direct Connect include latency and packet loss.

Why this answer

AWS CloudWatch is the correct service because it provides built-in metrics for Direct Connect virtual interfaces, including 'VirtualInterfaceRxNoPacket' and 'VirtualInterfaceTxNoPacket' for packet loss, and you can derive latency by monitoring the 'VirtualInterfaceBpsEgress' and 'VirtualInterfaceBpsIngress' metrics with appropriate alarms. CloudWatch also supports custom metrics and logs that can be used to calculate round-trip time (RTT) by analyzing ping results or using AWS Direct Connect's native health checks. This allows the network team to set up dashboards and alarms for latency and packet loss directly from the Direct Connect metrics.

Exam trap

The trap here is that candidates often confuse AWS CloudWatch with AWS X-Ray, assuming X-Ray can measure network latency because it traces HTTP requests, but X-Ray operates at the application layer and cannot measure Layer 2 or Layer 3 packet loss or latency on a Direct Connect virtual interface.

How to eliminate wrong answers

Option A is wrong because AWS Config is a service for evaluating, auditing, and assessing the configurations of AWS resources against desired policies, not for monitoring real-time network performance metrics like latency or packet loss. Option C is wrong because AWS X-Ray is designed for tracing and analyzing application-level requests and distributed transactions, not for measuring network-level metrics such as latency or packet loss on Direct Connect virtual interfaces. Option D is wrong because AWS CloudTrail records API activity and user actions for auditing and governance, but it does not capture network performance metrics like latency or packet loss.

Full explanation →

560

Matchingmedium

Match each AWS security feature to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Stateful firewall that controls inbound and outbound traffic at instance level

Stateless firewall that controls traffic at subnet level

Web application firewall that protects against common web exploits

Managed DDoS protection service with enhanced detection and mitigation

Managed firewall service that provides stateful inspection for VPC traffic

Why these pairings

These are core security services for network protection. Security Groups are instance-level, NACLs are subnet-level, WAF protects web apps, and Shield provides DDoS protection.

Full explanation →

561

Multi-Selectmedium

A company is designing a hybrid network using AWS Direct Connect. They have a VPC with a CIDR of 10.0.0.0/16 and an on-premises network with CIDR 10.0.0.0/8. The company needs to ensure that traffic from the VPC to the on-premises network uses the Direct Connect connection and that traffic does not traverse the internet. Which TWO actions are required? (Choose TWO.)

Select 2 answers

A.Attach the VPC to an AWS Transit Gateway

B.Create a private virtual interface (VIF) on the Direct Connect connection

C.Configure static routes or BGP to advertise the on-premises CIDR to the VPC

D.Create a public virtual interface (VIF) on the Direct Connect connection

E.Create a Direct Connect Gateway to connect the VPC to the on-premises network

AnswersB, C

Private VIF allows connectivity to the VPC via the Virtual Private Gateway.

Why this answer

A private virtual interface (VIF) is required to connect your VPC to an on-premises network over Direct Connect. It allows traffic to traverse the Direct Connect connection privately, bypassing the internet. Without a private VIF, you cannot route traffic from the VPC to the on-premises network over the Direct Connect link.

Exam trap

The trap here is that candidates often confuse public VIFs with private VIFs, thinking a public VIF can be used for on-premises connectivity, or they assume a Direct Connect Gateway is always required for any Direct Connect setup, even for a single VPC.

Full explanation →

562

MCQmedium

A company has a VPC with multiple subnets and an internet gateway. The security team wants to detect and block malicious traffic patterns. Which AWS service should be used to provide intrusion detection and prevention?

A.AWS Network Firewall

B.Network ACLs

C.Security Groups

D.AWS WAF

AnswerA

Network Firewall provides managed intrusion detection and prevention.

Why this answer

AWS Network Firewall is a managed service that provides both intrusion detection and intrusion prevention capabilities, with stateful inspection of network traffic. Option B (Network ACLs) is incorrect because NACLs are stateless and do not provide intrusion prevention; they only provide basic allow/deny rules. Option C (Security Groups) is incorrect because Security Groups are stateful but only provide instance-level filtering without IPS functionality.

Option D (AWS WAF) is incorrect because WAF protects web applications at Layer 7 and does not provide network-level intrusion prevention.

Full explanation →

563

MCQhard

A company has a Direct Connect connection with two private virtual interfaces (VIFs) to two different VPCs in the same AWS Region. The company wants to use AWS Transit Gateway to simplify connectivity between these VPCs and their on-premises network. Which steps are required to integrate the existing Direct Connect connection with Transit Gateway?

A.Set up a VPN connection over the Direct Connect link and attach the VPN to the Transit Gateway.

B.Attach the existing private VIFs directly to the Transit Gateway.

C.Create a new private VIF on the Direct Connect connection and attach it to the Transit Gateway.

D.Create a Direct Connect gateway, associate the existing VIFs, and attach the Direct Connect gateway to the Transit Gateway.

AnswerD

This is the correct integration path.

Why this answer

AWS Direct Connect private VIFs cannot be attached directly to a Transit Gateway. Instead, you must create a Direct Connect Gateway, associate the existing private VIFs with it, and then attach the Direct Connect Gateway to the Transit Gateway. This architecture allows the Transit Gateway to route traffic between the on-premises network (via the Direct Connect connection) and the attached VPCs, while also enabling inter-VPC routing through the Transit Gateway.

Exam trap

The trap here is that candidates assume private VIFs can be attached directly to a Transit Gateway, similar to how they attach to VPCs, but AWS requires the intermediate Direct Connect Gateway to mediate between the Layer 2 VIF and the Layer 3 Transit Gateway routing domain.

How to eliminate wrong answers

Option A is wrong because setting up a VPN over Direct Connect adds unnecessary complexity and overhead; Transit Gateway natively supports Direct Connect Gateway integration without requiring a VPN. Option B is wrong because private VIFs cannot be attached directly to a Transit Gateway; they must be associated with a Direct Connect Gateway first. Option C is wrong because creating a new private VIF is unnecessary; the existing VIFs can be reused by associating them with a Direct Connect Gateway, and a single Direct Connect Gateway can handle multiple VIFs for the same Transit Gateway.

Full explanation →

564

MCQmedium

A company has a VPC with public and private subnets. They have an EC2 instance in a private subnet that needs to access the internet for software updates. Which solution provides internet access while keeping the instance private?

A.Attach an internet gateway to the VPC and assign a public IP to the EC2 instance.

B.Create a NAT gateway in a public subnet, and update the private subnet's route table to point 0.0.0.0/0 to the NAT gateway.

C.Use an AWS PrivateLink VPC endpoint for the software update service.

D.Set up a VPC peering connection with another VPC that has internet access.

AnswerB

The NAT gateway enables outbound internet traffic while keeping the instance private.

Why this answer

A NAT gateway in a public subnet allows instances in private subnets to initiate outbound internet traffic while preventing inbound traffic from the internet. Option B is correct. Option A (internet gateway) would expose the instance to inbound traffic if assigned a public IP.

Option C (VPC peering) does not provide internet access. Option D (VPC endpoint) only provides access to specific AWS services, not general internet.

Full explanation →

565

Multi-Selectmedium

Which TWO of the following are valid methods to connect an on-premises data center to an Amazon VPC over a private, dedicated network connection? (Choose two.)

Select 2 answers

A.VPC peering

B.AWS Direct Connect

C.AWS Direct Connect with a VPN (IPsec) over the private VIF

D.AWS Site-to-Site VPN over the internet

E.AWS Client VPN

AnswersB, C

AWS Direct Connect provides a dedicated private connection from on-premises to VPC.

Why this answer

AWS Direct Connect provides a dedicated private connection. AWS VPN can also be used over the internet but is not dedicated; however, a VPN over Direct Connect is possible. The question asks for 'private, dedicated network connection', so Direct Connect is the primary method.

VPN over internet is not dedicated. VPN over Direct Connect uses the dedicated connection.

Full explanation →

566

MCQmedium

A company has deployed a multi-VPC architecture with AWS Transit Gateway. The network team notices that traffic between two VPCs is intermittently dropped. Both VPCs are attached to the same transit gateway. Which action should the network engineer take to troubleshoot the issue?

A.Configure AWS Direct Connect to route traffic between the VPCs.

B.Use Transit Gateway Network Manager to view the network topology.

C.Enable CloudWatch metrics for the transit gateway attachments.

D.Enable VPC Flow Logs on the subnets of the VPCs.

AnswerD

VPC Flow Logs capture detailed traffic data, including dropped packets.

Why this answer

VPC Flow Logs capture IP traffic information at the network interface level, allowing engineers to analyze traffic patterns and identify dropped packets. Option A is incorrect because AWS Direct Connect is a dedicated network connection from on-premises to AWS, not between VPCs. Option B is incorrect because Transit Gateway Network Manager provides a visual representation of the network topology but does not provide packet-level details.

Option C is incorrect because CloudWatch metrics for transit gateway attachments show aggregate metrics like bytes in/out but not individual packet drops.

Full explanation →

567

Multi-Selectmedium

A company's security team is designing a network architecture for a multi-tier application. The web tier must be accessible from the internet, while the application and database tiers must be isolated. Which TWO actions should be taken to meet these requirements?

Select 2 answers

A.Place application and database servers in a public subnet with a VPC endpoint

B.Place web servers in a private subnet with a NAT Gateway

C.Place application and database servers in private subnets

D.Place web servers in a public subnet with an Internet Gateway

E.Use security group rules to allow traffic only between tiers

AnswersC, D

Private subnets isolate them from direct internet access.

Why this answer

A public subnet with an Internet Gateway allows web servers to be accessed from the internet. Private subnets isolate application and database tiers from direct internet access. Option A is incorrect because placing application and database servers in a public subnet exposes them to the internet.

Option B is incorrect because web servers in a private subnet cannot be reached from the internet; NAT Gateway only provides outbound access. Option E is incorrect because security group rules alone do not provide subnet-level isolation; they are used for instance-level traffic control.

Full explanation →

568

MCQmedium

A company has a VPC with a CIDR of 10.0.0.0/16. They have two Availability Zones, each with a public subnet (10.0.1.0/24 and 10.0.2.0/24) and a private subnet (10.0.3.0/24 and 10.0.4.0/24). They have an internet-facing ALB in the public subnets and EC2 instances in the private subnets. The EC2 instances need to download updates from the internet. They deploy a NAT Gateway in each public subnet and add routes in the private subnet route tables pointing to the respective NAT Gateway in the same AZ. However, the EC2 instances in AZ2 cannot access the internet, while those in AZ1 can. What is the most likely cause?

A.The security group of the EC2 instances in AZ2 is blocking outbound traffic.

B.The NAT Gateway in AZ2 does not have an Elastic IP address assigned.

C.The private subnet in AZ2 is routing traffic to the NAT Gateway in AZ1, which is in a different Availability Zone and incurs cross-AZ charges but should still work.

D.The route table for the private subnet in AZ2 is missing a route to the NAT Gateway.

AnswerB

A NAT Gateway requires an Elastic IP; without it, it cannot route traffic to the internet.

Why this answer

The NAT Gateway in AZ2 does not have an Elastic IP address assigned. A NAT Gateway requires an Elastic IP to enable outbound internet traffic. Without it, the NAT Gateway cannot route traffic to the internet, causing the EC2 instances in AZ2 to fail to download updates.

Option A is incorrect because security group rules are account-level and would affect both AZs equally. Option C is incorrect because the route table in AZ2 is configured to point to the NAT Gateway in the same AZ, not cross-AZ. Option D is incorrect because the route table for the private subnet in AZ2 does have a route to the NAT Gateway, but the NAT Gateway itself is missing the Elastic IP.

Full explanation →

569

MCQmedium

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises data centers. The network team notices that traffic between two VPCs is taking an unexpected path through the on-premises network instead of staying within the Transit Gateway. What is the most likely cause?

A.The Transit Gateway route table is not associated with the VPC attachments.

B.The VPC subnet route tables are not pointing to the Transit Gateway as the target.

C.The on-premises network is advertising more specific routes via BGP that override the Transit Gateway routes.

D.VPC peering connections are being used alongside Transit Gateway, creating conflicting routes.

AnswerC

BGP routes from on-premises can be more specific and take precedence, causing traffic to be sent on-premises.

Why this answer

When using AWS Transit Gateway with VPN or Direct Connect, the on-premises network can advertise more specific BGP routes that override the default routes learned from the Transit Gateway. This causes traffic to take the path through the on-premises network instead of staying within the Transit Gateway. Option A is wrong because route tables are associated with the Transit Gateway attachments, not the VPCs themselves.

Option B is wrong because the subnet route tables must point to the Transit Gateway for traffic to be routed correctly, but that would not cause traffic to go on-premises; rather, it would prevent traffic from reaching the Transit Gateway. Option D is wrong because VPC peering is not used with Transit Gateway in this scenario; conflicting routes could occur but the most likely cause is more specific BGP routes from on-premises.

Full explanation →

570

MCQmedium

A company is designing a hybrid network architecture that connects an on-premises data center to AWS via AWS Direct Connect. The on-premises network uses BGP to advertise routes to AWS. The company wants to ensure that the on-premises network can reach all VPCs in the AWS account using a single Direct Connect virtual interface. Which solution should the architect use?

A.Create a Direct Connect gateway and associate all VPCs directly.

B.Create a transit gateway and a Direct Connect gateway. Attach the VPCs to the transit gateway and associate the transit gateway with the Direct Connect gateway.

C.Create VPC peering connections between all VPCs and the on-premises network.

D.Create a virtual private gateway and attach all VPCs to it.

AnswerB

This setup allows multiple VPCs to communicate over a single Direct Connect virtual interface.

Why this answer

A transit gateway acts as a central hub for VPC-to-VPC and on-premises connectivity, and when associated with a Direct Connect gateway via a transit virtual interface, it allows a single Direct Connect connection to reach multiple VPCs. The Direct Connect gateway terminates the BGP session from on-premises and forwards traffic to the transit gateway, which then routes to the attached VPCs. This design scales to many VPCs without requiring multiple virtual interfaces or complex peering.

Exam trap

The trap here is that candidates often assume a Direct Connect gateway can directly connect to multiple VPCs, but it requires a transit gateway to enable multi-VPC connectivity, as the Direct Connect gateway alone only supports a single VPC via a virtual private gateway.

How to eliminate wrong answers

Option A is wrong because a Direct Connect gateway can only be associated with a single virtual private gateway or transit gateway per association, not directly with multiple VPCs; it requires an intermediate gateway to route traffic to multiple VPCs. Option C is wrong because VPC peering does not support transitive routing and requires a full mesh of peering connections between all VPCs and the on-premises network, which is not feasible for a single Direct Connect virtual interface. Option D is wrong because a virtual private gateway can only be attached to a single VPC, so it cannot provide connectivity to all VPCs in the account via one Direct Connect virtual interface.

Full explanation →

571

Multi-Selecteasy

A company is designing a VPC architecture for a web application that must be highly available across multiple Availability Zones. Which TWO components should be deployed in at least two Availability Zones to meet this requirement?

Select 2 answers

A.Transit Gateway

B.Internet Gateway

C.NAT Gateway

D.Application Load Balancer (with subnets in multiple AZs)

E.VPN connection

AnswersC, D

NAT Gateway is deployed in a specific AZ; multiple AZs needed for HA.

Why this answer

A NAT Gateway is a regional resource that is deployed within a specific Availability Zone, but to achieve high availability across multiple AZs, you must deploy a NAT Gateway in each AZ used by your application. This ensures that if one AZ fails, instances in other AZs can still access the internet or other AWS services through their local NAT Gateway, preventing a single point of failure.

Exam trap

The trap here is that candidates often assume NAT Gateway is a regional service like Internet Gateway, but it is actually AZ-specific and requires explicit deployment in each AZ for high availability, while the Application Load Balancer requires subnets in multiple AZs to be considered highly available.

Full explanation →

572

MCQmedium

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that no security group allows inbound SSH (port 22) from 0.0.0.0/0. Which policy type should be used?

A.Network ACL

B.IAM policy

C.Service Control Policy (SCP)

D.AWS Config rule

AnswerC

SCPs can deny creation of security groups with SSH from 0.0.0.0/0.

Why this answer

The Service Control Policy (SCP). SCPs are used in AWS Organizations to centrally control the maximum available permissions for all accounts in an organization. They can be used to prevent security groups from allowing inbound SSH from 0.0.0.0/0 by denying the ability to create or modify security group rules that permit such traffic.

Network ACLs (Option A) operate at the subnet level and are not account-wide; they control traffic entering/exiting subnets, but cannot enforce organizational policies across multiple accounts. IAM policies (Option B) apply to users, groups, or roles, and cannot directly restrict security group configurations. AWS Config rules (Option D) are detective controls that can evaluate compliance but are not preventive; they do not block the creation of non-compliant security group rules.

Therefore, SCP is the appropriate preventive policy type.

Full explanation →

573

Multi-Selecthard

Which TWO actions can be taken to reduce the attack surface of a VPC's public subnets? (Choose 2.)

Select 2 answers

A.Allow all inbound traffic from the internet to the public subnets

B.Place web servers in private subnets and use a load balancer in a public subnet

C.Use a single subnet for all application tiers

D.Use security groups to restrict inbound traffic to only necessary ports and IPs

E.Disable ICMP traffic on the network ACL

AnswersB, D

Reduces direct exposure of web servers.

Why this answer

Placing web servers in private subnets and using a load balancer in a public subnet reduces the attack surface by ensuring that the web servers have no direct internet-facing IP addresses. The load balancer acts as a single point of ingress, allowing security groups to tightly control traffic from the load balancer to the web servers, while the public subnet only exposes the load balancer's endpoints. This architecture follows AWS best practices for a multi-tier application, minimizing the number of resources directly accessible from the internet.

Exam trap

AWS often tests the misconception that disabling ICMP or using network ACLs alone is sufficient to reduce attack surface, when in fact the primary reduction comes from architectural changes like moving instances to private subnets and using a load balancer, combined with security group restrictions.

Full explanation →

574

MCQhard

A company is designing a network security architecture for a multi-account AWS environment using AWS Transit Gateway. They need to ensure that all traffic between VPCs must be inspected by a centralized security appliance (e.g., firewall) in a shared services VPC. Which routing design meets this requirement?

A.Attach all VPCs to a single route table and enable VPC peering for inspection VPC.

B.Use a centralized NAT gateway in the inspection VPC and configure all spokes to route traffic through it.

C.Attach the inspection VPC and all spoke VPCs to the same Transit Gateway route table, and add a static route for the spoke VPC CIDRs pointing to the inspection VPC attachment, with blackhole routes for the same CIDRs.

D.Create separate route tables for each VPC attachment and propagate routes from all VPCs.

AnswerC

This forces spoke traffic to be routed to the inspection VPC for inspection before reaching the destination.

Why this answer

By attaching both the inspection VPC and the spoke VPCs to the same route table with blackhole routes, traffic between spokes is forced to go through the inspection VPC. Option A is incorrect because it uses separate route tables, which would allow direct routing. Option B allows direct traffic.

Option D is not a standard practice.

Full explanation →

575

MCQmedium

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from an S3 bucket in the same region. The company wants to minimize data transfer costs and avoid traversing the internet. Which solution should the company implement?

A.Create a VPC Interface Endpoint for S3 and attach it to the private subnet.

B.Configure an S3 bucket policy to allow access from the VPC and use an Internet Gateway.

C.Create a VPC Gateway Endpoint for S3 and attach it to the private subnet's route table.

D.Create a NAT Gateway in the public subnet and route traffic to the S3 bucket through it.

AnswerC

Gateway Endpoint is free and provides private connectivity to S3.

Why this answer

A VPC Gateway Endpoint for S3 provides private, cost-free connectivity to S3 from within a VPC without traversing the internet. It uses prefix-based routing via the route table, ensuring traffic to S3 stays within the AWS network, minimizing data transfer costs and avoiding internet egress charges.

Exam trap

The trap here is that candidates often confuse Gateway Endpoints with Interface Endpoints, assuming Interface Endpoints are always the better choice for private connectivity, but for S3 and DynamoDB, Gateway Endpoints are the cost-optimized solution that avoids data transfer charges.

How to eliminate wrong answers

Option A is wrong because a VPC Interface Endpoint for S3 is a PrivateLink-based endpoint that incurs hourly charges and per-GB data processing fees, making it more expensive than a Gateway Endpoint for S3, which has no such costs. Option B is wrong because using an Internet Gateway would route traffic over the internet, incurring data transfer costs and violating the requirement to avoid traversing the internet. Option D is wrong because a NAT Gateway also routes traffic over the internet, incurring NAT Gateway hourly charges and data processing fees, plus internet egress costs, which contradicts the goal of minimizing costs and avoiding internet traversal.

Full explanation →

576

MCQmedium

A company is deploying a web application in a VPC with public and private subnets. The web servers in public subnets must be protected from direct internet access, but they need to receive traffic from an Application Load Balancer (ALB). Which architecture should be used?

A.Internet-facing ALB in public subnets with web servers also in public subnets

B.Internal Network Load Balancer in private subnets with web servers

C.Internet-facing ALB in public subnets, and internal ALB in private subnets pointing to web servers

D.Amazon CloudFront with origin pointing to web servers in public subnets

AnswerC

This allows traffic to flow through the internet-facing ALB to the internal ALB, keeping web servers private.

Why this answer

It uses an internet-facing ALB in public subnets to receive traffic from the internet, then forwards it to an internal ALB in private subnets, which distributes traffic to web servers in private subnets. This ensures the web servers are not directly accessible from the internet, meeting the security requirement while still allowing traffic from the ALB. The internal ALB uses private IP addresses, keeping the web servers isolated from direct internet access.

Exam trap

The trap here is that candidates often assume an internet-facing ALB alone can protect servers in public subnets, but the key requirement is that servers must not be directly accessible from the internet, which necessitates placing them in private subnets and using an internal ALB for internal routing.

How to eliminate wrong answers

Option A is wrong because placing web servers in public subnets with an internet-facing ALB still allows direct internet access to the servers if security groups are misconfigured, and the requirement explicitly states servers must be protected from direct internet access. Option B is wrong because an internal Network Load Balancer cannot receive traffic from the internet; it only routes traffic within the VPC, so it cannot serve as the entry point for external users. Option D is wrong because Amazon CloudFront with an origin pointing to web servers in public subnets still exposes the servers directly to the internet (via the origin), and CloudFront does not inherently protect the servers from direct access unless additional measures like VPC origins or WAF are used, which are not specified.

Full explanation →

577

MCQmedium

A company has a VPC with multiple subnets. They want to centrally control outbound traffic to the internet and log all traffic. Which AWS service should they use?

A.NAT Gateway

B.Network ACL

C.VPC Flow Logs

D.VPC Traffic Mirroring

AnswerA

Correct. NAT Gateway centralizes outbound internet traffic, and combined with VPC Flow Logs, you can log all traffic. This satisfies both requirements.

Why this answer

NAT Gateway provides centralized outbound internet access for instances in private subnets. While it does not natively log traffic, you can enable VPC Flow Logs on the VPC to capture metadata of all traffic, including that traversing the NAT Gateway. This combination meets both the control and logging requirements.

Other options either fail to control traffic (VPC Traffic Mirroring only copies, VPC Flow Logs only logs) or provide control at a different level (Network ACL is stateless and subnet-level).

Exam trap

Candidates often assume VPC Traffic Mirroring can both control and log, but it only copies traffic; it does not enforce policies. The correct approach is to use a service that actually controls outbound traffic, such as NAT Gateway, and add logging via VPC Flow Logs.

How to eliminate wrong answers

Option A is wrong because a NAT Gateway enables outbound internet traffic for private subnets but does not log or centrally control traffic; it only translates private IPs to a public IP. Option B is wrong because a Network ACL is a stateless firewall that filters traffic at the subnet boundary but does not log or centrally control outbound traffic; it only allows or denies packets based on rules. Option C is wrong because VPC Flow Logs capture metadata (IP addresses, ports, protocols) about traffic flows but do not provide centralized control or full packet-level logging for inspection.

Full explanation →

578

MCQmedium

A company wants to monitor network traffic in their VPC for troubleshooting and security analysis. They need to capture IP traffic information, including source/destination IPs, ports, and protocol, but not the packet payload. Which AWS service should be used?

A.Amazon CloudWatch Logs.

B.AWS Network Firewall.

C.VPC Flow Logs.

D.AWS Traffic Mirroring.

AnswerC

VPC Flow Logs capture metadata without payload.

Why this answer

VPC Flow Logs capture metadata about IP traffic in a VPC, including source/destination IPs, ports, protocol, and packet counts, but never the payload. This meets the requirement for troubleshooting and security analysis without the overhead or privacy concerns of full packet capture.

Exam trap

The trap here is that candidates confuse VPC Flow Logs (metadata only) with AWS Traffic Mirroring (full packet capture), assuming both provide payload data, but the question explicitly excludes payload capture.

How to eliminate wrong answers

Option A is wrong because Amazon CloudWatch Logs is a service for storing, monitoring, and accessing log files from AWS resources, not for capturing network traffic metadata directly from the VPC. Option B is wrong because AWS Network Firewall is a managed firewall service that filters traffic based on rules, but it does not natively log flow-level metadata like source/destination IPs and ports without additional configuration. Option D is wrong because AWS Traffic Mirroring copies entire packets (including payload) from network interfaces for deep packet inspection, which exceeds the requirement to capture only metadata and not payload.

Full explanation →

579

Multi-Selectmedium

Which TWO statements are correct regarding the use of AWS Network Firewall? (Choose 2)

Select 2 answers

A.It supports stateful inspection using Suricata-compatible rules

B.It can be used with AWS Transit Gateway for centralized inspection

C.It can be used to inspect traffic between on-premises and AWS without a VPC

D.It provides automatic SSL/TLS decryption

E.It is a managed service that can be deployed outside of a VPC

AnswersA, B

Network Firewall uses Suricata for stateful inspection.

Why this answer

A: Correct. AWS Network Firewall supports stateful inspection using Suricata-compatible rules, allowing deep packet inspection for threat detection. B: Correct.

Network Firewall can be integrated with AWS Transit Gateway to enable centralized inspection of traffic across multiple VPCs. C: Incorrect. Network Firewall is deployed within a VPC, not as a standalone service, and it requires a VPC to inspect traffic; it cannot inspect traffic between on-premises and AWS without a VPC.

D: Incorrect. Network Firewall does not provide automatic SSL/TLS decryption; it can only inspect traffic that is not encrypted or after decryption is performed by another service. E: Incorrect.

Network Firewall is a managed service, but it is always deployed inside a VPC, not outside.

Full explanation →

580

MCQmedium

A company is designing a VPC with public and private subnets in two Availability Zones. The private subnets host EC2 instances that need to download patches from the internet. The company wants to minimize costs while ensuring high availability. Which solution meets these requirements?

A.Create a NAT gateway in one public subnet and use a second NAT gateway in a different AZ as a backup, but only route traffic to the primary.

B.Create a NAT gateway in one public subnet and configure route tables for private subnets to use it.

C.Launch a NAT instance in one public subnet and configure route tables for private subnets to use it.

D.Create a NAT gateway in a public subnet in each Availability Zone and configure route tables for private subnets to use the NAT gateway in the same AZ.

AnswerD

Highly available and cost-effective with proper AZ-level routing.

Why this answer

Deploying a NAT gateway in each Availability Zone ensures high availability by eliminating a single point of failure, while the private subnets in each AZ use the local NAT gateway for outbound internet access. This design meets the requirement for high availability at minimal cost compared to other resilient architectures, as NAT gateways are fully managed and scale automatically.

Exam trap

The trap here is that candidates often choose a single NAT gateway (Option B) thinking it is sufficient for high availability, but AWS explicitly recommends one NAT gateway per AZ for fault tolerance, and the exam expects you to recognize that a single AZ design is not highly available.

How to eliminate wrong answers

Option A is wrong because using a second NAT gateway as a backup but not routing traffic to it creates a single point of failure; if the primary NAT gateway fails, traffic is dropped, and the backup is unused. Option B is wrong because a single NAT gateway in one AZ is not highly available; if that AZ or the NAT gateway fails, all private instances lose internet access. Option C is wrong because a NAT instance is a single EC2 instance that is not highly available, requires manual failover, and incurs additional management overhead and potential cost for an instance that must be sized for peak traffic.

Full explanation →

581

MCQmedium

A company has a VPC with an application load balancer (ALB) in public subnets and web servers in private subnets. The web servers must be accessible only from the ALB. What is the most secure and efficient configuration?

A.Configure the web server security group to allow inbound HTTP from 0.0.0.0/0.

B.Configure the web server security group to allow inbound HTTP from the ALB's security group.

C.Configure the web server security group to allow inbound HTTP from the ALB's private IP addresses.

D.Configure the web server security group to allow inbound HTTP from the VPC CIDR.

AnswerB

Correct: Only ALB traffic is allowed.

Why this answer

Referencing the ALB's security group in the web server security group rule allows traffic only from the ALB, regardless of its IP addresses. This is the most secure and efficient configuration as it leverages AWS security group referencing, which automatically scales with the ALB's elastic network interfaces and avoids managing IP changes.

Exam trap

The ANS-C01 exam often tests the misconception that using the ALB's private IP addresses is more secure than using security group references, but the trap is that IP-based rules are static and break when the ALB scales, whereas security group references are dynamic and the recommended best practice.

How to eliminate wrong answers

Option A is wrong because allowing inbound HTTP from 0.0.0.0/0 would permit traffic from any source on the internet, bypassing the ALB and exposing the web servers directly, violating the requirement of access only from the ALB. Option C is wrong because the ALB's private IP addresses can change due to scaling or replacement, making this configuration brittle and requiring manual updates; it also does not leverage the dynamic security group referencing feature. Option D is wrong because allowing inbound HTTP from the VPC CIDR would permit traffic from any resource within the VPC (e.g., other instances, NAT gateways) rather than exclusively from the ALB, violating the access restriction and potentially allowing unauthorized internal access.

Full explanation →

582

Multi-Selecthard

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. They have a VPC with a subnet that hosts a web application. They need to ensure that traffic from the on-premises network to the web application does not traverse the internet. Which TWO components are required? (Select TWO.)

Select 2 answers

A.Internet Gateway attached to the VPC

B.Direct Connect Gateway associated with the Transit Gateway

C.Direct Connect private virtual interface attached to a Direct Connect Gateway

D.Site-to-Site VPN connection to the Transit Gateway

E.CloudFront distribution in front of the web application

AnswersB, C

This allows the Direct Connect connection to be propagated to the Transit Gateway.

Why this answer

A Direct Connect Gateway associated with the Transit Gateway allows traffic from on-premises networks to reach VPCs attached to the Transit Gateway without traversing the internet. This association enables the Transit Gateway to route traffic between Direct Connect virtual interfaces and VPC attachments using private IP addresses, ensuring the path remains over the AWS private network.

Exam trap

The ANS-C01 exam often tests the misconception that a Site-to-Site VPN can provide private connectivity, but the trap here is that VPNs still traverse the public internet (even if encrypted), whereas Direct Connect provides a dedicated private path that avoids internet transit entirely.

Full explanation →

583

MCQeasy

A company has a VPC with public and private subnets. They launch an Amazon RDS for MySQL DB instance in a private subnet. The DB instance needs to be accessible from an on-premises application that connects via an AWS Site-to-Site VPN. What is the MOST secure way to allow the on-premises application to connect to the DB instance?

A.Assign a public IP address to the DB instance and restrict access using a security group.

B.Place the DB instance in a private subnet and use a NAT gateway to allow inbound traffic.

C.Place the DB instance in a public subnet and configure a network ACL to allow traffic from the on-premises CIDR.

D.Place the DB instance in a private subnet and configure a security group to allow inbound traffic from the on-premises CIDR.

AnswerD

Private subnet with security group provides granular, stateful firewall control without internet exposure.

Why this answer

Placing the RDS DB instance in a private subnet ensures it has no public IP address, and configuring a security group to allow inbound traffic from the on-premises CIDR over the Site-to-Site VPN provides a secure, direct connection without exposing the database to the internet. Security groups act as a stateful firewall at the instance level, allowing only specified traffic from the on-premises network through the VPN tunnel.

Exam trap

The trap here is that candidates often confuse the directionality of NAT gateways (outbound only) or assume that placing a database in a public subnet with a network ACL is sufficient, overlooking the inherent security advantage of keeping the instance in a private subnet without public exposure.

How to eliminate wrong answers

Option A is wrong because assigning a public IP address to the DB instance exposes it to the internet, increasing the attack surface, and security groups alone cannot prevent internet-based threats if the instance is publicly reachable. Option B is wrong because a NAT gateway is used for outbound traffic from private subnets to the internet, not for inbound traffic; it cannot initiate inbound connections from on-premises to the DB instance. Option C is wrong because placing the DB instance in a public subnet exposes it to the internet, and network ACLs are stateless, requiring explicit inbound and outbound rules, which is less secure and more complex than using security groups in a private subnet with VPN connectivity.

Full explanation →

584

Multi-Selecteasy

A network engineer needs to monitor network performance between an on-premises data center and AWS via Direct Connect. Which TWO metrics should the engineer monitor in Amazon CloudWatch?

Select 2 answers

A.VirtualInterfaceBgpState

B.ConnectionBandwidthUtilization

C.Jitter

D.PacketLoss

E.Latency

AnswersA, B

This metric indicates the BGP session state.

Why this answer

The correct answers are A and B. VirtualInterfaceBgpState indicates the BGP session status for the virtual interface, which is critical for monitoring Direct Connect connectivity. ConnectionBandwidthUtilization measures the bandwidth usage on the Direct Connect connection.

Options C, D, and E (Jitter, PacketLoss, Latency) are not standard Direct Connect CloudWatch metrics; they are typically measured using additional tools like Amazon CloudWatch Synthetics or third-party solutions.

Full explanation →

585

Multi-Selectmedium

A company is deploying a new application across multiple Availability Zones in a VPC. The application needs to be highly available and must handle traffic from both internal users and external customers. Which TWO options should the network team implement to meet these requirements? (Choose two.)

Select 2 answers

A.Attach an Internet Gateway to the VPC.

B.Use a Network Load Balancer to distribute traffic across AZs.

C.Provision a NAT Gateway in each AZ for outbound connectivity from private subnets.

D.Create a single NAT Gateway in one AZ for outbound traffic.

E.Deploy an Application Load Balancer in each public subnet across multiple AZs.

AnswersC, E

Correct. A NAT Gateway in each AZ ensures that instances in private subnets can initiate outbound traffic to the internet without a single point of failure, fulfilling high availability requirements.

Why this answer

Provisioning a NAT Gateway in each AZ allows instances in private subnets to initiate outbound traffic to the internet without relying on a single AZ, thus providing high availability and fault tolerance. Option E is correct because deploying an Application Load Balancer in each public subnet across multiple AZs ensures that the ALB can route traffic to healthy targets across AZs, providing high availability and fault tolerance for incoming client traffic. Option A is incorrect because an Internet Gateway is a VPC-level component that allows communication between the VPC and the internet; it is not something that needs to be 'attached' per se (it's already attached to the VPC), and it does not handle traffic distribution across AZs.

Option B is incorrect because a Network Load Balancer is suitable for TCP/UDP traffic, but the question does not specify protocol requirements; however, the primary reason it is not the best choice is that the requirement for high availability is better met with an Application Load Balancer for HTTP/HTTPS traffic, and the option says 'use a Network Load Balancer to distribute traffic across AZs' which is not the best fit for typical web applications. Option D is incorrect because a single NAT Gateway in one AZ creates a single point of failure; if that AZ goes down, outbound connectivity is lost.

Full explanation →

586

MCQmedium

A security engineer needs to allow an EC2 instance in a private subnet to access an S3 bucket without traversing the internet. Which solution meets this requirement?

A.Attach an Internet Gateway to the VPC.

B.Use AWS Direct Connect to connect to S3.

C.Create a VPC Gateway Endpoint for S3.

D.Deploy a NAT gateway in a public subnet and update the route table.

AnswerC

Provides private connectivity to S3 without internet.

Why this answer

A VPC Gateway Endpoint for S3 allows private connectivity between EC2 instances in a private subnet and S3 without traversing the internet. Option A is incorrect because an Internet Gateway provides internet access, not private connectivity to S3. Option B is incorrect because Direct Connect is typically used for hybrid connectivity between on-premises and AWS, not for EC2 to S3 within the same region.

Option D is incorrect because a NAT gateway allows outbound internet traffic from private subnets, but traffic would still go over the internet, not privately.

Full explanation →

587

MCQhard

A company is designing a VPC with public and private subnets. The private subnets need to access Amazon S3 and Amazon DynamoDB. The company wants to minimize data transfer costs and avoid using a NAT gateway. What is the MOST cost-effective solution?

A.Set up an HTTP proxy in the private subnets and configure the applications to use it

B.Use a NAT instance instead of a NAT gateway

C.Create VPC endpoints for S3 and DynamoDB in the private subnets and update route tables

D.Create a NAT gateway in a public subnet and route private subnet traffic to it

AnswerC

VPC endpoints are free and provide private connectivity without NAT gateway.

Why this answer

VPC endpoints for S3 and DynamoDB allow private connectivity without incurring data transfer costs or NAT gateway fees. Option A is wrong because an HTTP proxy adds complexity and cost. Option B is wrong because a NAT instance still incurs instance costs and management overhead.

Option D is wrong because a NAT gateway incurs hourly and data processing charges.

Full explanation →

588

MCQeasy

A networking engineer is troubleshooting connectivity issues between two VPCs that are peered using a VPC peering connection. The VPCs are in different AWS accounts. The engineer has verified that the route tables are correct and the security groups allow traffic. However, ICMP ping fails from an instance in VPC A to an instance in VPC B. What is a likely cause?

A.The route tables in both VPCs do not have the route propagation enabled.

B.The VPC CIDR blocks overlap.

C.There is a VPN connection attached to both VPCs that creates a transitive routing issue.

D.The security group in VPC A does not allow inbound ICMP from VPC B.

E.The network ACLs are not configured correctly for return traffic.

AnswerC

VPC peering does not support transitive routing; if there is another connection that could create a transitive route, it may cause unexpected behavior.

Why this answer

A VPN connection attached to both VPCs can introduce transitive routing, which is not supported by VPC peering. VPC peering does not allow transitive routing; traffic must flow directly between the peered VPCs. If both VPCs have a VPN connection to the same on-premises network or another network, the VPN can create a path that interferes with the direct peering path, causing ICMP pings to fail even when route tables and security groups are correctly configured.

Exam trap

AWS often tests the concept that VPC peering does not support transitive routing, and candidates may overlook how a VPN connection can inadvertently create a transitive path that breaks direct peering traffic.

How to eliminate wrong answers

Option A is wrong because route propagation is a feature used with virtual private gateways (VPN or Direct Connect) to automatically propagate routes into route tables; it is not required for VPC peering, which uses static routes. Option B is wrong because overlapping CIDR blocks would cause a route conflict that would prevent the VPC peering connection from being established in the first place, not just cause ICMP ping failures after correct route tables are verified. Option D is wrong because the scenario states that security groups allow traffic, and the question specifies that ICMP ping fails from an instance in VPC A to an instance in VPC B, so the security group in VPC A would need to allow outbound ICMP (or the security group in VPC B would need to allow inbound ICMP), but the issue is not about inbound ICMP to VPC A.

Option E is wrong because network ACLs are stateless and must allow both inbound and outbound traffic for the ICMP echo request and reply; however, the engineer has verified that route tables and security groups are correct, and network ACLs are not mentioned as verified, but the most likely cause among the options is the transitive routing issue, not a misconfigured network ACL.

Full explanation →

589

MCQhard

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network uses BGP to advertise a specific prefix (10.0.0.0/16) to AWS. The VPC CIDR is 10.0.0.0/16. The company wants to ensure that traffic from the VPC to on-premises uses the Direct Connect connection. However, traffic is going over the internet instead. What is the most likely cause?

A.The on-premises BGP ASN is prepended, causing the route to be less preferred.

B.The on-premises prefix is less specific than the VPC CIDR, so the VPC route takes precedence.

C.The VPC CIDR overlaps with the on-premises prefix, and the local route in the VPC route table takes precedence.

D.The BGP route is not being propagated into the VPC route table.

AnswerC

Overlapping CIDRs cause the local route to be used, ignoring Direct Connect.

Why this answer

When a VPC CIDR (10.0.0.0/16) exactly matches a prefix advertised via Direct Connect (10.0.0.0/16), the VPC's local route (which is implicitly created for the VPC CIDR) takes precedence over any propagated BGP route. This is because AWS route tables prioritize the most specific matching route, and when prefixes are identical, the local route is preferred over static or propagated routes. As a result, traffic destined for 10.0.0.0/16 stays within the VPC instead of being sent over the Direct Connect connection.

Exam trap

The ANS-C01 exam often tests the misconception that BGP propagated routes can override the VPC local route when prefixes are identical, but the trap here is that AWS always prioritizes the local route for exact CIDR matches, regardless of BGP attributes or propagation status.

How to eliminate wrong answers

Option A is wrong because ASN prepending makes a BGP route less preferred on the on-premises side, not on the AWS side; AWS does not use AS path length to influence route preference in VPC route tables. Option B is wrong because the on-premises prefix (10.0.0.0/16) is exactly as specific as the VPC CIDR (10.0.0.0/16), not less specific; less specific prefixes would be /17 or larger, which would not override the local route. Option D is wrong because if the BGP route were not propagated, the VPC route table would not have any route for 10.0.0.0/16 via Direct Connect, but the question states traffic is going over the internet, implying a default route or internet gateway route is being used instead of the Direct Connect path.

Full explanation →

590

MCQmedium

A company is running a stateful firewall appliance in an EC2 instance in a VPC. The appliance inspects traffic between subnets. The company needs to ensure that traffic from the web tier subnet to the application tier subnet passes through the firewall, but the firewall itself must not affect other traffic. Which configuration should the company implement?

A.Place the firewall in the same subnet as the web tier and use security groups to redirect traffic.

B.Place the firewall in a separate subnet and use network ACLs to force traffic through it.

C.Use a Gateway Load Balancer to deploy the firewall appliance in a separate subnet, and configure route tables to send inter-subnet traffic to the Gateway Load Balancer endpoint.

D.Use a transit gateway with appliance mode and attach all subnets to it, then configure routing to send traffic through the firewall.

AnswerC

GWLB transparently intercepts traffic for inspection.

Why this answer

A Gateway Load Balancer (GWLB) allows you to deploy a fleet of third-party firewall appliances in a separate subnet and use a Gateway Load Balancer endpoint (GWLBe) to transparently intercept and steer inter-subnet traffic through the firewall. By configuring the route tables of the web and application subnets to send traffic to the GWLBe, the firewall inspects only the desired traffic without affecting other VPC traffic, as the GWLB operates at Layer 3 (Geneve encapsulation) and does not alter the source/destination IP addresses.

Exam trap

The ANS-C01 exam often tests the misconception that network ACLs or security groups can redirect traffic to a firewall appliance, but these are filtering mechanisms, not routing or forwarding mechanisms; the trap here is confusing stateless/stateful filtering with traffic steering, which requires route table manipulation or a Gateway Load Balancer endpoint.

How to eliminate wrong answers

Option A is wrong because placing the firewall in the same subnet as the web tier and using security groups to redirect traffic is not possible; security groups are stateful filters that cannot redirect traffic, and they evaluate traffic at the instance level, not between subnets. Option B is wrong because network ACLs are stateless packet filters that can only allow or deny traffic based on rules; they cannot force traffic through a specific appliance or redirect packets to a different destination. Option D is wrong because a transit gateway with appliance mode is designed for centralized inspection of traffic between VPCs or on-premises networks, not for intra-VPC subnet-to-subnet traffic; using it for inter-subnet traffic would add unnecessary complexity and cost, and it would affect all traffic passing through the transit gateway, not just the desired flows.

Full explanation →

591

MCQmedium

A company is designing a multi-region architecture with an Application Load Balancer (ALB) in each region. They need to route traffic to the closest healthy endpoint. Which AWS service should be used for global load balancing?

A.Use a single Application Load Balancer in one region with cross-region VPC peering.

B.Use AWS Global Accelerator with an endpoint group in each region.

C.Use Route 53 latency-based routing with health checks.

D.Use a Network Load Balancer in each region and Route 53 weighted routing.

AnswerB

Global Accelerator provides anycast IP and routes to the closest healthy endpoint.

Why this answer

AWS Global Accelerator uses the AWS global network to route traffic to the closest healthy endpoint via Anycast IP addresses and endpoint groups in each region. It provides static IP addresses and intelligent traffic distribution based on latency, health, and geography, making it ideal for multi-region ALB architectures requiring global load balancing.

Exam trap

The trap here is that candidates often confuse Route 53 latency-based routing with true global load balancing, not realizing that DNS-based routing is affected by client caching and does not provide real-time traffic steering or static IP addresses, which Global Accelerator uniquely offers.

How to eliminate wrong answers

Option A is wrong because a single Application Load Balancer cannot span multiple regions; cross-region VPC peering does not provide global load balancing or anycast routing, and it introduces single-region failure risk. Option C is wrong because Route 53 latency-based routing operates at the DNS level, which can be affected by DNS caching and does not provide real-time traffic steering or static IP addresses; it also lacks the ability to route based on endpoint health at the network level. Option D is wrong because Network Load Balancers are regional and Route 53 weighted routing distributes traffic based on static weights, not proximity or real-time latency, and it does not provide the global anycast optimization that Global Accelerator offers.

Full explanation →

592

MCQmedium

A company uses AWS Transit Gateway to connect multiple VPCs. The network team notices that traffic between two VPCs is taking a suboptimal path through a third VPC. What is the most likely cause?

A.Security groups are blocking the direct path, forcing traffic through a third VPC.

B.BGP is not configured between the VPCs, so traffic defaults through a transit VPC.

C.ECMP routing is enabled, causing traffic to be load-balanced across multiple paths.

D.Incorrect route table associations and propagations in the Transit Gateway.

AnswerD

Route tables determine which attachments can reach each other.

Why this answer

Incorrect route table associations and propagations in the Transit Gateway cause traffic between two VPCs to take a suboptimal path through a third VPC. The Transit Gateway uses route tables to determine the next hop for traffic; if the route table for the source VPC does not have a direct route to the destination VPC but instead has a route pointing to the third VPC (e.g., via a VPN attachment or a transit VPC attachment), traffic will be forwarded through that third VPC. This is a common misconfiguration when route propagation is not properly set up or when static routes are incorrectly prioritized.

Exam trap

The trap here is that candidates often assume traffic between VPCs in a Transit Gateway always takes the most direct path, but they overlook that route table associations and propagations control the path, and a misconfigured route table can force traffic through an intermediate VPC even when a direct attachment exists.

How to eliminate wrong answers

Option A is wrong because security groups are stateful firewalls that filter traffic at the instance or ENI level, not at the Transit Gateway or VPC routing level, and they cannot force traffic to take a different network path through a third VPC. Option B is wrong because BGP is not required for VPC-to-VPC routing through a Transit Gateway; Transit Gateway uses its own route tables and attachments, and traffic does not 'default' through a transit VPC unless routes are explicitly configured to do so. Option C is wrong because ECMP (Equal-Cost Multi-Path) routing is a load-balancing mechanism that distributes traffic across multiple equal-cost paths, but it does not cause traffic to take a suboptimal path through a third VPC; it would only apply if multiple direct paths existed.

Full explanation →

593

MCQmedium

A company applies the above S3 bucket policy. An administrator reports that an application using the AWS SDK is unable to upload objects to the bucket from an EC2 instance in the same account. The EC2 instance has an IAM role with s3:PutObject permission. What is the most likely cause?

A.The bucket policy grants access to the root user only, not the IAM role.

B.The application is not using server-side encryption.

C.The bucket policy does not grant access to the bucket itself, only to objects.

D.The application is using HTTP instead of HTTPS.

AnswerD

The condition requires secure transport; HTTP requests are denied.

Why this answer

The bucket policy includes a condition 'aws:SecureTransport': 'true', which requires all requests to use HTTPS. If the AWS SDK is configured to use HTTP instead of HTTPS, the request will be denied even though the IAM role has s3:PutObject permission. Option A is incorrect because the bucket policy likely grants access to all users in the account or to the IAM role specifically, not just the root user.

Option B is incorrect because server-side encryption is not required by the policy; only HTTPS is enforced. Option C is incorrect because the policy resource typically covers both the bucket and its objects, so access to the bucket is granted.

Full explanation →

594

Multi-Selecthard

Which THREE actions can AWS Config perform to help with network security compliance? (Choose 3)

Select 3 answers

A.Evaluate whether security groups allow unrestricted SSH access

B.Automatically block non-compliant traffic

C.Track changes to Network ACLs and security groups

D.Send alerts when a security group rule is modified

E.Prevent creation of VPCs that do not have a specific tag

AnswersA, C, D

Config rules can check for specific security group rules.

Why this answer

AWS Config can evaluate whether security groups allow unrestricted SSH access using managed rules like 'restricted-ssh'. Option C is correct because Config records configuration changes to Network ACLs and security groups, enabling tracking. Option D is correct because Config can trigger custom rules or send notifications via Amazon SNS when a security group rule is modified.

Option B is incorrect because Config does not block traffic; it only evaluates and can trigger remediation actions via other services. Option E is incorrect because Config evaluates resources after creation; it cannot prevent creation, though it can trigger automated remediation via Lambda or Systems Manager.

Full explanation →

595

MCQeasy

Which AWS service can be used to centrally manage and enforce security group rules across multiple accounts in AWS Organizations?

A.AWS Identity and Access Management (IAM)

B.AWS Firewall Manager

C.AWS Config

D.AWS Shield Advanced

AnswerB

Centrally manages security groups.

Why this answer

AWS Firewall Manager (Option B) is the correct answer because it provides centralized management of security group rules across accounts in AWS Organizations, allowing you to enforce a common set of security rules. Option A (IAM) manages user permissions, not security groups. Option C (AWS Config) evaluates resource compliance but does not enforce rules.

Option D (AWS Shield Advanced) is a DDoS protection service.

Full explanation →

596

Multi-Selectmedium

A company is designing a network security architecture for a multi-tier application. They want to ensure that the web tier can communicate with the application tier only on specific ports, and the application tier can communicate with the database tier only on specific ports. Which TWO configurations should be implemented?

Select 2 answers

A.Use a transit gateway with network ACLs to filter traffic between tiers.

B.Use VPC peering to connect the tiers and apply security groups on the peering connection.

C.Use network ACLs to provide a secondary layer of stateless filtering at the subnet level.

D.Use a single security group for all tiers and define rules based on CIDR blocks.

E.Use security groups for each tier and allow traffic only from the source security group on the required ports.

AnswersC, E

Network ACLs can be used to further restrict traffic between subnets.

Why this answer

The correct answers are C and E. Security groups (E) are stateful and can reference other security groups as a source, allowing traffic between tiers only on required ports. Network ACLs (C) are stateless and provide a secondary layer of filtering at the subnet level.

Option A is wrong because a transit gateway is used to connect multiple VPCs, not for filtering within a VPC. Option B is wrong because VPC peering connects VPCs, and security groups cannot be applied to a peering connection. Option D is wrong because a single security group cannot differentiate traffic between tiers; each tier needs its own security group.

Exam trap

Candidates often mistakenly choose transit gateway or VPC peering solutions for intra-VPC traffic filtering, but these are designed for inter-VPC connectivity, not for tier segmentation within a single VPC.

Full explanation →

597

MCQhard

A company is designing a global application that will use Amazon CloudFront to serve content from an Application Load Balancer (ALB) in us-east-1. They want to restrict access to the ALB so that it only accepts traffic from CloudFront. Additionally, they want to ensure that if someone bypasses CloudFront and directly accesses the ALB, the request is denied. Which solution should they implement?

A.Use CloudFront Origin Access Control (OAC) to restrict access to the ALB.

B.Configure the ALB security group to allow inbound traffic only from the CloudFront IP address ranges published in the AWS IP address ranges JSON file.

C.Use AWS WAF on the ALB with a rule that allows traffic only from CloudFront IP ranges.

D.Configure CloudFront to add a custom HTTP header (e.g., X-Origin-Verify) to requests forwarded to the ALB. Configure the ALB to only forward requests that contain that specific header to the target group.

AnswerD

This ensures that only requests from CloudFront with the correct header are accepted, preventing direct access.

Why this answer

It uses a custom HTTP header (e.g., X-Origin-Verify) that CloudFront adds to requests forwarded to the ALB, and the ALB is configured to only forward requests containing that specific header to the target group. This ensures that any request not originating from CloudFront (i.e., direct access to the ALB) lacks the header and is denied, providing a secure and scalable method to restrict access without relying on static IP lists.

Exam trap

AWS often tests the misconception that CloudFront Origin Access Control (OAC) or IP-based restrictions (security groups or WAF) are sufficient for ALB origins, but the trap is that OAC only works with S3 and IP lists are dynamic and spoofable, making the custom header method the only reliable solution for non-S3 origins.

How to eliminate wrong answers

Option A is wrong because CloudFront Origin Access Control (OAC) is designed to restrict access to Amazon S3 origins, not Application Load Balancers; it uses signed requests with AWS Signature Version 4, which ALBs do not support. Option B is wrong because the CloudFront IP address ranges published in the AWS IP address ranges JSON file are not static and can change frequently, requiring constant updates to the ALB security group, and this approach does not prevent bypass if an attacker spoofs a CloudFront IP. Option C is wrong because using AWS WAF on the ALB with a rule that allows traffic only from CloudFront IP ranges suffers from the same IP volatility and spoofing risks as Option B, and WAF rules based on IP sets are not a reliable or recommended method for origin access restriction in this scenario.

Full explanation →

598

MCQhard

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Site-to-Site VPN. The security team wants to inspect all traffic between VPCs using a centralized inspection VPC with third-party firewall appliances. Which architecture ensures that traffic from VPC A to VPC B is routed through the inspection VPC?

A.Attach all VPCs to a Transit Gateway. Create separate route tables: one for inspection VPC attachments and one for others. In VPC A's route table, route to VPC B via the inspection VPC attachment.

B.Create a VPC peering connection between VPC A and VPC B, and attach firewall appliances in both VPCs.

C.Use AWS PrivateLink to create VPC endpoints in VPC A and VPC B, and route traffic through the firewall VPC.

D.Deploy AWS Network Firewall in each VPC and configure VPC route tables to send traffic to the firewall endpoint.

AnswerA

This design uses Transit Gateway route tables to force traffic through the inspection VPC.

Why this answer

It uses separate Transit Gateway route tables to isolate the inspection VPC and other VPCs. By configuring the route table for VPC A to point to VPC B's CIDR via the inspection VPC attachment, all inter-VPC traffic is forced through the centralized firewall appliances. This leverages Transit Gateway's ability to route traffic between attachments based on route table associations and propagations, ensuring traffic flows through the inspection VPC without requiring VPC peering or additional per-VPC firewalls.

Exam trap

The trap here is assuming that simply attaching all VPCs to a Transit Gateway automatically routes traffic through a centralized inspection VPC, when in fact you must explicitly configure separate route tables and static routes to force traffic through the inspection VPC, otherwise Transit Gateway uses its default route table for direct attachment-to-attachment routing.

How to eliminate wrong answers

Option B is wrong because VPC peering creates a direct, one-to-one network connection between VPC A and VPC B, bypassing the inspection VPC entirely, so traffic cannot be centrally inspected. Option C is wrong because AWS PrivateLink is designed for private access to services via VPC endpoints, not for routing general inter-VPC traffic through a firewall; it does not support transitive routing between VPCs. Option D is wrong because deploying AWS Network Firewall in each VPC inspects traffic locally within each VPC but does not force traffic from VPC A to VPC B through a centralized inspection VPC; it lacks the transitive routing capability needed for centralized inspection.

Full explanation →

599

Multi-Selectmedium

A network engineer is troubleshooting intermittent connectivity issues between an on-premises data center and a VPC over a Direct Connect connection. The engineer reviews the CloudWatch metrics for the virtual interface and sees an increase in 'ConnectionReset' and 'PacketDropRate'. Which TWO actions should the engineer take to resolve the issue? (Choose TWO.)

Select 2 answers

A.Add additional BGP peers to the Direct Connect connection

B.Increase the MTU on the virtual interface to 1500

C.Check the BGP session status and metrics on the virtual interface

D.Increase the bandwidth of the VPN connection as a backup

E.Check the physical layer metrics such as light levels and signal strength

AnswersC, E

BGP issues can cause connection resets.

Why this answer

Options C and E are correct. Checking the BGP session status and metrics on the virtual interface helps identify if there are BGP-related issues such as route flapping or session drops that could cause connectivity problems. Checking physical layer metrics like light levels and signal strength can reveal underlying physical issues with the Direct Connect connection.

Option A is incorrect because adding BGP peers does not address the symptoms of ConnectionReset and PacketDropRate. Option B is incorrect because increasing MTU could actually increase drop rates if the underlying physical layer has issues. Option D is incorrect because the VPN connection is not directly related to Direct Connect and increasing its bandwidth would not resolve issues with the Direct Connect connection.

Full explanation →

600

MCQeasy

A company is deploying a web application across multiple Availability Zones in a VPC. The application tier consists of EC2 instances behind an Application Load Balancer (ALB). The security team requires that all traffic between the ALB and the EC2 instances be encrypted. Which solution meets this requirement?

A.Use an internal ALB with a TCP listener and a security group that allows only HTTPS.

B.Use an HTTP listener on the ALB and enable encryption on the security group.

C.Use an HTTPS listener on the ALB with a target group that uses HTTPS.

D.Use a TCP listener on the ALB with a target group that uses TCP.

AnswerC

HTTPS provides end-to-end encryption.

Why this answer

To encrypt traffic between the Application Load Balancer (ALB) and the EC2 instances, the ALB must use an HTTPS listener and the target group must be configured with the HTTPS protocol. This ensures that the ALB terminates the client’s HTTPS connection and then re-encrypts traffic to the backend instances using TLS, meeting the security team’s requirement for end-to-end encryption.

Exam trap

The trap here is that candidates often assume a TCP listener can provide encryption by using a security group, but security groups do not encrypt traffic—they only filter based on IP/port, and TCP listeners do not support TLS termination or re-encryption.

How to eliminate wrong answers

Option A is wrong because an internal ALB with a TCP listener does not provide encryption; TCP listeners pass traffic without TLS termination, and security groups do not encrypt traffic—they only filter it. Option B is wrong because an HTTP listener does not encrypt traffic between the ALB and clients, and enabling encryption on a security group is not a valid concept; security groups are stateful firewalls, not encryption mechanisms. Option D is wrong because a TCP listener with a TCP target group does not support TLS encryption; it forwards raw TCP traffic without any encryption between the ALB and the instances.

Full explanation →

Page 8 of 22

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

Practice ANS-C01 by domain

Target a specific domain to shore up weak areas.

Network Management and Operations Network Security, Compliance and Governance Network Design Network Implementation

See all domains with question counts →